Method and system for generating ciphertext and message authentication codes utilizing shared hardware

• US 8,996,871 B2
• Filed: 03/19/2012
• Issued: 03/31/2015
• Est. Priority Date: 11/08/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sandberg, Melanie J., Schaffer, Scott J.
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US13/423,843
• Publication Number:
  US 20120179912A1
• Time in Patent Office: 1,107 Days
• Field of Search: 713/170
• US Class Current: 713/170
• CPC Class Codes: H04L 2209/125 Parallelization or pipelining, e.g. for accelerating processing of cryptographic operations
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A method and system for generating ciphertext and message authentication codes utilizing shared hardware are disclosed. According to one embodiment, a method is provided of generating ciphertext message data and message authentication codes utilizing shared authenticated encryption unit hardware. In the described embodiment, plaintext message data is received at an authenticated encryption unit which comprises first and second authenticated encryption hardware modules. Thereafter, a first message authentication code (MAC) associated with a first authenticated encryption mode and a second MAC associated with a second authenticated encryption mode are generated. More specifically, the first MAC is generated utilizing the plaintext message data and first authenticated encryption hardware module and ciphertext message data and the second MAC are generated utilizing the plaintext message data and second authenticated encryption hardware module.

Claims

1. A method of generating ciphertext message data and message authentication codes utilizing shared authenticated encryption unit hardware, said method comprising:

receiving plaintext message data at an authenticated encryption unit, wherein said authenticated encryption unit comprises a first authenticated encryption hardware module and a second authenticated encryption hardware module;

generating a first message authentication code based on data generated by the second authenticated encryption module, the first message authentication code associated with a first authenticated encryption mode of operation utilizing said plaintext message data and said first authenticated encryption hardware module; and

generating ciphertext message data and a second message authentication code based on data generated by the second authenticated encryption module, the second message authentication code associated with a second authenticated encryption mode of operation utilizing said plaintext message data and said second authenticated encryption hardware module, wherein generating said first message authentication code and generating said ciphertext and said second message authentication code are performed substantially simultaneously, the first message authentication code different from the second message authentication code.

2. The method of claim 1, wherein

said method further comprises receiving authenticated encryption mode selection data,

said first message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said first authenticated encryption mode of operation, and

said second message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said second authenticated encryption mode of operation.

3. The method of claim 1, said method further comprising:

receiving authenticated encryption mode selection data;

providing a selected message authentication code of said first message authentication code and said second message authentication code at an output of said authenticated encryption unit in response to a receipt of said authenticated encryption mode selection data.

4. The method of claim 1, said method further comprising:

generating a third message authentication code utilizing said first message authentication code and said second message authentication code.

5. The method of claim 4, wherein

generating said third message authentication code comprises concatenating said first message authentication code and said second message authentication code.

6. The method of claim 1, wherein generating said ciphertext message data comprises performing a counter mode block cipher operation.

7. The method of claim 1, wherein said first authenticated encryption mode of operation comprises Galois/Counter Mode and said second authenticated encryption mode of operation comprises Counter with Cipher-Block Chaining Message Authentication Code Mode.

8. A computer program product for generating ciphertext message data and message authentication codes utilizing shared authenticated encryption unit hardware, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions readable/executable by a processor to cause the processor to:

receive, by processor, plaintext message data at an authenticated encryption unit, wherein said authenticated encryption unit comprises a first authenticated encryption hardware module and a second authenticated encryption hardware module;

generate, by processor, a first message authentication code based on the plaintext message data, the first message authentication code associated with a first authenticated encryption mode of operation utilizing said plaintext message data and said first authenticated encryption hardware module; and

generate, by processor, ciphertext message data and a second message authentication code based on the plaintext message data, the second message authentication code associated with a second authenticated encryption mode of operation utilizing said plaintext message data and said second authenticated encryption hardware module, wherein generating said first message authentication code and generating said ciphertext and said second message authentication code are performed substantially simultaneously, the first message authentication code different from the second message authentication code.

9. The computer program product of claim 8, wherein

the program instructions are further configured to receive authenticated encryption mode selection data,

said first message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said first authenticated encryption mode of operation, and

said second message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said second authenticated encryption mode of operation.

10. The computer program product of claim 8, the program instructions further configured to:

receive authenticated encryption mode selection data;

provide a selected message authentication code of said first message authentication code and said second message authentication code at an output of said authenticated encryption unit in response to a receipt of said authenticated encryption mode selection data.

11. The computer program product of claim 8, the program instructions-further configured to:

generate a third message authentication code utilizing said first message authentication code and said second message authentication code.

12. The computer program product of claim 11, wherein

generating said third message authentication code comprises concatenating said first message authentication code and said second message authentication code.

13. The computer program product of claim 8, wherein generating said ciphertext message data comprises performing a counter mode block cipher operation.

14. The computer program product of claim 8, wherein said first authenticated encryption mode of operation comprises Galois/Counter Mode and said second authenticated encryption mode of operation comprises Counter with Cipher-Block Chaining Message Authentication Code Mode.

15. An apparatus for generating ciphertext message data and message authentication codes comprising:

a first input to receive plaintext message data;

a first authenticated encryption hardware module to generate a first message authentication code based on data generated by the second authenticated encryption module, the first message authentication code associated with a first authenticated encryption mode of operation utilizing said plaintext message data; and

a second authenticated encryption hardware module to generate ciphertext message data and a second message authentication code based on data generated by the second authenticated encryption module, the second message authentication code associated with a second authenticated encryption mode of operation utilizing said plaintext message data, wherein said first message authentication code and said ciphertext and said second message authentication code are generated substantially simultaneously, the first message authentication code different from the second message authentication code.

16. The apparatus of claim 15, wherein

the apparatus further comprises a second input to receive authenticated encryption mode selection data,

said first message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said first authenticated encryption mode of operation, and

said second message authentication code is generated in response to a determination that said authenticated encryption mode selection data indicates said second authenticated encryption mode of operation.

17. The apparatus of claim 15, further comprising:

a second input to receive authenticated encryption mode selection data, and

an output to provide a selected message authentication code of said first message authentication code and said second message authentication code in response to a receipt of said authenticated encryption mode selection data.

18. The apparatus of claim 15, further comprising:

a third authenticated encryption hardware module to generate a third message authentication code utilizing said first message authentication code and said second message authentication code.

19. The apparatus of claim 18, wherein

said third message authentication code is generated by concatenating said first message authentication code and said second message authentication code.

20. The apparatus of claim 15, wherein said second authenticated encryption hardware module comprises a counter mode block cipher module.