Abstract:
An encryption apparatus and method for generating a ciphertext from an input plaintext of the same length as the ciphertext by parallel processing of the input signal. Since a non-delayed signal is synchronized to a delayed signal, an accurate ciphertext is produced. Therefore, the encryption speed is increased, the number of devices for timing synchronization is reduced, an encryption system is stabilized, and production cost is reduced.

Description:
PRIORITY  
         [0001]    This application claims priority under 35 U.S.C. § 119 to an application entitled “Encryption Apparatus and Method in a Wireless Communications System” filed in the Korean Industrial Property Office on Oct. 8, 2002 and assigned Serial No. 2002-61179, the contents of which are incorporated herein by reference.  
         BACKGROUND OF THE INVENTION  
         [0002]    1. Field of the Invention  
           [0003]    The present invention relates generally to a wireless communications system, and in particular, to an encryption apparatus and method for implementing confidentiality and integrity algorithms in a wireless communications system.  
           [0004]    2. Description of the Related Art  
           [0005]    As the first generation analog encryption system has evolved into the second generation digital encryption system, more advanced encryption techniques have been used. The current third generation encryption system provides encryption service for multimedia service i.e., audio and video information. Thus, the importance of encryption has increased in order to provide confidentiality to voice signals, multimedia service, and user data. An integrity algorithm is required to authenticate control signals between mobile terminals in a wireless communication system and a network. The 3 rd  Generation Project Partnership (3GPP) has selected the KASUMI algorithm as the f8 confidentiality and f9 integrity algorithms for a third generation system based on a Global System for Mobile communication (GSM) core network, and a Universal Mobile Telecommunication System (UMTS).  
           [0006]    [0006]FIG. 1 is a block diagram illustrating an example of a conventional KASUMI algorithm. Referring to FIG. 1, KASUMI is an 8-round Feistel unit cipher that provides a 64-bit output ciphertext from a 64-bit input plaintext with 8-round encryption. The 64-bit input signal is divided into a 32-bit signal L 0  and a 32-bit signal R 0 . FLi units (1≦i≦8)  110  to  180  and FOi units (1≦i≦8)  210  to  280  encrypt the signals L 0  and R 0  under corresponding encryption keys KL i  (1≦i≦8), KO i  (1≦i≦8), and KI i  (1≦i≦8) and output the 64-bit ciphertext.  
           [0007]    Encryption in accordance with FIG. 1 occurs in the following manner. An FL 1  unit  110  encrypts the input 32-bit signal L 0  with an encryption key KL 1  and outputs a ciphertext L 01 . An FO 1  unit  210  encrypts the 32-bit ciphertext L 01  with encryption keys KO 1  and KI 1  and outputs a ciphertext L 02 . An Exclusive-OR operation is performed to logically “exclusive OR” the ciphertext L 02  and the 32-bit signal R 0  to provide a 64-bit ciphertext. This encryption occurs eight times and a final 64-bit ciphertext is generated in the KASUMI.  
           [0008]    [0008]FIG. 2A is a block diagram illustrating an example of FOi units. Referring to FIG. 2A, FOi denotes an ith FO unit. The FOi unit comprises a plurality of F 1   i,j  sub-ciphers (1≦i≦3, 1≦i≦3) to provide 3-rounds of encryption. Here, the operation of the FO 1  unit  210  will be described by way of example. The 32-bit input signal is divided into two 16-bit signals L 0  and R 0 . An Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal L 0  and a 16-bit sub-encryption key KO 1,1 , to provide a signal L 1 . A F 1   1,1  sub-cipher  201  encrypts the signal L 1  with a 16-bit sub-encryption key KI 1,1  and outputs a signal L 1D . Meanwhile, a first delay (D 1 )  10  delays the 16-bit signal R 0 , which is equivalent to the signal R 1 , in order to synchronize the 16-bit signal R 0  with the signal L 1D  and output a delayed signal R 1D . For a second-round of encryption, an Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal RID and a 16-bit sub-encryption key KO 1,2  to provide a signal L 2 . A F 1   1,2  sub-cipher  203  encrypts the signal L 2  with a 16-bit sub-encryption key KI 1,2  and outputs a signal L 2D . Meanwhile, an Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal R 1D  and the signal L 1D , to provide a signal R 2 . A second delay (D 2 )  20  delays the signal R 2  in order to synchronize the signal R 2  with the signal L 2D  and output a delayed signal R 2D . For a third-round of encryption, an Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal R 2D  and a 16-bit sub-encryption key KO 1,3 , resulting in a signal L 3 . A F 1   1,3  sub-cipher  205  encrypts the signal L 3  with a 16-bit sub-encryption key KI 1,3  and outputs a signal L 3D . Meanwhile, an Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal R 2D  and the signal L 2D  to provide a signal R 3 . A third delay (D 3 )  30  delays the signal R 3  in order to synchronize the signal R 3  with the signal L 3D  and output a delayed signal R 3D . An Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal R 3D  and the signal L 3D , to provide a signal R 4 . The 16-bit signal R 4  is operated with the 16-bit signal R 3D  (=L 4 ), resulting in a 32-bit ciphertext L 4 //R 4 .  
           [0009]    The FO 1  unit uses the three delays  10 ,  20  and  30  to synchronize to the output timings of the sub-ciphers  201 ,  203  and  205 .  
           [0010]    [0010]FIG. 2B is a block diagram illustrating another example of the FOi units. Referring to FIG. 2B, a FOi unit comprises a plurality of F 1   i′,j′  sub-ciphers (1≦i′≦3 1≦j′≦3), for 3-rounds of encryption. Here, the FO 1  unit  210  will be described by way of example. The 32-bit input signal is divided into two 16-bit signals L 0′  and R 0′ . An Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal L 0′  and a 16-bit sub-encryption key KO 1,1 , to provide a signal L 1′ . A F 1   1′,1′  sub-cipher  211  encrypts the signal L 1′  with the 16-bit sub-encryption key KI 1,1  and outputs a signal L 1D′ . Meanwhile, a fourth delay (D 4 )  40  delays the 16-bit signal R 0′  (=R 1′ ) and outputs a delayed signal R 1D′ . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 1D′  and R 1D′  to provide a signal L 2′ . Simultaneously, an Exclusive-OR operation is performed to logically “exclusive OR” the 16-bit signal R 0′  and a 16-bit sub-encryption key KO 1,2 , to provide a signal R 2′ . A F 1   1′,2′  sub-cipher  213  encrypts the signal R 2′  with a 16-bit sub-encryption key KI 1,2  and outputs a signal R 2D′ . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 2′  and R 2D′  to provide a signal R 3′ . Another Exclusive-OR operation is performed to logically “exclusive OR” the signal L 2′  and a 16-bit sub-encryption key KO 1,3 , to provide a signal L 3′ . A F 1   1′,3′  sub-cipher  215  encrypts the signal L 3′  with a 16-bit sub-encryption key KI 1,3  and outputs a signal L 3D′ . Meanwhile, a fifth delay (D 5 )  50  delays the signal R 3′  and outputs a delayed signal R 3D′ . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 3D′  and R 3D′  to provide a 16-bit signal L 4′ . The 16-bit signal L 4′  is operated with the 16-bit signal R 3D′  (=R 4′ ), resulting in a 32-bit ciphertext L 4′ //R 4′ .  
           [0011]    The above advanced FOi unit uses the two delays  40  and  50  to synchronize to the output timings of the F 1  sub-ciphers  211  and  215 . However, due to the use of the delays, a large chip capacity is required.  
           [0012]    [0012]FIG. 3 is a block diagram illustrating an example of the F 1   i,j  sub-ciphers illustrated in FIGS. 2A and 2B. By way of example, the F 1   1,1  sub-cipher  201  will be described below. Referring to FIG. 3, the 16-bit input signal is divided into a 9-bit signal RL 0  and a 7-bit signal RR 0 . An SBox 91  (S 91 ) operator  310  generates a 9-bit signal y 0 , y 1 , . . . , y 8  from the input signal RL 0  using  
                       y   0     =     x0x2   ⊕   x3   ⊕   x2x5   ⊕   x5x6   ⊕   x0x7   ⊕   x1x7   ⊕   x2x7   ⊕   x4x8   ⊕   x5x8   ⊕   x7x8   ⊕   1            
            y   1     =     x1   ⊕   x0x1   ⊕   x2x3   ⊕   x0x4   ⊕   x1x4   ⊕   x0x5   ⊕   x3x5   ⊕   x6   ⊕   x1x7   ⊕   x2x7   ⊕   x5x8   ⊕   1            
          y2   =     x1   ⊕   x0x3   ⊕   x3x4   ⊕   x0x5   ⊕   x2x6   ⊕   x3x6   ⊕   x5x6   ⊕   x4x7   ⊕   x5x7   ⊕   x6x7   ⊕   x8   ⊕   x0x8   ⊕   1            
          y3   =     x0   ⊕   x1x2   ⊕   x0x3   ⊕   x2x4   ⊕   x5   ⊕   x0x6   ⊕   x1x6   ⊕   x4x7   ⊕   x0x8   ⊕   x1x8   ⊕   x7x8            
          y4   =     x0x1   ⊕   x1x3   ⊕   x4   ⊕   x0x5   ⊕   x3x6   ⊕   x0x7   ⊕   x6x7   ⊕   x1x8   ⊕   x2x8   ⊕   x3x8            
          y5   =     x2   ⊕   x1x4   ⊕   x4x5   ⊕   x0x6   ⊕   x1x6   ⊕   x3x7   ⊕   x4x7   ⊕   x6x7   ⊕   x5x8   ⊕   x6x8   ⊕   x7x8   ⊕   1            
          y6   =     x0   ⊕   x2x3   ⊕   x1x5   ⊕   x2x5   ⊕   x4x5   ⊕   x3x6   ⊕   x4x6   ⊕   x5x6   ⊕   x7   ⊕   x1x8   ⊕   x3x8   ⊕   x5x8   ⊕   x7x8            
          y7   =     x0x1   ⊕   x0x2   ⊕   x1x2   ⊕   x3   ⊕   x0x3   ⊕   x2x3   ⊕   x4x5   ⊕   x2x6   ⊕   x3x6   ⊕   x2x7   ⊕   x5x7   ⊕   x8   ⊕   1            
          y8   =     x0x1   ⊕   x2   ⊕   x1x2   ⊕   x3x4   ⊕   x1x5   ⊕   x2x5   ⊕   x1x6   ⊕   x4x6   ⊕   x7   ⊕   x2x8   ⊕   x3x8                                 (   1   )                               
 
           [0013]    A ZE 1  unit  320  receives the signal RR 0 , adds two zeroes to the Most Significant Bit (MSB) of the signal RR 0 , and outputs a 9-bit signal. An Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the S 91  operator  310  and the ZE 1  unit  320  to provide a 9-bit signal RL 1 . Another Exclusive-OR operation is performed to logically “exclusive OR” the signal RL 1  and a 9-bit sub-encryption key KI 1,1,2 , to provide a 9-bit signal RL 2 .  
           [0014]    A TR 1  unit  330  removes two zero bits from the MSBs of the 9-bit signal RL 1 . An SBox 71  (S 71 ) operator  340  generates a 7-bit signal y 0 , y 1 , . . . , y 6  from the input signal RR 0  (=RR 1 ) by  
                       y   0     =     x1x3   ⊕   x4   ⊕   x0x1x4   ⊕   x5   ⊕   x2x5   ⊕   x3x4x5   ⊕   x6   ⊕   x0x6   ⊕   x1x6   ⊕   x3x6   ⊕   x2x4x6   ⊕   x1x5x6   ⊕   x4x5x6            
            y   1     =     x0x1   ⊕   x0x4   ⊕   x2x4   ⊕   x5   ⊕   x1x2x5   ⊕   x0x3x5   ⊕   x6   ⊕   x0x2x6   ⊕   x3x6   ⊕   x4x5x6   ⊕   1            
          y2   =     x0   ⊕   x0x3   ⊕   x2x3   ⊕   x1x2x4   ⊕   x0x3x4   ⊕   x1x5   ⊕   x0x2x5   ⊕   x0x6   ⊕   x0x1x6   ⊕   x2x6   ⊕   x4x6   ⊕   1            
          y3   =     x1   ⊕   x0x1x2   ⊕   x1x4   ⊕   x3x4   ⊕   x0x5   ⊕   x0x1x5   ⊕   x2x3x5   ⊕   x1x4x5   ⊕   x2x6   ⊕   x1x3x6            
          y4   =     x0x2   ⊕   x3   ⊕   x1x3   ⊕   x1x4   ⊕   x0x1x4   ⊕   x2x3x4   ⊕   x0x5   ⊕   x1x3x5   ⊕   x0x4x5   ⊕   x1x6   ⊕   x3x6   ⊕   x0x3x6   ⊕   x5x6   ⊕   1            
          y5   =     x2   ⊕   x0x2   ⊕   x0x3   ⊕   x1x2x3   ⊕   x0x2x4   ⊕   x0x5   ⊕   x2x5   ⊕   x4x5   ⊕   x1x6   ⊕   x1x2x6   ⊕   x0x3x6   ⊕   x3x4x6   ⊕   x2x5x6   ⊕   1            
          y6   =     x1x2   ⊕   x0x1x3   ⊕   x0x4   ⊕   x1x5   ⊕   x3x5   ⊕   x6   ⊕   x0x1x6   ⊕   x2x3x6   ⊕   x1x4x6   ⊕   x0x5x6                                 (   2   )                               
 
           [0015]    An Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the TR 1  330 and the S 71  operator  340  via a sub-encryption key KI 1,1,1 , to provide a 7-bit signal RR 2 .  
           [0016]    A SBox  92  (S 92 ) operator  350  generates a 9-bit signal y 0 , y 1 , . . . , y 8  from the signal RL 2  by Eq. (1). A ZE 2  unit  360  receives the signal RR 1 , adds two zeroes to the MSB of the signal RR 1 , and outputs a 9-bit signal. An Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the S 92  operator  350  and the ZE 2  unit  360  to provide a 9-bit signal RL 3 . A TR 2  unit  370  removes two zero bits from the MSBs of the 9-bit signal RL 3 . A SBox 72  (S 72 ) operator  380  generates a 7-bit signal y 0 , y 1 , . . . , y 6  from the input signal RR 2  (=RR 3 ) using Eq. (2). Another Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the TR 2   370  and the S 72  operator  380  to provide a 7-bit signal RR 4 .  
           [0017]    The 9-bit signal RL 3  (=RL 4 ) and the 7-bit signal RR 4  are operated, resulting in a 16-bit ciphertext RL 4 //RR 4 .  
           [0018]    As described above, the S 91  operator  310  and the S 92  operator  350  each sequentially perform an AND operation to perform a logical “AND” and an exclusive-OR operation to perform a logical “Exclusive-OR” using Eq. (1), to thereby generate an output signal y 0 , y 1 , . . . , y 8 . Similarly, the S 71  operator  340  and the S 72  operator  380  sequentially perform an AND operation to perform a logical “AND” and an exclusive-OR operation to perform a logical “Exclusive-OR” using Eq. (2), to thereby generate an output signal y 0 , y 1 , . . . , y 6 . Consequently, the encryption speed is decreased. Moreover, a gate delay involved in the operations of the S 91 , S 92 , S 71  and S 72  operators  310 ,  350 ,  340 , and  360  gradually increases glitch.  
         SUMMARY OF THE INVENTION  
         [0019]    It is, therefore, an object of the present invention to provide an encryption method for generating a ciphertext bit stream of length 2n from a plaintext bit stream of length 2n.  
           [0020]    It is another object of the present invention to provide an encryption apparatus for generating a ciphertext bit stream of length 2n from a plaintext bit stream of length 2n.  
           [0021]    To achieve the above objects, in an encryption method for dividing a first plaintext bit stream of length 2n into first and second sub-bit streams of length n, dividing a second plaintext bit stream of length 2n into third and fourth sub-bit streams of length n, and generating a ciphertext bit stream of length 2n from the first, second, third and fourth sub-bit streams using 2-rounds of encryption, first and second ciphertext bit streams of length n are generated by encrypting the first and second sub-bit streams with predetermined first encryption codes KO 1,1 , KO 1,2 , KO 1,3 , KI 1,1 , KI 1,2 , and KI 1,3 , the second ciphertext bit stream being output with a predetermined time delay from the first ciphertext bit stream, in a first-round encryption. A first operated ciphertext bit stream is generated by performing a logical exclusive-OR-operation on the first ciphertext bit stream and the third sub-bit stream, and a second operated ciphertext bit stream is operated by performing a logical exclusive-OR-operation on the second ciphertext bit stream and the fourth sub-bit stream. In a second-round of encryption, third and fourth ciphertext bit streams of length n are generated by encrypting the first operated ciphertext bit stream and the second operated ciphertext bit stream with predetermined second encryption codes KO 2,1 , KO 2,2 , K 2,3 , KI 2,1 , KI 2,2 , and KI 2,3  and the third and fourth ciphertext bit streams a concurrently output.  
           [0022]    In an encryption apparatus for dividing a first plaintext bit stream of length 2n into first and second sub-bit streams of length n, dividing a second plaintext bit stream of length 2n into third and fourth sub-bit streams of length n, and generating a ciphertext bit stream of length 2n from the first, second, third and fourth sub-bit streams using 2-rounds of encryption, a first ciphering unit receives the first and second sub-bit streams, and generates first and second ciphertext bit streams of length n by encrypting the first and second sub-bit streams with predetermined first encryption codes KO 1,1 , KO 1,2 , KO 1,3 , KI 1,1 , KI 1,2 , and KI 1,3 . Here, the second ciphertext bit stream is output with a predetermined time delay from the first ciphertext bit stream. An operating unit generates a first operated ciphertext bit stream by performing a logical exclusive-OR operation on the first ciphertext bit stream and the third sub-bit stream, and generates a second operated ciphertext bit stream by performing a logical exclusive-OR-operation on the second ciphertext bit stream with the fourth sub-bit stream. A second ciphering unit receives the first operated ciphertext bit stream and the second operated ciphertext bit stream having the predetermined time delay, generates third and fourth ciphertext bit streams of length n by encrypting the first operated ciphertext bit stream and the second operated ciphertext bit stream with predetermined second encryption codes KO 2,1 , KO 2,2 , KO 2,3 , KI 2,1 , KI 2,2 , and KI 2,3  and concurrently outputs the third and fourth ciphertext bit streams. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0023]    The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which:  
         [0024]    [0024]FIG. 1 is a block diagram illustrating an example of a conventional KASUMI algorithm;  
         [0025]    [0025]FIG. 2A is a block diagram illustrating an example of FOi units illustrated in FIG. 1;  
         [0026]    [0026]FIG. 2B is a block diagram illustrating another example of the FOi units illustrated in FIG. 1;  
         [0027]    [0027]FIG. 3 is a block diagram illustrating an example of F 1   i, j  sub-ciphers illustrated in FIGS. 2A and 2B;  
         [0028]    [0028]FIG. 4 is a block diagram illustrating an example of a KASUMI algorithm according to the present invention;  
         [0029]    [0029]FIG. 5 is a block diagram illustrating an example of SLIMFOi units illustrated in FIG. 4 according to the present invention; and  
         [0030]    [0030]FIG. 6 is a block diagram illustrating an example of F 1   i, j  sub-ciphers illustrated in FIG. 5 according to the present invention. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0031]    An embodiment of the present invention will be described herein below with reference to the accompanying drawings. Also, a description of known functions and configurations have been omitted for conciseness.  
         [0032]    A KASUMI algorithm according to the present invention is a ciphering algorithm used as the f8 confidentiality and f9 integrity algorithms. The f8 confidentiality algorithm encrypts a plaintext signal having a predetermined number of bits by exclusive-OR-operating the plaintext with an encryption key and decrypts a ciphertext by exclusive-OR-operating the ciphertext with the encryption key. The f9 integrity algorithm derives a message authentication code from a received signal. The KASUMI algorithm, as previously discussed, has emerged as a significant issue to confidentiality and integrity.  
         [0033]    [0033]FIG. 4 is a block diagram illustrating an example of a KASUMI algorithm according to the present invention. Referring to FIG. 4, a KASUMI of the present invention provides a 64-bit output ciphertext from a 64-bit input plaintext using first, second and third encryption keys. The 64-bit input signal is divided into a 32-bit signal L 0  and another 32-bit signal R 0 . FLi units (1≦i≦8)  410  to  480  and SLIMFOi units (1≦i≦4)  510  to  540  are used to encrypt the signals L 0  and R 0  using corresponding encryption keys KO i  (1≦i≦8) and KI i  (1≦i≦8) to output a 64-bit ciphertext.  
         [0034]    Describing FIG. 4 in more detail, an FL 1  unit  410  encrypts the input 32-bit signal L 0  with an encryption key KL 1  and outputs a ciphertext L 1 . An SLIMFO 1  unit  510  encrypts the 32-bit ciphertext L 1  with encryption keys KO 1  and KI 1 , outputs a signal SR 1  by encrypting the signal L 1  with the 32-bit signal R 0 , and then outputs a signal R 1  by encrypting the signal SR 1  with encryption keys KO 2  and KI 2 . An FL 2  unit  420  encrypts the signal R 1  with an encryption key KL 2  and outputs a ciphertext R 2 . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 0  and R 2  to provide a signal L 2  (=SL 1 ).  
         [0035]    An FL 3  unit  430  encrypts the signal L 2  with an encryption key KL 3  and outputs a ciphertext L 3 . An SLIMFO 2  unit  520  encrypts the signal L 3  with encryption keys KO 3  and KI 3 , outputs a signal SR 2  by operating the encrypted signal L 3  with the signal SR 1 , and then outputs a signal R 3  by encrypting the signal SR 2  with encryption keys KO 4  and KI 4 . An FL 4  unit  440  encrypts the signal R 3  with an encryption key KL 4  and outputs a ciphertext R 4 . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 2  (=SL 1 ) and R 4  to provide a signal L 4  (=SL 2 ).  
         [0036]    An FL 5  unit  450  encrypts the signal L 4  with an encryption key KL 5  and outputs a ciphertext L 5 . An SLIMFO 3  unit  530  encrypts the signal L 5  with encryption keys KO 5  and KI 5 , outputs a signal SR 3  by operating the encrypted signal L 3  with the signal SR 2 , and then outputs a signal R 5  by encrypting the signal SR 3  with encryption keys KO 6  and KI 6 . An FL 6  unit  460  encrypts the signal R 5  with an encryption key KO 6  and outputs a ciphertext R 6 . An Exclusive-OR operation is performed to logically “exclusive OR” the signals L 4  (=SL 2 ) and R 6  to provide a signal L 6  (=SL 3 ).  
         [0037]    An FL 7  unit  470  encrypts the signal L 6  with an encryption key KL 7  and outputs a ciphertext L 7 . An SLIMFO 4  unit  540  encrypts the signal L 7  with encryption keys KO 7  and KI 7 , outputs a signal SR 4  by operating the encrypted signal L 7  with the signal SR 3 , and then outputs a signal R 7  by encrypting the signal SR 4  with encryption keys KO 8  and KI 8 . An FL 8  unit  480  encrypts the signal R 7  with an encryption key KL 8  and outputs a ciphertext R 8 . The signals L 6  (=SL 3 ) and R 8  are exclusive-OR-operated, resulting in a signal L 8  (=SL 4 ). Consequently, the eight FLi units (1≦i≦8)  410  to  480  and the four SLIMFOi units (1≦i≦4)  510  to  540  encrypt the 64-bit plaintext and output the 64-bit ciphertext, that is, the 32-bit signal SL 4 //the 32-bit SR 4 .  
         [0038]    [0038]FIG. 5 is a block diagram illustrating an example of the SLIMFOi units illustrated in FIG. 4 according to an embodiment of the invention. Referring to FIG. 5, a SLIMFOi unit is an ith SLIMFO unit and implemented using parallel operations of signals in two FOi units. The SLIMFO 1  unit  510  of FIG. 4 will be described by way of example. The SLIMFO 1  unit  510  comprises an FO 1  cipher  501  and an FO 2  cipher  502 . Each FO cipher includes F 1   i,j  sub-ciphers (1≦i≦2, 1≦j≦3), for 3-round encryption.  
         [0039]    The signal resulting from encrypting the 32-bit signal L 0  with the encryption key KL 1  in FIG. 4 is divide into a 16-bit signal L 0  (=L 1 ) and a 16-bit signal R 0  (=R 1 ) in the FO 1  cipher  501 . A signal L 2  is generated by performing a logical exclusive-OR operation on the signal L 1  with a sub-encryption key KO 1,1 . An F 1   1,1  sub-cipher  511  generates a signal L 2D  by encrypting the signal L 2  with a sub-encryption key KI 1,1 . A delay (D 6 )  600  delays the signal R 1  and outputs a delayed signal R 1D . A signal L 3  is generated by performing a logical exclusive-OR operation on the signals R 1D  and L 2D . Meanwhile, a signal R 2  is generated by performing a logical exclusive-OR operation on the signal R 1  with a sub-encryption key KO 1,2 . An FL 1,2  sub-cipher  512  generates a signal R 2D  by encrypting the signal R 2  with a sub-encryption key KI 1,2 . A signal R 3  is generated by performing a logical exclusive-OR operation on the signals R 2D  and L 3 . A signal L 4  is generated by performing a logical exclusive-OR operation on the signal L 3  with a sub-encryption key KO 1,3 . An F 1   1,3  sub-cipher  513  generates a signal L 4D  by encrypting the signal L 4  with a sub-encryption key KI 1,3 . A delay (D 7 )  620  delays the signal R 3  and outputs a delayed signal R 3D . A 16-bit signal L 5  is generated by performing a logical exclusive-OR operation on the signals R 3D  and L 4D .  
         [0040]    The 32-bit signal R 0  which was divided from the 64-bit signal in FIG. 4 is further divided into a 16-bit signal L 0′  and a 16-bit signal R 0′  in the FO 2  cipher  502 . A signal L 6  is generated by performing a logical exclusive-OR operation on the signal L 0′  using the 16-bit signal L 5 . Meanwhile, a signal R 4  is generated by performing a logical exclusive-OR operation on the signal R 0′  using the 16-bit signal R 3 . A signal R 5  is generated by performing a logical exclusive-OR operation on the signal R 4  using a sub-encryption key KO 2,1 . An F 1   2,1  sub-cipher  514  generates a signal R 5D  by encrypting the signal R 5  with a sub-encryption key KI 2,1 . A signal R 6  is generated by performing a logical exclusive-OR operation on the signals R 5D  and L 6 . That is, the F 1   1,3  sub-cipher  513  and the F 1   2,1  sub-cipher  514  synchronize the signal L 6  to the signal R 6  without using delays. A signal L 7  is generated by performing a logical exclusive-OR operation on the signal L 6  with a 16-bit sub-encryption key KO 2,2 . An FL 2,2  sub-cipher  515  generates a signal L 7D  by encrypting the signal L 7  with a 16-bit sub-encryption key KI 2,2 . A delay (D 8 )  640  delays the signal R 6  and outputs a delayed signal R 6D . A signal L 8  is generated by performing a logical exclusive-OR operation on the signals L 7D  and R 6D . A signal R 7  is generated by performing a logical exclusive-OR operation on the signal R 6  with a 16-bit sub-encryption key KO 2,3 . An F 1   2,3  sub-cipher  516  generates a signal R 7D  by encrypting the signal R 7  with a 16-bit sub-encryption key KI 2,3 . A signal R 8  is generated by performing a logical exclusive-OR operation on the signals R 7D  and L 8 . Consequently, a 32-bit ciphertext L 8 ∥R 8  is generated by operating the 16-bit signal L 8  with the 16-bit signal R 8 .  
         [0041]    As described above, the SLIMFO 1  unit encrypts the input plaintext by processing the 16-bit signals L 0  and R 0  in parallel in the FO 1  cipher  501  and processing the 16-bit signals L 0′  and R 0′  in parallel in the FO 2  cipher  502 . The parallel processing of the 32-bit signals L 0  and R 0  which were divided from the 64-bit input signal in the SLIMFOi units remarkably increases encryption speed and reduces the number of delays used to synchronize a delayed signal to a non-delayed signal.  
         [0042]    [0042]FIG. 6 is a block diagram illustrating an example of the F 1   i,j  sub-ciphers illustrated in FIG. 5 according to an embodiment of the invention. By way of example, the F 1   1,1  sub-cipher  511  will be described below.  
         [0043]    Referring to FIG. 6, the F 1   1,1  sub-cipher  511  includes a first ciphering unit and a second ciphering unit. In the first ciphering unit, a 16-bit input signal is divided into a 9-bit signal RL 0  and a 7-bit signal RR 0 . An S 91  operator  710  generates a 9-bit signal y 0 , y 1 , . . . , y 8  from the input signal RL 0  by  
                         y   0     =       (   x0x2   )     ⊕   x3   ⊕     (   x2x5   )     ⊕     (   x5x6   )     ⊕     (   x0x7   )     ⊕     (   x1x7   )     ⊕     (   x2x7   )     ⊕     (   x4x8   )     ⊕     (   x5x8   )     ⊕     (   x7x8   )          ⊕   ′          1   ′         ;          
              y   1     =     x1   ⊕     (   x0x1   )     ⊕     (   x2x3   )     ⊕     (   x0x4   )     ⊕     (   x1x4   )     ⊕     (   x0x5   )     ⊕     (   x3x5   )     ⊕   x6   ⊕     (   x1x7   )     ⊕     (   x2x7   )     ⊕     (   x5x8   )          ⊕   ′          1   ′         ;          
            y2   =     x1   ⊕     (   x0x3   )     ⊕     (   x3x4   )     ⊕     (   x0x5   )     ⊕     (   x2x6   )     ⊕     (   x3x6   )     ⊕     (   x5x6   )     ⊕     (   x4x7   )     ⊕     (   x5x7   )     ⊕     (   x6x7   )     ⊕   x8   ⊕     (   x0x8   )          ⊕   ′          1   ′         ;          
            y3   =     x0   ⊕     (   x1x2   )     ⊕     (   x0x3   )     ⊕     (   x2x4   )     ⊕   x5   ⊕     (   x0x6   )     ⊕     (   x1x6   )     ⊕     (   x4x7   )     ⊕     (   x0x8   )     ⊕     (   x1x8   )     ⊕     (   x7x8   )         ;          
            y4   =       (   x0x1   )     ⊕     (   x1x3   )     ⊕   x4   ⊕     (   x0x5   )     ⊕     (   x3x6   )     ⊕     (   x0x7   )     ⊕     (   x6x7   )     ⊕     (   x1x8   )     ⊕     (   x2x8   )     ⊕     (   x3x8   )         ;          
            y5   =     x2   ⊕     (   x1x4   )     ⊕     (   x4x5   )     ⊕     (   x0x6   )     ⊕     (   x1x6   )     ⊕     (   x3x7   )     ⊕     (   x4x7   )     ⊕     (   x6x7   )     ⊕     (   x5x8   )     ⊕     (   x6x8   )     ⊕     (   x7x8   )          ⊕   ′          1   ′         ;          
            y6   =     x0   ⊕     (   x2x3   )     ⊕     (   x1x5   )     ⊕     (   x2x5   )     ⊕     (   x4x5   )     ⊕     (   x3x6   )     ⊕     (   x4x6   )     ⊕     (   x5x6   )     ⊕   x7   ⊕     (   x1x8   )     ⊕     (   x3x8   )     ⊕     (   x5x8   )     ⊕     (   x7x8   )         ;          
            y7   =       (   x0x1   )     ⊕     (   x0x2   )     ⊕     (   x1x2   )     ⊕   x3   ⊕     (   x0x3   )     ⊕     (   x2x3   )     ⊕     (   x4x5   )     ⊕     (   x2x6   )     ⊕     (   x3x6   )     ⊕     (   x2x7   )     ⊕     (   x5x7   )     ⊕   x8        ⊕   ′          1   ′         ;          
            y8   =       (   x0x1   )     ⊕   x2   ⊕     (   x1x2   )     ⊕     (   x3x4   )     ⊕     (   x1x5   )     ⊕     (   x2x5   )     ⊕     (   x1x6   )     ⊕     (   x4x6   )     ⊕   x7   ⊕     (   x2x8   )     ⊕     (   x3x8   )         ;                               (   3   )                               
 
         [0044]    That is, the S 91  operator  710  generates the 9-bit signal y 1 , y 2 , . . . , y 8  by performing parallel logical AND operations and then performing a logical exclusive-OR operation of a 9-bit signal x 0 , x 1 , . . . , x 8  in parallel. A ZE 1  unit  720  receives the signal RR 0 , adds two zeroes to the MSB of the signal RR 0 , and outputs a 9-bit signal. An Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the S 91  operator  710  and the ZE 1  unit  720  to provide a 9-bit signal RL 1 . Another Exclusive-OR operation is performed to logically “exclusive OR” the signal RL 1 , and a 9-bit sub-encryption key KI 1,1,2 , to provide a 9-bit signal RL 2 . The signal RL 2  is temporarily stored in a first register (register  1 )  800 .  
         [0045]    Simultaneously, an S 71  operator  740  generates a 7-bit signal y 0 , y 1 , . . . , y 6  from the input signal RR 0  (=RR 1 ) by  
                         y   0     =       (   x1x3   )     ⊕   x4   ⊕     (   x0x1x4   )     ⊕   x5   ⊕     (   x2x5   )     ⊕     (   x3x4x5   )     ⊕   x6   ⊕     (   x0x6   )     ⊕     (   x1x6   )     ⊕     (   x3x6   )     ⊕     (   x2x4x6   )     ⊕     (   x1x5x6   )     ⊕     (   x4x5x6   )         ;          
              y   1     =       (   x0x1   )     ⊕     (   x0x4   )     ⊕     (   x2x4   )     ⊕   x5   ⊕     (   x1x2x5   )     ⊕     (   x0x3x5   )     ⊕   x6   ⊕     (   x0x2x6   )     ⊕     (   x3x6   )     ⊕     (   x4x5x6   )          ⊕   ′          1   ′         ;          
            y2   =     x0   ⊕     (   x0x3   )     ⊕     (   x2x3   )     ⊕     (   x1x2x4   )     ⊕     (   x0x3x4   )     ⊕     (   x1x5   )     ⊕     (   x0x2x5   )     ⊕     (   x0x6   )     ⊕     (   x0x1x6   )     ⊕     (   x2x6   )     ⊕     (   x4x6   )          ⊕   ′          1   ′         ;          
            y3   =     x1   ⊕     (   x0x1x2   )     ⊕     (   x1x4   )     ⊕     (   x3x4   )     ⊕     (   x0x5   )     ⊕     (   x0x1x5   )     ⊕     (   x2x3x5   )     ⊕     (   x1x4x5   )     ⊕     (   x2x6   )     ⊕     (   x1x3x6   )         ;          
            y4   =       (   x0x2   )     ⊕   x3   ⊕     (   x1x3   )     ⊕     (   x1x4   )     ⊕     (   x0x1x4   )     ⊕     (   x2x3x4   )     ⊕     (   x0x5   )     ⊕     (   x1x3x5   )     ⊕     (   x0x4x5   )     ⊕     (   x1x6   )     ⊕     (   x3x6   )     ⊕     (   x0x3x6   )     ⊕     (   x5x6   )          ⊕   ′          1   ′         ;          
            y5   =     x2   ⊕     (   x0x2   )     ⊕     (   x0x3   )     ⊕     (   x1x2x3   )     ⊕     (   x0x2x4   )     ⊕     (   x0x5   )     ⊕     (   x2x5   )     ⊕     (   x4x5   )     ⊕     (   x1x6   )     ⊕     (   x1x2x6   )     ⊕     (   x0x3x6   )     ⊕     (   x3x4x6   )     ⊕     (   x2x5x6   )          ⊕   ′          1   ′         ;          
            y6   =       (   x1x2   )     ⊕     (   x0x1x3   )     ⊕     (   x0x4   )     ⊕     (   x1x5   )     ⊕     (   x3x5   )     ⊕   x6   ⊕     (   x0x1x6   )     ⊕     (   x2x3x6   )     ⊕     (   x1x4x6   )     ⊕     (   x0x5x6   )         ;                               (   4   )                               
 
         [0046]    That is, the S 71  operator  740  generates the 9-bit signal y 1 , y 2 , . . , y 6  by performing parallel logical AND operations and then performing a logical exclusive-OR operation of a 7-bit signal x 0 , x 1 , . . . , x 6  in parallel. A TR 1  unit  730  removes two zeroes from the MSBs of the 9-bit signal RL 1  and outputs the resulting 7-bit signal. A 7-bit signal RR 2  is generated by performing a logical exclusive-OR operation on the outputs of the TR 1   730  and the S 71  operator  740  with a sub-encryption key KI 1,1,1 . The signal RR 2  is temporarily stored in the first register  800 . Upon receipt of a first clock signal CLK 1  from a controller (not shown), the register  800  simultaneously outputs the 9-bit signal RL 2  and the 7-bit signal RR 2 . Thus the register  800  functions to synchronize the output timings of signals according to delay involved with encryption in the S 91  operator  710 , the ZE 1  unit  720 , the TR 1  unit  730 , and the S 71  operator  740 .  
         [0047]    In the second ciphering unit, an S 92  operator  750  generates a 9-bit signal y 0 , y 1 , . . . , y 8  from the 9-bit signal RL 2  received from the register  800  using Eq. (3). A ZE 2  unit  760  adds two zeroes to the MSB of the signal RR 2  received from the register  800  and outputs a 9-bit signal. An Exclusive-OR operation is performed to logically “exclusive OR” the outputs of the S 92  operator  750  and the ZE 2  unit  760  to provide a 9-bit signal RL 3 . The signal RL 3  is temporarily stored in a second register (register  2 )  820 .  
         [0048]    Simultaneously, an S 72  operator  780  generates a 7-bit signal y 0 , y 1 , . . . , y 6  from the 7-bit signal RR 2  (=RR 3 ) using Eq. (4). A TR 2  unit  770  removes two zeroes from the MSBs of the 9-bit signal RL 3  and outputs the resulting 7-bit signal. A 7-bit signal RR 4  is generated by performing a logical exclusive-OR-operation on the outputs of the TR 2   770  and the S 72  operator  780 . The signal RR 4  is temporarily stored in the second register  820 .  
         [0049]    Upon receipt of a second clock signal CLK 2  from the controller; the register  820  simultaneously outputs the 9-bit signal RL 4  and the 7-bit signal RR 4 . Thus the register  820  functions to synchronize the output timings of signals according to the delay involved with the encryption in the S 92  operator  750 , the ZE 2  unit  760 , the TR 2  unit  770 , and the S 72  operator  780 .  
         [0050]    As described above, the S 91  operator  710  and the S 92  operator  750  each output a 9-bit signal y 0 , y 1 , . . . , y 8  by performing parallel logical AND operations and then performing a logical exclusive-OR operation according to Eq. (3). The S 71  operator  740  and the S 72  operator  780  each output a 7-bit signal y 0 , y 1 , . . . , y 6  by parallel AND operations and then exclusive-OR operation according to Eq. (4). Therefore, encryption speed is remarkably increased. Furthermore, the use of the registers  800  and  820  for signal timing synchronization enables output of an accurate ciphertext.  
         [0051]    In accordance with the present invention, (1) parallel computation of input signals increases signal processing speed; (2) due to synchronization of the output timings of a delayed signal and a non-delayed signal, an accurate ciphertext is achieved and thus an encryption system is further stabilized; and (3) the decrease in devices used for synchronization reduces required chip capacity and production cost.  
         [0052]    While the invention has been shown and described with reference to a certain embodiment thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.