Abstract:
There is provided a high-speed pipelined ARIA encryption apparatus. The high-speed pipelined ARIA encryption apparatus includes a round key generator for generating a plurality of round keys required for performing an encryption operation using a master key formed to have uniform bits, a plurality of round units whose number is in proportion to the number of times of round operations corresponding to the number of bit of an input value to receive the round keys and the input value and to perform the round operations, and a plurality of pipelined register provided between the round units to transmit the output value of a previous round unit as the input value of the next round unit. A plurality of round units are provided and pipelined registers are inserted between the round units so that it is possible to improve the performance of processing a large amount of data and to perform ARIA encryption at high speed.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application claims the benefit of Korean Application No. 10-2008-0092301 filed on Sep. 19, 2008 in the Korean Intellectual Property Office, the disclosure of which is incorporated by reference. 
       BACKGROUND OF THE INVENTION 
       [0002]    1.Field of the Invention 
         [0003]    The present invention relates to a high-speed pipelined ARIA encryption apparatus, and more particularly, to a high-speed pipelined ARIA encryption apparatus in which a plurality of round units are provided in accordance with the number of times of rounds so that ARIA encryption can be performed at high speed. 
         [0004]    2. Discussion of the Related Art 
         [0005]    An ARIA encryption algorithm is a public-private block symmetrical key encryption algorithm developed by the NSRI. 
         [0006]    In general, in the ARIA encryption algorithm, with respect to the number of rounds and the size of a master key, it is recommended to use a 12-round operation when the master key has 128 bits, to use a 14-round operation when the master key has 192 bits, and to use a 16-round operation when the master key has 256 bits. 
         [0007]    The ARIA algorithm performs an encryption operation by round operations that include a substitution operation and a diffusion operation. 
         [0008]    In the ARIA algorithm, key extension processes include key initialization processes and round key generation processes of generating four 128-bit initialization key values W0, W1, W2, and W3 when the master key MK and specific initialization constants (CK1, CK2, and CK3) are given as inputs. 
         [0009]    In accordance with a method of performing the substitution and diffusion operations and a method of performing the key extension processes, there is a difference in the time spent on the ARIA encryption operation and used hardware resources, which is directly connected to the performance of an ARIA encryption processor. 
         [0010]    The conventional ARIA encryption apparatus repeatedly drives one round unit so that a plurality of clock cycles are used for encrypting a large amount of data when the encryption operation is performed. 
       SUMMARY OF THE INVENTION 
       [0011]    It is an object of the present invention to provide a high-speed pipelined ARIA encryption apparatus in which a plurality of round units are provided so that ARIA encryption can be performed at high speed. 
         [0012]    Therefore, in order to achieve the above object, there is provided a high-speed pipelined ARIA encryption apparatus, including a round key generator for generating a plurality of round keys required for performing an encryption operation using a master key formed to have uniform bits, a plurality of round units whose number is in proportion to the number of times of round operations corresponding to the number of bit of an input value to receive the round keys and the input value and to perform the round operations, and a plurality of pipelined register provided between the round units to transmit the output value of a previous round unit as the input value of the next round unit. 
         [0013]    According to the ARIA encryption apparatus, a plurality of round units are provided, pipelined registers are inserted between the round units, and sub-pipelined registers are inserted into the round units. Therefore, a block encryption operation without a feedback is calculated in one clock to perform a high performance encryption operation. Therefore, since it is possible to improve the performance of processing a large amount of data, it is possible to perform ARIA encryption at high speed. In addition, key initialization processes are performed using the round units without including an additional key initialization operation unit. Therefore, it is possible to reduce the size of hardware. In addition, a substitution unit is not formed of a look-up table but is formed of a composite field logic and the sub-pipelined registers are inserted. Therefore, it is possible to improve the performance of processing a large amount of data. 
         [0014]    The present invention can be applied to an ARIA encryption algorithm. A plurality of round units are provided in accordance with the number of times of rounds so that ARIA encryption can be performed at high speed. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0015]    The present invention will become more fully understood from the detailed description given herein below and the accompanying drawings, which are given by illustration only, and thus are not limitative of the present invention, and wherein: 
           [0016]      FIG. 1  is a block diagram of an ARIA encryption apparatus for encrypting a master key of 128 bits according to an embodiment of the present invention; 
           [0017]      FIG. 2  is a block diagram of the first round unit of  FIG. 1 ; 
           [0018]      FIG. 3  is a block diagram of the second round unit of  FIG. 1 ; 
           [0019]      FIG. 4  is a block diagram of the fourth to 11th round units of  FIG. 1 ; 
           [0020]      FIG. 5  is a block diagram of the 12th round unit of  FIG. 1 ; 
           [0021]      FIG. 6  is a block diagram of the substitution unit illustrated in  FIGS. 2 to 5 ; 
           [0022]      FIG. 7  is a block diagram of the first Sbox operation unit of  FIG. 6 ; 
           [0023]      FIG. 8  is a block diagram of the second Sbox operation unit of  FIG. 6 ; 
           [0024]      FIG. 9  is a block diagram of the finite field inverse operation unit illustrated in  FIGS. 7 and 8 ; 
           [0025]      FIGS. 10 to 13  are matrices illustrating the operations performed by first to fourth unification units; 
           [0026]      FIG. 14  is a block diagram illustrating that sub-pipelined registers are displayed on the round units that operate substitution boxes S 1  and S 2  among the fourth to 11th round units of  FIG. 1 ; 
           [0027]      FIG. 15  is a block diagram illustrating that sub-pipelined registers are displayed on the round units that operate inverse substitution boxes S 1   −1  and S 2   −1  among the fourth to 11th round units of  FIG. 1 ; and 
           [0028]      FIG. 16  is a block diagram illustrating an embodiment of the diffusion unit of  FIGS. 2 to 4 . 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0029]    Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. 
         [0030]    An ARIA encryption apparatus includes a plurality of round units that perform round operations to correspond to the number of rounds set in accordance with the size of a master key to perform an encryption operation at high speed. 
         [0031]    In the present ARIA encryption apparatus, 12 round units for performing the round operations are provided when the master key has 128 bits, 14 round units are provided when the master key has 192 bits, and 16 round units are provided when the master key has 256 bits. In the following embodiment, the case in which the master key has 128 bits will be taken as an example. However, the structure of the present invention can be applied when the master key has 192 bits and 256 bits. 
         [0032]      FIG. 1  is a block diagram of an ARIA encryption apparatus for encrypting a master key of 128 bits according to an embodiment of the present invention. 
         [0033]    The ARIA encryption apparatus includes a round key generator  50 , first to 12th round units  1 ,  2 , •;  11 , and  12 , and first to 11th pipelined registers  31 ,  32 , •;  41 . 
         [0034]    The round key generator  50  generates round keys required for performing the encryption operation using the master keys of 128 bits, 192 bits, and 256 bits. The round key generator  50  generates first to 13th round keys when the master key has 128 bit, generates first to fifth round keys when the master key has 192 bits, and generates first to 17th round keys when the master key has 256 bits. Since the ARIA encryption apparatus according to the present embodiment encrypts the master key of 128 bitts, the round key generator  50  generates the first to 13th round keys. 
         [0035]    The first to 12th round units  1 ,  2 , •;  11 , and  12  perform the round operations for the input value of 128 bits to perform encryption. When the round operations are performed for the input value of 192 bits, the 13th round unit and the 14th round unit must be further provided. When the round operations are performed for the input value of 256 bits, the 15th round unit and the 16th round unit must be further provided. 
         [0036]    Here, the first to 12th round units  1 ,  2 , •;  11 , and  12  commonly include a first XOR unit and a substitution unit and selectively include a multiplexer, a diffusion unit, and a second XOR unit in accordance with the operation order of the first to 12th round units  1 ,  2 , •;  11 , and  12 . Detailed description of the structures of the first to 12th round units  1 ,  2 , •;  11 , and  12  will be performed later. On the other hand, the first to 12th round units  1 ,  2 , •;  11 , and  12  include sub-pipelined registers, which will be described later with reference to the drawings. 
         [0037]    The first to 11th pipelined registers  31 ,  32 , •; and  41  store the results output from the first to 12th round units  1 ,  2 , •;  11 , and  12  and input the results to the next round units. For example, the first pipelined register  31  inputs the result output from the first round unit  1  to the second round unit  2  and the 11th pipelined register  41  inputs the result output from the 11th round unit  11  to the 12th round unit  12 . When the input value of 192 bits is processed, the 12th and 13th pipelined registers must be further provided. When the input value of 256 bits is processed, the 14th and 15th pipelined registers must be further provided. 
         [0038]    When the encryption operation is performed using the ARIA encryption apparatus having such a structure, the input value becomes a plaintext and the output value becomes a ciphertext. When a decoding operation is performed using the ARIA encryption apparatus having such a structure, the input value becomes the cihertext and the output value becomes the plaintext. 
         [0039]      FIG. 2  is a block diagram of the first round unit of  FIG. 1 . 
         [0040]    The first round unit  1  includes a first multiplexer  110 , a second multiplexer  120 , a first XOR unit  130 , a substitution unit  140 , a diffusion unit  180 , and a second XOR unit  190 . 
         [0041]    The first multiplexer  110  receives an input value and a first key to transmit the input value and the first key to the first XOR unit  130 . The second multiplexer  120  receives a key initialization constant and a first round key from the round key generator  50  to transmit the key initialization constant and the first round key to the first XOR unit  130 . On the other hand, in a common ARIA encryption apparatus, the master key is divided into the first key and a second key. In the ARIA encryption apparatus according to the present invention, the first key is input to the first multiplexer  110  of the first round unit  1  and the second key is input to the second XOR unit  190 . 
         [0042]    The first XOR unit  130  performs an XOR operation on the plaintext and the first key input through the first multiplexer  110  and the key initialization constant and the first round key input through the second multiplexer  120  in units of bits. 
         [0043]    The substitution unit  140  performs the substitution operation for the output value of the first XOR unit  130 . The value output from the diffusion unit  180  becomes the first round resultant value that is the output value of the first round unit  1 . 
         [0044]    The second XOR unit  190  performs an XOR operation on the value output from the diffusion unit  180  and the second key to output a key initial value. 
         [0045]    In the first round unit  1 , the first and second multiplexers  110  and  120  and the second XOR unit  190  are required for performing the round operations for the plaintext and key initialization processes. 
         [0046]      FIG. 3  is a block diagram of the second round unit of  FIG. 1 . 
         [0047]    The second round unit  2  receives the first round resultant value of the first round unit  1  to perform the round operations and includes a first multiplexer  210 , a first XOR unit  230 , a substitution unit  2440 , a diffusion unit  280 , and a second XOR unit  290 . 
         [0048]    The first multiplexer  210  receives a key initialization constant and a second round key to provide the key initialization constant and the second round key to the first XOR unit  230 . 
         [0049]    The first XOR unit  230  performs an XOR operation on the first round resultant value of the first round unit  1  and the key initialization constant and the first round key provided from the first multiplexer  210  in units of bits. 
         [0050]    The substitution unit  240  performs the substitution operation on the output value of the first XOR unit  230 . The diffusion unit  280  performs the diffusion operation on the output value of the substitution unit  240 . Here, the output value of the diffusion unit  280  becomes the second round resultant value of the second round unit  2 . 
         [0051]    The second XOR unit  290  receives the output value of the diffusion unit  280 , a first key, or the key initial value output from the first round unit  1  to output the key initial value. 
         [0052]    On the other hand, a third round unit (not shown) has the same structure as the second round unit  2  and is different from the second round unit  2  in that the second round resultant value, the key initialization constant from the first multiplexer  210 , and a third round key are input to the first XOR unit  230 . 
         [0053]    In the second round unit  2  and the third round unit, the first multiplexer  210  and the second XOR unit  290  are required for performing the round operations for the plaintext and the key initialization processes using the second round unit  2  and the third round unit. Therefore, the first multiplexer  210  and the second XOR unit  290  are not provided in the fourth to 11th round units  11  that are the next round units. 
         [0054]      FIG. 4  is a block diagram of the fourth to 11th round units of  FIG. 1 . 
         [0055]    The fourth to 11th round units  11  include an XOR unit  330 , a substitution unit  340 , and a diffusion unit  380 . 
         [0056]    The XOR unit  330  receives the previous round resultant value output from the previous round unit and the round key of the corresponding round from the round key generator  50  to perform an XOR operation. For example, the XOR unit  330  of the fourth round unit receives a third round resultant value and a fourth round key from the round key generator  50  to perform an XOR operation and the XOR unit  330  of a fifth round unit (not shown) receives a fourth round resultant value and a fifth round key from the round key generator  50  to perform an XOR operation. The 11th round unit  11  receives a 10th round resultant value and an 11th round key to perform an XOR operation. 
         [0057]    The substitution unit  340  performs the substitution operation on the resultant value of the XOR unit  330 . The diffusion unit  380  performs the diffusion operation on the resultant value of the substitution unit  340 . The resultant value of the diffusion unit  380  becomes the resultant value of each of the round units. 
         [0058]    According to the present embodiment, since the case in which the master key has 128 bits is taken as an example, the structures of the fourth to 11th round units  11  are the same. On the other hand, when the master key has 192 bits, the structures of the fourth to 13th round units excluding the last 14th round unit are the same. When the master key has 256 bits, the structures of the fourth to 15th round units excluding the last 16th round unit are the same. 
         [0059]      FIG. 5  is a block diagram of the 12th round unit of  FIG. 1 . 
         [0060]    When the master key has 128 bits, since the 12th round unit  12  becomes the last round unit, the structure of  FIG. 5  represents the structure of the last round unit. Therefore, when the master key has 192 bits, the structure of the 14th round unit is the same as the structure of  FIG. 5 . When the master key has 256 bits, the structure of the 16th round unit is the same as the structure of  FIG. 5 . 
         [0061]    The 12th round unit  12  includes a first XOR unit  430 , a substitution unit  440 , and a second XOR unit  490 . 
         [0062]    The resultant value of the 11th round that is the previous round and the 12th round key generated by the round key generator  50  are input to the first XOR unit  430 . The first XOR unit  430  performs an XOR operation on the 11th round resultant value and the 12th round key. 
         [0063]    The substitution unit  440  performs the substitution operation on the resultant value of the first XOR unit  430  and provides the resultant value to the second XOR unit  490 . 
         [0064]    The second XOR unit  490  receives the resultant value from the substitution unit  440  and the 13th round key from the round key generator  50  to perform an XOR operation and to output a final output value. 
         [0065]    When the master key has 192 bits, the 13th round resultant value and the 14th round key are input to the first XOR unit of the 14th round unit to perform an XOR operation. The resultant value of the substitution unit and the 15th round key are input to the second XOR unit to perform an XOR operation and to output the final output value. When the master key has 256 bits, the 15th round resultant value and the 16th round key are input to the first XOR unit of the 16th round unit to perform an XOR operation. The resultant value of the substitution unit and the 17th round key are input to the second XOR unit to perform an XOR operation and to output the final output value. 
         [0066]      FIG. 6  is a block diagram of the substitution unit illustrated in  FIGS. 2 to 5 . 
         [0067]    In  FIG. 6 , an example of substitution units  140 ,  240 ,  340 , and  440  that perform the substitution operation on the output value of 128 bits for the input value of 128 bits is illustrated. The substitution units  140 ,  240 ,  340 , and  440  include a first Sbox operation unit  145 , a second Sbox operation unit  155 , and a controller  165 . 
         [0068]    The first Sbox operation unit  145  performs substitution box S 1  and inverse substitution box S 1   −1  operations and the second Sbox operation unit  155  performs substitution box S 2  and inverse substitution box S 2   −1  operations. 
         [0069]    The controller  165  controls the operations of the first Sbox operation unit  145  and the second Sbox operation unit  155 . 
         [0070]    The substitution unit  240  can perform the substitution operation of block encryption ARIA without including additional ROM and/or RAM in order to realize the substitution box. The structures of the first Sbox operation unit  145  and the second Sbox operation unit  155  for performing the substitution operation are as follows. 
         [0071]      FIG. 7  is a block diagram of the first Sbox operation unit of  FIG. 6 . 
         [0072]    The first Sbox operation unit  145  includes a first inverse affine conversion unit  146 , a first multiplexer  147 , a finite field inverse operation unit  148 , a first affine conversion unit  149 , and a second multiplexer  150 . The controller  165  generates the selection control signals of the first multiplexer  147  and the second multiplexer  150 . The first inverse affine conversion unit  146  obtains the inverse substitution box S 1   −1  of the input value. The detailed operations of the first inverse affine conversion unit  146  are represented in EQUATION 1. 
         [0000]      B[0]=A[2] xor A[5] xor A[7] xor ‘1’ 
         [0000]      B[1]=A[0] xor A[3] xor A[6] 
         [0000]      B[2]=A[1] xor A[4] xor A[7] xor ‘1’ 
         [0000]      B[3]=A[0] xor A[2] xor A[5] 
         [0000]      B[4]=A[1] xor A[3] xor A[6] 
         [0000]      B[5]=A[2] xor A[4] xor A[7] 
         [0000]      B[6]=A[0] xor A[3] xor A[5] 
         [0000]      B[7]=A[4] xor A[4] xor A[6]  [EQUATION 1] 
         [0073]    wherein, A means the input value of 8 bits and consists of A[0] to A[7] . Here, A[0] means the lowermost bit and A[7] means the uppermost bit. B means the output value of 8 bits and consists of B[0] to B[7]. Here, B[0] means the lowermost bit and B[7] means the uppermost bit. 
         [0074]    The first multiplexer  147  receives an input value and the resultant value of the first inverse affine conversion unit  146  to determine the input value of the finite field inverse operation unit  148  and to provide the determined input value. 
         [0075]    The finite field inverse operation unit  148  calculates GF(2 8 ) inverse for the input value and/or the resultant value of the first inverse affine conversion unit  146  and performs finite field inverse operation logic for m(x)=x 8 +x 4 +x 3 +x+1 that is the irreducible polynomial adopted by the block encryption ARIA algorithm. The resultant value of the finite field inverse operation unit  148  is input to the first affine conversion unit  149  and the second multiplexer  150 . 
         [0076]    The first affine conversion unit  149  obtains the substitution box S 1  of the resultant value of the finite field inverse operation unit  148  and provides the resultant value to the second multiplexer  150 . The detailed operations of the first affine conversion unit for obtaining the substitution box S 1  are represented in EQUATION 2. 
         [0000]      B[0]=A[0] xor A[4] xor A[5] xor A[6] xor A[7] xor ‘1’ 
         [0000]      B[1]=A[1] xor A[5] xor A[6] xor A[7] xor A[0] xor ‘1’ 
         [0000]      B[2]=A[2] xor A[6] xor A[7] xor A[0] xor A[1] 
         [0000]      B[3]=A[3] xor A[7] xor A[0] xor A[1] xor A[2] 
         [0000]      B[4]=A[4] xor A[0] xor A[1] xor A[2] xor A[3] 
         [0000]      B[5]=A[5] xor A[1] xor A[2] xor A[3] xor A[4] xor ‘1’ 
         [0000]      B[6]=A[6] xor A[2] xor A[3] xor A[4] xor A[5] xor ‘1’ 
         [0000]      B[7]=A[7] xor A[3] xor A[4] xor A[5] xor A[6]  [EQUATION 2] 
         [0077]    The second multiplexer  150  receives the resultant value of the first affine conversion unit  149  and the resultant value of the finite field inverse operation unit  148  to select one of the resultant value of the first affine conversion unit  149  and the resultant value of the finite field inverse operation unit  148  as the resultant value of the first Sbox operation unit  145  and to output the resultant value. 
         [0078]      FIG. 8  is a block diagram of the second Sbox operation unit of  FIG. 6 . 
         [0079]    The second Sbox operation unit  155  includes a second inverse affine conversion unit  156 , a third multiplexer  157 , a finite field inverse operation unit  158 , a second affine conversion unit  159 , and a fourth multiplexer  160 . The controller  165  generates the selective control signal of the third multiplexer  157  and the fourth multiplexer  160 . 
         [0080]    The second inverse affine conversion unit  156  obtains the inverse substitution box S 2   −1  of the input value. The detailed operations of the first inverse affine conversion unit  146  are represented in EQUATION 3. 
         [0000]      B[0]=A[3] xor A[4] 
         [0000]      B[1]=A[2] xor A[5] xor A[6] 
         [0000]      B[2]=A[4] xor A[6] xor A[7] xor ‘1 
         [0000]      B[3]=A[0] xor A[1] xor A[2] xor A[6] xor A[7] xor ‘1’ 
         [0000]      B[4]=A[0] xor A[1] xor A[2] xor A[4] xor A[5] 
         [0000]      B[5]=A[1] xor A[2] xor A[4] xor A[6] xor A[7] xor ‘1’ 
         [0000]      B[6]=A[0] xor A[2] xor A[3] xor A[4] xor A[5] xor A[7] 
         [0000]      B[7]=A[0] xor A[3] xor A[6] xor A[7]  [EQUATION 3] 
         [0081]    The third multiplexer  157  receives the input value and the resultant value of the second inverse affine conversion unit  156  to determine the input value of the finite field inverse operation unit  158  and to provide the determined input value. 
         [0082]    The finite field inverse operation unit  158  calculates GF(2 8 ) inverse for the input value and/or the resultant value of the first inverse affine conversion unit  146  and performs finite field inverse operation logic for m(x)=x 8 +x 4 +x 3 +x+1 that is the irreducible polynomial adopted by the block encryption ARIA algorithm. The resultant value of the finite field inverse operation unit  158  is input to the second affine conversion unit  159  and the fourth multiplexer  160 . 
         [0083]    The second affine conversion unit  159  obtains the substitution box S 1  of the resultant value of the finite field inverse operation unit  158  and provides the resultant value to the fourth multiplexer  160 . The detailed operations of the second affine conversion unit  159  for obtaining the substitution box S 1  are represented in EQUATION 4. 
         [0000]      B[0]=A[1] xor A[3] xor A[5] xor A[6] xor A[7] 
         [0000]      B[1]=A[2] xor A[3] xor A[4] xor A[5] xor A[6] xor A[7] xor ‘1’ 
         [0000]      B[2]=A[0] xor A[1] xor A[2] xor A[4] xor A[5] xor A[7] 
         [0000]      B[3]=A[0] xor A[1] xor A[6] xor A[7] 
         [0000]      B[4]=A[1] xor A[6] xor A[7] 
         [0000]      B[5]=A[0] xor A[1] xor A[4] xor A[5] xor A[6] xor ‘1’ 
         [0000]      B[6]=A[1] xor A[2] xor A[6] xor A[7] xor ‘1’ 
         [0000]      B[7]=A[0] xor A[1] xor A[2] xor A[3] xor A[5] xor A[6] xor ‘1’  [EQUATION 4] 
         [0084]    The fourth multiplexer  160  receives the resultant value of the second affine conversion unit  159  and the resultant value of the finite field inverse operation unit  158  to select one of the resultant value of the second affine conversion unit  159  and the resultant value of the finite field inverse operation unit  158  as the resultant value of the second Sbox operation unit  155  and to output the resultant value. 
         [0085]      FIG. 9  is a block diagram of the finite field inverse operation unit illustrated in  FIGS. 7 and 8 . 
         [0086]    The finite field inverse operation units  148  and  158  include a Map(x) function unit  501 , first and second squarers  503  and  505 , a first multiplier  507 , a first adder  509 , a constant multiplier  511 , a second adder  513 , a third adder  515 , an inverse unit  517 , a second multiplier  518 , a third multiplier  519 , and a Map −1 (x) function unit  521 . 
         [0087]    The Map(x) function unit  501  operates the input value using a GF(2 4 ) isomorphic mapping function and uses the following EQUATION 5. 
         [0000]    
       
         
           
             
               
                 
                   M 
                   = 
                   
                     [ 
                     
                       
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                     
                     ] 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                      
                     
                         
                     
                      
                     5 
                   
                   ] 
                 
               
             
           
         
       
     
         [0088]    The first and second squarers  503  and  505  perform the square operation in GF(2 4 ), that is, squares the output value of the Map(x) function unit  501 . 
         [0089]    The first multiplier  507  receives the output value of the Map(x) function unit  501  to perform a multiplication operation in GF(2 4 ). 
         [0090]    The first adder  509  receives the output value of the Map(x) function unit  501  to perform an addition operation in GF(2 4 ). At this time, the addition operation is an XOR operation. 
         [0091]    The constant multiplier  511  receives the output value of the first squarer  503  to perform a multiplication operation on the constant {e} in GF(2 4 ). 
         [0092]    The second adder  513  receives the output value of the constant multiplier  511  and the output value from the second squarer  505  to perform an XOR operation. 
         [0093]    The third adder  515  receives the output value of the second adder  513  and the output value of the first multiplier  507  to perform an XOR operation. 
         [0094]    The inverse unit  517  receives the output value from the third adder  515  to perform an inverse operation in GF(2 4 ). 
         [0095]    The second multiplier  518  receives the resultant value of the Map(x) function unit  501  and the resultant value from the inverse unit  517  to perform a multiplication operation. The third multiplier  519  receives the resultant value of the first adder  509  and the resultant value of the inverse unit  517  to perform a multiplication operation. 
         [0096]    The resultant values of the second multiplier  518  and the third multiplier  519  are input to the Map −1 (x) function unit  521  to be operated by the GF(2 4 ) 2  isomorphic mapping function. The Map −1 (x) function unit  521  performs an operation using the matrix of EQUATION 6. 
         [0000]    
       
         
           
             
               
                 
                   
                     M 
                     
                       - 
                       1 
                     
                   
                   = 
                   
                     [ 
                     
                       
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                       
                       
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                       
                         
                           0 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                         
                           1 
                         
                         
                           0 
                         
                         
                           1 
                         
                       
                     
                     ] 
                   
                 
               
               
                 
                   [ 
                   
                     EQUATION 
                      
                     
                         
                     
                      
                     6 
                   
                   ] 
                 
               
             
           
         
       
     
         [0097]    On the other hand, in the elements of the finite field inverse operation units  148  and  158 , the Map −1 (x) function unit  521  can be united with the first and second affine conversion units  149  and  159  and the Map(x) function unit  501  can be united with the first Sbox operation unit  145  and the second Sbox operation unit  155 . Therefore, the Map −1 (x) function unit  521  and the first affine conversion unit  149  are united to form a first unification unit, the Map(x) function unit  501  and the first inverse affine conversion unit  146  are united to form a second unification unit, the Map −1 (x) function unit  521  and the second affine conversion unit  159  are united to form a third unification unit, and the Map(x) function unit  501  and the second inverse affine conversion unit  156  are united to form a fourth unification unit. 
         [0098]    The operations performed by the first to fourth unification units can be illustrated in  FIGS. 10 to 13 . 
         [0099]      FIG. 14  is a block diagram illustrating that sub-pipelined registers are displayed on the round units that operate substitution boxes S 1  and S 2  among the fourth to 11th round units of  FIG. 1 . 
         [0100]    In the round unit of  FIG. 14 , the positions of the sub-pipelined registers are illustrated so that the positions of the sub-pipelined registers are divided into two stages, three stages, and four stages. 
         [0101]    In the case of the two-stage sub-pipelined register, the sub-pipelined register is provided after the inverse unit  617  of GF(2 4 ). 
         [0102]    In the case of the three-stage sub-pipelined register, the first sub-pipelined register is provided before the inverse unit  617  of GF(2 4 ) and the second sub-pipelined register is provided before the first unification unit or the third unification unit  622 . Here, the first unification unit or the third unification unit  622  is displayed as the first unification unit when the Map −1 (x) function unit and the first affine conversion unit  149  are united and is displayed as the third unification unit when the Map −1 (x) function unit and the second affine conversion unit  159  are united. 
         [0103]    In the case of the four-stage sub-pipelined register, the first sub-pipelined register is provided before the constant multiplier  611  that performs the multiplication operation for the constant {e} in GF(2 4 ), the second sub-pipelined register is provided after the inverse unit  617  of GF(2 4 ), and the third sub-pipelined register is provided before the diffusion unit  280 . 
         [0104]    The sub-pipelined registers are provided so that delay times are the same and that the performance of the operation logic is improved. 
         [0105]      FIG. 15  is a block diagram illustrating that sub-pipelined registers are displayed on the round units that operate inverse substitution boxes S 1   −1  and S 2   −1  among the fourth to 11th round units of  FIG. 1 . 
         [0106]    In the round units of the present embodiment, the positions of the sub-pipelined registers are divided into two stages, three stages, and four stages. 
         [0107]    In the case of the two-stage sub-pipelined register, the sub-pipelined register is provided after the inverse unit  717  of GF(2 4 ). 
         [0108]    In the case of the three-stage sub-pipelined register, the first sub-pipelined register is provided before the inverse unit  717  of GF(2 4 ) and the second sub-pipelined register is provided before the Map −1 (x) function unit  722 . 
         [0109]    In the case of the four-stage sub-pipelined register, the first sub-pipelined register is provided before the constant multiplier  711  that performs the multiplication operation for the constant {e} in GF(2 4 ), the second sub-pipelined register is provided after the inverse unit  717  of GF(2 4 ), and the third sub-pipelined register is provided before the diffusion unit  380 . 
         [0110]    In  FIG. 15 , the second unification unit or the fourth unification unit is displayed as the second unification unit when the Map(x) function unit and the first inverse affine conversion unit  146  are united and is displayed as the fourth unification unit when the Map(x) function unit and the second inverse affine conversion unit  156  are united. 
         [0111]      FIG. 16  is a block diagram illustrating an embodiment of the diffusion unit of  FIGS. 2 to 4 . 
         [0112]    The diffusion units  180 ,  280 , and  380  performs an operation on A of 16 bytes that is an input value to output C of 16 bytes that is an output value. Here, the input value A consists of A0 to A15 each of which means one byte. A0 means the uppermost byte and A15 means the lowermost byte. The output value C consists of C0 to C15 each of which means one byte. C0 means the uppermost byte and C15 means the lowermost byte. B0, B1, B2, and B3 mean the intermediate calculation values of one byte. 
         [0113]    The diffusion operation processes of the diffusion units  180 ,  280 , and  380  are represented in EQUATIONs 7A to 7D 
         [0000]      B0=A3 xor A4 xor A9 xor A14 
         [0000]      C0=B0 xor A6 xor A8 xor A13 
         [0000]      C5=B0 xor A1 xor A10 xor A15 
         [0000]      C11=B0 xor A2 xor A7 xor A12 
         [0000]      C14=B0 xor A0 xor A5 xor A11   [EQUATION 7A] 
         [0000]      B1=A2 xor A5 xor A8 xor A15 
         [0000]      C1=B1 xor A7 xor A9 xor A12 
         [0000]      C4=B1 xor A0 xor A11 xor A14 
         [0000]      C1=B1 xor A3 xor A6 xor A13 
         [0000]      C15=B1 xor A1 xor A4 xor A10   [EQUATION 7B] 
         [0000]      B2=A1 xor A6 xor A11 xor A12 
         [0000]      C2=B2 xor A4 xor A10 xor A15 
         [0000]      C7=B2 xor A3 xor A8 xor A13 
         [0000]      C9=B2 xor A0 xor A5 xor A14 
         [0000]      C12=B2 xor A2 xor A7 xor A9   [EQUATION 7C] 
         [0000]      B3=A3 xor A4 xor A9 xor A14 
         [0000]      C0=B0 xor A6 xor A8 xor A13 
         [0000]      C5=B0 xor A1 xor A10 xor A15 
         [0000]      C11=B0 xor A2 xor A7 xor A12 
         [0000]      C14=B0 xor A1 xor A5 xor A11   [EQUATION 7D] 
         [0114]    When the diffusion units  180 ,  280 , and  380  are formed as described above, the diffusion units  180 ,  280 , and  380  can be formed of 20 XOR units of 4 bytes. Therefore, it is possible to reduce the size of the hardware of the ARIA encryption apparatus in comparison with the case in which the diffusion units are formed of 16 XOR units of 7 bytes in a conventional art. 
         [0115]    Although embodiments of the present invention have been described with reference to drawings, these are merely illustrative, and those skilled in the art will understand that various modifications and equivalent other embodiments of the present invention are possible. Consequently, the true technical protective scope of the present invention must be determined based on the technical spirit of the appended claims.