Abstract:
A method of designing an optimum encryption algorithm and an optimized encryption apparatus are disclosed. In the encryption apparatus, a function block produces a first ciphertext of length 2n by encrypting a first plaintext of length 2n with an encryption code of length 4n generated from a key scheduler, and a second ciphertext of length m by encrypting the first ciphertext with a second plaintext of length m under the control of a controller. A memory stores the second ciphertext.

Description:
PRIORITY  
         [0001]    This application claims priority under 35 U.S.C. § 119 to an application entitled “Method of Designing Optimum Encryption Function and Optimized Encryption Apparatus in a Mobile Communication System” filed in the Korean Industrial Property Office on Feb. 5, 2003 and assigned Serial No. 2003-7202, the contents of which are incorporated herein by reference.  
         BACKGROUND OF THE INVENTION  
         [0002]    1. Field of the Invention  
           [0003]    The present invention relates generally to a mobile communication system, and in particular, to a method of designing an optimum encryption function for hardware implementations and an optimized encryption apparatus.  
           [0004]    2. Description of the Related Art  
           [0005]    As the analog first analog communication systems developed into subsequent digital communication systems, mobile subscribers expected stable high-rate data transmissions. Accordingly, service providers have made efforts to satisfy the user demand by presenting more reliable, advanced ciphering methods. The 3 rd  generation communication system, which provides multimedia service (including voice and video data) for a highly sophisticated information-based society, requires standardization of encryption algorithms that ensures the confidentiality, security, and reliability of multimedia signals. The use of 11 encryption algorithms, f0 to f10 is under consideration for implementation in a universal mobile telecommunication system (UMTS). The UMTS is a global system for mobile communication (GSM) core network-based 3 rd  generation system proposed by the 3 rd  generation project partnership (3GPP). Among the encryption algorithms, the 3GPP confidentiality algorithm f8 and the 3GPP integrity algorithm f9 have already been standardized. These two algorithms are based on KASUMI, which is a modified version of the MISTY1 crypto algorithm developed by Mitsubishi Electronic Corporation from Japan.  
           [0006]    The KASUMI is a Feistel block cipher that outputs a 64-bit ciphertext from a 64-bit input plaintext with 8 round operations. Plaintext is defined as cleartext messages that are not encrypted, and ciphertext is defined as text that has been encrypted with an encryption algorithm and key and thus ensures confidentiality.  
           [0007]    [0007]FIG. 1 is a block diagram of a conventional KASUMI hardware. Referring to FIG. 1, the KASUMI encryption block is comprised of a plurality of multiplexers (MUX 1 , MUX 2  and MUX 3 )  101 ,  103 , and  107 , a demultiplexer (DEMUX)  109 , registers (register A 1  and register A 2 )  102  and  104 , a plurality of function blocks (FL 1 , FL 2 , and FO)  106 ,  110  and  108 , a controller  100  for controlling the components of the KASUMI encryption block, and a key scheduler  105  for providing cipher keys.  
           [0008]    An 64-bit plaintext input is divided into two 32-bit strings L 0  and R 0 , which are applied to the input of the MUX  1   100  and the MUX  2   103 , respectively. The MUX 1   101  outputs the 32-bit string L 0  to the register A 1   102  under the control of the controller  100 , and the MUX 2   103  outputs the 32-bit string R 0  to the register A 2   104  under the control of the controller  100 . The register A 1   102  and register A 2   104  temporarily store the 32-bit strings L 0  and R 0  and output them upon receipt of a control signal from the controller  100 .  
           [0009]    The KASUMI encryption block takes different encryption paths depending on whether it is an odd round or an even round. For an odd round, the FL1 block  106  encrypts the bit string L 0  received from the register A 1   102  with first cipher keys KL i,1  and KL i,2  received from the key scheduler  105  and outputs a ciphertext L 01  to the MUX 3   107 . The MUX 3   107  outputs the ciphertext L 01  to the FO block  108  according to a control signal from the controller  100 . The FO block  108  encrypts the 32-bit string L 01  with a second cipher key KI i,j  and a third cipher key KO i,j  received from the key scheduler  105  and outputs a ciphertext L 02  to the DEMUX  109  under the control of the controller  100 . The DMUX  109  outputs the 32-bit string L 02  under the control of the controller  100 . The bit string L 02  is exclusive-ORed with the bit string R 0  from the register A 2   104 , resulting in a ciphertext R 1 . The signal R 1  is fed back to the MUX 2   103 .  
           [0010]    For an even round, the MUX  3   107  feeds the 32-bit string R 0  received from the register A 2   104  to the FO block  108  under the control of the controller  100 . The FO block  108  encrypts the 32-bit string R 0  with the second and third cipher keys KI i,j  and KO i,j  received from the key scheduler  105  and outputs a ciphertext R 01  to the DEMUX  109  under the control of the controller  100 . The DMUX  109  outputs the 32-bit string R 01  to the FL2 block  110  under the control of the controller  100 . The FL2 block  110  encrypts the bit string R 01  with a first cipher key KL i,j  received from the key scheduler  105  and outputs a ciphertext R 02 . The bit string R 02  is exclusive-ORed with the bit string L 0  from the register A 1   102 , resulting in a ciphertext L 1 . The signal L 1  is fed back to the MUX 1   101 . As the round increases, i and j in the cipher keys KL i,j , KI i,j  and KO i,j  are increased.  
           [0011]    The two FL blocks  106  and  110  perform the same cryptographic function in the conventional KASUMI encryption. The redundant use of the function blocks decreases user efficiency of the device and increases power consumption.  
           [0012]    [0012]FIG. 2 depicts the 3GPP confidentiality function f8 with conventional KASUMI computations. Referring to FIG. 2, the confidentiality function f8 stores a plaintext to be transmitted in an input memory  270 . A ciphertext is produced by repeated KASUMI computations on the plaintext and stored in an output memory  280 . A register C  220  temporarily stores the 64-bit input data under the control of a controller  200 . BLKCNT denotes a block counter for processing the input 64-bit data, CK denotes a 128-bit cipher key, and KM denotes a key modifier, which is a 128-bit constant. Each KASUMI can encrypt a maximum of 5114 bits, which is equivalent to 80 rounds. The controller  200  controls the input and output memories  260  and  280  by control signals. The control signals include an address signal for assigning an address to the memories  260  and  280 , an enable/disable signal for enabling/disabling them, a read/write signal for reading/writing stored data or ciphertext, and a data signal for storing a data unit at an assigned address. Thus, the memories  260  and  280  store or output data units at or from assigned addresses.  
           [0013]    A KASUMI encryption block  230  encrypts the initial input 64-bit data string with the exclusive-OR of a 128-bit CK and a 128-bit KM (CKOKM) and outputs an initial ciphertext K 00 . The register C  220  temporarily stores the signal K 00  and outputs it under the control of an encryption block controller (not shown). The signal K 00  is exclusive-ORed with a block count value 0 (BLKCNT  0 ) and applied to the input of a KASUMI encryption block  230 . The KASUMI encryption block  230  encrypts the received signal with a CK and outputs a ciphertext K 01 . At the same time, the controller  200  reads a plaintext D 1  from the first address in the input memory  270 . The signals K 01  and D 1  are exclusive-ORed to a ciphertext K 1 . The output memory  280  stores the final ciphertext K 1  at its first address under the control of the controller  280 . The f8 function repeats this encryption according to the length of plaintext.  
           [0014]    In the f8 function as described above, the controller  200  reads a plaintext from each address in the input memory  270 , encrypts it with the output of a KASUMI encryption block, and stores the resulting ciphertext in the output memory  280 . The use of the separate input and output memories leads to inefficient hardware implementation of the f8 function and increases power consumption.  
         SUMMARY OF THE INVENTION  
         [0015]    It is, therefore, an object of the present invention to provide an encryption apparatus for dividing an input plaintext bit sting of length 2n to first and second sub-bit strings of length n and outputting a ciphertext bit string of length 2n after encrypting them.  
           [0016]    It is another object of the present invention to provide an encryption method for dividing an input plaintext bit sting of length 2n to first and second sub-bit strings of length n and outputting a ciphertext bit string of length 2n after encrypting them.  
           [0017]    It is a further object of the present invention to provide an encryption apparatus for outputting a first ciphertext bit string of length n by encrypting a first plaintext bit string of length 2n in a first encryption and outputting a second ciphertext bit string of length m by encrypting a second plaintext bit string of length 2m in a second encryption.  
           [0018]    It is still another object of the present invention to provide an encryption apparatus for outputting a first ciphertext bit string of length n by encrypting a first plaintext bit string of length 2n in a first encryption and outputting a second ciphertext bit string of length m by encrypting a second plaintext bit string of length 2m in a second encryption.  
           [0019]    According to one aspect of the present invention, in an encryption apparatus for dividing a plaintext of length 2n into first and second sub-bit strings of length n and producing a ciphertext of length 2n by encrypting the first and second sub-bit strings, a first function block produces a first ciphertext of length n by encrypting the first sub-bit string with first encryption codes KL 1,1  and KL 1,2 , or a third ciphertext of length n by encrypting the second sub-bit string with the first encryption codes KL 1,1  and KL 1,2 . A second function block produces a fourth ciphertext of length n by encrypting the first ciphertext with second encryption codes KO 1,1 , KO 1,2  and KO 1,3 , or the second ciphertext by encrypting the first sub-bit string with the second encryption codes KO 1,1 , KO 1,2  and KO 1,3  and third encryption codes KI 1,1 , KI 1,2  and KI 1,3 . A key scheduler provides the first encryption codes KL 1,1  and KL 1,2 , the second encryption codes KO 1,1 , KO 1,2  and KO 1,3 , and the third encryption codes KI 1,1 , KI 1,2  and KI 1,3  to the first and second function blocks. Here, the encryption codes are of length n. A controller controls a plurality of multiplexers to feed the first sub-bit string to the first or second function block and controls the first and second function blocks to encrypt the received sub-bit string with the first encryption codes KL 1,1  and KL 1,2 , the second encryption codes KO 1,1 , KO 1,2  and KO 1,3 , and the third encryption codes KI 1,1 , KI 1,2  and KI 1,3 .  
           [0020]    According to another aspect of the present invention, in an encryption method for dividing a plaintext of length 2n into first and second sub-bit strings of length n and producing a ciphertext of length 2n by encrypting the first and second sub-bit strings, a first ciphertext of length n is produced by encrypting the first sub-bit string with first encryption codes KL 1,1  and KL 1,2 . A fourth ciphertext of length n is produced by encrypting the first ciphertext with second encryption codes KO 1,1 , KO 1,2  and KO 1,3 , and the third encryption codes KI 1,1 , KI 1,2  and KI 1,3 . A fifth ciphertext is produced by exclusive-ORing the fourth ciphertext with the second sub-bit string. A second ciphertext of length n is produced by encrypting the first sub-bit string with the second encryption codes KO 1,1 , KO 1,2  and KO 1,3 , and the third encryption codes KI 1,1 , KI 1,2  and KI 1,3 . A third ciphertext of length n is produced by encrypting the second ciphertext with the first encryption codes KL 1,1  and KL 1,2 . A sixth ciphertext is then produced by exclusive-ORing the third ciphertext with the second sub-bit string.  
           [0021]    According to a further aspect of the present invention, in an encryption apparatus, a function block produces a first ciphertext of length 2n by encrypting a first plaintext of length 2n with an encryption code of length 4n generated from a key scheduler, and a second ciphertext of length m by encrypting the first ciphertext with a second plaintext of length m under the control of a controller. The key scheduler generates the encryption code. A memory outputs the second plaintext and stores the second ciphertext under the control of the controller. The controller reads the second plaintext from the memory and stores the second ciphertext in the memory.  
           [0022]    According to still another aspect of the present invention, in an encryption method, a first ciphertext of 2n is produced by encrypting a first plaintext of length 2n with an encryption code of length 4n. A second ciphertext of length m is then produced by encrypting the first ciphertext with a second plaintext of length m, and stored in a memory. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0023]    The above and other objects, features and advantages of the embodiments of the present invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which:  
         [0024]    [0024]FIG. 1 is a block diagram of a conventional KASUMI hardware;  
         [0025]    [0025]FIG. 2 illustrates a conventional encryption algorithm with conventional KASUMI operations;  
         [0026]    [0026]FIG. 3 illustrates a KASUMI encryption algorithm to which an embodiment of the present invention is applied;  
         [0027]    [0027]FIG. 4 illustrates the detailed structure of an FL function block illustrated in FIG. 3;  
         [0028]    [0028]FIG. 5 illustrates the detailed structure of an FO function block illustrated in FIG. 3;  
         [0029]    [0029]FIG. 6 illustrates the detailed structure of an FI sub-function block illustrated in FIG. 5;  
         [0030]    [0030]FIG. 7 is a block diagram of a KASUMI hardware according to an embodiment of the present invention; and  
         [0031]    [0031]FIG. 8 illustrates a conventional encryption algorithm with KASUMI operations according to an embodiment of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0032]    Various embodiments of the present invention will be described herein below with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.  
         [0033]    [0033]FIG. 3 illustrates a KASUMI encryption algorithm to which the present invention is applied. Referring to FIG. 3, the KASUMI encryption algorithm is a Feistel block cipher that outputs a 64-bit ciphertext from a 64-bit input plaintext through 8 round operations. The Feistel structure refers to an encryption system that divides a 2n-bit input string into two n-bit strings L 0  and R 0  and encrypts/decrypts them in their respective function blocks for m rounds. Since full diffusion is achieved after 2 rounds in the Feistel structure, fast encryption is possible. Specifically, the KASUMI encryption block divides a 64-bit plaintext input into two 32-bit strings L 0  and R 0  and outputs a 64-bit ciphertext by encrypting them with cipher keys KI i  (1≦i≦8), KL i  (1≦i≦8), and KO i  (1≦i≦8) generated from a key scheduler (not shown) in FLi and FOi function blocks (1≦i≦8).  
         [0034]    For an odd round, an FL1 function block  310  encrypts the 32-bit string L 0  with a first cipher key KL 1  and outputs a ciphertext L 01 . An FO1 function block  410  encrypts the bit string L 01  with a second cipher key KO 1  and a third cipher key KI 1  and outputs a 32-bit string L 02 . The signal L 02  is exclusive-ORed with the 32-bit string R 0 , resulting in a ciphertext R 1 .  
         [0035]    For an even round (i.e., a second round), an FO2 function block  420  encrypts the 32-bit string R 1  (=L 1 ) with a second cipher key KO 2  and a third cipher key KI 2  and outputs a ciphertext L 11 . An FL2 function block  320  encrypts the bit string L 11  with a first cipher key KL 2  and outputs a ciphertext L 12 . The signal L 12  is exclusive-ORed with the initial input bit string L 0 , resulting in a ciphertext R 2 . The remaining rounds are performed in an identical manner, using the appropriate function blocks and cipher keys, as sown in FIG. 3. In this manner, the KASUMI produces a final 64-bit ciphertext from the input of a 64-bit plaintext after 8 rounds.  
         [0036]    [0036]FIG. 4 illustrates the detailed structure of the FL function blocks illustrated in FIG. 3. Referring to FIG. 4, the FL1 function block  310  is taken by way of example. The FL1 function block  310  is comprised of a plurality of an AND gate  301 , shift registers  302  and  304 , and an OR gate  303 . A 32-bit input string is divided into two 16-bit strings L 0  and R 0 . The AND gate  301  AND-operates the 16-bit string L 0  with a 16-bit sub-cipher key KL 1,1  and outputs a 16-bit string AL 1 . The shift register  302  shifts the signal AL 1  to the left by one bit and outputs a signal SAL 1 . The 16-bit strings SAL 1  and R 0  are exclusive-ORed, resulting in a sub-ciphertext R 1 . The OR gate  303  OR-operates the signal R 1  with a sub-cipher key KL 1,2  and outputs a 16-bit string OR 1 . The shift register  304  shifts the signal OR 1  to the left by one bit and outputs a signal SOR 1 . The signals SOR 1  and L 0  are exclusive-ORed, resulting in a sub-ciphertext L 1 . Thus, the FL1 function block  310  produces the 32-bit ciphertext L 1 //R 1  (=L 01  in FIG. 3) by the sub-ciphertexts R 1  and L 1 .  
         [0037]    [0037]FIG. 5 illustrates the detailed structure of the FO function blocks illustrated in FIG. 3. Referring to FIG. 5, the FO1 function block  410  is taken by way of example. The FO1 function block  410  is comprised of a plurality of FI i,j  sub-function blocks (1≦i≦3, 1≦j≦3). An input 32-bit string L 01  in FIG. 3 is divided into two 16-bit strings L 0  and R 0 . For a first round, a signal L 1  is generated by exclusive-ORing the 16-bit string L 0  and a 16-bit sub-cipher key KO 1,1 . An FI 1,1 , sub-function block  401  encrypts the signal L 1  with a 16-bit sub-cipher key KI 1,1  and outputs a signal L 1D . Meanwhile, a delay (D 1 )  411  delays the signal R 0  (=R 1 ) and outputs a delayed signal R 1D  in order to synchronize to the output timing of the signal L 1D .  
         [0038]    For a second round, a signal L 2  is generated by exclusive-ORing the 16-bit string R 1D  with a 16-bit sub-cipher key KO 1,2 . An FI 1,2  sub-function block  403  encrypts the signal L 2  with a 16-bit sub-cipher key KI 1,2  and outputs a signal L 2D . Meanwhile, a signal R 2  is generated by exclusive-ORing the signals R 1D  and L 1D . A delay (D 2 )  412  delays the signal R 2  and outputs a delayed signal R 2D  in order to synchronize to the output timing of the signal L 2D .  
         [0039]    For a third round, a signal L 3  is generated by exclusive-ORing the 16-bit string R 2D  with a 16-bit sub-cipher key KO 1,3 . An FI 1,3  sub-function block  405  encrypts the signal L 3  with a 16-bit sub-cipher key KI 1,3  and outputs a signal L 3D . Meanwhile, a signal R 3  is generated by exclusive-ORing the signals R 2D  and L 2D . A delay (D 3 )  413  delays the signal R 3  and outputs a delayed signal R 3D  in order to synchronize to the output timing of the signal L 3D . A signal R 4  is generated by exclusive-ORing the signals L 3D  and R 3D . A final 32-bit ciphertext L 4 //R 4  (=L 02  in FIG. 3) is produced from the 16-bit strings R 4  and R 3D  (=L 4 ).  
         [0040]    [0040]FIG. 6 illustrates the detailed structure of the FI sub-function blocks illustrated in FIG. 5. The FL 1,1  sub-function block is taken by way of example.  
         [0041]    Referring to FIG. 6, a 16-bit input signal (L 1  in FIG. 5) is divided into a 9-bit string RL 0  and a 7-bit string RR 0 . An SBox91 (S91) operator  610  generates a 9-bit string y0, y1, . . . , y8 from the input signal RL 0  by  
           y 0= x 0 x 2⊕ x 3⊕ x 2 x 5⊕ x 5 x 6⊕ x 0 x 7⊕ x 1 x 7⊕ x 2 x 7⊕ x 4 x 8⊕ x 5 x 8⊕ x 7 x 8⊕1  
           y 1= x 1⊕ x 0 x 1⊕ x 2 x 3⊕ x 0 x 4⊕ x 1 x 4⊕ x 0 x 5⊕ x 3 x 5⊕ x 6⊕ x 1 x 7⊕ x 2 x 7⊕ x 5 x 8⊕1  
           y 2= x 1⊕ x 0 x 3⊕ x 3 x 4⊕ x 0 x 5⊕ x 2 x 6⊕ x 3 x 6⊕ x 5 x 6⊕ x 4 x 7⊕ x 5 x 7⊕ x 6 x 7⊕ x 8⊕ x 0 x 8⊕1  
           y 3= x 0⊕ x 1 x 2⊕ x 0 x 3⊕ x 2 x 4⊕ x 5⊕ x 0 x 6⊕ x 1 x 6⊕ x 4 x 7⊕ x 0 x 8⊕ x 1 x 8⊕ x 7 x 8  
           y 4= x 0 x 1⊕ x 1 x 3⊕ x 4⊕ x 0 x 5⊕ x 3 x 6⊕ x 0 x 7⊕ x 6 x 7⊕ x 1 x 8⊕ x 2 x 8⊕ x 3 x 8  
           y 5= x 2⊕ x 1 x 4⊕ x 4 x 5⊕ x 0 x 6⊕ x 1 x 6⊕ x 3 x 7⊕ x 4 x 7⊕ x 6 x 7⊕ x 5 x 8⊕ x 6 x 8⊕ x 7 x 8⊕1  
           y 6= x 0⊕ x 2 x 3⊕ x 1 x 5⊕ x 2 x 5⊕ x 4 x 5⊕ x 3 x 6⊕ x 4 x 6⊕ x 5 x 6⊕ x 7⊕ x 1 x 8⊕ x 3 x 8⊕ x 5 x 8⊕ x 7 x 8  
           y 7= x 0 x 1⊕ x 0 x 2⊕ x 1 x 2⊕ x 3⊕ x 0 x 3⊕ x 2 x 3⊕ x 4 x 5⊕ x 2 x 6⊕ x 3 x 6⊕ x 2 x 7⊕ x 5 x 7⊕⊕ x 8⊕1  
           y 8= x 0 x 1⊕ x 2⊕ x 1 x 2⊕ x 3 x 4⊕ x 1 x 5⊕ x 2 x 5⊕ x 1 x 6⊕ x 4 x 6⊕ x 7⊕ x 2 x 8⊕ x 3 x 8  (1)  
         [0042]    A ZE1 unit  620  receives the signal RR 0 , adds two zeroes to the MSB (Most Significant Bit) of the signal RR 0  and outputs a 9-bit string. The outputs of the S91 operator  610  and the ZE1 unit  620  are exclusive-ORed, resulting in a 9-bit string RL 1 . The signal RL 1  is exclusive-ORed with a 9-bit sub-cipher key KI 1,1,2 , resulting in a 9-bit string RL 2 .  
         [0043]    A TR1 unit  630  removes two zero bits from the MSBs of the 9-bit string RL 1 . An SBox71 (S71) operator  640  generates a 7-bit string y0, y1, . . . , y6 from the input signal RR 0  (=RR 1 ) by  
           y 0= x 1 x 3⊕ x 4⊕ x 0 x 1 x 4⊕ x 5⊕ x 2 x 5⊕ x 3 x 4 x 5⊕ x 6⊕ x 0 x 6⊕ x 1 x 6⊕ x 3 x 6⊕ x 2 x 4 x 6⊕ x 1 x 5 x 6⊕ x 4 x 5 x 6  
           y 1= x 0 x 1⊕ x 0 x 4⊕ x 2 x 4⊕ x 5⊕ x 1 x 2 x 5⊕ x 0 x 3 x 5⊕ x 6⊕ x 0 x 2 x 6⊕ x 3 x 6⊕ x 4 x 5 x 6⊕1  
           y 2= x 0⊕ x 0 x 3⊕ x 2 x 3⊕ x 1 x 2 x 4⊕ x 0 x 3 x 4⊕ x 1 x 5⊕ x 0 x 2 x 5⊕ x 0 x 6⊕ x 0 x 1 x 6⊕ x 2 x 6⊕ x 4 x 6⊕1  
           y 3= x 1⊕ x 0 x 1 x 2⊕ x 1 x 4⊕ x 3 x 4⊕ x 0 x 5⊕ x 0 x 1 x 5⊕ x 2 x 3 x 5⊕ x 1 x 4 x 5⊕ x 2 x 6⊕ x 1 x 3 x 6  
           y 4= x 0 x 2⊕ x 3⊕ x 1 x 3⊕ x 1 x 4⊕ x 0 x 1 x 4⊕ x 2 x 3 x 4⊕ x 0 x 5⊕ x 1 x 3 x 5⊕ x 0 x 4 x 5⊕ x 1 x 6⊕ x 3 x 6⊕ x 0 x 3 x 6⊕ x 5 x 6⊕1  
           y 5= x 2⊕ x 0 x 2⊕ x 0 x 3⊕ x 1 x 2 x 3⊕ x 0 x 2 x 4⊕ x 0 x 5⊕ x 2 x 5⊕ x 4 x 5⊕ x 1 x 6⊕ x 1 x 2 x 6⊕ x 0 x 3 x 6⊕ x 3 x 4 x 6⊕ x 2 x 5 x 6⊕1  
           y 6= x 1 x 2⊕ x 0 x 1 x 3⊕ x 0 x 4⊕ x 1 x 5⊕ x 3 x 5⊕ x 6⊕ x 0 x 1 x 6⊕ x 2 x 3 x 6⊕ x 1 x 4 x 6⊕ x 0 x 5 x 6  (2)  
         [0044]    The outputs of the TR 1   630  and the S71 operator  640  are exclusive-ORed with a sub-cipher key KI 1,1,1 , resulting in a 7-bit string RR 2 .  
         [0045]    An SBox92 (S92) operator  650  generates a 9-bit string y0, y1, . . . , y8 from the signal RL 2  by Eq. (1). A ZE2 unit  660  receives the signal RR 1 , adds two zeroes to the MSB of the signal RR 1 , and outputs a 9-bit string. The outputs of the S92 operator  650  and the ZE2 unit  660  are exclusive-ORed, resulting in a 9-bit string RL 3 . A TR2 unit  670  removes two zero bits from the MSBs of the 9-bit string RL 3 . An SBox72 (S72) operator  680  generates a 7-bit string y0, y1, . . . , y6 from the input signal RR 2  (=RR 3 ) by Eq. (2). The outputs of the TR 2   670  and the S72 operator  680  are exclusive-OR-operated, resulting in a 7-bit string RR 4 .  
         [0046]    A final 16-bit ciphertext RL 4 //RR 4  is produced from the 9-bit string RL 3  (=RL 4 ) and the 7-bit string RR 4 .  
         [0047]    [0047]FIG. 7 is a block diagram of a KASUMI hardware according to the present invention. Referring to FIG. 7, the KASUMI encryption block is comprised of a plurality of multiplexers (MUX 1  to MUX 5 )  701 ,  703 ,  706 ,  708  and  710 , registers (register B 1  and register B 2 )  702  and  704 , a plurality of function blocks (FL and FO)  707  and  709 , a controller  700  for controlling the components of the KASUMI encryption block, and a key scheduler  711  for providing cipher keys. The controller  700  takes different encryption paths for an even round and an odd round by controlling the MUXs  701 ,  703 ,  706 ,  708  and  710 .  
         [0048]    For an odd round, a 64-bit plaintext input is divided into two 32-bit strings L 0  and R 0 , which are applied to the input of the MUX  1   701  and the MUX  2   703 , respectively. The MUX 1   701  outputs the 32-bit string L 0  to the register B 1   702  under the control of the controller  700 , and the MUX 2   703  outputs the 32-bit string R 0  to the register B 2   704  under the control of the controller  700 . The register B 1   702  and register B 2   704  temporarily store the 32-bit strings L 0  and R 0  and output them upon receipt of a control signal from the controller  700 . The controller  700  controls the MUXs  706 ,  708  and  710  to take a “zero-path” indicated by solid lines. The MUX 3   706  outputs the signal L 0  to the FL function block  707  via the zero-path. The FL block  707  encrypts the bit string L 0  with a first odd-numbered cipher key KL i,j  (0≦i≦8, 0≦j≦2) received from the key scheduler  711  and outputs a ciphertext L 01  to the MUX 4   708 . The MUX 4   708  outputs the signal L 01  to the FO function block  709  via the zero-path. The FO block  709  encrypts the bit string L 01  with a second odd-numbered cipher key KL i,j  and a third odd-numbered cipher key KO i,j  (0≦i≦8, 0≦j≦3) received from the key scheduler  711  and outputs a ciphertext L 02  to the MUX 5   710 . The MUX 5   710  outputs the signal L 02  via the zero-path. A ciphertext R 1  (=L 1 ) is then produced by exclusive-ORing the signal L 02  with the signal R 0  received from the register B 2   704  and fed back to the MUX 1   701 .  
         [0049]    For an even round, the 32-bit strings R 1  and L 0  are applied to the input of the MUX 1   701  and MUX 2   703 , respectively. The MUX 1   701  outputs the 32-bit string R 1  to the register B 1   702  under the control of the controller  700 , and the MUX 2   703  outputs the 32-bit string L 0  to the register B 2   704  under the control of the controller  700 . The register B 1   702  and register B 2   704  temporarily store the 32-bit strings R 1  and L 0  and output them upon receipt of a control signal from the controller  700 . The controller  700  controls the MUXs  706 ,  708  and  710  to take a “one-path” indicated by dotted lines. The MUX 4   708  receives the signal R 1  under the control of the controller  700  and outputs the signal R 1  to the FO function block  708  via the one-path. The FO block  709  encrypts the bit string R 1  with a second even-numbered cipher key KL i,j  and a third even-numbered cipher key KO i,j  (0≦i≦8, 0≦j≦3) received from the key scheduler  711  and outputs a ciphertext R 11  to the MUX 3   706 . The MUX 3   706  outputs the signal R 11  to the FL function block  707  via the one-path. The FL block  707  encrypts the bit string R 11  with a first odd-numbered cipher key KL i,j  (0≦i≦8, 0≦j≦2) received from the key scheduler  711  and outputs a ciphertext R 12  to the MUX 5   710 . The MUX 5   710  outputs the signal R 12  via the one-path. A ciphertext R 2 (=L 2 ) is then produced by exclusive-ORing the signal R 12  with the signal L 0  received from the register B 2   704  and fed back to the MUX 1   701 .  
         [0050]    As described above, the controller  700  controls the MUXs  706 ,  708  and  710  to take the zero-path for an odd round. Thus, a 32-bit input string is encrypted with a first odd-numbered cipher key KL i,j  in the FL function block  707  and then with a second off-numbered cipher key KL i,j  and a third off-numbered cipher key KO i,j  in the FO function block  709 . For an even round, the controller  700  controls the MUXs  706 ,  708  and  710  to take the one-path. Thus, a 32-bit input string is encrypted with a second off-numbered cipher key KL i,j  and a third off-numbered cipher key KO i,j  and then with a first odd-numbered cipher key KL i,j  in the FL function block  707 .  
         [0051]    Implementation of the KASUMI in hardware using the single FL function block  707  and the single FO function block  709  achieves the same effects as the conventional KASUMI implementation, but reduces the number of components used and power consumption.  
         [0052]    [0052]FIG. 8 depicts the 3GPP confidentiality function f8 with KASUMI computations according to an embodiment of the present invention. A plaintext from a memory  870  is encrypted for a plurality of rounds using a plurality of KASUMI encryption blocks and a final ciphertext is stored in the same memory  870 .  
         [0053]    The confidentiality f8 algorithm is a block cipher for encrypting up to 5114 bits, that is, up to 80-rounds of KASUMI operations. The number of KASUMI encryption rounds varies with the length of the plaintext and is counted by a block counter (BLKCNT). The plurality of KASUMI encryption blocks are shown for the purpose of illustrating feed-back of the ciphertext from one KASUMI encryption block and re-encryption of the ciphertext as a plaintext for rounds. CK denotes a 128-bit cipher key generated from a key scheduler (not shown), and KM denotes a key modifier being a 128-bit constant. A controller  800  controls the memory  870  by control signals. The control signals include an address signal for assigning an address for the plaintext, an enable/disable signal for enabling/disabling the memory  870 , a read/write signal for reading/writing stored data or ciphertext in/from the memory  870 , and a data signal for storing a data unit at an assigned address in the memory  870 .  
         [0054]    A KASUMI encryption block  810  encrypts an initial 64-bit string date input with the exclusive-OR of a 128-bit CK and a 128-bit KM ( CK⊕KM ), received from the key scheduler and outputs an initial ciphertext K 00 . A register D  820  temporarily stores the signal K 00  and outputs it under the control of an encryption block controller (not shown). This is an initial operation for KASUMI encryption.  
         [0055]    For a first KASUMI encryption, the signal K 00  is exclusive-ORed with a block count value 0 (BLKCNT 0) and applied to the input of a KASUMI encryption block  830 . The KASUMI encryption block  830  encrypts the received signal with a CK and outputs a 64-bit ciphertext K 01  ranging from bit  0  to bit  63 . The controller  800  reads a plaintext D 1  from the first address in the memory  870 . The signals K 01  and D 1  are exclusive-ORed to a ciphertext K 1 . The memory  870  stores the first ciphertext K 1  at an address assigned to the plaintext D 1 , that is, the first address under the control of the controller  800 .  
         [0056]    For a second KASUMI encryption, a signal K 10  is generated by exclusive-ORing the signal K 00  with a block count value 1 (BLKCNT 1), and then exclusive-ORed with the signal K 01  received from the KASUMI encryption block  830 , resulting in a signal K 11 . A KASUMI encryption block  840  encrypts the signal K 11  with a CK and outputs a 64-bit ciphertext K 02  ranging from bit  64  to bit  127 . The controller  800  reads a plaintext D 2  from the second address in the memory  870 . The signals K 02  and D 2  are exclusive-ORed to a ciphertext K 2 . The memory  870  stores the second ciphertext K 2  at an address assigned to the plaintext D 2 , that is, the second address under the control of the controller  800 .  
         [0057]    In the f8 function, the block count and the number of KASUMI encryption rounds are determined according to the length of the plaintext. The controller  800  reads the plaintext from an address in the memory  870  and stores a ciphertext at the same address by sharing the memory  870  for reading plaintext and storing ciphertext.  
         [0058]    In accordance with certain embodiments of the present invention, an encryption algorithm is implemented in hardware using a reduced number of devices and sharing a memory for reading plaintext and storing ciphertext. Therefore, the overall power consumption of an encryption apparatus is reduced.  
         [0059]    While the various embodiments of the invention have been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and details can be made therein without departing from the spirit and scope of the invention as defined by the appended claims.