分组密码中的 SWAPMOVE 函数是什么？
我在下面看到了一个名为“SWAPMOVE”的函数。
SWAPMOVE(A,B,M,n):
T = (B ^ (A >> n)) & M
B = B ^ T
A = A ^ (T << n)
而且我不知道这个功能实际上是做什么的。
它似乎计算一些分组密码的线性层，但我无法理解使用这个函数的整个步骤。
那么，这个函数实际上是做什么的呢？
这是我看到的研究论文：Alexandre Adomnicai、Zakaria Najm 和 Thomas Peyrin。修复切片：一种新的 GIFT 表示：ARM Cortex-M 上 GIFT 和 GIFT-COFB 的快速恒定时间实现。 IACR Transactions on Cryptographic Hardware and Embedded Systems, 2020(3):402–427, Jun. 2020。
参见本文第 15~16p。
I saw a function called 'SWAPMOVE' below.
SWAPMOVE(A,B,M,n):
T = (B ^ (A >> n)) & M
B = B ^ T
A = A ^ (T << n)
And I don't know what does this function actually do.
It seems to calculate the linear layer of some block ciphers, but I can't understand the entire steps using this function.
So, what does this function actually do?
This is the research paper I saw: Alexandre Adomnicai, Zakaria Najm, and Thomas Peyrin. Fixslicing: A New GIFT Representation: Fast Constant-Time Implementations of GIFT and GIFT-COFB on ARM Cortex-M. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2020(3):402–427, Jun. 2020.
Look up 15~16p of this paper.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
让我们更详细地看看这个。
假设我们没有
M，它是一个掩码。在这种情况下，B = B ^ T将等同于B = B ^ B ^ (A >>> n)。这本身就相当于B = A >>> n。那么最后一行相当于A = A ^ B ^ ((A >> n) << n)，其中B是我们原来的 B <代码>(A >> n) << n 本质上是清除底部的n位并保留其余的。因此，最后一行将使用Kn的顶部Kn（其中K是字中的总位数）计算B异或。代码>A。因此，这里唯一的区别是我们有一个掩码
M，它调整字T中的位，从而影响哪些位包含在我们的结果值中。如果你多思考一下，应该可以推断出是什么影响了结果，尽管用文字描述有点困难。该函数被认为是线性的，因为它仅包含 XOR、AND 和移位，而这些在 GF(2) 中是线性的。其他在 GF(2) 中呈线性的类似操作包括 CRC。这里无需过多讨论密码学（这不是主题），大多数密码算法都包含线性运算（通常提供廉价的扩散）和非线性运算（以防止使用线性密码分析来轻松解决它们）。如果您想了解有关此函数的加密目的的更多信息，您应该在 Cryptography Stack Exchange 上询问，在那里您会得到比我更有能力的密码学专家的更好的、切题的答复。
Let's look at this in some more detail.
Pretend we didn't have
M, which is a mask. In such a case,B = B ^ Twould be equivalent toB = B ^ B ^ (A >> n). That would itself be equivalent toB = A >> n. Then the last line would be equivalent toA = A ^ B ^ ((A >> n) << n), whereBis our original B.(A >> n) << nessentially clears the bottomnbits and preserves the rest. So this last line would computeBxor'd with the topK-n(whereKis the total number of bits in the word) ofA.So the only difference here is that we have a mask
M, which adjusts the bits in the wordTand therefore affects which bits are included in our resulting values. It should be possible to deduce what affects the results if you think about it a little more, although it's a little more difficult to describe using words.This function is considered linear because it includes only XORs, ANDs, and shifts, and those are linear in GF(2). Other, similar operations which are linear in GF(2) include CRCs. Without going into the cryptography too much here, which isn't on topic, most cryptographic algorithms include linear operations (which often offer cheap diffusion) with non-linear operations (to prevent using linear cryptanalysis to easily solve them). If you want to know more about the cryptographic purposes of this function, you should ask that on Cryptography Stack Exchange, where you'll get a better, on-topic response by someone much more capable in cryptography than I am.
正如论文第6页所述，SWAPMOVE技术
因此目标只是根据掩码 M 和移位在两个输入变量（A 和 B）之间交换一些位索引 n.
As stated in the page 6 of the paper, the SWAPMOVE technique
So the goal is just to swap some bits between two input variables (A and B) according to a mask M and shift index n.