1、raising standards worldwide NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW BSI Standards Publication BS ISO/IEC 29192-3:2012 Information technology Security techniques Lightweight cryptography Part 3: Stream ciphersBS ISO/IEC 29192-3:2012 BRITISH STANDARD National foreword Th
2、is British Standard is the UK implementation of ISO/IEC 29192-3:2012. The UK participation in its preparation was entrusted to Technical Committee IST/33, IT - Security techniques. A list of organizations represented on this committee can be obtained on request to its secretary. This publication doe
3、s not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2012. Published by BSI Standards Limited 2012 ISBN 978 0 580 71685 0 ICS 35.040 Compliance with a British Standard cannot confer immunity from leg
4、al obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2012. Amendments issued since publication Date Text affectedBS ISO/IEC 29192-3:2012Reference number ISO/IEC 29192-3:2012(E) ISO/IEC 2012INTERNATIONAL STANDARD ISO/IEC
5、29192-3 First edition 2012-10-01 Information technology Security techniques Lightweight cryptography Part 3: Stream ciphers Technologies de linformation Techniques de scurit Cryptographie pour environnements contraints Partie 3: Chiffrements flot BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) COPYR
6、IGHT PROTECTED DOCUMENT ISO/IEC 2012 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address be
7、low or ISOs member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org Published in Switzerland ii ISO/IEC 2012 All rights reservedBS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:201
8、2(E) ISO/IEC 2012 All rights reserved iiiContents Page Foreword iv Introduction . v 1 Scope 1 2 Normative reference 1 3 Terms and definitions . 1 4 Symbols and operational terms . 3 5 General models for stream ciphers . 4 5.1 General . 4 5.2 Synchronous Keystream generators 4 5.3 Output functions 4
9、6 Dedicated keystream generators . 5 6.1 Enocoro-128v2 keystream generator 5 6.2 Enocoro-80 keystream generator 10 6.3 Trivium keystream generator . 13 Annex A (normative) Object Identifiers 16 Annex B (informative) Test vectors . 17 Annex C (informative) Guidance on implementation and use 24 Annex
10、D (informative) Feature Table 26 Annex E (informative) Computation over a finite field 27 Bibliography 28 BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) iv ISO/IEC 2012 All rights reservedForeword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical C
11、ommission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity.
12、 ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee,
13、 ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to nat
14、ional bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. ISO/IEC 29192-3 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques. ISO/IEC 29192 consi
15、sts of the following parts, under the general title Information technology Security techniques Lightweight cryptography: Part 1: General Part 2: Block ciphers Part 3: Stream ciphers Part 4: Mechanisms using asymmetric techniques BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) ISO/IEC 2012 All rights
16、 reserved vIntroduction This part of ISO/IEC 29192 specifies keystream generators for lightweight stream ciphers tailored for implementation in constrained environments. ISO/IEC 29192-1 specifies the requirements for lightweight cryptography. A stream cipher is an encryption mechanism that uses a ke
17、ystream generator to generate a keystream to encrypt a plaintext in bitwise or block-wise manner. The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) draw attention to the fact that it is claimed that compliance with this document may involve
18、the use of patents. ISO and IEC take no position concerning the evidence, validity and scope of these patent rights. The holders of these patent rights have assured ISO and IEC that they are willing to negotiate licences under reasonable and non-discriminatory terms and conditions with applicants th
19、roughout the world. In this respect, the statement of the holders of these patent rights are registered with ISO and IEC. Information may be obtained from: Ren-MichaelCordes/ErnstSchobesberger/M Trivium: a lightweight keystream generator with a key size of 80 bits. 2 Normative reference The followin
20、g referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. ISO/IEC 29192-1, Information technology Security techniques L
21、ightweight cryptography Part 1: General 3 Terms and definitions For the purposes of this document, the terms and definitions given in ISO/IEC 29192-1 and the following apply. 3.1 big-endian method of storage of multi-byte numbers with the most significant bytes at the lowest memory addresses ISO/IEC
22、 18033-4:2011 3.2 ciphertext data which has been transformed to hide its information content ISO/IEC 18033-1:2005 3.3 decryption reversal of a corresponding encipherment ISO/IEC 18033-1:2005 BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) 2 ISO/IEC 2012 All rights reserved3.4 encryption (reversible)
23、 transformation of data by a cryptographic algorithm to produce ciphertext, i.e. to hide the information content of the data ISO/IEC 18033-1:2005 3.5 initialization value value used in defining the starting point of an encryption process ISO/IEC 18033-4:2011 3.6 key sequence of symbols that controls
24、 the operation of a cryptographic transformation (e.g. encipherment, decipherment) ISO/IEC 18033-1:2005 3.7 keystream function function that takes as input, the current state of the keystream generator and (optionally) part of the previously generated ciphertext, and gives as output the next part of
25、 the keystream ISO/IEC 18033-4:2011 3.8 keystream generator state-based process (i.e., a finite state machine) that takes as input, a key, an initialization vector, and if necessary the ciphertext, and gives as output a keystream (i.e., a sequence of bits or blocks of bits) of arbitrary length ISO/I
26、EC 18033-4:2011 3.9 next-state function function that takes as input, the current state of the keystream generator and (optionally) part of the previously generated ciphertext, and gives as output a new state for the keystream generator ISO/IEC 18033-4:2011 3.10 plaintext unenciphered information IS
27、O/IEC 18033-1:2005 3.11 secret key key used with symmetric cryptographic techniques by a specified set of entities ISO/IEC 18033-1:2005 3.12 state internal state of a keystream generator BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) ISO/IEC 2012 All rights reserved 34 Symbols and operational terms
28、 0x Prefix for hexadecimal values. 0 (n)n-bit variable where 0 is assigned to every bit. AND Bitwise logical AND operation. a iVariable forming part of the internal state of a keystream generator. b iVariable forming part of the internal state of a keystream generator. C iCiphertext block. Fx The po
29、lynomial ring over the finite field F. GF(2 n ) Finite field of 2 nelements. Init Function which generates the initial internal state of a keystream generator. IV Initialization vector. K Key. Next Next-state function of a keystream generator. n Block length. OR Bitwise logical OR operation. Out Out
30、put function combining keystream and plaintext in order to generate ciphertext. P Plaintext. P iPlaintext block. Strm Keystream function of a keystream generator. S iInternal state of a keystream generator. Z Keystream. Z iKeystream block. x The smallest integer greater than or equal to the real num
31、ber x. x Bitwise complement operation. Polynomial multiplication. | Bit concatenation. + mInteger addition modulo 2 m . Bitwise XOR (eXclusive OR) operation. nt t-bit left shift in an n-bit register. BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) 4 ISO/IEC 2012 All rights reserved nt t-bit right sh
32、ift in an n-bit register. nt t-bit right circular rotation in an n-bit register. Multiplication operation for elements in the finite field GF(2 n ). NOTE An example of operation of multiplication of elements in the finite field GF(2 n ) is given in Annex E. 5 General models for stream ciphers 5.1 Ge
33、neral This clause describes general models for stream ciphers ISO/IEC 18033-4:2011. 5.2 Synchronous Keystream generators A synchronous keystream generator is a finite-state machine. It is defined by: 1. An initialization function, Init, which takes as input a key K and an initialization vector IV, a
34、nd outputs an initial state S 0for the keystream generator. The initialization vector should be chosen so that no two messages are ever encrypted using the same key and the same IV. 2. A next-state function, Next, which takes as input the current state of the keystream generator S i , and outputs th
35、e next state of the keystream generator S i+1 . 3. A keystream function, Strm, which takes as input a state of the keystream generator S i , and outputs a keystream block Z i . When the synchronous keystream generator is first initialized, it will enter an initial state S 0defined by S 0= Init(IV, K
36、). On demand the synchronous keystream generator will for i=0,1,.: 1. Output a keystream block Z i= Strm(S i , K). 2. Update the state of the machine S i+1= Next(S i , K). Therefore to define a synchronous keystream generator it is only necessary to specify the functions Init, Next and Strm, includi
37、ng the lengths and alphabets of the key, the initialization vector, the state, and the output block. 5.3 Output functions 5.3.1 General model of output function This subclause specifies a stream cipher output function, i.e. a technique to be used in a stream cipher to combine a keystream with plaint
38、ext to derive ciphertext. An output function for a synchronous or a self-synchronizing stream cipher is an invertible function Out that combines a plaintext block P i , a keystream block Z ito give a ciphertext block C i(i 0). A general model for a stream cipher output function is now defined. Encry
39、ption of a plaintext block P iby a keystream block Z iis given by: BS ISO/IEC 29192-3:2012 ISO/IEC 29192-3:2012(E) ISO/IEC 2012 All rights reserved 5C i= Out(P i , Z i ), and decryption of a ciphertext block C iby a keystream block Z iis given by: P i= Out -1 (C i , Z i ). The output function shall
40、be such that, for any keystream block Z i , and plaintext block P i , we have P i = Out -1 (Out(P i , Z i ), Z i ). 5.3.2 Binary-additive output function A binary-additive stream cipher is a stream cipher in which the keystream, plaintext, and ciphertext blocks are binary digits, and the operation t
41、o combine plaintext with keystream is bitwise XOR. Let n be the bit length of P i . This function is specified by Out(P i , Z i ) = P i Z i . The operation Out -1is specified by Out 1 (C i , Z i ) = C i Z i . 6 Dedicated keystream generators 6.1 Enocoro-128v2 keystream generator 6.1.1 Introduction t
42、o Enocoro-128v2 Enocoro-128v2 is a keystream generator which uses a 128-bit secret key K, a 64-bit initialization vector IV, and a state variable S i(i 0) consisting of 34 bytes, and outputs a keystream block Z iof one byte at every iteration of the function Strm. NOTE This keystream generator was o
43、riginally proposed in 5. The state variable S iis sub-divided into a 2-byte variable: a (i)= (a 0 (i) , a 1 (i) ), where a j (i)is a byte (for j = 0, 1), and a 32-byte variable: b (i)= (b 0 (i) , b 1 (i) , , b 31 (i) ), where b j (i)is a byte (for j = 0, 1, , 31). The Init function, defined in detai
44、l in 6.1.2, takes as input the 128-bit key K and the 64-bit initializing vector IV, and produces the initial value of the state variable S 0= (a (0) , b (0) ). The Next function, defined in detail in 6.1.3, takes as input the 34-byte state variable S i= (a (i) , b (i) ) and produces as output the ne
45、xt value of the state variable S i+1= (a (i+1) , b (i+1) ). The Strm function, defined in detail in 6.1.4, takes as input the 34-byte state variable S i= (a (i) , b (i) ) and produces as output the keystream block Z i . Enocoro-128v2 uses operations over the finite field GF(2 8 ). In the polynomial representation, GF(2 8 ) is realized as GF(2)x / 8432 (x), where 8432 (x) is an irreducible polynomial of degree 8 defined over GF(2). The Enocoro-128v2 keystream generator uses the following irreducible polynomial:
