Customizable encryption algorithm based on a sponge construction with authenticated and non-authenticated modes of operation

1. A method for generating encrypted data, comprising:

combining, by an electronic circuit, a cryptographic key with state initialization bits to generate first combination bits, the state initialization bits comprising bits b that have been initialized to pre-defined bit values;

producing a first keystream by performing a permutation function ƒ using the first combination bits as inputs thereto, the permutation function ƒ comprising a round function ƒ round that is iterated R times, the round function ƒ round consisting of

(1) a substitution layer in which the first combination bits are substituted with substitute bits,

(2) a permutation layer in which the substitute bits are re-arranged,

(3) a mixing layer in which at least two outputs of the permutation layer are combined together, and

(4) an addition layer in which a constant is added to the output of the mixing layer; and

using, by the electronic circuit, the first keystream to encrypt first data so as to produce first encrypted data.

2. The method according to claim 1 , further comprising concatenating the cryptographic key with a flag value prior to said combining.

3. The method according to claim 1 , further comprising selecting a multi-bit value for the state initialization bits that is unique for a given application.

4. The method according to claim 1 , further comprising truncating the first keystream to a desired length prior to being used to encrypt the first data.

5. The method according to claim 1 , further comprising padding the first data to make a total number of bits contained therein a multiple of the total number of state initialization bits prior to being encrypted.

6. The method according to claim 1 , wherein the first data is combined with the first keystream using modular arithmetic.

7. The method according to claim 1 , wherein the first data comprises authentication data or message body data.

8. The method according to claim 1 , further comprising:

producing a second keystream by performing the permutation function ƒ using the first keystream as inputs thereto; and

using, by the electronic circuit, the second keystream to encrypt second data so as to produce second encrypted data.

9. A method for generating encrypted data, comprising:

combining, by an electronic circuit, a cryptographic key with state initialization bits to generate first combination bits;

producing a first keystream by performing a permutation function ƒ using the first combination bits as inputs thereto, the permutation function ƒ comprising a round function ƒ round that is iterated R times, the round function ƒ round consisting of

(1) a substitution layer in which the first combination bits are substituted with substitute bits,

(2) a permutation layer in which the substitute bits are re-arranged,

(3) a mixing layer in which at least two outputs of the permutation layer are combined together, and

(4) an addition layer in which a constant is added to the output of the mixing laver; and

using, by the electronic circuit, the first keystream to encrypt first data so as to produce first encrypted data;

wherein the first encrypted data is produced by:

combining the first keystream with authentication data to generate second combination bits;

producing a second keystream by performing the permutation function ƒ using the second combination bits as inputs thereto; and

combining the second keystream with message body data so as to produce the first encrypted data.

10. The method according to claim 9 , further comprising generating an authentication tag by:

combining the second keystream with the message body data to produce third combination bits;

producing a third keystream by performing the permutation function ƒ using the third combination bits as inputs thereto; and

using at least a portion of the third keystream as the authentication tag.

11. A system, comprising:

an electronic circuit

combining a cryptographic key with state initialization bits to generate first combination bits, the state initialization bits comprising bits b that have been initialized to pre-defined bit values,

producing a first keystream by performing a permutation function ƒ using the first combination bits as inputs thereto, and

using the first keystream to encrypt first data so as to produce first encrypted data;

wherein the permutation function ƒ comprises a round function ƒ round that is iterated R times, the round function ƒ round consisting of (1) a substitution layer in which the first combination bits are substituted with substitute bits, (2) a permutation layer in which the substitute bits are re-arranged, (3) a mixing layer in which at least two outputs of the permutation layer are combined together, and (4) an addition layer in which a constant is added to the output of the mixing layer.

12. The system according to claim 11 , wherein the electronic circuit further concatenates the cryptographic key with a flag value prior to said combining.

13. The system according to claim 11 , wherein a multi-bit value for the state initialization bits is selected to be unique for a given application.

14. The system according to claim 11 , wherein the electronic circuit further truncates the first keystream to a desired length prior to being used to encrypt the first data.

15. The system according to claim 11 , wherein the electronic circuit further pads the first data to make a total number of bits contained therein a multiple of the total number of state initialization bits prior to being encrypted.

16. The system according to claim 11 , wherein the first data is combined with the first keystream using modular arithmetic.

17. The system according to claim 11 , wherein the first data comprises authentication data or message body data.

18. The system according to claim 11 , wherein the electronic circuit further:

produces a second keystream by performing the permutation function ƒ using the first keystream as inputs thereto; and

uses the second keystream to encrypt second data so as to produce second encrypted data.

19. A system, comprising:

an electronic circuit

combining a cryptographic key with state initialization bits to generate first combination bits,

producing a first keystream by performing a permutation function ƒ using the first combination bits as inputs thereto, and

using the first keystream to encrypt first data so as to produce first encrypted data;

wherein the permutation function ƒ comprises a round function ƒ round that is iterated R times, the round function ƒ round consisting of (1) a substitution layer in which the first combination bits are substituted with substitute bits, (2) a permutation layer in which the substitute bits are re-arranged, (3) a mixing layer in which at least two outputs of the permutation layer are combined together, and (4) an addition layer in which a constant is added to the output of the mixing layer; and

wherein the first encrypted data is produced by:

combining the first keystream with authentication data to generate second combination bits;

producing a second keystream by performing the permutation function ƒ using the second combination bits as inputs thereto; and

combining the second keystream with message body data so as to produce the first encrypted data.

20. The system according to claim 19 , wherein the electronic circuit further generates an authentication tag by:

combining the second keystream with the message body data to produce third combination bits;

producing a third keystream by performing the permutation function ƒ using the third combination bits as inputs thereto; and

using at least a portion of the third keystream as the authentication tag.