2. Overview¶
2.1. Overview¶
CIPHER isJingshi Intelligentnumbermediaprocessingplatformprovidesecurityalgorithmmodule, provides symmetric encryption/decryption algorithms including AES/DES/SM4, Asymmetric Encryption/Decryption Algorithms RSA(Note SW), Random Number Generation, anddigest algorithmpacketinsertHASH, HMAC, mainneed toused to audiovideobitstreamperform encryption/decryptionprotection, authenticationuservalidnessetc.scene, eachfunctiondivideas follows:
Symmetric Encryption Algorithms
AES: supports ECB/CBC/CTR/ CCM/GCM (Note SW)etc.operating mode, where CCM/GCM modeunder, encryption/decryptionendafterneed togetonetime TAG value.
DES: supports ECB/CBC/CTR/ CFB/OFB (Note SW)etc.operating mode, where CFB and OFB modesupportbit widthcan is1/8/64
SM4: supports ECB/CBC/CTRetc.operating mode
withonalgorithmexcept CTR/ CCM/GCM, itsitalgorithm, modedatalengthmustpressblock sizealignment; CCM/GCM N, A need torely onsoftwarepressstandardtheeachfieldpackagebecomeblock sizealignmentdatablock;
Asymmetric Encryption/Decryption Algorithms
RSA (Note SW): supportkeybit width 1024/2048/3072/4096
RSA keybit width 1024 andwithunderalgorithmisindustryknownnotsecurityalgorithm, shouldprohibituse.
Random Number Generation
RNG: highrategetrandom number
Digest Algorithms
HASH: supports SHA1/SHA2/ SHA512/SM3 (Note SW);
HMAC : supportHMAC1/HMAC224/HMAC256/HMAC384/HMAC512 (Note SW);
SHA1 algorithmsecuritynessrelativelylow, notcanapplicationinreferencewithgenerate"numbersignature"scene, recommenduse SHA2 (256 bitsandwithon) algorithm.
2.2. Usage Flow¶
2.2.1. Single-Packet Data Encryption/Decryption¶
Scenario Description
When physicalmemoryinhasa segmentbitstreamdataneed toperform add/decryptionwhen, getitsphysicaladdressafter, inuserlayercall CIPHER moduleimplementsinglepacketdataadd/decryption.
Workflow
fordataperform symmetric AES/DES/SM4 encryption/decryptionprocessas follows:
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : Get the CIPHER handle. Call the API CVI_UNF_CIPHER_CreateHandle completed.
Step 3 : Configure CIPHER control information, includingkey, initial vector, encryption algorithm, operating modeetc.information. Call the APICVI_UNF_CIPHER_ConfigHandle orCVI_UNF_CIPHER_ConfigHandleEx completed.
Step 4 : Encrypt/decrypt data. callwithunderany oneconnectportperform encryption/decryption.
Single-packet encryption, CVI_UNF_CIPHER_Encrypt
Single-packet decryption, CVI_UNF_CIPHER_Decrypt
Step 5 : If use CCM, GCM (Note SW)mode, Call the APICVI_UNF_CIPHER_GetTagTAG value retrieval.
Step 6 : Destroy the CIPHER handle. Call the API CVI_UNF_CIPHER_DestroyHandle completed.
Step 7 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.2. Multi-Packet Data Encryption/Decryption¶
Scenario Description
When physicalmemoryinhasmultiplesegmentbitstreamdataneed toperform add/decryptionwhen, getitsphysicaladdressafter, inuserlayercall CIPHER moduleimplementmultiplepacketdataadd/decryption.
Workflow
fordataperform symmetric AES/DES/SM4 encryption/decryptionprocessas follows:
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : Get the CIPHER handle. Call the API CVI_UNF_CIPHER_CreateHandle completed.
Step 3 : Configure CIPHER control information, includingkey, initial vector, encryption algorithm, operating modeetc.information. Call the API CVI_UNF_CIPHER_ConfigHandle or CVI_UNF_CIPHER_ConfigHandleEx completed.
Step 4 : Encrypt/decrypt data. callwithunderany oneconnectportperform encryption/decryption.
Multi-packet encryption, CVI_UNF_CIPHER_EncryptMulti
Multi-packet decryption, CVI_UNF_CIPHER_DecryptMulti
Step 5 : Destroy the CIPHER handle. Call the API CVI_UNF_CIPHER_DestroyHandle completed.
Step 6 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.3. HASH Calculation¶
Scenario Description
calculatedataHASHvalue, can selectSHA1/SHA2/ SHA512/SM3 (Note SW)
Workflow
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : Get HASHhandle, selectHASHalgorithm. Call the API CVI_UNF_CIPHER_HashInit completed.
Step 3 : inputdata, one by onedatablocks sequentiallycalculate HASH value. Call the API CVI_UNF_CIPHER_HashUpdate completed.
Step 4 : If digestunusedcalculatecomplete, thentimeexecutestep 3.
Step 5 : Complete the digest calculation, end input, and obtain the result.Call the API CVI_UNF_CIPHER_HashFinal completed.
Step 6 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.4. HMAC Calculation (NOTE SW)¶
Scenario Description
based onHASHalgorithm, calculatedataHMACvalue.
Workflow
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : Get HASHhandle, selectHASHalgorithmandconfigureHMAC Calculationkey,Call the API CVI_UNF_CIPHER_HashInitcompleted.
Step 3 : inputdata, one by onedatablocks sequentiallycalculate HMAC value. Call the API CVI_UNF_CIPHER_HashUpdate completed.
Step 4 : If digestunusedcalculatecomplete, thentimeexecutestep 3.
Step 5 : completedigestcalculate, endinput, GetHMAC Calculationresult. Call the API CVI_UNF_CIPHER_HashFinal completed.
Step 6 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.5. Generate Random Numbers¶
Scenario Description
Obtain true random numbers generated by the hardware
Workflow
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : Get 256bitsrandom number, Call the API CVI_UNF_CIPHER_GetRandomNumbercompleted.
Step 3 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.6. RSA Encryption/Decryption Procedure (NOTE SW)¶
Scenario Description
Perform RSA notsymmetricalgorithmencryption/decryption. usepublic keyencryptiondata, mustuseprivate keyperform decryption. conversely, useprivate keyencryptiondata, mustusepublic keydecryption.
Workflow
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : fordataperform encryption/decryptionorsignatureverification. according tousekeynotsame, callwithunderany oneconnectportperform encryption/decryption, signatureverification, generatekeyforetc..
public keyencryption : CVI_UNF_CIPHER_RsaPublicEncrypt
private keydecryption : CVI_UNF_CIPHER_RsaPrivateDec
private keyencryption : CVI_UNF_CIPHER_RsaPrivateEnc
public keydecryption : CVI_UNF_CIPHER_RsaPublicDec
private keysignature : CVI_UNF_CIPHER_RsaSign
public keyverification : CVI_UNF_CIPHER_RsaVerify
Step 3 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions
2.2.7. RSA Signing and Signature Verification Procedure¶
Scenario Description
Perform RSA signatureandsignature verificationwhen, useprivate keyperform datasignature, useperform datasignature verification.
Workflow
Step 1 : CIPHERdevice initialization. Call the API CVI_UNF_CIPHER_Init completed.
Step 2 : fordataperform signatureverification.
private keysignature : CVI_UNF_CIPHER_RsaSign
public keyverification : CVI_UNF_CIPHER_RsaVerify
Step 3 : Close the CIPHER device.Call the API CVI_UNF_CIPHER_Deinit completed.
Precautions