JP2010128154A - Hash value generating device, verification device, hash value generating method, verification method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a hash value generating device capable of assuring second preimage resistance and unidirectionality if a compression means has second preimage resistance and unidirectionality. <P>SOLUTION: The hash value generating device comprises: a preprocessing section converting input data X of any length into data Y; a data length adjusting section performing padding to the data Y to output data Z whose data length is a multiple of m-n bits; and a data compression section compressing the data Z by using a compression function to obtain a hash value. The preprocessing section converts the data X into the data Y so that the data Y satisfies the following two conditions: (condition 1) when the data Z is divided into C pieces of m-n bit blocks z[1] to z[C], all blocks z[1] to z[C] include more than μ bits in the data X (μ is a predetermined integer); (condition 2) data X and data Y correspond one-on-one to each other. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a hash value generation device and a hash value generation method for generating a hash value for data on a communication path or a recording medium, and verification for verifying the cryptographic security for a set of data and hash value The present invention relates to an apparatus, a verification method, a program thereof, and a recording medium.

A function for determining a fixed length (hereinafter, n bits) value from arbitrary length data H: {0, 1} ^* → {0, 1} ⁿ
Is called a hash function. However, “{0, 1} ^* ” represents a bit string in which 0 or 1 are arranged in an arbitrary length, and “{0, 1} ⁿ ” represents a bit string in which n 0 or 1 are arranged. A hash function is mainly a method using an iterative method called a Merkle-Damgard configuration (Non-Patent Documents 1 and 2). The hash function H of the Merkle Dungard configuration repeats the compression function h that compresses m-bit data (where m is an integer greater than n) into n-bit data after padding the input data X By using this, an n-bit hash value is obtained for input data of an arbitrary length. A typical compression function includes m = 672 and n = 160 shar1: {0, 1} ^{160 + 512} → {0, 1} ¹⁶⁰
And m = 768, n = 256, sha256: {0, 1} ^{256 + 512} → {0, 1} ²⁵⁶
and so on.

In order for the hash function H to be cryptographically secure, it is necessary to satisfy the three conditions of collision discovery difficulty, second original image discovery difficulty, and unidirectionality. The difficulty of collision detection
H (X) = H (X ′) and X ≠ X ′
It is difficult to find a set of (X, X ′). Since there are 2 ⁿ types of outputs of the hash function H, n is a parameter indicating the degree of collision detection difficulty. Increasing n increases collision detection difficulty. It is known that the collision detection difficulty is half the output length n. The second original image finding difficulty is that for any given X,
H (X) = H (X ′) and X ≠ X ′
It is difficult to find such X ′. Unidirectionality means that it is difficult to find X ′ such that V = H (X ′) for a given V. However, “V is given arbitrarily” means that X is arbitrarily selected,
V ← H (X)
And calculating an arbitrary value of V. “←” means that the calculation result on the right side is the value of the variable on the left side (here, the value of V is set to H (X), or H (X) is assigned to the variable V). Show. In addition, in order for the hash function H having the Merkle Dungard configuration to be cryptographically secure, the compression function h also needs to be difficult to find a collision, difficult to find the second original image, and unidirectional.

The second original image finding difficulty and unidirectionality will be further described with different expressions. For example, the second original image difficulty of finding the compression function h specifically means the following property. First, the attacker selects data W having a predetermined length. Next, data X whose length is m− | W | is arbitrarily selected, and the value of data X is notified to the attacker. At this time,
h (X‖W) = h (X ′) and X‖W ≠ X ′
The characteristic that it is difficult for an attacker to find data X ′ having a length m such that is the second original image difficulty of finding the compression function h. However, “‖” means the combination of bit strings, and m is the length of the bit string input to the compression function h. Further, for example, the unidirectionality of the compression function h specifically means the following property. First, the attacker selects data W having a predetermined length. Next, data X having a data length of m− | W | is arbitrarily selected, and the value of h (X‖W) is notified to the attacker. At this time,
h (X‖W) = h (X ′) and X‖W ≠ X ′
The characteristic that it is difficult for an attacker to find data X ′ having a length m such that

  FIG. 1 is a diagram illustrating a functional configuration example of a conventional hash value generation device, and FIG. 2 is a diagram illustrating an example of a processing flow of the conventional hash value generation device. The hash value generation device 900 generates a hash value using a hash function having a Merkle Dungard configuration. The hash value generation device 900 includes a data length adjustment unit 980 and a data compression unit 990. The data length adjusting unit 980 includes a data Y dividing unit 981 and a data Z generating unit 982, performs padding on the input data Y having an arbitrary length, and the data length is a multiple of mn bits. Is output. The data compression unit 990 includes a data Z dividing unit 991 and a compression unit 992, compresses the input data Z, and obtains a hash value having a data length of n bits.

である。 Specifically, for example, when the data Y dividing unit 981 receives data Y having an arbitrary length,
Y → y [1] ‖y [2] ‖ ... ‖y [B]
As shown in FIG. 5, the block is divided into B-1 mn bit blocks y [1],..., Y [B-1] and one mn bit or less block y [B] (S981). . Here, “→” indicates that the left side is converted (divided) like the right side. B is the number of divided blocks,

It is.

The data Z generation unit 982 confirms whether | y [B] | ≦ mn−σ−1 (S983). That is, it is confirmed whether the data length of the block y [B] is equal to or less than mn-σ-1. When step S983 is Yes, the data Z generation means 982 converts the data Z into
Z ← Y‖10 ^{mn-σ-1- | y [B] |} ‖ <| Y |>
(S984). When step S983 is No, the data Z generation means 982 converts the data Z into
Z ← Y‖10 ^{mn-1- | y [B] |} ‖0 ^mn-σ ‖ <| Y |>
(S985). However, “0 ^m ” is a bit string in which m “0” s are arranged, and <| Y |> is a bit string in which the data length | Y | For example, σ is 64. Since the data Z is generated in this way, the data Z has a data length that is a multiple of mn.

Data Z dividing means 991 converts data Z into
Z → z [1] ‖z [2] ‖ ... ‖z [C]
As shown, the block is divided into C mn bit blocks z [1],..., Z [C] (S991). C is the number of divided blocks, and C = | Z | / (mn).

The compression unit 992 sets an n-bit initial value v ₀ to the n-bit variable v [0] (S993). Further, 1 is substituted into the variable c (S994). The compression means 992
v [c] ← h (z (c) ‖v [c−1])
As shown, the calculation using the compression function h is performed (S995). It is checked whether c matches C (S996). If No, the value of c is incremented by 1, and the process returns to step S995 (S997). If step S996 is Yes, the value of variable v [C] is output as a hash value (S998).
Ralph C. Merkle, “One Way Hash Functions and DES,” CRYPTO 1989, LNCS vol.435, pp.428-446, Springer, Heidelberg (1990). Ivan Damgard, “A Design Principle for Hash Functions,” CRYPTO 1989, LNCS vol.435, pp.416-427, Springer, Heidelberg (1990).

  In the hash value generation device (hash function) of the Merkle Dungard configuration, it is known that if the compression means (compression function) has collision detection difficulty, the hash value generation device is also guaranteed to have collision detection difficulty. ing. However, in the hash value generation device having the conventional Merkle Dunguard configuration, even if the compression means has the second original image finding difficulty and the one-way, the second original image finding difficulty of the hash value generating device. And one-way could not be guaranteed.

  This is because there is a possibility that there is a block that does not include input data to the hash value generation device among the blocks input to the compression function. The present invention provides a hash value generation device capable of guaranteeing the second original image finding difficulty and the one-way if the compression means has the second original image finding difficulty and the one-way. With the goal.

  The hash value generation apparatus of the present invention generates an n-bit hash value for data X using a compression function that compresses m-bit data into n bits. The hash value generation device of the present invention includes a pre-processing unit that converts input arbitrary length data X into data Y, and data that outputs data Z that is padded with data Y and whose data length is a multiple of mn bits. A length adjustment unit, and a data compression unit that compresses the data Z using a compression function to obtain a hash value. The preprocessing unit converts the data X into the data Y so that the data Y satisfies the following two conditions.

(Condition 1) When the data length of the data X is μ bits or more, the data Z is divided into C mn-bit blocks z [1],..., Z [C] (provided that C Is the number of divisions when data Z is divided into mn bits), and all blocks z [1],..., Z [C] are μ bits in data X (where μ is a predetermined integer). Including the above.
(Condition 2) Data X and data Y have a one-to-one correspondence.

  More specifically, the pre-processing unit of the hash value generation device of the present invention may include a data X dividing unit and a data Y generating unit. Then, the data X dividing means divides the data X into A-1 mn bit blocks x [1],..., X [A-1] and one mn bit block x [ (A is the number of divisions when the data X is divided into mn bits). The data Y generation means A′−1 so that the blocks x [1],..., X [A] include at least μ bits (where μ is a predetermined integer) in the data X. .., X ′ [A′−1] and one block x ′ [A ′] of mn bits or less (where A ′ Is an integer equal to or greater than A), and a bit string including x ′ [1] ‖x ′ [2] ‖... X ′ [A ′] (where “‖” is a symbol indicating a combination of bit strings) is data Y. . At this time, the data Y generating means makes a one-to-one correspondence between a combination of blocks x [1],..., X [A] and a combination of blocks x ′ [1],. To do. Further, the data Y generation unit adjusts the data length of x [A ′] so that the data length of the data Z generated by the processing of the data length adjustment unit is A ′ × (mn). For example, when the number of bits added to the data Y by the data length adjustment unit regardless of the data length of the data Y is σ + 1 bits, the data Y generation unit sets the data length of x [A ′] to mn−σ−1. If it is as follows, the data length of the data Z is A ′ × (mn). However, it is not necessary to limit to this specific example, and the blocks x ′ [1],..., X ′ [A are set so that A ′ = B = C in consideration of the processing of the data length adjustment unit and the data compression unit. Another method may be used as long as it is a method of converting to '].

The data Y generation means may perform the following processing. For example, the data Y generation means sets the data Y to the result of adding the bit “0” to the data X if μ ≦ | x [A] | ≦ m−n−σ−2. If | x [A] | ≦ μ−1 and A ≧ 2, the block x [A−1] is changed to an mn−μbit block x ′ [A−1] and a μbit block x ″. Then, x ″ ‖x [A] is divided into blocks x ′ [A], and x [1] ‖... ‖X [A-2] ‖x ′ [A−1] ‖10 ^μ−1 ‖x ′ [A ] Let ‖1 be data Y. If | x [A] | ≦ μ−1 and A = 1, x [1] ‖1 is the data Y. If | x [A] | ≧ mn−σ−1, block x [A] is divided into | x [A] | −μ-bit block x ′ [A] and μ-bit block x ″, Let block x ″ be block x [A + 1], x [1] ‖ ... ‖x [A−1] ‖x ′ [A] ‖10 mn− ^{| x ′ [A] | −1} −１x ′ [A + 1 ] Let ‖1 be data Y. However, “| x [A] |” is a symbol indicating the data length of x [A], “‖” is a symbol indicating a combination of bit strings, “0 ^μ-1 ” is ^μ−1 of “0”. The bit string, σ is a number one less than the number of bits added inside the data length adjustment unit regardless of the data length of the data Y (the number of bits added by the data length adjustment unit regardless of the data length of the data Y is σ + 1 bits) To do. In this example, the data Y generation means changes the last two blocks so that all the blocks z [1],..., Z [C] include μ bits or more in the data X. However, it is not necessary to limit to the last two, and three or more blocks may be changed.

  According to the hash value generation device of the present invention, when the data length of the data X is μ bits or more, all of the C blocks z [1],..., Z [C] obtained by dividing the data Z are obtained. Includes μ bits or more in the data X. Therefore, when the compression function is used, the bit string in the data X of μ bits or more is always included in the input to the compression function. Thus, if the compression function has the second original image finding difficulty and the one-way property, it can be guaranteed that the hash function also has the second original image finding difficulty and the one-way property. Moreover, since the data X and the data Y correspond one-to-one, the collision detection difficulty can be maintained. In addition, the hash value generation device of the present invention can guarantee the second original image finding difficulty and unidirectionality only by adding a pre-processing unit to the conventional hash value generation device having the Merkle Dunguard configuration. In other words, there is an advantage that a hash value generation device having a Merkle Dungard configuration that is already widely used can be used as it is.

  Examples of the present invention will be described below. In addition, the same number is attached | subjected to the structure part and step which have the same function, and duplication description is abbreviate | omitted.

Analysis First, in the hash value generation device of the conventional Merkle Dungard configuration, even if the compression means has the second original image finding difficulty and one-way, the second original image finding of the hash value generation device Explain how difficult and one-way could not be guaranteed.

  As shown in FIG. 2, in the hash value generating apparatus 900 having the conventional Merkle Dunguard configuration, the data length adjusting unit 980 converts the bit string into the data Y so that the data length of the data Z is a multiple of mn bits. Append. However, the data length adjustment unit 980 adds at least σ + 1 bits regardless of the data length of the data Y. Therefore, the data length of the data Z is longer than the data length of the data Y by σ + 1 bits or more. As a result, when the data length of the block y [B] is longer than mn-σ-1, the number of blocks when the data Z is divided is larger than the number of blocks when the data Y is divided. (In other words, C = B + 1). The last block z [C] does not include any bit string in the data Y. When the data length of the block y [B] is short, the last block z [C] includes only a small bit string in the data Y.

  Therefore, among the repetitive operations using the compression function h in the compression unit 992 of the data compression unit 990, in the last operation, the input data (block z [C]) sufficiently includes the bit string in the data Y. It may not be. This is because in the conventional hash value generation device with the Merkle Dungard configuration, even if the compression means has the second original image finding difficulty and unidirectionality, the second original image finding of the hash value generation device This is the reason why difficulty and unidirectionality could not be guaranteed.

  From the above analysis, in the present invention, when the data length of the data X is μ bits or more, all the blocks input to the compression function include input data to the hash value generation device of μ bits or more. FIG. 3 is a diagram illustrating a functional configuration example of the hash value generation device according to the first embodiment. FIG. 4 is a diagram illustrating a processing flow of the hash value generation device according to the first embodiment.

  The hash value generation device 100 generates an n-bit hash value for the data X using a compression function that compresses m-bit data into n bits. The hash value generation device 100 includes a preprocessing unit 110, a data length adjustment unit 980, and a data compression unit 990. The preprocessing unit 110 converts data X having an arbitrary length that is input so as to satisfy a predetermined condition into data Y (S110). The data length adjustment unit 980 performs padding on the data Y and outputs data Z whose data length is a multiple of mn bits (S980). The data compression unit 990 obtains a hash value by compressing the data Z using a compression function (S990). The data length adjustment unit 980 and the data compression unit 990 are the same as the conventional hash value generation device 900. In the description of the conventional hash value generation device 900, the input data (the data for which the hash value is obtained) is the data Y. However, in the description of the hash value generation device 100, the input data (the object for which the hash value is obtained) Note that data X is data X.

The preprocessing unit 110 includes a data X dividing unit 120 and a data Y generating unit 130, and converts the data X into data Y so that the data Y satisfies the following two conditions.
(Condition 1) When the data length of the data X is μ bits or more, the data Z generated by the data length adjustment unit 980 is converted into C mn bit blocks z [1],..., Z [C]. When divided (where C is the number of divisions when data Z is divided into mn bits), all the blocks z [1],..., Z [C] have more than μ bits in the data X. Including.
(Condition 2) Data X and data Y have a one-to-one correspondence.
However, μ is a predetermined integer and is a parameter for determining the security level. If μ = n, the difficulty of finding the second original image and the degree of unidirectionality become the difficulty of the output length n. If μ = n / 2, the second original image finding difficulty and the degree of unidirectionality are half the output length n (the same degree as the collision finding difficulty). Therefore, it is appropriate to determine the value of μ in the range of n / 2 to n.

  Since the preprocessing unit 110 generates the data Y in this way, all of the C blocks z [1],..., Z [C] obtained by dividing the data Z are μ bits in the data X. Includes the above. Therefore, when the compression function is used, the bit string in the data X of μ bits or more is always included in the input to the compression function. Thus, if the compression function has the second original image finding difficulty and the one-way property, it can be guaranteed that the hash function also has the second original image finding difficulty and the one-way property. Moreover, since the data X and the data Y correspond one-to-one, the collision detection difficulty can be maintained.

  Furthermore, the present invention converts the input data (data for which a hash value is obtained) so that the preprocessing unit 110 satisfies a predetermined condition, and converts the converted data into a conventional hash value generation device. Enter 900. If the compression function has the second original image finding difficulty and one-way while using the widely used conventional hash value generation device 900 only by adding the preprocessing unit 110, the hash It can be assured that the function also has the second original image finding difficulty and unidirectionality. Also, collision detection difficulty is maintained. Therefore, it is possible to effectively use widely spread technology.

  More specifically, the preprocessing unit 110 may perform processing as follows. The data X dividing means 120 divides the data X into A-1 mn bit blocks x [1],..., X [A-1] and one mn bit or less block x [A]. (Where A is the number of divisions when the data X is divided into mn bits). The data Y generating unit 130 includes blocks x [1],..., X [A] such that all blocks include μ bits (where μ is a predetermined integer) or more in the data X. Is converted into one mn bit block x ′ [1],..., X ′ [A′−1] and one block of mn bits or less x ′ [A ′] (where A ′ 'Is an integer greater than or equal to A), x' [1] ‖x '[2] ‖ ... ‖x' [A '] (where "‖" is a symbol indicating a combination of bit sequences) To do. At this time, the data Y generating means makes a one-to-one correspondence between a combination of blocks x [1],..., X [A] and a combination of blocks x ′ [1],. To do. Further, the data Y generation unit adjusts the data length of x [A ′] so that the data length of the data Z generated by the processing of the data length adjustment unit 980 is A ′ × (mn). . For example, if the number of bits that the data length adjustment unit 980 adds to the data Y regardless of the data length of the data Y is σ + 1 bits, the data Y generation unit 130 sets the data length of x [A ′] to mn−σ. If it is set to −1 or less, the data length of the data Z is A ′ × (mn). However, in order to perform such processing, m must be n + σ + μ + 2 or more. If μ = n and σ = 64, both the widely used compression functions sha1 and sha256 satisfy this condition. Note that it is not necessary to limit to the above-described specific example, and considering the processing of the data length adjustment unit 980 and the data compression unit 990, the blocks x ′ [1],. The same effect can be obtained by another method as long as it is a method for conversion to '[A'].

  FIG. 5 shows a specific example of the processing flow of the preprocessing unit 110. This processing flow is premised on the combination of the data length adjustment unit 980 and the data compression unit 990 shown in FIG. The data X dividing means 120 divides the data X into A-1 mn bit blocks x [1],..., X [A-1] and one mn bit or less block x [A]. (Where A is the number of divisions when the data X is divided into mn bits) (S120).

  The data Y generation means 130 checks whether μ ≦ | x [A] | ≦ mn−σ−2 (S131). If step S131 is Yes, the data Y generation means 130 sets the result of adding the bit “0” to the data X as data Y (S132). In this case, A ′ = A, x ′ [1],..., X ′ [A−1] is the same as x [1],. ] Is x [A-1] ‖0.

If the result in step S131 is No, the data Y generation means 130 checks whether | x [A] | ≦ μ−1 (S133). If the step S133 is Yes, the data Y generation means 130 checks whether A ≧ 2 (S134). If step S134 is Yes, the data Y generation means 130 divides the block x [A-1] into an mn-μbit block x ′ [A-1] and a μbit block x ″ (S135). X ″ ‖x [A] is set as a block x ′ [A] (S136). Then, x [1] ‖ ... ‖x [A-2] ‖x ′ [A-1] ‖10 ^μ- 1‖x ′ [A] ‖1 is set as data Y (S137). In this case, A ′ = A, and x ′ [1],..., X ′ [A−2] is the same as x [1],. The data Y generation unit 130 sets x [1] デ ー タ 1 as the data Y if step S134 is No (S138). In this case, A ′ = A, x ′ [1],..., X ′ [A−1] is the same as x [1],. ] Is x [A-1] ‖1.

If the step S133 is No (that is, | x [A] | ≧ mn−σ−1), the data Y generation means 130 converts the block x [A] into a block x of | x [A] | −μ bits. '[A] and μ-bit block x ″ are divided (S139). Block x ″ is set as block x [A + 1] (S140). x [1] ‖ ... ‖x [A-1] ‖x ′ [A] ‖10 mn− ^{| x ′ [A] |} −1‖x ′ [A + 1] ‖1 is set as data Y (S141) . In this case, A ′ = A + 1, and x ′ [1],..., X ′ [A−1] is the same as x [1],. However, “| x [A] |” is a symbol indicating the data length of x [A], “‖” is a symbol indicating a combination of bit strings, “0 ^μ-1 ” is ^μ−1 of “0”. The bit string, σ, is the number of bits expressing the data length | Y | of the data Y, and is one less than the number of bits added by the data length adjusting unit 980 regardless of the data length of the data Y. Note that the data Y generation unit 130 of this example changes all the last two blocks so that all the blocks z [1],..., Z [C] include μ bits or more in the data X. However, it is not necessary to limit to the last two, and three or more blocks may be changed.

FIG. 6 is a diagram showing processing of the data compression unit 990 (compression unit 992) when the preprocessing unit 110 is added. As described above, the processing of the preprocessing unit 110 differs depending on the data length of the block x [A]. Therefore, the processing of the data compression unit 990 also differs depending on the data length of the block x [A]. When μ ≦ | x [A] | ≦ m−n−σ−2, the input to the compression function h is x [1],..., x [A-1], x [A] ‖0‖10 ^{m −n−σ−1− | y [B] |} ‖ <| Y |>. Therefore, data X is included in all inputs by μ bits or more. When | x [A] | ≦ μ−1 and A ≧ 2, the input to the compression function h is x [1],..., X ′ [A−1] ‖10 ^μ−1 , x ′ [A] ‖1‖10 ^{mn-σ-1- | y [B] |} ‖ <| Y |> Therefore, data X is included in all inputs by μ bits or more. When | x [A] | ≦ μ−1 and A = 1, the input to the compression function h is x [1] ‖1‖10 ^{mn−σ−1− | y [B]} | Only Y |>. In this case, the data X does not include more than μ bits. However, since the input data X itself is shorter than μ bits, it is not the subject of the problem to be solved by the present invention. | X [A] | For ≧ m-n-σ-1 , the input to the compression function h, x [1], ..., x [A-1], x '[A] ‖10 ^{m-n- | X ′ [A] | −1} , x ′ [A + 1] ‖1‖10 ^{mn-σ-1-−y [B] |} ‖ <| Y |>. Therefore, data X is included in all inputs by μ bits or more. Therefore, if the data length of the input data X is μ bits or more, it can be seen that the bit string in the data X of μ bits or more is always included in the input to the compression function.

  FIG. 7 shows a functional configuration example of the verification apparatus of the present invention. FIG. 8 shows a processing flow example of the verification apparatus of the present invention. The verification device 500 includes the hash value generation device 100, the comparison unit 510, and the recording unit 590 described in the first embodiment. The verification device 500 receives data X and a hash value τ, and outputs a verification result.

The hash value generation device 100 in the verification device 500 generates a hash value τ ′ from the data X (S100). The comparison unit 510 compares the hash value τ and the hash value τ ′. If τ = τ ′, the consistency of data contents is verified. If τ ≠ τ ′, it is determined that the data has been tampered with. Then, the verification result is output (S510). The recording unit 590 may not be provided, and these pieces of information may be recorded by other components.
With this configuration, the verification device 500 can obtain the same effects as the hash value generation device 100.

  FIG. 9 shows a functional configuration example of the computer. Note that the hash value generation device and the verification device of the present invention cause the recording unit 2020 of the computer 2000 to read a program that causes the computer 2000 to operate as each component of the present invention, and the processing unit 2010, the input unit 2030, and the output unit 2040. It can be realized by operating. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

  The hash value generation device, the verification device, the hash value generation method, and the verification method of the present invention are incorporated in, for example, a mobile phone, a personal computer, a router, a server, etc., and generate hash values for transmitted / received data or accumulated data, or It can be used for verification.

The figure which shows the function structural example of the conventional hash value production | generation apparatus. The figure which shows the example of the processing flow of the conventional hash value production | generation apparatus. FIG. 3 is a diagram illustrating a functional configuration example of a hash value generation device according to the first embodiment. The figure which shows the processing flow of the hash value production | generation apparatus of Example 1. FIG. The figure which shows the specific example of the processing flow of the pre-processing part 110. FIG. The figure which shows the process of the data compression part 990 when the pre-processing part 110 is added. The figure which shows the function structural example of the verification apparatus of this invention. The figure which shows the example of a processing flow of the verification apparatus of this invention. The figure which shows the function structural example of a computer.

Explanation of symbols

100, 900 Hash value generation device 110 Pre-processing unit 120 Data X division unit 130 Data Y generation unit 500 Verification unit 510 Comparison unit 590 Recording unit 980 Data length adjustment unit 981 Data Y division unit 982 Data Z generation unit 990 Data compression unit 991 Data Z dividing means 992 compression means

Claims (10)

A hash value generation device that generates an n-bit hash value for data X using a compression function that compresses m-bit data into n bits,
A preprocessing unit for converting the data X into data Y;
A data length adjustment unit that performs padding on data Y and outputs data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function and obtains a hash value;
The pre-processing unit is
When data Z is divided into C mn bit blocks z [1],..., Z [C] (where C is the number of divisions when data Z is divided into mn bits each) ), All blocks z [1],..., Z [C] include at least μ bits in data X (where μ is a predetermined integer), and
A hash value generation device, wherein data X and data Y are converted to data Y so that data X and data Y correspond one-to-one. A hash value generation device that generates an n-bit hash value for data X using a compression function that compresses m-bit data into n bits,
A preprocessing unit for converting the data X into data Y;
A data length adjustment unit that performs padding on data Y and outputs data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function and obtains a hash value;
The pre-processing unit is
The data X is divided into A-1 mn bit blocks x [1],..., X [A-1] and one mn bit or less block x [A]. A is the number of divisions when data X is divided into mn bits) Data X dividing means;
The block x [1],..., X [A] includes A′−1 m−n such that all the blocks include μ bits (where μ is a predetermined integer) in the data X. A block of bits x ′ [1],..., X ′ [A′−1] and a block x ′ [A ′] of mn bits or less are converted (where A ′ is an integer greater than or equal to A) ), X ′ [1] ‖x ′ [2] ‖... ‖X ′ [A ′] (where “‖” is a symbol indicating a combination of bit strings), and data Y generating means that uses data Y as a bit string. Have
The data Y generating means makes the combination of the blocks x [1],..., X [A] and the combination of the blocks x ′ [1],. The data Y generating means sets the data length of x [A ′] so that the data length of the data Z generated by the processing of the data length adjusting unit is A ′ × (mn). A hash value generation device characterized. A hash value generation device that generates an n-bit hash value for data X using a compression function that compresses m-bit data into n bits,
A preprocessing unit for converting the data X into data Y;
A data length adjustment unit that performs padding on data Y and outputs data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function and obtains a hash value;
The pre-processing unit is
Data X division that divides the data X into A-1 mn bit blocks x [1], ..., x [A-1] and one mn bit block x [A] or less. Means,
If μ ≦ | x [A] | ≦ m−n−σ−2,
The result of adding bit “0” to data X is data Y,
If | x [A] | ≦ μ−1 and A ≧ 2,
The block x [A-1] is divided into an mn-μbit block x ′ [A-1] and a μbit block x ″.
Let x ″ ‖x [A] be a block x ′ [A],
x [1] ‖ ... ‖x [A-2] ‖x ′ [A-1] ‖10 ^μ−1 ‖x ′ [A] ‖1 is data Y,
If | x [A] | ≦ μ−1 and A = 1,
Let x [1] ‖1 be data Y,
If | x [A] | ≧ mn−σ−1,
The block x [A] is divided into | x [A] | −μbit block x ′ [A] and μbit block x ″.
Let block x ″ be block x [A + 1],
x [1] ‖ ... ‖x [A−1] ‖x ′ [A] ‖10 mn− ^{| x ′ [A] | −1} Data Y generation with ‖x ′ [A + 1] ‖1 as data Y (Where A is the number of divisions when the data X is divided into mn bits, μ is a predetermined integer, and “| x [A] |” is the data length of x [A]. , “は” means a bit string combination, “0 ^μ-1 ” is a bit string in which μ-1 “0” s are arranged, and the data length adjustment unit is added regardless of the data length of data Y (The number of bits to be used is σ + 1 bits)
A hash value generation device characterized by that. A verification device that receives data X and hash value τ as input and performs verification of data X,
The hash generation device according to any one of claims 1 to 3, which outputs a hash value τ 'for data X;
A verification device comprising: a comparison unit that compares the hash value τ and the hash value τ ′ and outputs a verification result of the data X. A hash value generation method for generating an n-bit hash value for data X using a compression function for compressing m-bit data to n bits,
A preprocessing step of converting the data X into data Y in a preprocessing unit;
A data length adjustment step of padding the data Y in the data length adjustment unit and outputting the data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function to obtain a hash value; and
The preprocessing step includes
When data Z is divided into C mn bit blocks z [1],..., Z [C] (where C is the number of divisions when data Z is divided into mn bits each) ), All blocks z [1],..., Z [C] include at least μ bits in data X (where μ is a predetermined integer), and
A method of generating a hash value, comprising: converting data X to data Y so that data X and data Y have a one-to-one correspondence. A hash value generation method for generating an n-bit hash value for data X using a compression function for compressing m-bit data to n bits,
A preprocessing step of converting the data X into data Y in a preprocessing unit;
A data length adjustment step of padding the data Y in the data length adjustment unit and outputting the data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function to obtain a hash value; and
The preprocessing step includes
The data X is divided into A-1 mn bit blocks x [1],..., X [A-1] and one mn bit or less block x [A]. A is the number of divisions when data X is divided into mn bits) Data X division substep;
The block x [1],..., X [A] includes A′−1 m−n such that all the blocks include μ bits (where μ is a predetermined integer) in the data X. A block of bits x ′ [1],..., X ′ [A′−1] and a block x ′ [A ′] of mn bits or less are converted (where A ′ is an integer greater than or equal to A) ), X ′ [1] ‖x ′ [2] ‖... X ′ [A ′] (where “‖” is a symbol indicating a combination of bit strings), and a data Y generation sub-step in which the data Y is a bit string. And
In the data Y generation sub-step, a combination of blocks x [1],..., X [A] and a combination of blocks x ′ [1],. The data Y generating means sets the data length of x [A ′] so that the data length of the data Z generated by the processing of the data length adjusting step is A ′ × (mn). A hash value generation method characterized by A hash value generation method for generating an n-bit hash value for data X using a compression function for compressing m-bit data to n bits,
A preprocessing step of converting the data X into data Y in a preprocessing unit;
A data length adjustment step of padding the data Y in the data length adjustment unit and outputting the data Z having a data length that is a multiple of mn bits;
A data compression unit that compresses the data Z using the compression function to obtain a hash value; and
The preprocessing step includes
Data X division that divides the data X into A-1 mn bit blocks x [1], ..., x [A-1] and one mn bit block x [A] or less. Substeps,
If μ ≦ | x [A] | ≦ m−n−σ−2,
The result of adding bit “0” to data X is data Y,
If | x [A] | ≦ μ−1 and A ≧ 2,
The block x [A-1] is divided into an mn-μbit block x ′ [A-1] and a μbit block x ″.
Let x ″ ‖x [A] be a block x ′ [A],
x [1] ‖ ... ‖x [A-2] ‖x ′ [A-1] ‖10 ^μ−1 ‖x ′ [A] ‖1 is data Y,
If | x [A] | ≦ μ−1 and A = 1,
Let x [1] ‖1 be data Y,
If | x [A] | ≧ mn−σ−1,
The block x [A] is divided into | x [A] | −μbit block x ′ [A] and μbit block x ″.
Let block x ″ be block x [A + 1],
x [1] ‖ ... ‖x [A−1] ‖x ′ [A] ‖10 mn− ^{| x ′ [A] | −1} Data Y generation with ‖x ′ [A + 1] ‖1 as data Y (Where A is the number of divisions when data X is divided into mn bits, μ is a predetermined integer, and “| x [A] |” is data of x [A]. Symbol indicating length, “‖” is a symbol indicating a combination of bit strings, “0 ^μ-1 ” is a bit string in which μ-1 “0” s are arranged, and the data length adjustment unit is independent of the data length of data Y (The number of bits to be added is σ + 1 bits)
A hash value generation method characterized by that. A verification method in which data X and hash value τ are input and data X is verified,
Each step of the hash generation method in any one of Claim 5 to 7 which outputs hash value (tau) 'with respect to the data X,
A comparison method comprising: a comparison unit that compares the hash value τ and the hash value τ ′ and outputs a verification result of the data X in the comparison unit.   A program that causes a computer to operate as the hash value generation device according to claim 1 or the verification device according to claim 4. A computer-readable recording medium on which the program according to claim 9 is recorded.

Images