JP2012168274A - Encryption method, decryption method, encryption apparatus, decryption apparatus and encryption/decryption system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a first ciphertext block from becoming a step to decryption when encrypting plaintext in an encryption block chain mode, and to make a length of ciphertext equal to that of plaintext.SOLUTION: When encrypting plaintext (M1...Mn) in an encryption block chain mode, an encryption apparatus 10 encrypts plaintext (P, M1...Mn) in which a preblock (P) generated by a preblock generator 12 is added to the head, and defines a result of removing ciphertext block (Cp) corresponding to the preblock (P) from ciphertext (Cp, C1...Cn) obtained by encrypting the plaintext (P, M1...Mn) as ciphertext (C1...Cn) of the plaintext (M1...Mn).

Description

  The present invention uses the same common key on the encryption side and the decryption side, such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard), and encrypts / decrypts in units of a predetermined block length. This invention relates to block ciphers that perform the above.

  Block encryption such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard) that uses the same common key on the encryption side and the decryption side and performs encryption / decryption in units of a block of a predetermined block length There is also an ECB mode (Electric Code Book) that does not chain cipher blocks, but since the ECB mode is vulnerable to decryption, the cipher block chaining mode (Cipher Block Chaining) is used. There are many cases.

Expression 1 is an expression for explaining a function of the ciphertext block chaining mode. As shown in Equation 1, the encryption function in the ciphertext block chaining mode calculates the ciphertext block (Ci) obtained by encrypting the i-th plaintext block (Mi), and the previous plaintext block ( The exclusive OR of the ciphertext block (Ci-1) obtained by encrypting Mi-1) and the plaintext block (Mi) is calculated, and the result of encrypting the result is defined as a ciphertext block (Ci). The decryption function in the ciphertext block chaining mode is an inverse function of the encryption function in the ciphertext block chaining mode.

Japanese Patent No. 2541113

 As described above, in the ciphertext block chaining mode, cipher blocks are chained, and thus stronger against cryptanalysis than the ECB mode, but the first plaintext block (M1) has no previous plaintext block, In the first plaintext block (M1), an IV (Initial Vector) is exclusively ORed instead of the ciphertext block, and the ciphertext block (C1) of the first plaintext block (M1) becomes a starting point for decryption. There is a risk that.

 As one method for solving such a problem, Patent Document 1 discloses an invention in which a redundant bit having a predetermined length generated by a random number is added to the head of a plaintext. If this method is used, adding a redundant bit to the beginning of the plaintext will cause the data length of the ciphertext to be longer than the data length of the plaintext, which may be a stepping stone for decryption. is there.

  Therefore, the present invention can prevent the first ciphertext block from becoming a starting point for decryption when encrypting plaintext in the cipher block chaining mode according to a predetermined block cipher, and the length of the ciphertext is plaintext. The purpose is to provide a technology that is the same in length.

  According to a first invention for solving the above-described problem, an encryption device for encrypting plaintext generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for plaintext encryption. A step of encrypting the plaintext with the preblock added with a common key in a cipher block chaining mode based on a predetermined block cipher, and then removing the cipher block corresponding to the preblock from the encrypted result And generating a plaintext ciphertext.

 Further, the second invention is a step in which a decryption device for decrypting ciphertext generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for decrypting ciphertext, A step of encrypting the pre-block with a common key in a cipher block chaining mode based on a block cipher, and a cipher with the pre-block cipher block added to the head in a cipher block chaining mode based on a predetermined block cipher And a step of generating a plaintext of the ciphertext by removing the pre-block from the decryption result after decrypting the text with a common key.

Further, the third invention is based on a pre-block generation unit that generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for plaintext encryption, and a predetermined block cipher. In cipher block chaining mode, plaintext with the preblock added at the beginning is encrypted with a common key, and then the ciphertext corresponding to the preblock is removed from the encrypted result to generate plaintext ciphertext And an encryption unit.

 The pre-block generation unit generates the pre-block as a method of manipulating the bits of the common key according to a predetermined procedure, or encrypting the common key with a common key or a common key with bits manipulated according to a predetermined procedure A method can be considered. In addition, a method of deriving a derived key from a common key and generating the pre-block can be considered. For example, the pre-block can be generated by encrypting the common key with this derived key, or encrypting this derived key with the common key, or encrypting the derived key itself with this derived key. It is also possible to generate the pre-block by making it. Further, a derived block whose data length is an integral multiple of the block cipher block length is derived from the common key, and a pre-block is generated by encrypting the derived block with the common key or the derived key derived from the common key. A method is also conceivable.

 Further, the fourth invention is based on a pre-block generation unit that generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for decrypting ciphertext, and a predetermined block cipher. A step of encrypting the pre-block with a common key in a cipher block chaining mode, and a ciphertext prefixed with the cipher block of the pre-block in a cipher block chaining mode based on a predetermined block cipher The decryption apparatus includes decryption that generates a plaintext of a ciphertext by removing the pre-block from the decryption result after decryption by.

 As in the third invention, the pre-block generation unit generates the pre-block as a method of operating a bit of a common key according to a predetermined procedure, or a common key or a common key operating a bit according to a predetermined procedure. A method of encrypting the common key with a key can be considered. In addition, a method of deriving a derived key from a common key and generating the pre-block can be considered. For example, the pre-block can be generated by encrypting the common key with this derived key, or encrypting this derived key with the common key, or encrypting the derived key itself with this derived key. It is also possible to generate the pre-block by making it. Further, a derived block whose data length is an integral multiple of the block cipher block length is derived from the common key, and a pre-block is generated by encrypting the derived block with the common key or the derived key derived from the common key. A method is also conceivable.

  Furthermore, the fifth aspect of the invention constructs a VPN (Virtual Private Network) with another device and generates a pre-block that is an integral multiple of the block cipher block length from the block cipher common key received from the other device. A pre-block generation apparatus that transmits the generated pre-block to the other apparatus, and a plain key encrypted with the pre-block generation apparatus when the plain text is encrypted, and a common key that is used to encrypt the plain text Transmitted to the block generator, and based on a predetermined block cipher, in the cipher block chaining mode, the plaintext prefixed with the preblock received from the preblock generator was encrypted with a common key, and then encrypted. An encryption device that generates plaintext ciphertext by removing the encryption block corresponding to the preblock from the result, and the preblock generation device and the VPN are configured. Then, a common key used for decrypting the ciphertext generated by the encryption device is transmitted to the preblock generation device, and the preblock is encrypted with the common key in a cipher block chaining mode based on a predetermined block cipher. Step of decrypting the ciphertext prefixed with the cipher block of the pre-block received from the pre-block generation device in the cipher block chaining mode based on a predetermined block cipher, and then decrypting the ciphertext An encryption / decryption system comprising at least a decryption device that generates plaintext of ciphertext by removing the pre-block from As in the third and fourth inventions, the pre-block generation device generates the pre-block as a method for bit-rotating the common key according to a predetermined procedure, or using the common key as the common key itself. An encryption method can be considered.

  According to the above-described invention, since the ciphertext block of the pre-block is chained to the first plaintext block, it is possible to prevent the ciphertext block of the first plaintext block from becoming a starting point for decryption. Also, by removing the block related to the pre-block from the encrypted result, the length of the ciphertext can be made the same as the length of the plaintext, and it is not possible to know that special processing is performed when encrypting. .

1 is a diagram for explaining an encryption / decryption system according to Embodiment 1. FIG. The flowchart which showed the procedure in which the encryption apparatus which concerns on Embodiment 1 encrypts plaintext. The flowchart which showed the procedure in which the decryption apparatus which concerns on Embodiment 1 decrypts a ciphertext. 1 is a diagram illustrating an encryption / decryption system according to Embodiment 1. FIG. FIG. 6 is a diagram for explaining an encryption device and a decryption device according to a second embodiment. The flowchart which showed the procedure in which the encryption apparatus which concerns on Embodiment 2 encrypts a plaintext. The flowchart which showed the procedure in which the decryption apparatus which concerns on Embodiment 2 decrypts a ciphertext. FIG. 6 is a diagram illustrating an IC card according to a second embodiment.

  From here, embodiments of the present invention will be described to the extent that those skilled in the art of the present invention can understand the contents of the invention and implement the invention. The embodiment described below is only one embodiment of the present invention, and the present invention is not limited to the embodiment described below, and various modifications and changes are possible.

(Embodiment 1)
First, Embodiment 1 which concerns on the system of this invention is demonstrated. FIG. 1 is a diagram for explaining an encryption / decryption system 1 according to the first embodiment.

 The encryption / decryption system 1 according to Embodiment 1 uses the same common key (K) on the encryption side and the decryption side, such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard). In a system that performs encryption / decryption by block cipher that performs processing in block units of a predetermined block length, a plaintext (in ciphertext block chaining mode is used in accordance with a predetermined block cipher algorithm using a common key (K). Decrypting ciphertext (C1... Cn) in ciphertext block chaining mode according to a predetermined block cipher algorithm using the encryption device 10 that encrypts M1... Mn) and the common key (K) And a pre-block generation device 12 that generates a pre-block to be added to the head of the plaintext (M1... Mn), and includes an encryption device 10, a decryption device 11, and a pre-block. Generator 12 is connected via the Internet 13.

  As illustrated in Equation 1, when plaintext is encrypted in the CBC mode, the plaintext (M1... Mn) to be encrypted is defined as a block length (for example, 64 bits for DES and 128 bits for AES). ) Is divided into a plurality of plaintext blocks (Mi, i = 1 to n), and the ciphertext block (Ci-1) and plaintext block (Mi) of the previous plaintext block (Mi-1) are exclusive logic The ciphertext block is chained by generating the ciphertext block (Ci) of the plaintext block (Mi) as a result of summing and encryption, and the ciphertext of plaintext (M1... Mn) is generated. Since the ciphertext block (C1) of the plaintext block (M1) is not chained with ciphertext blocks, the ciphertext block (C1) may become a starting point for decryption.

 On the other hand, when encrypting plaintext (M1... Mn) in the ciphertext block chaining mode, the encryption device 10 of Embodiment 1 starts with the pre-block (P) generated by the problock generation device 12 at the top. The added plaintext (P, M1... Mn) is encrypted, and the encryption corresponding to the pre-block (P) from the encryption result (Cp, C1... Cn) of the plaintext (P, M1... Mn). The result of removing the text block (Cp) is the ciphertext (C1... Cn) of the plaintext (M1... Mn), so that the ciphertext block (Cp) of the preblock (P) is the first plaintext block. The ciphertext block (C1) of the first plaintext block (M1) is prevented from becoming a step for decryption, and the length of the ciphertext (C1... Cn) is plaintext. Same as the length of (M1 ... Mn) , Special treatment when encryption is no longer know that they are implemented.

  In block ciphers such as DES and ASE, since the common key (K) is shared between the ciphertext generation side and the decryption side, a common technique is used to generate the pre-block (P) in encryption / decryption. By doing so, it becomes possible to generate the pre-block (P) generated when generating the ciphertext (C1... Cn) and the ciphertext block (Cp) of the pre-block (P) also on the decryption side. The decryption apparatus 11 can decrypt the ciphertext (C1... Cn) into plaintext (M1... Mn) by executing the reverse procedure of encryption.

  From here, the pre-block generation device 12, the encryption device 10, and the decryption device 11 included in the encryption system will be described in more detail.

  First, the pre-block generation device 12 will be described. The pre-block generation device 12 is a device that generates a pre-block (P) to be added to the head of the plaintext (M1... Mn) from the delivered common key (K). It is realized by a computer program for generating a pre-block.

  The pre-block generation device 12 may generate the pre-block (P) by any method as long as the data length is an integral multiple of the block cipher block length. As such a method, the common key (K) is shared. A method of encrypting with the key (K), a method of bit-rotating the common key (K) according to a predetermined procedure, and the like are conceivable, and an extreme example may be an identity function.

  In addition, a method of generating a pre-block (P) by deriving a derived key from the common key (K) is also conceivable. For example, the pre-block (P) can be generated by encrypting the common key (K) with this derived key, or encrypting this derived key with the common key (K). A pre-block (P) can also be generated by encrypting the derived key itself with a key. The derived key may be derived by shifting or rotating a predetermined byte of the common key (K).

  Further, a method of generating a pre-block (P) by deriving a derived block whose data length is an integral multiple of the block cipher block length from the common key (K) using an encryption key extension algorithm or the like is also conceivable. For example, the pre-block (P) can be generated by encrypting this derived block with the common key (K). The encryption key used for the encryption of the derived block may be the above-described derived key.

 The data length of the pre-block (P) is determined by a method for generating the pre-block (P). For example, the common key (K) is encrypted with the common key (K) as a function for generating the pre-block (P). If the single DES is a block cipher, the key length of the single DES is 64 bits including parity, so the data length of the pre-block (P) is the DES block length (64 bits). 1x. In addition, when AES is a block cipher, if the AES key length is 256 bits, the data length of the pre-block (P) is twice the AES block length (256 bits).

 Next, the encryption device 10 will be described. The encryption device 10 passes the common key (K) to the pre-block generation device 12, and uses the pre-block (P) generated by the pre-block generation device 12, and the plaintext (M1... Mn) to be encrypted. The encryption unit is realized by a computer program for causing a computer used as the encryption device 10 to operate as an encryption unit.

 FIG. 2 is a flowchart showing a procedure in which the encryption device 10 encrypts plain text (M1... Mn).

  When the encryption device 10 encrypts plaintext (M1... Mn), first, the plaintext (M1... Mn) to be encrypted and the common key (K) used for encryption are encrypted. 10 (S1). When the plaintext (M1... Mn) and the common key (K) are not stored in the encryption device 10, the plaintext (M1... Mn) and the common key (K) are encrypted by the operator or an external device. When the plaintext (M1... Mn) and the common key (K) are stored in the encryption device 10, the plaintext (M1) stored in the encryption device 10 is to be input to the device 10. ... Mn) and the common key (K) are designated by an operator or an external device.

 Since block ciphers are processed in units of block length, if the specified plaintext data length is not an integer multiple of the block cipher block length, the data length is an integer multiple of the block cipher block length. Predetermined data is padded according to a standard such as PKCS # 5, and the plaintext is divided into n plaintext blocks (Mi, i = 1 to n).

 Next, the encryption device 10 constructs a pre-block generation device 12 and a VPN (Virtual Private Network) using a technology such as SSL (Secure Socket Layer) (S2), and then designates a specified common key (K ) To the pre-block generation device 12, and the pre-block (P) generated by the pre-block generation device 12 is received from the pre-block generation device 12 (S3).

  When the preblock (P) is delivered from the preblock generation device 12, the encryption device 10 generates plaintext (P, M1... Mn) with the preblock (P) added to the head (S4). The plaintext (P, M1,... Mn) is encrypted in the ciphertext block chain mode according to a predetermined block cipher algorithm using the common key (K) (S5).

  In the ciphertext block chaining mode, since encryption is performed sequentially from the first plaintext block, the ciphertext (P, M1... Mn) cipher result is the cipher block (Cp) corresponding to the pre-block (P). The ciphertext (Cp, C1... Cn) is obtained by combining the cipher blocks (Ci, i = 1 to n) corresponding to the plaintext blocks (Mi, i = 1 to n).

  And the encryption part of the encryption apparatus 10 preblocks (P from the head of the ciphertext (Cp, C1 ... Cn) obtained by encrypting plaintext (P, M1 ... Mn). ) To remove the cipher block (Cp) corresponding to the pre-block (P), and the cipher text (C1... Mn) corresponding to the plain text (M1... Mn). Cn) is generated (S6), and the procedure illustrated in FIG.

  For example, if the pre-block (P) is one block, the encryption unit of the encryption device 10 will remove block-length data from the beginning of the ciphertext (Cp, C1... Cn). If the pre-block (P) is two blocks, the encryption unit of the encryption device 10 removes data twice the block length from the beginning of the ciphertext (Cp, C1,... Cn).

 Next, the decoding device 11 will be described. The decryption device 11 passes the common key (K) to the pre-block generation device 12, and uses the pre-block (P) generated by the pre-block generation device 12, and transmits the ciphertext (C1... Cn) to be decrypted. A computer that generates decrypted plaintext (M1... Mn) and a decryption device 11 is installed with a computer program for decrypting ciphertext (C1... Cn).

 FIG. 3 is a flowchart showing a procedure in which the decryption device 11 decrypts the ciphertext (C1... Cn).

  When the decryption unit of the decryption device 11 decrypts the ciphertext (C1... Cn), the ciphertext (C1... Cn) to be decrypted and the common key (K) are designated (S10). Since the plaintext (M1... Mn) data length is encrypted after being padded to an integral multiple of the block cipher block length, the ciphertext (C1... Cn) data length is always the block cipher block length. In FIG. 3, the ciphertext (C1... Cn) is divided into n ciphertext blocks (Ci, i = 1 to n).

  When a ciphertext (C1... Cn) to be decrypted is designated, a pre-block generation device 12 and a VPN (Virtual Private Network) are constructed using a technology such as SSL (Secure Socket Layer). (S11) The designated common key (K) is transferred to the pre-block generation device 12, and the pre-block (P) generated by the pre-block generation device 12 is received from the pre-block generation device 12 (S12).

 As described above, in the block cipher, since the common key is shared between the generation side and the decryption side of the ciphertext (C1... Cn), the same common key (K) is used in the same manner as the encryption device 10. By using, the pre-block (P) used when generating the ciphertext (C1... Cn) can be generated also on the decryption apparatus 11 side.

  Next, the decryption device 11 encrypts the pre-block (P) in the ciphertext block chaining mode according to a predetermined block cipher algorithm using the designated common key (K), thereby pre-block (P) The encryption block (Cp) is generated (S13).

  When the encryption block (Cp) of the pre-block (P) is generated, the decryption device 11 performs the reverse procedure to the process of removing the encryption block (Cp) of the pre-block (P), that is, the encryption block of the pre-block (P). After generating a ciphertext (Cp, C1... Cn) prefixed with (Cp) (S14), a procedure reverse to the encryption, that is, using a common key (K), a predetermined block cipher algorithm Then, the ciphertext (Cp, C1... Cn) is decrypted in the ciphertext block chain mode (S15).

  In the ciphertext block chaining mode, decryption is performed in order from the first block, so that the decryption result of the ciphertext (Cp, C1... Cn) is a block obtained by decrypting the cipher block (Cp), that is, a pre-block (P) To plaintext (P, M1... Mn) obtained by combining plaintext blocks (Mi, i = 1 to n) corresponding to ciphertext (Ci, i = 1 to n).

  Next, the decryption device 11 removes the data having the data length of the pre-block (P) from the head of the decryption result (P, M1... Mn) of the ciphertext (Cp, C1... Cn). Then, the pre-block (P) is removed, plaintext (M1... Mn) corresponding to the ciphertext (C1... Cn) is generated (S16), and the procedure illustrated in FIG. .

 When predetermined data is padded and encrypted according to a standard such as PKCS # 5, the predetermined data padded according to a standard such as PKCS # 5 is removed from the plaintext (M1... Mn). .

  From here, the Example of the encryption system based on this invention is described. FIG. 4 is a diagram illustrating the encryption / decryption system 2 according to the first embodiment. The encryption / decryption system 2 illustrated in FIG. 4 includes a personal computer 20 that functions as the encryption device 10, a personal computer 21 that functions as the decryption device 11, and a server 22 that functions as the pre-block generation device 12. The personal computers 20 and 21 and the server 22 are connected via the Internet 23.

  In the server 22 functioning as the pre-block generation device 12, a software as a service (Saas) for sharing application software corresponding to a required function to a plurality of users, or an ASP (for renting application software for business use to a specific user) In the first embodiment, the application software provided by the server 22 is software that functions as the pre-block generation device 12 described so far.

  The personal computer 20 that functions as the encryption device 10 is mounted with the computer program that functions as the encryption device 10 described so far, and the personal computer 21 that functions as the decryption device 11 includes the decryption device described so far. A computer program functioning as 11 is implemented.

  The computer program that functions as the encryption device 10 and the decryption device 11 is specifically realized by an add-in of an application that needs to encrypt data transmitted between personal computers. An example of the application is a mail Client software.

  When encrypting the data to be transmitted to the personal computer 21, the personal computer 20 executes the procedure illustrated in FIG. 2 to generate a ciphertext of the data, and transmits the generated ciphertext to the personal computer 21. In the first embodiment, since the apparatus that generates the pre-block (P) is the server 22, the personal computer 20 generates the pre-block (P) using application software operated by the server 22. It will be.

  Further, when decrypting the ciphertext received from the personal computer 20, the personal computer 21 executes the procedure illustrated in FIG. 3 to decrypt the ciphertext. In the first embodiment, since the apparatus that generates the pre-block (P) is the server 22, the personal computer 21 generates the pre-block (P) using application software operated by the server 22. It will be.

(Embodiment 2)
Next, a second embodiment according to the encryption device and the decryption device of the present invention will be described. FIG. 5 is a diagram illustrating the encryption device 3 and the decryption device 4 according to the second embodiment.

 The encryption device 3 according to the second embodiment uses the same common key (K) on the encryption side and the decryption side, such as DES and AES, and encrypts in units of blocks having a predetermined block length. As shown in FIG. 5A, the encryption device 3 includes a pre-block generation unit 31 that generates a pre-block (P) from the transferred common key (K), and a pre-block generation unit 31. The ciphertext (C1... Mn) encrypted by encrypting the plaintext (M1... Mn) to be encrypted using the preblock (P) generated by the preblock generation unit 31. Cn) is generated, and the pre-block generation unit 31 and the encryption unit 30 are computer programs for causing a computer used as the encryption device 3 to operate as the pre-block generation unit 31 and the encryption unit 30. Real It is.

  In addition, the decryption device 4 according to the second embodiment uses the same common key (K) on the encryption side and the decryption side, such as DES and AES, and decrypts in units of blocks having a predetermined block length. As shown in FIG. 5B, the decryption device 4 includes a pre-block generation unit 41 that generates a pre-block (P) from the transferred common key (K), and a pre-block generation unit 41. A plaintext (M1... Mn) obtained by passing the common key (K) and decrypting the ciphertext (C1... Cn) to be decrypted using the preblock (P) generated by the preblock generation unit 41. The pre-block generation unit and the decoding unit 40 are provided by a computer program that causes a computer used as the decoding device 4 to operate as a decoding unit.

  From here, the procedure which the encryption apparatus 3 performs is demonstrated. FIG. 6 is a flowchart showing a procedure in which the encryption device 3 encrypts plain text (M1... Mn).

  When the encryption unit of the encryption device 3 encrypts plaintext (M1... Mn), first, the plaintext (M1... Mn) to be encrypted and the common key (K) used for encryption. Is designated as the encryption device 3 (S20). When the plaintext (M1... Mn) and the common key (K) are not stored in the encryption device 3, the plaintext (M1... Mn) and the common key (K) are encrypted by the operator or an external device. When the plaintext (M1... Mn) and the common key (K) are stored in the encryption device 3, the plaintext (M1) stored in the encryption device 3 is input to the device 3. ... Mn) and the common key (K) are designated by an operator or an external device.

 Since block ciphers are processed in units of block length, if the data length of the specified plaintext is not an integral multiple of the block length, PKCS # 5 is set so that the data length is an integral multiple of the block cipher block length. Predetermined data is padded according to a standard such as, and the plaintext is divided into n plaintext blocks (Mi, i = 1 to n).

 Next, the encryption device 3 passes the designated common key (K) to the pre-block generation unit 31, and the pre-block generation unit 31 generates and generates a pre-block (P) from the common key (K). The pre-block (P) is transferred to the encryption unit 30 (S21).

  The method used when the pre-block generation unit 31 generates the pre-block (P) may be arbitrary as long as the data length is an integral multiple of the block length of the block cipher. As such a method, the common key (K) Can be encrypted with the common key (K), bit rotation can be performed according to a predetermined procedure for the common key (K), and an extreme example can be used.

  In addition, a method of generating a pre-block (P) by deriving a derived key from the common key (K) is also conceivable. For example, the pre-block (P) can be generated by encrypting the common key (K) with this derived key, or encrypting this derived key with the common key (K). A pre-block (P) can also be generated by encrypting the derived key itself with a key. The derived key may be derived by shifting or rotating a predetermined byte of the common key (K).

  Further, a method of generating a pre-block (P) by deriving a derived block whose data length is an integral multiple of the block cipher block length from the common key (K) using an encryption key extension algorithm or the like is also conceivable. For example, the pre-block (P) can be generated by encrypting this derived block with the common key (K). The encryption key used for the encryption of the derived block may be the above-described derived key.

  When the preblock (P) is delivered from the preblock generation unit 31, the encryption unit 30 of the encryption device 3 generates plaintext (P, M1... Mn) with the preblock (P) added to the head. After that, the plaintext (P, M1... Mn) is encrypted in the ciphertext block chain mode according to a predetermined block cipher algorithm using the common key (K) (S23).

  In the ciphertext block chaining mode, since encryption is performed sequentially from the first plaintext block, the encryption result of the plaintext (P, M1... Mn) is the cipher block (Cp) corresponding to the pre-block (P). And ciphertext (Cp, C1... Cn) obtained by combining cipher blocks (Ci, i = 1 to n) corresponding to plaintext blocks (Mi, i = 1 to n).

  Then, the encryption unit of the encryption device 3 starts from the top of the ciphertext (Cp, C1... Cn) obtained by encrypting the plaintext (P, M1. By removing the data of the data length, a process of removing the cipher block (Cp) corresponding to the pre-block (P) is performed, and the cipher text (C1... Cn) corresponding to the plain text (M1... Mn). (S24), and the procedure illustrated in FIG. 6 ends.

 Next, a procedure executed by the decoding device 4 will be described. FIG. 7 is a flowchart showing a procedure in which the decryption device 4 decrypts the ciphertext (C1... Cn).

  When the decryption device 4 decrypts the ciphertext (C1... Cn), the ciphertext (C1... Cn) to be decrypted and the common key (K) are designated (S30). Since the plaintext (M1... Mn) data length is encrypted after being padded to an integral multiple of the block cipher block length, the ciphertext (C1... Cn) data length is always the block cipher block length. In FIG. 3, the ciphertext (C1... Cn) is divided into n ciphertext blocks (Ci, i = 1 to n).

 Next, the decryption device 4 passes the designated common key (K) to the pre-block generation unit 41, and the pre-block generation unit 41 substitutes the common key (K) for a predetermined function to pre-block (P) And the generated pre-block (P) is transferred to the decoding unit 40 (S31).

  The method used when the pre-block generation unit 41 generates the pre-block (P) may be arbitrary as long as the data length is an integral multiple of the block length of the block cipher. As such a method, the common key (K) Can be encrypted with the common key (K), bit rotation can be performed according to a predetermined procedure for the common key (K), and an extreme example can be used.

  When the pre-block generation unit 41 generates the pre-block (P), the decryption unit 40 of the decryption device 4 uses the designated common key (K) and pre-blocks in the ciphertext block chain mode according to a predetermined block cipher algorithm. By encrypting (P), a cipher block (Cp) corresponding to the pre-block (P) is generated (S32).

  When the encryption block corresponding to the pre-block is generated, the decryption unit 40 of the decryption device 4 performs the procedure reverse to the process of removing the encryption block (Cp) corresponding to the pre-block (P), that is, the pre-block (P). After generating a ciphertext (Cp, C1... Cn) prefixed with the corresponding cipher block (Cp) (S33), a procedure reverse to the encryption, that is, using a common key (K) In accordance with the block cipher algorithm, the ciphertext (Cp, C1... Cn) is decrypted in the ciphertext block chain mode (S34).

  In the ciphertext block chaining mode, since the decryption is performed sequentially from the first block, the decryption result of the ciphertext (Cp, C1... Cn) is the block obtained by decrypting the cipher block (Cp), that is, the pre-block (P ) And plaintext (P, M1... Mn) obtained by combining plaintext blocks (Mi, i = 1 to n) corresponding to ciphertext (Ci, i = 1 to n).

  Next, the decryption unit 40 of the decryption device 4 removes the data having the data length of the pre-block (P) from the head of the decryption result (P, M1... Mn) of the plaintext (Cp, C1... Cn). By doing so, the process of removing the pre-block (P) from the plaintext (P, M1... Mn) is performed, and the plaintext (M1... Mn) corresponding to the ciphertext (C1... Cn) is generated. (S35), the procedure illustrated in FIG. 7 ends.

  Next, as an embodiment of the encryption device 3 and the decryption device 4, an IC card 5 having the functions of the encryption device 3 and the decryption device 4 according to the present invention will be described.

  FIG. 8 is a diagram illustrating the IC card 5 according to the second embodiment. FIG. 8A illustrates a circuit and a memory included in the IC chip 6 mounted on the IC card 5. As illustrated in FIG. 8A, the IC chip 6 mounted on the IC card 5 includes A central processing unit 60 (CPU: Central Processing Unit) having an arithmetic function and a function for controlling a memory, an I / O circuit 61 used for data input / output with an external device, and a random access memory 62 which is a volatile memory (RAM: Random Access Memory), read-only nonvolatile memory 63 (ROM: Read Only Memory), EEPROM 64 (EEPROM: Electrically Erasable Programmable Read-Only Memory), DES, The CPU 60 and the CPU 6 are provided with a coprocessor circuit 65 that is a circuit specialized for cryptographic operations, an RNG circuit 66 (Random Number Generator) that is a circuit that generates random numbers, and the like. Memory and circuits other than being connected via a data bus 67 and address bus 68.

  In FIG. 8A, the coprocessor circuit 65, which is a circuit specialized for DES cryptographic operations, is illustrated. However, since DES cryptographic operations can be realized only by a computer program, DES There may be a case where the coprocessor circuit 65, which is a circuit specialized for the cryptographic operation, is not mounted.

 FIG. 8B illustrates a computer program mounted on the IC card. As illustrated in FIG. 8B, the ROM 63 and the EEPROM 64 of the IC chip 6 have a common key (used for a predetermined block cipher ( K) is stored, and the plaintext (M1... Mn) is encrypted in the ciphertext block chaining mode according to a predetermined block cipher algorithm as a computer program operating on the IC card 1 using a common key (K). The ciphertext (C1... Cn) in the ciphertext block chain mode using the encryption module 50 functioning as the encryption means 30 of the encryption device 3 to be encrypted and the common key (K) according to a predetermined block cipher algorithm Decryption module 51 functioning as the decryption means 40 of the decryption device 4 for decrypting the data, and the pre-block generation means 31 or the decryption device of the encryption device 3 8 includes a pre-block generation module 52 that functions as the pre-block generation unit 41 of FIG. 4, and FIG. 8B illustrates an internal authentication command 53 (Internal Authentication Command) as an example of a command that uses the encryption module 50. As an example of a command using the decryption module 51, an external authentication command 54 (External Authentication Command) is illustrated.

  The internal authentication command 53 using the encryption module 50 is a challenge (random number) transmitted from an external device using an internal authentication key (here, a common key) as described in an IC card standard such as JICSAP. When encrypting a challenge (random number) transmitted from an external device using an internal authentication key (here, a common key) with a command that generates an internal authentication code by encrypting As described above, the encryption module 50 generates the pre-block (P) using the pre-block generation module 52 and encrypts the challenge (random number) transmitted from the external device.

As described in the IC card standard such as JICSAP, the external authentication command 54 using the decryption module 51 uses an external authentication key (here, a common key) to send an external authentication code transmitted from an external device. A command that authenticates the external authentication code by decrypting and comparing the decryption result with the challenge (random number) output from the IC card, and using the external authentication key (here, the common key) When decrypting the authentication code, as illustrated in FIG. 7, the decryption module 51 generates a pre-block (P) using the pre-block generation module 52 and decrypts the external authentication code transmitted from the external device. .

DESCRIPTION OF SYMBOLS 1 Encryption / decryption system according to Embodiment 1 10 Encryption device according to Embodiment 1 11 Decryption device according to Embodiment 1 12 Pre-block generation device according to Embodiment 1 2 Encryption / decryption system 20 according to Example 1 Personal computer that functions as an encryption device 21 Personal computer that functions as a decryption device 22 Server that functions as a pre-block generation device 3 Encryption device according to the second embodiment 30 Encryption means 31 Pre-block generation means 4 Decryption according to the second embodiment Device 40 Decryption Unit 41 Preblock Generation Unit 5 IC Card According to Embodiment 2 50 Encryption Module 51 Decryption Module 52 Preblock Generation Module 53 Internal Authentication Command 54 External Authentication Command

Claims (19)

 An encryption device for encrypting plaintext generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for plaintext encryption, based on a predetermined block cipher In the chain mode, after encrypting the plaintext with the preblock added at the head with a common key, generating a plaintext ciphertext by removing the encryption block corresponding to the preblock from the encrypted result; An encryption method comprising:  A step in which a decryption device for decrypting a ciphertext generates a pre-block that is an integral multiple of the block cipher block length from a block cipher common key used for decrypting the ciphertext, and a cipher block chain based on a predetermined block cipher Encrypting the pre-block with a common key in the mode, after decrypting the ciphertext prefixed with the cipher block of the pre-block with the common key in the cipher block chaining mode based on a predetermined block cipher And a step of generating plaintext of ciphertext by removing the pre-block from the decryption result.  Based on a block cipher common key used for plaintext encryption, a preblock generation unit that generates a preblock that is an integral multiple of the block length of the block cipher, and a predetermined block cipher in the cipher block chaining mode, An encryption unit that generates a plaintext ciphertext by removing a cipher block corresponding to the preblock from the encrypted result after encrypting the plaintext with the preblock added at the head, and An encryption device characterized by that.   The encryption apparatus according to claim 3, wherein the pre-block generation unit generates the pre-block by manipulating bits of a common key according to a predetermined procedure.   The encryption according to claim 3, wherein the pre-block generation unit generates the pre-block by encrypting a common key using a common key or a common key obtained by manipulating bits according to a predetermined procedure. apparatus.   The pre-block generation unit generates the pre-block by deriving a derived key from a common key, encrypting the common key with the derived key, or encrypting the derived key with the common key The encryption device according to claim 3.   4. The encryption apparatus according to claim 3, wherein the pre-block generation unit generates the pre-block by deriving a derived key from a common key and encrypting the derived key with the derived key. .   The pre-block generation unit generates a pre-block by deriving a derived block whose data length is an integral multiple of the block length of the block cipher from a common key, and encrypting the derived block with the common key. The encryption device according to claim 3.  The pre-block generation unit generates a pre-block by deriving a derived block and a derived key whose data length is an integral multiple of the block cipher block length from a common key, and encrypting the derived block with the derived key The encryption apparatus according to claim 3, wherein:  Based on a pre-block generation unit that generates a pre-block that is an integral multiple of the block cipher block length from the block cipher common key used for decrypting the ciphertext, and based on a predetermined block cipher, in the cipher block chaining mode, Encrypting a pre-block with a common key, based on a predetermined block cipher, in a cipher block chaining mode, after decrypting the ciphertext with the pre-block cipher block added to the beginning of the ciphertext with the common key, A decryption apparatus comprising decryption for generating plaintext of ciphertext by removing the pre-block from the decryption result.   The decoding apparatus according to claim 10, wherein the pre-block generation unit generates the pre-block by manipulating bits of a common key according to a predetermined procedure.   The decryption apparatus according to claim 10, wherein the pre-block generation unit generates the pre-block by encrypting a common key using a common key or a common key obtained by manipulating bits according to a predetermined procedure. .   The pre-block generation unit generates the pre-block by deriving a derived key from a common key, encrypting the common key with the derived key, or encrypting the derived key with the common key The decoding device according to claim 10.   The decryption apparatus according to claim 10, wherein the pre-block generation unit generates the pre-block by deriving a derived key from a common key and encrypting the derived key with the derived key.   The pre-block generation unit generates a pre-block by deriving a derived block whose data length is an integral multiple of the block length of the block cipher from a common key, and encrypting the derived block with the common key. The decoding device according to claim 10.  The pre-block generation unit generates a pre-block by deriving a derived block and a derived key whose data length is an integral multiple of the block cipher block length from a common key, and encrypting the derived block with the derived key The decoding device according to claim 10, wherein: A VPN (Virtual Private Network) is constructed with another device, a pre-block that is an integral multiple of the block cipher block length is generated from the block cipher common key received from the other device, and the generated pre-block is A pre-block generation device that transmits to another device;
When encrypting plaintext, construct a VPN with the pre-block generation device, send a common key to be used for plaintext encryption to the pre-block generation device, and in cipher block chaining mode based on a predetermined block cipher Then, after encrypting the plaintext added with the preblock received from the preblock generation device with a common key, the ciphertext corresponding to the preblock is removed from the encrypted result by removing the encrypted block corresponding to the preblock. An encryption device to generate;
A VPN is constructed with the pre-block generation device, and a common key used for decrypting the ciphertext generated by the encryption device is transmitted to the pre-block generation device, and in a cipher block chaining mode based on a predetermined block cipher A step of encrypting the pre-block with a common key, based on a predetermined block cipher, in a cipher block chaining mode, a ciphertext prefixed with the pre-block cipher block received from the pre-block generation device is shared A decryption device that generates plaintext of ciphertext by removing the pre-block from the decryption result after decryption with the key;
An encryption / decryption system comprising:   18. The encryption / decryption system according to claim 17, wherein the pre-block generation device generates the pre-block by bit-rotating a common key according to a predetermined procedure. 18. The encryption / decryption system according to claim 17, wherein the pre-block generation device generates the pre-block by encrypting a common key with the common key itself.

Images