JP2015022269A - Encryption device, decryption device, encryption method, decryption method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the leakage of an initialization vector and thereby improve cipher strength in encryption by a ciphertext block chain mode.SOLUTION: An encryption device according to the present invention, in performing encryption by a CBC mode, generates an initialization vector by utilizing a prescribed plaintext block selected from second and subsequent plaintext blocks in accordance with a content indicated by initialization vector generation instruction information and encrypts plaintext data by utilizing the generated initialization vector. A decryption device according to the present invention generates, upon obtaining second and subsequent plaintext blocks by decrypting second and subsequent ciphertext blocks, an initialization vector by utilizing prescribed plaintext data selected from the second and subsequent plaintext data obtained by decryption in accordance with a content indicated by the same initialization vector generation instruction information as on the encryption device side and decrypts a first ciphertext block by utilizing the generated initialization vector to obtain a first plaintext block.

Description

  The present invention relates to an encryption device, a decryption device, an encryption method, a decryption method, and a program.

  Block encryption methods such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard) are known. The block encryption method is one of common key encryption methods, for example, encryption methods that perform encryption and decryption in units of fixed-length blocks.

As block ciphers, an ECB (Electronic CodeBook) mode (cipher book mode) and a CBC (Cipher Block Chaining) mode (ciphertext block chain mode) are known.
The ECB mode simply performs encryption and decryption completed in units of blocks.
In the CBC mode, an exclusive OR operation (XOR) is performed between the ciphertext block obtained by encrypting the previous plaintext block and the current plaintext block, and the result of the exclusive OR operation is encrypted. In this case, for the first plaintext block, there is no previous ciphertext block to be subjected to the exclusive OR operation. Therefore, the first plaintext block is encrypted by performing an exclusive OR operation with a predetermined initialization vector instead of the ciphertext block.

  For example, in the encryption in the CBC mode, a technology that encrypts a plaintext with a preblock added at the head and removes a ciphertext block corresponding to the preblock from a ciphertext obtained by the encryption is used as a ciphertext for the plaintext. Known (Patent Document 1).

JP 2012-168274 A

  The initialization vector in the CBC mode is normally used in a fixed manner after being previously shared between the encryption side and the decryption side. For this reason, in the case where the initialization vector leaks in the CBC mode, the initialization vector may become a starting point for decryption. In other words, in the CBC mode, preventing leakage of the initialization vector is one effective measure for increasing the encryption strength.

  However, since the technique described in Patent Document 1 has a configuration for the purpose of preventing the initial ciphertext block from becoming a starting point for decryption, it cannot prevent the initialization vector from leaking. .

  The present invention has been made in view of such circumstances, and an object of the present invention is to improve the encryption strength by preventing the leakage of the initialization vector in the ciphertext block chain mode encryption.

  In order to solve the above-described problem, an encryption apparatus according to an aspect of the present invention is a method for generating an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing plaintext data. An initialization vector generation instruction information storage unit for storing initialization vector generation instruction information in which the same contents are also stored in the decoding device, and an initialization vector indicated by the initialization vector generation instruction information An initialization vector generation unit that generates an initialization vector using the predetermined plaintext block according to the generation method of the first plaintext block of the plaintext block is encrypted using the initialization vector. An encryption unit that encrypts the second and subsequent plaintext blocks using the ciphertext block obtained by the previous encryption, and the ciphertext block And a ciphertext data output unit for outputting the ciphertext data including.

  In the encryption apparatus, the initialization vector generation instruction information indicates that an exclusive OR of the predetermined plaintext block should be an initialization vector, and the initialization vector generation unit An initialization vector may be generated by obtaining an exclusive OR of plaintext blocks.

  In the encryption apparatus, the initialization vector generation instruction information is sequentially transmitted from the n (n is a predetermined natural number of 2 or more) plaintext blocks as predetermined plaintext blocks used for generating the initialization vector. The initialization vector generation unit may use plaintext blocks sequentially selected from the nth and subsequent plaintext blocks to generate an initialization vector.

  The decryption device according to an aspect of the present invention is content information indicating how to generate an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing plaintext data, 1 for the second and subsequent ciphertext blocks among ciphertext blocks included in the ciphertext data, and an initialization vector generation instruction information storage unit that stores initialization vector generation instruction information in which the same contents are stored. The second and subsequent plaintext blocks are obtained by decrypting using the previous ciphertext block, and the first plaintext block is obtained by decrypting using the initialization vector for the first ciphertext block. And the second and subsequent plaintext blocks acquired by the decoding unit according to the method of generating the initialization vector indicated by the initialization vector generation instruction information From among using a predetermined plaintext block and a initialization vector generator for generating an initialization vector.

  Further, in the above decoding device, the initialization vector generation instruction information indicates that an exclusive OR of the predetermined plaintext block should be an initialization vector, and the initialization vector generation unit includes the predetermined plaintext An initialization vector may be generated by obtaining an exclusive OR of blocks.

  In the above decoding apparatus, the initialization vector generation instruction information is sequentially selected from nth (n is a predetermined natural number of 2 or more) plaintext blocks as predetermined plaintext blocks used for generating the initialization vector. The initialization vector generation unit may use plaintext blocks sequentially selected from the nth and subsequent plaintext blocks to generate an initialization vector.

  An encryption method according to an aspect of the present invention includes a predetermined plaintext block in the second and subsequent plaintext blocks among a plurality of plaintext blocks obtained by dividing plaintext data indicated by initialization vector generation instruction information in which the same content is stored in a decryption device An initialization vector generation step of generating an initialization vector using the predetermined plaintext block according to a method of generating an initialization vector using the method, and the initialization vector for the first plaintext block of the plaintext block And encrypting the second and subsequent plaintext blocks using the ciphertext block obtained by the previous encryption, and outputting ciphertext data including the ciphertext block A ciphertext data output step.

  In the decryption method as one aspect of the present invention, the second and subsequent ciphertext blocks of ciphertext data included in the ciphertext data are decrypted using the previous ciphertext block. A plaintext block is obtained, and the first ciphertext block is decrypted using an initialization vector to obtain the first plaintext block, and initialization in which the same content is stored in the encryption device The second and subsequent plaintexts acquired by the decryption step according to the method of generating an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data indicated by the vector generation instruction information An initialization vector generation step of generating an initialization vector using the predetermined plaintext block from among the blocks.

  A program according to one aspect of the present invention is a program in which a predetermined plaintext in a second and subsequent plaintext blocks among a plurality of plaintext blocks divided by plaintext data indicated by initialization vector generation instruction information in which the same contents are stored in a decryption device An initialization vector generation step of generating an initialization vector using the predetermined plaintext block according to a method of generating an initialization vector using the block, and the initialization of the first plaintext block of the plaintext block Encrypting using a vector, encrypting the second and subsequent plaintext blocks using the ciphertext block obtained by the previous encryption, and ciphertext data including the ciphertext block This is for executing the ciphertext data output step to be output.

  The program as one aspect of the present invention allows the computer to decrypt the second and subsequent ciphertext blocks out of ciphertext blocks included in the ciphertext data by using the previous ciphertext block. The subsequent plaintext block is acquired, and the first ciphertext block is decrypted using the initialization vector to obtain the first plaintext block, and the same contents are stored in the encryption device. The second and subsequent acquired by the decryption step according to the method of generating an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data indicated by the initialization vector generation instruction information An initialization vector generating step for generating an initialization vector using the predetermined plaintext block from among the plaintext blocks of It is intended to execute.

  According to the present invention, it is possible to prevent the initialization vector from being leaked and improve the encryption strength in the encryption in the ciphertext block chain mode.

It is a figure which shows the structural example of the encryption apparatus and decryption apparatus in this embodiment. It is a figure which shows the IC card and reader / writer as an example which actualized the encryption apparatus and decryption apparatus of this embodiment. It is a figure which shows the example of a general encryption procedure which the encryption apparatus corresponding to CBC mode performs. It is a figure which shows the example of the procedure of the general decoding which the decoding apparatus corresponding to CBC mode performs. It is a figure which shows the example of a procedure of the encryption which the encryption apparatus of this embodiment performs. It is a figure which shows the structural example of the initialization vector production | generation part in this embodiment. It is a figure which shows the example of a procedure of the decoding which the decoding apparatus of this embodiment performs. It is a flowchart which shows the example of a process sequence for the encryption apparatus of this embodiment to set the production | generation algorithm for initialization vector production | generation. It is a flowchart which shows the example of a process sequence for the encryption which the encryption apparatus of this embodiment performs, and the decoding which a decoding apparatus performs. It is a figure which shows the example of selection of the plaintext block as a modification of this embodiment. It is a figure which shows the example of selection of the plaintext block as another modification of this embodiment.

[Configuration example of encryption device and decryption device]
FIG. 1 shows a configuration example of the encryption device 100 and the decryption device 200 of the present embodiment.
First, the encryption device 100 will be described. The encryption apparatus 100 according to the present embodiment corresponds to a block encryption method as a CBC (Cipher Block Chaining) mode.
The encryption apparatus 100 shown in the figure includes a plaintext data output unit 101, a plaintext data division unit 102, an initialization vector generation instruction information storage unit 103, an initialization vector generation unit 104, an encryption unit 105, and a ciphertext data output unit 106. And a transmission unit 107.

  The plaintext data output unit 101 outputs plaintext data to be encrypted. As a specific example, the plaintext data output unit 101 includes a plaintext data storage unit (not shown), and is configured to read plaintext data stored in advance in the plaintext data storage unit and output the plaintext data to the plaintext data division unit 102. be able to. Alternatively, the plaintext data output unit 101 may output plaintext data input from the outside via a data interface or the like to the plaintext data division unit 102, for example.

  The plaintext data dividing unit 102 divides the plaintext data output by the plaintext data output unit 101 into plaintext block units. The plaintext block has a fixed length of 8 bits or 16 bits, for example.

The initialization vector generation instruction information storage unit 103 stores initialization vector generation instruction information. The initialization vector generation instruction information is information indicating how to generate an initialization vector using a predetermined plaintext block.
The initialization vector generation instruction information indicates how to generate the initialization vector. For example, which plaintext block is selected when generating the initialization vector, and how the selected plaintext block is used to generate the initialization vector. It is information which shows.
Since the initialization vector is used to encrypt the first (first) plaintext block, the plaintext block that can be used to generate the initialization vector is the plaintext obtained by the plaintext data dividing unit 102. Among the blocks, the second and subsequent plaintext blocks excluding the first are used.

The same content is stored in the decoding device 200 as the initialization vector generation instruction information. For this reason, the initialization vector generation instruction information is stored in the initialization vector generation instruction information storage unit 103 of the encryption apparatus 100, for example, before being transferred to the user of the encryption apparatus 100. Similarly, on the decoding device 200 side, the initialization vector generation instruction information is stored in the decoding device 200 before being delivered to the user of the decoding device 200.
That is, in the present embodiment, the initialization vector generation instruction information is shared in advance between the encryption device 100 and the decryption device 200.

The initialization vector generation unit 104 generates an initialization vector (Initial Vector: IV). The initialization vector is data used for encryption of the first plaintext block in the block cipher in the CBC mode corresponding to the present embodiment.
The initialization vector generation unit 104 in the present embodiment generates an initialization vector using a predetermined plaintext block according to the method of generating the initialization vector indicated by the initialization vector generation instruction information.

Specifically, the initialization vector generation unit 104 reads the initialization vector generation instruction information from the initialization vector generation instruction information storage unit 103 when the encryption apparatus 100 is activated. The initialization vector generation unit 104 sets an initialization vector generation algorithm according to the method of generating the initialization vector indicated by the read initialization vector generation instruction information.
Thereafter, the initialization vector generation unit 104 uses the generated plaintext block from the plaintext block obtained by the plaintext data division unit 102 according to the generation algorithm according to the timing at which the plaintext data should be encrypted. Enter the power plaintext block. The initialization vector generation unit 104 generates an initialization vector by performing an operation according to a generation algorithm set using the input plaintext block.

  The encryption unit 105 encrypts the first plaintext block of the plaintext blocks obtained by the plaintext data division unit 102 using the initialization vector, and encrypts the previous plaintext block for the second and subsequent plaintext blocks. Encrypt using the ciphertext block obtained by That is, the encryption unit 105 performs encryption in block units corresponding to the CBC mode in the block encryption method to obtain ciphertext blocks.

The ciphertext data output unit 106 generates ciphertext data using a ciphertext block corresponding to each plaintext block obtained by the encryption unit 105. Specifically, the ciphertext data output unit 106 can generate ciphertext data by concatenating ciphertext blocks. The ciphertext data output unit 106 outputs the generated ciphertext data.
The transmission unit 107 transmits the ciphertext data output from the ciphertext data output unit 106 to the decryption device 200. The transmission path for transmitting the ciphertext data to the decryption apparatus 200 by the transmitting unit 107 may be a network or a predetermined data interface, and may be wireless or wired.

Next, the decoding device 200 will be described.
The decryption apparatus 200 includes a reception unit 201, a ciphertext data division unit 202, a decryption unit 203, an initialization vector generation instruction information storage unit 204, an initialization vector generation unit 205, and a plaintext data generation unit 206.

The receiving unit 201 receives the ciphertext data transmitted from the encryption device 100.
The ciphertext data dividing unit 202 divides the ciphertext data received by the receiving unit 201 into ciphertext block units. One ciphertext block corresponds to one plaintext block and has a size with a predetermined fixed length.

  The decryption unit 203 obtains second and subsequent plaintext blocks by decrypting the second and subsequent ciphertext blocks using the previous ciphertext block among ciphertext blocks included in the ciphertext data. . In addition, the decryption unit 203 obtains the first plaintext block by performing decryption using the initialization vector for the first ciphertext block.

  The initialization vector generation instruction information storage unit 204 stores initialization vector generation instruction information having the same content as that stored in the initialization vector generation instruction information storage unit 103 of the encryption device 100. That is, the encryption apparatus 100 and the decryption apparatus 200 share the initialization vector generation instruction information having the same contents in advance as described above. Thereby, the encryption apparatus 100 and the decryption apparatus 200 can generate an initialization vector by the same process.

The initialization vector generation unit 205 generates an initialization vector using a predetermined plaintext block indicated by the initialization vector generation instruction information from the second and subsequent plaintext blocks acquired by the decryption unit 203.
Specifically, the initialization vector generation unit 205 reads the initialization vector generation instruction information from the initialization vector generation instruction information storage unit 204, for example, when the decoding device is activated. The initialization vector generation unit 205 sets an initialization vector generation algorithm according to the method of generating the initialization vector indicated by the read initialization vector generation instruction information.
Also, the decryption unit 203 in the decryption device 200 decrypts the second and subsequent ciphertext blocks in response to the reception of the ciphertext data, and acquires the second and subsequent plaintext blocks. Therefore, the initialization vector generation unit 205 inputs a plaintext block to be used for generation of the initialization vector from the second and subsequent plaintext blocks obtained by the decryption unit 203 according to the generation algorithm. The initialization vector generation unit 205 generates an initialization vector by performing a predetermined operation according to a generation algorithm using the input plaintext block.
The decryption unit 203 decrypts the first ciphertext block using the initialization vector generated as described above.

  The plaintext data generation unit 206 generates plaintext data from the first and second and subsequent plaintext blocks obtained by the decryption unit 203. Specifically, the plaintext data generation unit 206 can generate plaintext data by connecting the first and second and subsequent plaintext blocks.

[Implementation example of encryption device and decryption device]
FIG. 2 shows an IC card 300 and a reader / writer 400 as an example of realizing the encryption device 100 and the decryption device 200 of the present embodiment.
The IC card 300 is a card on which an integrated circuit is mounted. The reader / writer 400 reads data from the IC card 300 or writes data to the IC card 300 by communicating with the IC card 300 using a predetermined communication method.

In the combination of the IC card 300 and the reader / writer 400 in FIG. 2, there are a case where the IC card 300 transmits data to the reader / writer 400 and a case where the reader / writer 400 transmits data to the IC card 300.
When data is encrypted when the IC card 300 transmits data to the reader / writer 400, the IC card 300 functions as the encryption device 100 and the reader / writer 400 functions as the decryption device 200.
When data is encrypted when the reader / writer 400 transmits data to the IC card 300, the reader / writer 400 functions as the encryption device 100 and the IC card 300 functions as the decryption device 200.

[General encryption and decryption processing as CBC mode]
The CBC mode corresponding to the encryption device 100 and the decryption device 200 of this embodiment is one of the usage modes in the block encryption method. The block encryption method is one of the common key encryption methods, and performs encryption and decryption in units of fixed-length blocks. In addition, in the CBC mode, an exclusive OR between the ciphertext block obtained by encrypting the previous plaintext block and the current plaintext block is obtained, and the obtained exclusive OR result is obtained. To encrypt.

FIG. 3 shows an example of a general encryption procedure executed by the encryption apparatus corresponding to the CBC mode.
In encryption in the CBC mode, plaintext data to be encrypted is divided into a plurality of fixed-length blocks. In the example of FIG. 3, the plaintext data Dpln is divided into four plaintext blocks M1, M2, M3, and M4.

As described above, in the CBC mode, when encrypting a plaintext block, a ciphertext block obtained by encrypting the previous plaintext block is used. However, for the first plaintext block M1, there is no ciphertext block obtained by encrypting the previous plaintext block.
Therefore, the initialization vector Div is used to encrypt the head plaintext block M1 in the CBC mode. The initialization vector Div in the case of FIG. 3 is a predetermined fixed value, and the decryption device shares the same initialization vector Div as the encryption device. Then, as shown in FIG. 3, the encryption apparatus obtains an exclusive OR of the head plaintext block M1 and the initialization vector Div (step S11).
Next, the encryption apparatus performs block unit encryption (block encryption) using the predetermined common key for the exclusive OR result obtained in step S11 (step S21). Thereby, the ciphertext block C1 corresponding to the plaintext block M1 is obtained.

Next, the encryption device obtains an exclusive OR of the plaintext block M2 next to the plaintext block M1 and the ciphertext block C1 (step S12). In addition, the encryption apparatus performs block encryption on the result of the exclusive OR (step S22). Thereby, the ciphertext block C2 corresponding to the plaintext block M2 is obtained.
Next, the encryption device obtains an exclusive OR of the plaintext block M3 and the ciphertext block C2 (step S13), and executes block encryption (step S23) to thereby obtain a ciphertext corresponding to the plaintext block M3. Get block C3.
Next, the encryption device obtains an exclusive OR operation between the plaintext block M4 and the ciphertext block C3 (step S14), and executes block encryption (step S24), thereby encrypting the ciphertext corresponding to the plaintext block M4. A sentence block C4 is obtained.
In this way, in the CBC mode, ciphertext blocks C1 to C4 corresponding to the plaintext blocks M1 to M4 are obtained. Then, the ciphertext data Denc corresponding to the plaintext data Dpln is obtained by the ciphertext blocks C1 to C4.

FIG. 4 shows an example of a general procedure in which the decryption apparatus corresponding to the CBC mode decrypts the ciphertext data Denc in FIG.
In this case, the ciphertext data Denc is divided into four ciphertext blocks C1 to C4. The decryption device shares the same initialization vector Div used by the encryption device during encryption.
Therefore, the decryption device first performs decryption (block decryption) in units of blocks using the common key for the first ciphertext block C1 (step S31), and the decryption result of step S31 and the initialization vector Div An exclusive OR is obtained (step S41). Thereby, the plaintext block M1 corresponding to the ciphertext block C1 is acquired.
Also, the decryption device performs block decryption on the second ciphertext block C2 (step S32), and obtains an exclusive OR of the decryption result and the previous ciphertext block C1 (step S42), thereby A plaintext block M2 corresponding to the sentence block C2 is acquired.
Further, the decryption device performs block decryption on the third ciphertext block C3 (step S33), and obtains an exclusive OR between the decryption result and the ciphertext block C2 (step S43), thereby obtaining the ciphertext block C3. The corresponding plaintext block M3 is acquired.
Further, the decryption device performs block decryption on the fourth ciphertext block C4 (step S34), and obtains an exclusive OR between the decryption result and the ciphertext block C3 (step S44), thereby obtaining the ciphertext block C4. The corresponding plaintext block M4 is acquired.
By arranging the plaintext blocks M1 to M4 thus obtained in order, the restored plaintext data Dpln is obtained.

In the encryption and decryption in the CBC mode shown in FIGS. 3 and 4, the encryption device and the decryption device each store the initialization vector Div having the same fixed value in advance. The encryption device and the decryption device use the initialization vector Div stored in the encryption device and the decryption device, respectively. As described above, when the initialization vector Div is stored in a fixed manner in advance, if the initialization vector Div stored in either the encryption device or the decryption device leaks, it may become a step for decryption. There is sex.
Therefore, in the present embodiment, the security relating to the leakage of the initialization vector Div is improved by performing encryption and decryption in the CBC mode as described below.

[Example of encryption and decryption procedures in this embodiment]
FIG. 5 shows an example of an encryption procedure executed by the encryption apparatus 100 of this embodiment. In the figure, the same parts as those in FIG. In the description of FIG. 5, it is assumed that the initialization vector generation unit 104 has already set a generation algorithm according to the content of the initialization vector generation instruction information.

  For encryption, the plaintext data output unit 101 of the encryption device 100 outputs plaintext data Dpln. The plaintext data division unit 102 divides the plaintext data Dpln output from the plaintext data output unit 101 into plaintext block units. FIG. 5 shows an example in which the plaintext data Dpln is divided into four plaintext blocks M1 to M4, as in FIG.

In response to the plaintext blocks M1 to M4 being obtained as described above, the initialization vector generation unit 104 generates the initialization vector Div as follows (step S51).
Here, the initialization vector generation instruction information indicates how to generate an initialization vector whose content is “select one by one from the second and subsequent plaintext blocks and find the exclusive OR of the selected plaintext blocks”. Take the case as an example.

  In this case, the initialization vector generation unit 104 selects the second to last plaintext blocks M2, M3, and M4 according to the initialization vector generation instruction information as the initialization vector generation processing in step S51. The initialization vector generation unit 104 generates an initialization vector Div by obtaining an exclusive OR for the selected plaintext blocks M2, M3, and M4. That is, in this case, the result of obtaining the exclusive OR for the plaintext blocks M2, M3, and M4 is the initialization vector Div.

Here, a functional configuration example of the initialization vector generation unit 104 when a generation algorithm is set corresponding to the example of FIG. 5 will be described with reference to FIG.
The initialization vector generation unit 104 shown in the figure includes calculation units 141-1 and 141-2. The calculation unit 141-1 calculates an exclusive OR of the plaintext blocks M2 and M3 and outputs the calculation result to the calculation unit 141-2. The operation unit 141-2 calculates the exclusive OR of the exclusive OR operation result output from the operation unit 141-1 and the plaintext block M4, and outputs the operation result as an initialization vector Div.

As described above, the initialization vector generation unit 104 according to the present embodiment generates the initialization vector Div by obtaining the exclusive OR of the plain text data to be used for generating the initialization vector Div.
In the case of an exclusive OR operation, the operations by the operation units 141-1 and 141-2 are equivalent to addition operations without carry at each bit position. That is, the calculation by the calculation units 141-1 and 141-2 outputs a result of 1 if the number of 1 is an odd number for each bit position between the plaintext blocks M2, M3, and M4, and if it is an even number. This can be realized by an operation of outputting a result of 0. Thus, in the case of an exclusive OR operation, for example, even if the number of plaintext blocks to be used for generating the initialization vector is increased, the operation is not particularly complicated. In this respect, depending on the exclusive OR operation, the initialization vector Div can be generated efficiently without depending on the number of plaintext blocks.

Returning to FIG.
The encryption unit 105 encrypts the first plaintext block M1 as follows in response to the generation of the initialization vector Div in step S51.
That is, the encryption unit 105 obtains an exclusive OR of the first plaintext block M1 and the initialization vector Div (step S11). The encryption unit 105 performs block encryption on the result of the exclusive OR obtained in step S11 using the common key (step S21). Thereby, the ciphertext block C1 corresponding to the plaintext block M1 is obtained.

Next, the encryption unit 105 obtains an exclusive OR of the second plaintext block M2 and the ciphertext block C1 obtained by encrypting the previous plaintext block M1 (step S12). The result of the exclusive OR is block-encrypted to obtain a ciphertext block C2 (step S22).
Next, the encryption unit 105 obtains an exclusive OR of the third plaintext block M3 and the ciphertext block C2 corresponding to the previous plaintext block M2 (step S13), and the obtained exclusive logic The ciphertext block C3 is obtained by block-encrypting the sum result (step S23).
Next, the encryption unit 105 obtains an exclusive OR of the fourth plaintext block M4 and the ciphertext block C3 corresponding to the previous plaintext block M3 (step S14), and the obtained exclusive logic The ciphertext block C4 is obtained by block-encrypting the sum result (step S24).

The ciphertext data output unit 106 generates ciphertext data Denc including the ciphertext blocks C1 to C4, and outputs the generated ciphertext data Denc to the transmission unit 107.
The transmission unit 107 transmits the ciphertext data Denc output from the ciphertext data output unit 106 to the decryption device 200.

  As described above, the encryption apparatus 100 according to the present embodiment uses the second and subsequent plaintext blocks among the plaintext blocks divided from the plaintext data Dpln in accordance with the initialization vector generation procedure indicated by the initialization vector generation instruction information. To generate the initialization vector Div. In addition, the encryption apparatus 100 performs encryption using the generated initialization vector Div to obtain ciphertext data Denc.

  Next, with reference to FIG. 7, an example of a decryption procedure executed by the decryption apparatus 200 according to the present embodiment in response to the ciphertext data Denc output by the encryption in FIG. 6 will be described. In FIG. 7, the same parts as those in FIG. 4 are denoted by the same reference numerals as those in FIG. In the description of the figure, it is assumed that the initialization vector generation unit 205 has already set a generation algorithm according to the content of the initialization vector generation instruction information.

In the decryption apparatus 200, the ciphertext data Denc received by the receiving unit 201 is divided into four ciphertext blocks C1 to C4 by the ciphertext data dividing unit 202.
Here, among the ciphertext blocks C1 to C4, the same initialization vector Div as that used when encrypting the plaintext block M1 is used to decrypt the first ciphertext block C1. The initialization vector generation instruction information in this case has the content of “select one by one from the second and subsequent plaintext blocks, and obtain an exclusive OR of the selected plaintext blocks”. Therefore, in this case, it is necessary to generate the initialization vector Div using the plaintext blocks M2, M3, and M4, which are all the second and subsequent plaintext blocks.

  Therefore, first, the decryption unit 203 performs decryption processing using the previous ciphertext blocks C1 to C3 for each of the second to fourth ciphertext blocks C2 to C4 to obtain plaintext blocks M2, M3, and M4. obtain.

That is, the decryption unit 203 performs block decryption on the ciphertext block C2 (step S32), and obtains a plaintext block M2 by obtaining an exclusive OR of the decryption result and the ciphertext block C1 ( Step S42).
The decryption unit 203 performs block decryption on the ciphertext block C3 (step S33), and obtains a plaintext block M3 by obtaining an exclusive OR of the decryption result and the ciphertext block C2 (step S43). ).
The decrypting unit 203 performs block decryption on the ciphertext block C4 (step S34), and obtains a plaintext block M4 by obtaining an exclusive OR operation between the decryption result and the ciphertext block C3 (step S34). S44).

As described above, the initialization vector generation unit 205 inputs the plaintext blocks M2, M3, and M4 in response to the plaintext blocks M2, M3, and M4 that are all the plaintext blocks after the second being obtained by decryption. Then, the initialization vector Div is generated (step S61).
Here, the initialization vector generation instruction information stored in the initialization vector generation instruction information storage unit 204 in the decryption apparatus 200 is the initialization vector generation stored in the encryption apparatus 100 as understood from the above description. A method of generating the initialization vector Div having the same contents as the instruction information is shown. Accordingly, the initialization vector generation unit 205 generates an initialization vector using the same generation algorithm as that of the initialization vector generation unit 104 in the encryption device 100.
Therefore, the configuration of the initialization vector generation unit 205 in this case is the same as that in FIG. As a result, the initialization vector generation unit 205 can efficiently generate the initialization vector Div without depending on the number of plaintext blocks, like the initialization vector generation unit 104 of the encryption device 100.

The decryption unit 203 decrypts the ciphertext block C1 using the initialization vector Div generated by the initialization vector generation unit 205 in step S61.
That is, the decryption unit 203 performs block decryption on the ciphertext block C1 (step S31), and obtains an exclusive OR of the decryption result and the initialization vector Div generated by the initialization vector generation unit 205. Thus, a plaintext block M1 is obtained (step S41).

  By performing the decryption process as described above, all the decrypted plaintext blocks M1 to M4 are obtained. The plaintext data generation unit 206 generates plaintext data Dpln from the plaintext blocks M1 to M4 obtained by the decryption process.

  Thus, in the present embodiment, the same procedure is performed between the encryption device 100 and the decryption device 200 by sharing the same initialization vector generation instruction information in advance between the encryption device 100 and the decryption device 200. Thus, the initialization vector Div is generated.

With such a configuration, the encryption apparatus 100 and the decryption apparatus 200 in the present embodiment do not need to share the initialization vector Div itself in advance.
In the present embodiment, initialization vector generation instruction information indicating how to generate the initialization vector Div is shared in advance between the encryption device 100 and the decryption device 200. However, even if the initialization vector generation instruction information is leaked and the generation method of the initialization vector Div is known, the second and subsequent predetermined plaintext blocks are required to generate the initialization vector Div. In order to obtain the second and subsequent predetermined plaintext blocks, it is necessary to decrypt the corresponding ciphertext block and to know the common key. Therefore, for example, even if an attacker knows how to generate the initialization vector Div, the security is maintained as long as the common key is not known and cannot be decrypted into a plaintext block.
On the other hand, when the fixed initialization vector Div itself is leaked, the initialization vector Div may become a starting point for estimating the common key by verifying the correspondence between the first ciphertext block C1 and the plaintext block M1. Goes up. Thus, in this embodiment, the security is improved as compared with the case where the initialization vector Div itself is shared between the encryption device and the decryption device.

In this embodiment, the initialization vector Div is generated using a plaintext block that is a part of the plaintext data. For example, in a single session or a plurality of sequences in a transaction, plaintext data having the same content is generated. It can be assumed that there is almost no encryption.
Therefore, by using the plaintext block for generating the initialization vector Div as in the present embodiment, a different initialization vector Div is generated every time plaintext data is encrypted. Thereby, in this embodiment, the security with respect to the leakage of the initialization vector Div can further be improved.

  In the example described with reference to FIGS. 5 and 7, the instruction to select a plaintext block to be used for generating the initialization vector indicated by the initialization vector generation instruction information is “one from the second and subsequent plaintext blocks”. "Sequentially select one by one". With such a selection instruction, the encryption device 100 and the decryption device 200 always select the second to last plaintext data even if the number of plaintext blocks obtained by division differs for each plaintext data. Thus, the plaintext data used for generating the initialization vector Div can be the same. In other words, the plaintext block selection instruction of “sequentially selecting from the second and subsequent plaintext blocks one by one” can be applied regardless of the number of plaintext blocks divided from the plaintext data.

Further, as understood from the above description, the plaintext block is used for generating the initialization vector in the present embodiment, but the first plaintext block is encrypted using the initialization vector, Since it becomes the data to be decoded, it is not used for generating the initialization vector. Therefore, the generation of the initialization vector in the present embodiment corresponds to the case where there are two or more plaintext blocks divided from the plaintext data.
However, the plaintext data encrypted by the CBC mode is somewhat long, specifically, it is generally larger than the plaintext block size of 8 bits or 16 bits. As an example, communication using the CBC mode is data to be encoded with a common key at the time of authentication, but such data is intentionally used in a long sentence from the viewpoint of security or the like.
Therefore, in the CBC mode communication, the number of plaintext blocks is always 2 or more, and in this respect, there is no situation where the generation of the initialization vector of the present embodiment is limited.

  In this embodiment, it is also possible to generate an initialization vector using only one second plaintext block at the minimum, but the number of plaintext data used for generating an initialization vector is Two or more are preferable, and the greater the number of plaintext data, the higher the security.

[Example of processing procedure]
The flowchart in FIG. 8 illustrates an example of a processing procedure for the initialization vector generation unit 104 in the encryption apparatus 100 to set a generation algorithm for generating an initialization vector.
For example, in response to the activation of the encryption device 100, the initialization vector generation unit 104 reads initialization vector generation instruction information from the initialization vector generation instruction information storage unit 103 (step S101).
The initialization vector generation unit 104 sets the generation algorithm for generating the initialization vector to itself according to the method of generating the initialization vector indicated by the initialization vector generation instruction information read in step S101 (step S102).

  Note that the initialization vector generation unit 205 in the decoding device 200 also performs initialization vector generation according to the initialization vector generation instruction information read from the initialization vector generation instruction information storage unit 204 by the same process as described in FIG. A generation algorithm can be set.

The flowchart in FIG. 9 illustrates an example of a processing procedure for encryption executed by the encryption apparatus 100 and decryption executed by the decryption apparatus 200.
The initialization vector generation unit 104 in the encryption device 100 waits for the plaintext data to be encrypted to be output from the plaintext data output unit 101 (step S201—NO).
In response to the plaintext data output unit 101 outputting the plaintext data (step S201—YES), the plaintext data dividing unit 102 divides the plaintext data output by the plaintext data output unit 101 in units of plaintext blocks (step S202). ).

The initialization vector generation unit 104 inputs a plaintext block to be used for generating an initialization vector from the plaintext blocks obtained by dividing the plaintext data in step S202 according to the generation algorithm (step S203).
The initialization vector generation unit 104 generates an initialization vector by performing an operation according to the generation algorithm (for example, an operation for obtaining an exclusive OR) for the plaintext block input in step S203 (step S204).

The encryption unit 105 performs encryption for each plaintext block divided in step S202 in response to the generation of the initialization vector in step S204 (step S205).
That is, the encryption unit 105 obtains the first ciphertext block by performing the encryption using the initialization vector for the first plaintext block, as described with reference to FIG. Next, the encryption unit 105 performs encryption using the previous ciphertext block for each of the second and subsequent plaintext blocks, and obtains the second and subsequent ciphertext blocks.

  The ciphertext data output unit 106 concatenates the first to last ciphertext blocks obtained in step S205 to generate ciphertext data, and causes the transmission unit 107 to transmit the generated ciphertext data to the decryption device 200. (Step S206).

In the decryption device 200, the ciphertext data transmitted in step S206 is received by the receiving unit 201 (step S301).
The ciphertext data dividing unit 202 divides the ciphertext data received in step S301 into ciphertext block units (step S302).

  The decryption unit 203 decrypts the second and subsequent ciphertext blocks among the ciphertext blocks obtained by the division in step S302 to obtain the second and subsequent plaintext blocks (step S303). As can be understood from the example of FIG. 4, the decryption in the CBC mode is performed by using the previous ciphertext block for the second and subsequent ciphertext blocks even if the initialization vector is not obtained. Is possible.

Next, the initialization vector generating unit 205 inputs a plaintext block used for generating an initialization vector from the second and subsequent plaintext blocks obtained in step S303 according to the generation algorithm (step S304).
The initialization vector generation unit 205 generates an initialization vector by performing an operation according to the generation algorithm (for example, an operation for obtaining an exclusive OR) for the plaintext block input in step S304 (step S305).

The decryption unit 203 decrypts the first ciphertext block using the initialization vector generated in step S305 to obtain the first ciphertext block (step S306). As a result, the decryption of the ciphertext blocks from the first to the end is completed together with the processing of the previous step S303, and the plaintext blocks from the first to the end are obtained.
Therefore, the plaintext data generation unit 206 generates plaintext data with the plaintext blocks from the first to the last (step S307).

  In addition, the decoding part 203 may decode as follows in step S303. That is, the decryption unit 203 first decrypts only the ciphertext block corresponding to the plaintext data used for generating the initialization vector among the second and subsequent ciphertext blocks. In addition, the decrypting unit 203 may decrypt the first ciphertext block in step S306 and the second and subsequent ciphertext blocks that were not decrypted in step S303.

[Modification]
In the description of FIG. 5 and FIG. 7, the initialization vector generation instruction information indicates that “sequential selection from the second and subsequent plaintext blocks” should be performed as the plaintext block used to generate the initialization vector. It was.
Here, when “sequentially selecting” the plaintext blocks used for generating the initialization vector from the second and subsequent plaintext blocks, the selection is not performed by the selection pattern one by one as described above. You may make it select sequentially according to a pattern.
Therefore, as a modification of the present embodiment, another example in which plaintext blocks used for generating an initialization vector are sequentially selected from the second and subsequent plaintext blocks will be described with reference to FIG.

FIG. 10 shows a case where the initialization vector generation instruction information indicates that “every other one from the second and subsequent plaintext blocks” is indicated for the plaintext block used for generating the initialization vector. .
That is, in this case, the plaintext blocks used for generating the initialization vector are plaintext blocks M2, M4, M6, M8,. In the figure, an example in which the last plaintext block Mmax is (Even: even number) is shown. Although illustration is omitted, when the last plaintext block Mmax is an odd number, the plaintext block immediately before the last plaintext block Mmax is selected as the last plaintext block used for generating the initialization vector. .
Even if such plaintext block selection is indicated by the initialization vector generation instruction information, both of the encryption device 100 and the decryption device 200 sequentially select plaintext blocks from the second onward according to the selection pattern. There is no change. Therefore, even if the number of plaintext blocks obtained by dividing the plaintext data is different for each sequence, for example, the encryption device 100 and the decryption device 200 always use the same plaintext blocks used for generating the initialization vector. You can get it.

As an example, when it is guaranteed that the lower limit number of plaintext blocks obtained by dividing plaintext data is 3, corresponding to this, the initialization vector generation instruction information “3rd and later The contents may be “select sequentially from plaintext blocks”.
That is, the method of selecting plaintext data indicated by the initialization vector generation instruction information is expressed as “selecting sequentially from the nth and subsequent plaintext blocks”. In this case, the variable n may be any number within the range of 2 ≦ n ≦ N, where N is the lower limit number of plaintext blocks obtained by dividing plaintext data.

In addition, if the lower limit number of plaintext blocks obtained by dividing the plaintext data is guaranteed, the plaintext blocks to be selected are individually selected within the range below the lower limit number of plaintext blocks by the initialization vector generation instruction information. It can also be specified.
A specific example is shown in FIG. In the drawing, between the second plaintext block M2 and the last plaintext block Mmax, three plaintext blocks Mi, Mj, and Mk are individually designated as selection targets. The initialization vector generation instruction information in this case indicates that “i-th, j-th and k-th plaintext blocks should be selected”.

  Note that a program for realizing the functions of the encryption device 100 and the decryption device 200 described above is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. Thus, the processing of the encryption device 100 and the decryption device 200 described above may be performed. Here, “loading and executing a program recorded on a recording medium into a computer system” includes installing the program in the computer system. The “computer system” here includes an OS and hardware such as peripheral devices. Further, the “computer system” may include a plurality of computer devices connected via a network including a communication line such as the Internet, WAN, LAN, and dedicated line. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. As described above, the recording medium storing the program may be a non-transitory recording medium such as a CD-ROM. The recording medium also includes a recording medium provided inside or outside that is accessible from the distribution server in order to distribute the program. The code of the program stored in the recording medium of the distribution server may be different from the code of the program that can be executed by the terminal device. That is, the format stored in the distribution server is not limited as long as it can be downloaded from the distribution server and installed in a form that can be executed by the terminal device. Note that the program may be divided into a plurality of parts, downloaded at different timings, and combined in the terminal device, or the distribution server that distributes each of the divided programs may be different. Furthermore, the “computer-readable recording medium” holds a program for a certain period of time, such as a volatile memory (RAM) inside a computer system that becomes a server or a client when the program is transmitted via a network. Including things. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 100 Encryption apparatus 101 Plaintext data output part 102 Plaintext data division | segmentation part 103 Initialization vector production | generation instruction information storage part 104 Initialization vector production | generation part 105 Encryption part 106 Ciphertext data output part 107 Transmission part 200 Decryption apparatus 201 Reception part 202 Encryption Sentence data division unit 203 Decoding unit 204 Initialization vector generation instruction information storage unit 205 Initialization vector generation unit 206 Plaintext data generation unit 300 Card 400 Reader / writer

Claims (10)

Initialization information indicating how to generate an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing plaintext data, and the same content is stored in the decryption device An initialization vector generation instruction information storage unit for storing vector generation instruction information;
In accordance with a method of generating an initialization vector indicated by the initialization vector generation instruction information, an initialization vector generation unit that generates an initialization vector using the predetermined plaintext block;
The first plaintext block of the plaintext blocks is encrypted using the initialization vector, and the second and subsequent plaintext blocks are encrypted using the ciphertext block obtained by the previous encryption. An encryption unit;
An encryption apparatus comprising: a ciphertext data output unit that outputs ciphertext data including the ciphertext block. The initialization vector generation instruction information is
Indicates that an exclusive OR of the predetermined plaintext block should be an initialization vector,
The initialization vector generation unit
The encryption apparatus according to claim 1, wherein an initialization vector is generated by obtaining an exclusive OR of the predetermined plaintext block. The initialization vector generation instruction information is
As a predetermined plaintext block used for generating an initialization vector, it indicates that it should be sequentially selected from n (n is a predetermined natural number of 2 or more) plaintext blocks.
The initialization vector generation unit
The encryption apparatus according to claim 1 or 2, wherein plaintext blocks sequentially selected from the nth and subsequent plaintext blocks are used for generating an initialization vector. Information indicating the method of generating an initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing plaintext data, and the initial content in which the same content is stored in the encryption device An initialization vector generation instruction information storage unit for storing initialization vector generation instruction information;
Of the ciphertext blocks included in the ciphertext data, the second and subsequent plaintext blocks are obtained by decrypting the second and subsequent ciphertext blocks using the previous ciphertext block, and the first ciphertext For the block, a decryption unit that obtains the first plaintext block by decrypting using an initialization vector;
Initialization for generating an initialization vector using a predetermined plaintext block from the second and subsequent plaintext blocks acquired by the decoding unit according to a method of generating an initialization vector indicated by the initialization vector generation instruction information A vector generator,
A decoding device comprising: The initialization vector generation instruction information is
Indicates that an exclusive OR of the predetermined plaintext block should be an initialization vector,
The initialization vector generation unit
The decryption device according to claim 4, wherein an initialization vector is generated by obtaining an exclusive OR of the predetermined plaintext block. The initialization vector generation instruction information is
As a predetermined plaintext block used for generating an initialization vector, it indicates that it should be sequentially selected from n (n is a predetermined natural number of 2 or more) plaintext blocks.
The initialization vector generation unit
6. The decryption device according to claim 4, wherein plaintext blocks sequentially selected from the nth and subsequent plaintext blocks are used for generating an initialization vector. According to the initialization vector generation instruction information in which the same content is also stored in the decryption device, according to the method of generating the initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data, An initialization vector generating step for generating an initialization vector using the predetermined plaintext block;
The first plaintext block of the plaintext blocks is encrypted using the initialization vector, and the second and subsequent plaintext blocks are encrypted using the ciphertext block obtained by the previous encryption. An encryption step;
An encryption method comprising: a ciphertext data output step for outputting ciphertext data including the ciphertext block. Of the ciphertext blocks included in the ciphertext data, the second and subsequent plaintext blocks are obtained by decrypting the second and subsequent ciphertext blocks using the previous ciphertext block, and the first ciphertext For the block, a decryption step for obtaining the first plaintext block by decrypting using the initialization vector;
In the encryption apparatus, the initialization vector generation instruction information storing the same contents indicates the initialization vector generation method using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data. An initialization vector generation step of generating an initialization vector using the predetermined plaintext block from the second and subsequent plaintext blocks acquired by the decryption step;
A decoding method comprising: On the computer,
According to the initialization vector generation instruction information in which the same content is also stored in the decryption device, according to the method of generating the initialization vector using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data, An initialization vector generating step for generating an initialization vector using the predetermined plaintext block;
The first plaintext block of the plaintext blocks is encrypted using the initialization vector, and the second and subsequent plaintext blocks are encrypted using the ciphertext block obtained by the previous encryption. An encryption step;
A ciphertext data output step for outputting ciphertext data including the ciphertext block. On the computer,
Of the ciphertext blocks included in the ciphertext data, the second and subsequent plaintext blocks are obtained by decrypting the second and subsequent ciphertext blocks using the previous ciphertext block, and the first ciphertext For the block, a decryption step for obtaining the first plaintext block by decrypting using the initialization vector;
In the encryption apparatus, the initialization vector generation instruction information storing the same contents indicates the initialization vector generation method using a predetermined plaintext block in the second and subsequent plaintext blocks obtained by dividing the plaintext data. An initialization vector generation step of generating an initialization vector using the predetermined plaintext block from the second and subsequent plaintext blocks acquired by the decryption step;
A program for running

Images