JPH06102820A - Cyphering device - Google Patents

Abstract

PURPOSE:To make a cyphering and a decyphering devices the same constitution and to reduce man-hour for design and manufacturing by generating plural intermediate keys in the reverse order, successively randomizing the cipher text and generating a plain text. CONSTITUTION:This device comprizes a key generating part 10 for successively randomizing a cryptographic key, outputting plural intermediate keys obtained in the process and a decyphering key obtained in the course of final randomization and outputting plural intermediate keys in the reverse order by inputting the decyphering key and a cyphering processing part 20 for successively randomizing a plain text or the cipher text using the intermediate key from the key generating part 10 and generating the cipher text or the plain text. Then, in the cyphering device, at the time of cyphering processing, the cryptographic key is successively randomized, plural intermediate keys and decyphering keys are generated, the plain text is successively randomized using the respective intermediate keys so as to generate the plain text. On the other hand, at the time of decyphering, plural intermediate keys are generated in the reverse order of cyphering processing by successively randomizing the decyphering key and the cipher text is successively randomized by using the respective intermediate keys so as to generate the plain language.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a cryptographic device, and more particularly to a cryptographic device for generating a ciphertext by randomizing a plaintext using an intermediate key generated from an encryption key.

[0002]

2. Description of the Related Art A typical encryption method is 1977.
DES (Data Encrypt)
ion Standard) is known. Here, the DES will be described.

As shown in FIG. 5, the encryption device in the DES includes 16 intermediate keys K ₁ , K ₂ , K ₃ from the encryption key.
K ₄ , K ₅ , K ₆ , K ₇ , K ₈ , K ₉ , K ₁₀ , K ₁₁ , K
Key generation unit 1 for sequentially generating ₁₂ , K ₁₃ , K ₁₄ , K ₁₅ , and K _16.
10 and 16 intermediate keys K ₁ to K ₁ from the key generation unit 110.
An encryption processing unit 130 for sequentially encrypting and encrypting a plaintext by using K ₁₆ .

Then, the key generator 110 generates the intermediate keys K _{1 to} K ₁₆ from the encryption key in ascending order of the subscripts. The encryption processing unit 130 sequentially randomizes (spreads) the plaintext by using these intermediate keys K _{1 to} K ₁₆ in the order in which they are generated, and generates the ciphertext.

Specifically, as shown in FIG. 5 described above, the key generation section 110 is a contraction-type transposition circuit 12 that performs so-called contraction transposition.
7 and the encryption keys contracted and transcribed by the contraction type transposition circuit 127 are bit-shifted and further contracted and transposed to generate intermediate keys K _{1 to} K ₁₆ , respectively, which are connected in cascade. 16 intermediate key generation circuits 111, 112, 113, 1
14, 115, 116, 117, 118, 119, 12
0, 121, 122, 123, 124, 125, 126
With.

Then, the contraction type transposing circuit 127 deletes the 8-bit parity from the encryption key supplied by 64 bits and transposes, that is, performs a predetermined permutation, for example, in a bit unit, and performs the contraction. Top 2 encryption keys that have been transcribed
It is divided into 8 bits (hereinafter referred to as block A ₀ ) and lower 28 bits (hereinafter referred to as block B ₀ ).

As shown in FIG. 5, each of the intermediate key generation circuits 111 to 126 has a block A _i (i = 0) from the preceding stage.
~ 16) are cyclically bit-shifted to the left and block A
_The shift register 101 for generating _{i + 1} and the shift register 10 for cyclically bit-shifting the block B _i (i = 0 to 16) from the previous stage to the left side to generate the block B _{i + 1}
2 and the block A _{i + 1} from the shift register 101
And a contraction type transposing circuit 103 for contracting the block B _{i + 1} from the shift register 102.

Then, the first-stage intermediate key generation circuit 111
The shift registers 101 and 102 of FIG.
The blocks A ₀ and B ₀ supplied from 27 are cyclically shifted to the left (higher bit side) by a predetermined number of bits to generate blocks A ₁ and B ₁ . The contraction type transposing circuit 103 of the intermediate key generating circuit 111 contracts and transposes 56 (= 28 + 28) -bit data obtained by combining the block A ₁ and the block B ₁ into an intermediate key K _{1 of} 48 bits. To generate.

Next, the intermediate key generation circuit 112 in the second stage
Shift registers 101 and 102 of
Block A supplied from circuit 111₁, B₁That
Cyclically shifts to the left by a predetermined number of bits, and
Ku A₂, B₂To generate. This intermediate key generation circuit 112
The contraction type transposing circuit 103 is a block A.₂And block B ₂
56-bit data combined with
Intermediate key K consisting of ₂To generate.

Similarly, the intermediate key generation circuits 113 to 113
126 generates an intermediate key K ₃ ~K ₁₆ respectively. In this way, the intermediate keys K ₁ to
The K ₁₆ is supplied to the encryption processing unit 130 in the order of generation.

The encryption processing unit 130, as shown in FIG. 5 described above, is an initial transposing circuit 147 for transcribing plain text in parallel.
And the plain text transcribed by the initial transcribing circuit 147 is sequentially randomized by using the intermediate keys K _{1 to} K ₁₆ sequentially supplied from the key generation unit 110, and ₁₆ cascaded random numbers are connected. Circuit 131, 132, 133, 134, 13
5, 136, 137, 138, 139, 140, 14
1, 142, 143, 144, 145, 146 and the output of the randomizing circuit 146 is transcribed in the reverse manner of the initial transposing circuit 147 to generate a ciphertext, and the final transposition of outputting the ciphertext. And a circuit 148.

The initial transcribing circuit 147 transposes the plaintext supplied as data in units of 64 bits in parallel, and transposes the transcribed plaintext in upper 32 bits (hereinafter referred to as block L ₀ ) and lower 32 bits (hereinafter referred to as block L ₀ ). Block R ₀ ).

As shown in FIG. 5, each of the randomizing circuits 131 to 146 transfers the block R _i from the preceding stage to the intermediate key K _{i + 1} supplied from the corresponding stage of the intermediate key generating circuits 111 to 126. Using the function circuit 105 that stirs by a predetermined function f, and the output of the function circuit 105 and the exclusive OR of the block L _i from the previous stage are calculated to obtain the block R _{i + 1}
Exclusive OR circuit to generate (hereinafter referred to as EX-OR) 1
06 and.

Then, the first-stage randomizing circuit 131
Is a block R supplied from the initial transposing circuit 147.
₀The data and the intermediate key K₁Given function with variable
The data obtained (f (R₀，
K₁)) And the block supplied from the initial transcription circuit 147
L₀The exclusive OR of is calculated and the result of this calculation and the block
R ₀Block R respectively₁, L₁As randomized times
Supply to the path 132. The above-mentioned function f is, for example,
Block R using the code conversion table₀Transcode
This is a function that includes so-called substitution processing.

Next, the second-stage randomizing circuit 132
Is a block R ₁ supplied from the randomizing circuit 131.
Is a predetermined function f whose variables are the data and the intermediate key K _2.
The data (f (R ₁ , K
₂ )) and the block L ₁ supplied from the randomizing circuit 131 are operated on, and the operation result and the block R ₁ are supplied to the randomizing circuit 133 as blocks R ₂ and L ₂ , respectively.

Similarly, the randomizing circuits 133 to
146 sequentially randomizes the plaintext by using the intermediate keys K _{3 to} K ₁₆ in the order in which they are generated, and the blocks L ₁₆ and R ₁₆ output from the randomizing circuit 146 at the final stage are the final transposing circuit 148. Is supplied to.

The final transposing circuit 148 includes blocks L ₁₆ and R.
₁₆ is combined, the obtained 64-bit data is converted in the reverse of the transliteration of the initial transposition circuit 147, a ciphertext is generated, and this ciphertext is output.

DES is a conventional encryption system in which the encryption key and the decryption key are the same, and the DES decryption device is a circuit equivalent to the above-mentioned key generation unit 110 and encryption processing unit 130 of the encryption device (hereinafter, They are called the key generation unit and encryption processing unit.)
And a memory for storing the intermediate keys K _{1 to} K ₁₆ sequentially generated by the key generation unit. Then, when the same decryption key as the encryption key is input to the key generation unit, the intermediate keys K _{1 to} K ₁₆
Are generated in ascending order of their subscripts, and these intermediate keys K _{1 to} K
₁₆ is once stored in the memory. Next, when the ciphertext is input to the encryption processing unit, the intermediate keys K _{1 to} K ₁₆ are read from the memory in the order of increasing subscripts, and the read intermediate keys K ₁ to K ₁₆ are read.
By sequentially randomizing the ciphertext using K ₁₆ in order, the decryption is performed and the plaintext is generated.

[0019]

[SUMMARY OF THE INVENTION That is, in the decoding apparatus of the DES, since the intermediate key K ₁ ~K ₁₆ whose index is created in ascending order in the key generation unit, an intermediate key K ₁ ~K ₁₆
A memory is required to store once. Further, there is a problem that it is impossible to perform the decoding process until all of the intermediate key K ₁ ~K ₁₆ is generated. Furthermore, there is a problem in that the encryption device and the decryption device cannot be designed in common, which requires a large number of design and manufacturing processes.

The present invention has been made in view of the above situation, and the circuit configurations of the encryption device and the decryption device can be the same, and a memory for storing the intermediate keys K _{1 to} K _16. It is an object of the present invention to provide a cryptographic device that does not require.

[0021]

In order to solve the above problems, an encryption device according to the present invention sequentially randomizes an encryption key, and a plurality of intermediate keys obtained in each randomization process,
When the decryption key obtained in the final randomization process is output and the decryption key is input, a key generation unit that outputs the plurality of intermediate keys in the reverse order, and the key generation unit are sequentially output. An encryption processing means for sequentially randomizing a plaintext or a ciphertext by using a plurality of supplied intermediate keys to generate the ciphertext or the plaintext.

[0022]

In the encryption device to which the present invention is applied, the encryption key is sequentially randomized at the time of encryption processing to generate a plurality of intermediate keys and decryption keys, and the plaintext is sequentially used by using these intermediate keys. Randomize and generate ciphertext.

On the other hand, during the decryption process, the decryption key is sequentially randomized, a plurality of intermediate keys are generated in the reverse order of the encryption process, and the ciphertext is sequentially randomized using these intermediate keys. To generate a plaintext.

[0024]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of a cryptographic device according to the present invention will be described below with reference to the drawings. An encryption device to which the present invention is applied, for example, as shown in FIG. 1, sequentially encrypts an encryption key, and a plurality of intermediate keys obtained in each randomization process,
When the decryption key obtained in the final randomization process is output and the decryption key is input, the key generation unit 10 that outputs the plurality of intermediate keys in the reverse order, and the key generation unit 10
An encryption processing unit 20 that sequentially randomizes a plaintext or a ciphertext by using a plurality of intermediate keys that are sequentially supplied to generate a ciphertext or a plaintext.

Then, at the time of encryption processing, the key generation unit 10
From the encryption key supplied in 64 bits, for example
Eight intermediate keys (internal key) K₁, K₂, K₃, K_Four,
K_Five, K ₆, K₇, K₈Generate the subscripts in ascending order
Together with, for example, generate a decryption key consisting of 64 bits.
It The encryption processing unit 20 uses the intermediate key K₁~ K₈To
Use them in the order in which they are generated, for example in 64-bit units.
Randomize (spread) the plaintext supplied as data,
For example, a 64-bit ciphertext is generated.
ing. Also, during the decryption process, the key generation unit 10
Encryption key to intermediate key K₁~ K₈In order of increasing subscript
The encryption processing unit 20 generates the intermediate key K ₁~ K₈
Are used in the order in which they are generated, for example, in 64-bit units.
Randomize the ciphertext supplied as a data
For example, 64-bit plaintext is generated.
It

Specifically, the key generation unit 10 is the same as that shown in FIG.
As shown in, the encryption key or the decryption key is sequentially randomized by a predetermined function f _K , and the intermediate keys K _{1 to} K ₈ are
Eight cascade-connected intermediate key generation circuits 11, 12, 13, 14, 15, 1 that generate the subscripts in ascending order during the encryption process and in descending order during the decryption process
The intermediate key generation circuit 11 including the first, second, and sixth stages 17 and 18.
, The encryption key or the decryption key is divided into upper 32 bits (hereinafter referred to as block C ₀ ) and lower 32 bits (hereinafter referred to as block D ₀ ) and supplied. For example, if the encryption key is 0001020304050607h (h: 16
(Representing a decimal number representation), the blocks C ₀ and D ₀ are 00010203h and 04050607h, respectively.

[0027] Each intermediate key generating circuit 11 to 18, as shown in FIG. 1 described above, the block D _{i (i} = 0~ from the preceding
8) a function circuit 1 for agitating a predetermined function f _K, and an exclusive OR circuit (hereinafter referred to as EX-OR) 2 for calculating the exclusive OR of the output of the function circuit 1 and the block C _i from the preceding stage 2 And a sector 3 for switching and selecting the output of the EX-OR 2 and the block C _i from the previous stage.

During the encryption process, the first-stage intermediate key generation circuit 11 stirs the block D ₀ of the encryption key with a predetermined function f _k whose data is a variable, and then
The exclusive OR of the obtained data (f _k (D ₀ )) and the block C ₀ of the encryption key is calculated, and the calculation result and the block D ₀ are calculated.
Intermediate key generating circuit 1 respectively as blocks D _1, C ₁
The lower 24 bits of the operation result are output as the intermediate key K ₁ while being supplied to

Next, the intermediate key generation circuit 12 of the second stage
Is a block D supplied from the intermediate key generation circuit 11.
After stirring ₁ with a predetermined function f _k having the data as a variable, an exclusive OR of the obtained data (f _k (D ₁ )) and the block C ₁ supplied from the intermediate key generation circuit 11 is calculated. and the calculation result and the block D ₁ and supplies to the intermediate-key generating circuit 13 as the block D _2, C _2, and outputs the lower 24 bits of the operation result as the intermediate key K _2.

Similarly, the intermediate key generation circuits 13-1
8 sequentially randomizes the encryption key by a predetermined function f _k to generate intermediate keys K _{3 to} K ₈ . In addition, the intermediate key generation circuit 18 at the final stage synthesizes the blocks C ₈ and D ₈ , that is, the intermediate key K ₈ and the intermediate key K ₇ , and the intermediate key K 8.
_A decryption key consisting of 64 bits is generated by combining so that ₈ becomes an upper bit.

On the other hand, in the decryption process, the lower 24 bits of the block C ₀ of the decryption key supplied to the first stage intermediate key generation circuit 11 is the intermediate key K ₈ (hereinafter block C _0).
Is simply referred to as the intermediate key K ₈ ) and the lower 24 bits of the block D ₀ is the intermediate key K ₇ (hereinafter the block D ₀ is simply referred to as the intermediate key K ₇ ).
After outputting ₈ and stirring the intermediate key K ₇ by the function f _k , the obtained data (f _k (K ₇ )) and the intermediate key K _{8 are obtained.}
Is calculated, that is, the intermediate key K ₆ is obtained by the following equation 1, and the intermediate key K ₆ and the intermediate key K ₇ are supplied to the intermediate key generation circuit 12 as blocks D ₁ and C ₁ , respectively.

Calculation result = K ₈ % f _k (K ₇ ) = K ₆ ... Equation 1 ∵K ₈ = K ₆ % f _k (K ₇ )

However, the operator "%" means exclusive OR.

Next, the intermediate key generation circuit 12 of the second stage
Outputs the intermediate key K ₇ supplied from the intermediate key generation circuit 11 and mixes the intermediate key K ₆ supplied from the intermediate key generation circuit 11 with the function f _k , and then obtains the obtained data (f _k (K ₆ )) and the intermediate key K ₇ are exclusive-ORed, that is, the intermediate key K ₅ is obtained by the following equation 2, and the intermediate key K ₅ and the intermediate key K ₆ are respectively designated as blocks D ₂ and C _2. It is supplied to the generation circuit 13.

Calculation result = K ₇ % f _k (K ₆ ) = K ₅ Equation 2 ∵K ₇ = K ₅ % f _k (K ₆ )

Similarly, the intermediate key generation circuits 13-1
8 sequentially randomizes the decryption keys using a predetermined function f _k to generate intermediate keys K _{3 to} K ₈ in descending order of their subscripts.

Each sector 3 of the intermediate key generation circuits 11-18
Operates with the control signal supplied through the terminal 4, selects the output of the EX-OR2 during the encryption process, and selects the input of the EX-OR2 during the decryption process. ing. Therefore, the key generation unit 10 outputs the intermediate keys K _{1 to} K _{8 in the} ascending order of the subscripts during the encryption process, and in the descending order of the subscripts during the decryption process. The intermediate keys K _{1 to} K ₈ thus generated are supplied to the encryption processing unit 20 in the order in which they were generated.

Here, a specific circuit configuration of the function circuit 1 used in each of the intermediate key generation circuits 11 to 18 will be described. For example, as shown in FIG. 2, the function circuit 1 includes an enlarged transposing circuit 41 for so-called enlarging transposing the data from the preceding stage in each randomization process, that is, the block D _i from the intermediate key generating circuit in the preceding stage, and EX-OR4 for mutually exclusive-ORing the outputs of the enlarged transposing circuit 41 byte by byte
2a, 42b, 42c, 42d, 42e and the EX-O
Adders (hereinafter referred to as MADD) 43a, 43b, 43c, 43d for mutually adding so-called modulo 256 outputs of R42a, 42b, 42d, and 42e, and the MADD4.
Bit replacement circuits (hereinafter referred to as ROTs) 44a, 4 which replace the outputs 3a to 43c in bit units.
4b and 44c.

Then, the enlarged transcribing circuit 41 is provided in the middle of the preceding stage.
Block consisting of 32 bits supplied from the key generation circuit
D_iIs enlarged transliteration, that is, divided into 8-bit units
And select 8 bits from 32 bits,
Data of 40 bits (5 bytes) is generated. This
Here, block D_iEach byte obtained by dividing _ij
(J = 0 to 3, and j = 3 is the so-called MSB side), and can be arbitrarily selected.
1 byte obtained by selecting the expansion element W_KiTo do. In addition, this
Expansion element W_KiNon-public bit selection method for generating
Different by opening and changing the selection method
The ciphertext of the cipher sequence can be obtained.

The EX-OR 42a is the enlarged transposing circuit 41.
Byte d supplied from_i3And byte d _i2The exclusive OR of
And the EX-OR 42b is supplied from the enlarged transposing circuit 41.
Byte d_i1And byte d_i0Exclusive-or of
However, the EX-OR 42c is supplied from the enlarged transcription circuit 41.
Expansion element W_KiAnd exclusive OR of constant 56h
Then, the EX-OR 42d and the output of the EX-OR 42b
The exclusive OR of the outputs of the X-OR 42c is calculated and EX-
The OR42e outputs the output of the EX-OR42a and the EX-OR4.
The exclusive OR of the outputs of 2d is calculated.

The MADD 43a adds the output of the EX-OR 42a and the output of the EX-OR 42d by adding Mojoro 256, that is, ignoring the carry, and adding the MADD 43b.
The output of the EX-OR 42b and the output of the EX-OR 42e are added by Mojoro 256.

The ROT 44a outputs the output of the MADD 43a, for example, bits b _{7 to} b ₀ (b ₇ is MSB) in the MSB.
Bit b ₂ , bit b ₀ , bit b ₅ , bit b ₄ , bit b ₃ , bit b ₇ , bit b ₁ , bit b
Bits are swapped to become _6, and ROT44b
Replaces the output of the MADD 43b with bits as in the ROT 44a described above.

The MADD 43c modulo 256 adds the byte d _i3 supplied from the enlarged transposing circuit 41 and the output of the ROT 44a, and the MADD 43d modulos the byte d _i0 supplied from the enlarged transposing circuit 41 and the output of the ROT 44b. to add.

The ROT 44c exchanges bits of the output of the MADD 43c in the same manner as the ROT 44a described above.

Then, the function circuit 1 uses the 32-bit data obtained as described above, that is, ROT44.
a to ROT44c outputs and MADD43d outputs sequentially from the MSB side to ROT44a output, ROT44
b output, MADD 43d output, and ROT 44c output. That is, the function circuit 1 randomizes the block D _i supplied from the intermediate key generation circuit in the preceding stage by the arithmetic processing of the expanded transposition, the exclusive OR, and the addition.

Next, the encryption processing section 20 will be described. As shown in FIG. 1 described above, the encryption processing unit 20 rearranges the plaintext or the ciphertext by a predetermined matrix I, and the plaintext or the ciphertext rearranged by the rearrangement circuit 29 with the key as the key. Using the intermediate keys K _{1 to} K ₈ supplied from the generation unit 10 in the order of increasing subscripts or increasing numbers, for example, eight serially connected randomizing circuits 21, 22, 23, 24, 25 are sequentially randomized. , 26,
27 and 28, and a rearrangement circuit 30 that rearranges the output of the randomization circuit 28 by the inverse matrix I ⁻¹ of the matrix I to generate ciphertext or plaintext.

Then, during the encryption process, the rearrangement circuit 29 rearranges the plaintext supplied as data in 64-bit units by a predetermined matrix I, and the rearranged plaintext is in the upper 32 bits (hereinafter referred to as block L ₀ ). ) And the lower 32
Bits (hereinafter referred to as block R ₀ ). For example, if the rearranged plaintext is 08090A0B0C0D0E
If 0Fh, the blocks L ₀ and R ₀ are 080
It becomes 90A0Bh and 0C0D0E0Fh. It should be noted that by allowing the user to freely set the above-mentioned matrix I, the ciphertext of the cipher sequence according to the purpose or application may be generated.

As shown in FIG. 1, each of the randomizing circuits 21 to 28 supplies the block R _i from the preceding stage to the intermediate key K supplied from the corresponding stage of the intermediate key generating circuits 11 to 18.
Function circuit 5 that uses _{i + 1} to stir by a predetermined function f
And an EX-O for generating the block R _{i + 1} by calculating the exclusive OR of the output of the function circuit 5 and the block L _i from the previous stage.
R6 and.

Then, the first-stage randomizing circuit 21
Is a block R ₀ supplied from the rearrangement circuit 29,
While agitating the data and a predetermined function f having the intermediate key K ₁ as a variable, the obtained data (f (R ₀ ,
K ₁ )) and the block L supplied from the rearrangement circuit 29.
The exclusive OR of ₀ is calculated, and this calculation result and block R
₀ is supplied to the randomization circuit 22 as respective blocks R _1, L _1.

Next, the second-stage randomizing circuit 22
Is a block R supplied from the randomizing circuit 21.
₁ is mixed by a predetermined function f having the data and the intermediate key K ₂ as variables, and the obtained data (f (R ₁ ,
K ₂ )) and an exclusive OR of the block L ₁ supplied from the randomizing circuit 21, and the operation result and the block R ₁ are supplied to the randomizing circuit 23 as blocks R ₂ and L ₂ , respectively.

Similarly, the randomizing circuits 23-2
8 sequentially randomizes the plaintext by using the intermediate keys K _{3 to} K ₈ in the order in which they are generated, and the blocks L ₈ and R ₈ output from the randomization circuit 18 at the final stage are supplied to the rearrangement circuit 30. To be done.

The rearrangement circuit 30 includes blocks L ₈ and R ₈
And the obtained 64-bit data are rearranged by using the inverse matrix I ⁻¹ of the matrix I of the rearrangement circuit 29 to generate a ciphertext and output the ciphertext.

On the other hand, during the decoding process, the rearrangement circuit 2
9 rearranges ciphertexts supplied as data in units of 64 bits by a predetermined matrix I, and rearranges the rearranged ciphertexts into upper 32 bits (hereinafter referred to as block L ₀ ) and lower 3 bits.
It is divided into 2 bits (hereinafter referred to as block R ₀ ).

Then, the first-stage randomizing circuit 21
Is a block R ₀ supplied from the rearrangement circuit 29,
With stirring by a predetermined function f to the data and intermediate key K ₈ with variable data obtained (f (R _0,
K ₈ )) and the block L supplied from the rearrangement circuit 29.
The exclusive OR of ₀ is calculated, and this calculation result and block R
₀ is supplied to the randomization circuit 22 as respective blocks R _1, L _1.

Next, the second-stage randomizing circuit 22
Is a block R supplied from the randomizing circuit 21.
₁ is mixed with the data and a predetermined function f having the intermediate key K ₇ as a variable, and the obtained data (f (R ₁ ,
K ₇ )) and an exclusive OR of the block L ₁ supplied from the randomizing circuit 21 are calculated, and the calculation result and the block R ₁ are supplied to the randomizing circuit 23 as blocks R ₂ and L ₂ , respectively.

Similarly, the randomizing circuits 23-2
8 sequentially randomizes the ciphertext by using the intermediate keys K _{3 to} K ₈ in the order in which they are generated, and the blocks L ₈ and R ₈ output from the randomization circuit 18 at the final stage are sent to the rearrangement circuit 30. Supplied.

The rearrangement circuit 30 includes blocks L ₈ and R ₈
Are combined, and the obtained 64-bit data is rearranged using the inverse matrix I ⁻¹ to generate a plaintext and the plaintext is output.

Here, a specific circuit configuration of the function circuit 5 used in each of the randomizing circuits 21 to 28 will be described. For example, as shown in FIG. 3, the function circuit 5 includes an enlarged transposing circuit 51 for enlarging and transposing the data from the preceding stage in each randomization process, that is, the block R _i from the randomizing circuit of the preceding stage, and the enlarged transposing circuit 51. EX for mutually exclusive-ORing the output of the character circuit 51 and the intermediate key K _{i + 1} in byte units
-OR 52a, 52b, 52c, 52d, 52e, 52
f, 52g and the EX-ORs 52b, 52c, 52e,
EX-OR 52 and adders (hereinafter referred to as ADD) 53a, 53b, and 53c that add the outputs of 52f to each other.
a-52g and the output of ADD53b are modulo 2 mutually.
MADD 54a and 54b for adding 56 and the MADD 5
4R, 54b, 52d, and 52g, and ROTs 55a and 55b for exchanging the outputs on a bit-by-bit basis.

Then, the enlarged transcribing circuit 51 executes the run of the preceding stage.
32-bit block supplied from the damming circuit
R_iIs enlarged transliteration, that is, divided into 8-bit units
And select 8 bits from 32 bits,
Data of 40 bits (5 bytes) is generated. This
Here, block R_iEach byte obtained by dividing _ij
(J = 0 to 3, j = 3 is the MSB side), and select
1 byte obtained by expanding W_iTo do. In addition, this expansion
Large factor W_KUnpublished the bit selection method for generating
Different encryption method by changing the selection method.
The ciphertext of the series can be obtained.

Is the EX-OR 52a an expansion transposing circuit 51?
Byte r supplied from_i3And the intermediate key generation circuits 11 to 18
Intermediate key K supplied from the corresponding stage of_{i + 1}Top 8 bits of
To (bit B_{twenty three}~ B₁₆) And the exclusive OR with
The X-OR 52b is a buffer supplied from the enlarged transposing circuit 51.
It r_i0And the intermediate key K_{i + 1}8 bits following the upper 8 bits of
To (bit B₁₅~ B₈) And the exclusive OR with
The X-OR 52c is a bus supplied from the enlarged transposing circuit 51.
It r_i2And the exclusive OR of the outputs of EX-OR52a
EX-OR52d is supplied from the expanded transposing circuit 51
Byte r _i1And the exclusive theory of the output of EX-OR52b
The EX-OR 52e calculates the Riwa, and the enlarged transposing circuit 51
Expansion element W supplied from_iAnd the intermediate key K_{i + 1}Bottom 8 of
Bit (bit B₇~ B₀), The exclusive OR is calculated.

The ADD 53a adds the output of the EX-OR 52c and the output of the EX-OR 52e and outputs the upper 8 bits.

The EX-OR 52f calculates the exclusive OR of the output of the EX-OR 52d and the output of the ADD 53a, and E
X-OR52g is the output of EX-OR52c and ADD5
The exclusive OR of the outputs of 3a is calculated.

The ADD 53b adds the output of the EX-OR 52c and the output of the EX-OR 52f and outputs the upper 8 bits, and the MADD 54a outputs the EX-OR 52.
The output of d and the output of the EX-OR 52g are added by a mojoro 256, and the ROT 55a outputs the output of the MADD 54a, for example, bits b _{7 to} b _{0 in} order from MSB, bit b ₂ , bit b ₀ , bit b ₅ , bit b ₄ , The bits are exchanged so that they are bit b ₃ , bit b ₇ , bit b ₁ , and bit b ₆ .

The MADD 54b adds the output of the EX-OR 52a and the output of the ADD 53b by using Mojoro 256, and AD
D53c adds the output of EX-OR52b and the output of ROT55a to Mojoro 256, and ROT55b is added to MAD.
The bits of the output of D54b are exchanged as in the case of ROT55a described above.

Then, the function circuit 5 uses the 32-bit data obtained as described above, that is, ROT55.
a, 55b and ADD53b, 53c output, MS
From the B side, the outputs of the ADD 53c, the ROT 55b, the ADD 53b, and the ROT 55a are sequentially output. That is, the function circuit 5 randomizes the block R _i supplied from the randomizing circuit in the preceding stage by performing arithmetic processing of enlarged transliteration, exclusive OR, and addition without performing so-called substitution processing unlike the conventional device. Turn into. In other words, the hardware can be simplified and high-speed processing can be performed without the substitution processing. Further, the data mixing effect of the function circuit 5 is superior to the so-called function S used in the conventional DES, as shown in FIG. 4, for example. The characteristic shown in FIG. 4 represents a change in output when the input is changed by 1 bit by a so-called Hamming distance, and is obtained when 32000 trials are performed (the number of samples is 32000).

As described above, the encryption device of this embodiment is
It can also be used as a decryption device, that is, the encryption device and the decryption device can have the same circuit configuration, and the number of designing and manufacturing steps can be reduced. Further, when used as a decryption device, the intermediate keys K _{1 to} K ₈ can be generated in descending order of their subscripts, and a memory for temporarily storing the intermediate key required in the conventional device is not required. Become. Further, the decryption key and the ciphertext can be continuously input.

Since the encryption key and the decryption key are different,
Even if one of them leaks, the other one is safe and the security can be improved.

The present invention is not limited to the above-described embodiments. For example, although the number of stages of the randomizing circuit is eight in the above-mentioned embodiments, any number of stages may be used. Further, for example, the function circuits 1 and 5 are not limited to the circuit configurations shown in FIGS.

[0069]

As is apparent from the above description, in the encryption device to which the present invention is applied, the encryption key is sequentially randomized during the encryption process to generate a plurality of intermediate keys and decryption keys. , The plaintext is sequentially randomized using these intermediate keys to generate a ciphertext. On the other hand, during the decryption process, the decryption key is sequentially randomized, a plurality of intermediate keys are generated in the reverse order, and the ciphertext is sequentially randomized using these intermediate keys to generate the plaintext. With this configuration, the encryption device and the decryption device can have the same circuit configuration, and the number of design and manufacturing steps can be reduced. Further, when used as a decryption device, the intermediate keys can be generated in the descending order of their subscripts, and the memory required in the conventional device is not required. Further, the decryption key and the ciphertext can be continuously input.

[Brief description of drawings]

FIG. 1 is a block diagram showing a circuit configuration of a cryptographic device to which the present invention is applied.

FIG. 2 is a diagram showing a specific circuit configuration of a function circuit of an intermediate key generation circuit which constitutes the encryption device.

FIG. 3 is a diagram showing a specific circuit configuration of a function circuit of a randomizing circuit that constitutes the encryption device.

FIG. 4 is a diagram showing a data agitation effect of the functional circuit.

FIG. 5 is a block diagram showing a circuit configuration of an encryption device in DES.

[Explanation of symbols]

 10 ... Key generation unit 11-18 ... Intermediate key generation circuit 20 ... Encryption processing unit 21-28 ... Randomization circuit

Claims (1)

[Claims] 1. An encryption key is sequentially randomized, and a plurality of intermediate keys obtained in each randomization process and a decryption key obtained in the final randomization process are output, and the decryption key is When input, the plaintext or the ciphertext is sequentially randomized by using the key generation means that outputs the plurality of intermediate keys in the reverse order, and the plurality of intermediate keys sequentially supplied from the key generation means to generate the ciphertext or An encryption device, comprising: an encryption processing unit that generates a plaintext.