WO2016067524A1 - Authenticated encryption apparatus, authenticated decryption apparatus, authenticated cryptography system, authenticated encryption method, and program - Google Patents

Abstract

An authenticated encryption apparatus comprises: a plain text input unit that receives the input of a plain text; a fixed length value generation unit that generates a new fixed length value different from the values generated in the past; a mask value generation unit that encrypts, by use of an adjustment value based on the plain text, the fixed length value, thereby generating a mask value; a plain text encryption unit that encrypts, by use of the mask value generated by the mask value generation unit, the plain text, thereby generating a cipher text; and a tag generation unit that encrypts the mask value generated by the mask value generation unit, thereby generating a tag. The authenticated encryption apparatus outputs both the cipher text, which has been encrypted by the plain text encryption unit, and the tag generated by the tag generation unit.

Description

Authenticated encryption device, authenticated decryption device, authenticated encryption system, authenticated encryption method, program

The present invention relates to an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, an authenticated encryption method, and a program that can both conceal content and detect unauthorized tampering.

It is known that encryption technology that encrypts plain text is used for the purpose of ensuring security in communications.

For example, Patent Document 1 is known as an encryption technique. In the technique described in Patent Literature 1, a shared key block cipher application key is generated based on an encryption key as a shared secret key and an initial vector, and plaintext is encrypted based on the shared key block cipher application key. Thereafter, data obtained by concatenating the generated ciphertext and the initial vector is transmitted. According to Patent Document 1, by using such a method, it becomes possible to encrypt plaintext while preventing encryption analysis such as power difference analysis.

Further, as another example of the encryption technique, for example, Patent Document 2 is known. Patent Document 2 includes a step of encoding plaintext using an error correction code, a step of encrypting a codeword encoded based on the encoded plaintext, a secret key, and a random vector, and A stochastic symmetric encryption method is described, including the step of adding a noise vector to the codeword. According to Patent Document 2, secure encryption can be realized at low cost by such a method.

Further, as a so-called authenticated encryption (AE) technique that simultaneously applies encryption to a plaintext message and authentication tag calculation for falsification detection using a secret key shared in advance, for example, a non-patent document Techniques such as No. 1 and Non-Patent Document 2 are known. According to Non-Patent Documents 1 and 2, an encryption function using a secret key as a parameter is used to generate a ciphertext and a tag that is a fixed-length alteration detection variable from an initial vector and plaintext. In other words, according to Non-Patent Documents 1 and 2, for example, the secret key is K, the plaintext is M, the initial vector is N, the encryption function with the key K as a parameter is AEnc_K, the encryption is C, and the tag is T. In this case, the following processing is performed.
(C, T) = AEnC_K (N, M)

In Non-Patent Documents 1 and 2, after the above processing, the generated ciphertext C, tag T, and initial vector N are transmitted to the other party (decryption device). Thereafter, in the decryption device that has received the transmission result, the presence / absence of alteration and the decryption of plaintext M are performed using the received result and the decryption function ADec_K. It is assumed that the initial vector N is generated so as not to coincide by chance.

Further, as another technique of AE, for example, Non-Patent Document 3 is known. In Non-Patent Document 3, a variable length input / output pseudo-random permutation (Wide Pseudo Random Permutation, WPRP) P_K with K as a key is used to input (N, For M), the ciphertext C = P_K (N, M) is the overall output. In this case, the length of the ciphertext C is the sum of the lengths of the initial vector N and the plaintext M.

Also, in the above case, the decryption side uses the shared key K to apply the reverse substitution of P_K to the ciphertext C to obtain (N, M), and then whether or not N is the expected value By confirming, authentication check will be performed. Note that the technique of Non-Patent Document 3 requires that the decryption side knows in advance the initial vector N to be used by the encryption side. This can be realized if the encryption side and the decryption side are synchronized with respect to the update of the initial vector N. Typically, this is achieved by the decryption side storing the initial vector of the normal encryption sent immediately before. This condition is a natural condition when the decoding side is required to detect and eliminate the replay attack (reflection attack, replay attack).

JP 2005-134478 A Special table 2011-509433 gazette

In technologies such as Patent Documents 1 and 2, when a new message authentication function is desired, for example, a message authentication code (MAC) is newly added. As a result, there is a problem that the amount of information to be transmitted increases and the communication band increases. In addition, when a new message authentication function is added in this way to achieve the authentication encryption function as a whole, it may be required to change the protocol regardless of the length of the message. May occur.

In the techniques described in Non-Patent Documents 1 and 2, it is necessary to transmit the ciphertext C having the same length as the plaintext M by concatenating the initial vector N and the tag T by encryption of the plaintext M. . In normal processing, both the initial vector N and the tag T are short values of about 4 bytes to 32 bytes. However, when the plain text M is also short, the increase in communication bandwidth due to the addition of the initial vector N and the tag T cannot be ignored. . Such a case is frequently seen, for example, in a device of a wireless sensor network. In such a network, the communication band is one of the important factors that influence power consumption. Therefore, bandwidth reduction has become an important issue.

Further, in the technology described in Non-Patent Document 3, the information to be transmitted is only the ciphertext C, and the length is the sum of the lengths of the initial vector N and the plaintext M as described above. Therefore, it is possible to suppress an increase in the communication band as compared with Non-Patent Documents 1 and 2. On the other hand, in the technique of Non-Patent Document 3, one block cipher finite field GF (2 ⁿ ) multiplication (where n is a block size) is required twice per block of input length. Therefore, the load becomes very large compared with general encryption, and there has been a problem that encryption efficiency is poor.

As described above, when using the encryption method with authentication, there is a problem that the communication band increases or the processing becomes complicated in order to suppress the increase of the communication band. That is, when using the encryption method with authentication, there has been a problem that it is difficult to efficiently prevent an increase in bandwidth.

Therefore, an object of the present invention is to provide an authenticated encryption apparatus that solves the problem that it is difficult to efficiently prevent an increase in bandwidth when using an authenticated encryption method.

In order to achieve such an object, an authenticated encryption apparatus according to an aspect of the present invention includes:
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
The ciphertext encrypted by the plaintext encryption unit and the tag generated by the tag generation unit are configured to output,
The structure is taken.

Moreover, the decryption apparatus with authentication which is another embodiment of the present invention is as follows.
A ciphertext input unit that accepts input of a ciphertext and a tag to be decrypted;
A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
A plaintext decryption unit that decrypts the ciphertext and generates a plaintext using the mask value generated by the mask value decryption unit;
A fixed length decoding unit that generates a fixed length value by decoding the mask value using an adjustment value based on the plaintext;
A tamper inspection unit that inspects the presence or absence of tampering by comparing the fixed length value and the expected value stored in advance,
Configured to output the presence / absence of tampering inspected by the tampering inspection unit and the plaintext generated by the plaintext decryption unit,
The structure is taken.

Moreover, the encryption system with authentication which is the other form of this invention is:
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
An encrypted device with authentication for outputting the ciphertext encrypted by the plaintext encryption unit and the tag generated by the tag generation unit;
A ciphertext input unit that accepts input of ciphertext and tags;
A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
Using the mask value generated by the mask value decryption unit, the plaintext decryption unit that decrypts the ciphertext that the ciphertext input unit has accepted and generates plaintext;
A fixed length decoding unit that generates a fixed length value by decoding the mask value generated by the mask value decoding unit using an adjustment value based on the plaintext generated by the plaintext decoding unit;
A tampering inspection unit that inspects the presence or absence of tampering by comparing the fixed length value generated by the fixed length value decoding unit and the expected value stored in advance,
And a decryption device with authentication that outputs the presence / absence of alteration checked by the alteration checking unit and the plaintext generated by the plaintext decoding unit.

In addition, an authenticated encryption method according to another embodiment of the present invention is as follows.
Accepts plaintext input,
Generate a new fixed length value that is different from the value generated in the past,
Using the adjustment value based on the plaintext, the fixed length value is encrypted to generate a mask value,
Using the generated mask value, the plaintext is encrypted to generate a ciphertext,
A tag is generated by encrypting the generated mask value,
Outputting the ciphertext and the tag;
The structure is taken.

Moreover, the program which is the other form of this invention is:
In the information processing device,
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
Realizing a tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit;
It is a program for outputting the ciphertext encrypted by the plaintext encryption unit and the tag generated by the tag generation unit.

By configuring as described above, the present invention provides an authenticated encryption apparatus that solves the problem that it is difficult to efficiently prevent an increase in bandwidth when using an authenticated encryption method. Is possible.

It is a block diagram which shows an example of a structure of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating an example of the checksum calculation method by the checksum calculation means of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating an example of the encryption by the block encryption means with an adjustment value of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating another example of the encryption by the block encryption means with an adjustment value of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating an example of the encryption by the encryption means with a mask of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating an example of the encryption by the encryption means with a mask of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a flowchart which shows an example of operation | movement of the encryption apparatus with authentication which concerns on the 1st Embodiment of this invention. It is a block diagram which shows an example of a structure of the decoding apparatus with authentication which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows an example of operation | movement of the decoding apparatus with authentication which concerns on the 2nd Embodiment of this invention. It is a figure which shows an example of a structure of the encryption system with an authentication comprised by the encryption apparatus with authentication and the decryption apparatus with authentication. It is a schematic block diagram which shows the outline of a structure of the encryption apparatus with authentication which concerns on the 3rd Embodiment of this invention. It is a schematic block diagram which shows the outline of a structure of the decoding apparatus with authentication which concerns on the 4th Embodiment of this invention. It is a schematic block diagram which shows the outline of a structure of the encryption system with authentication which concerns on the 4th Embodiment of this invention.

[First Embodiment]
A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a block diagram showing an example of the configuration of the encryption device with authentication 1 according to the first embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a checksum calculation method performed by the checksum calculation unit 12 of the authenticated encryption apparatus 1. FIG. 3 is a diagram illustrating an example of an encryption process performed by the adjustment value-added block encryption unit 13 of the authenticated encryption apparatus 1. FIG. 4 is a diagram illustrating another example of the encryption process performed by the adjustment value-added block encryption unit 13 of the authenticated encryption apparatus 1. FIG. 5 is a diagram illustrating an example of the encryption process performed by the encryption unit with mask 14 of the encryption device with authentication 1. FIG. 6 is a diagram illustrating an example of the encryption process performed by the encryption unit with mask 14 of the encryption device with authentication 1. FIG. 7 is a flowchart showing an example of the operation of the authenticated encryption apparatus 1.

In the first embodiment of the present invention, a description will be given of an encryption apparatus with authentication 1 that uses a common key cryptosystem to encrypt and output input plaintext. The authenticated encryption apparatus 1 in this embodiment is configured to perform an authenticated encryption process. As will be described later, the encrypted encryption device 1 encrypts the input plaintext by a predetermined process, and then outputs a ciphertext obtained by encrypting the plaintext and a tag described later.

The encryption device with authentication 1 in the present embodiment is an information processing device having an arithmetic device and a storage device. A program is stored in the storage device, and each unit to be described later is realized by the arithmetic device reading and executing the program stored in the storage device.

Referring to FIG. 1, the authenticated encryption apparatus 1 according to the present embodiment includes a plaintext input unit 10 (plaintext input unit), an initial vector generation unit 11 (fixed length value generation unit), and a checksum calculation unit 12 (adjustment). Value calculation unit), block encryption unit with adjustment value 13 (mask value generation unit), encryption unit with mask 14 (plaintext encryption unit), tag generation unit 15 (tag generation unit), and ciphertext output And means 16.

The plaintext input means 10 (plaintext input unit) is a means for inputting plaintext M to be encrypted. The plaintext input means 10 is composed of a character input device such as a keyboard, for example. Note that the plaintext input unit 10 may be configured to be able to input the plaintext M from an external device connected via a network, for example.

As described above, plaintext M is input via the plaintext input means 10. Then, the plaintext input means 10 to which the plaintext M has been input outputs the input plaintext M to the checksum calculation means 12 and the masked encryption means 14.

The initial vector generation means 11 (fixed length value generation unit) generates an n-bit initial vector N (fixed length value, nonce) different from the values generated in the past. For example, the initial vector generation means 11 initially generates an arbitrary fixed value. Further, the initial vector generation means 11 stores the previously generated initial vector in a storage unit (not shown), and when newly generating an initial vector, by adding 1 to the stored initial vector, A new initial vector different from the generated value is generated. For example, the initial vector generating unit 11 generates N + 1 as a new initial vector N ′ when the last generated initial vector is N. In this case, the update process performed by the initial vector generation means 11 can be expressed using the initial vector update function f (N) = N + 1.

In this way, the initial vector generation means 11 generates the initial vector N so as not to overlap with values generated in the past. Thereafter, the initial vector generating unit 11 outputs the generated initial vector N to the block encryption unit 13 with adjustment value.

Note that the initial vector update function used by the initial vector generation unit 11 is not limited to the above example. The initial vector generation means 11 can be configured to use various functions for generating an initial vector N different from values generated in the past. Further, the initial vector generation means 11 may be configured to generate the initial vector N by combining other auxiliary information such as time information. In this case, the auxiliary information used when generating the initial vector N is assumed to be synchronized on the encryption side and the decryption side.

Also, as described above, the initial vector generation means 11 in this embodiment generates an n-bit initial vector. If the value corresponding to the initial vector generated by the initial vector generation unit 11 is shorter than n bits, the initial vector generation unit 11 generates an n-bit initial vector after performing appropriate padding. It will be.

The checksum calculation unit 12 (adjustment value calculation unit) calculates an n-bit checksum SUM (adjustment value) from the plaintext M acquired from the plaintext input unit 10 by simple calculation.

FIG. 2 shows an example of processing when the checksum calculation means 12 calculates the checksum SUM. Referring to FIG. 2, for example, the checksum calculation unit 12 divides the plaintext M acquired from the plaintext input unit 10 into blocks (M [1],..., M [m]) every n bits. The exclusive OR (Xclusive or XOR) of the plaintext block is calculated. For example, the calculation result is an n-bit checksum SUM (adjustment value). Note that when the plaintext M is divided into blocks each having n bits in this way, the final block M [m] may be less than n bits. In this case, the checksum calculation means 12 calculates an exclusive OR after applying appropriate padding to the final block (see FIG. 2).

The checksum calculation means 12 calculates the checksum SUM by such processing, for example. Thereafter, the checksum calculation unit 12 outputs the calculated checksum SUM to the block encryption unit 13 with adjustment value.

The checksum calculation means 12 may be configured to calculate the checksum SUM by a process other than the above process. The checksum calculation means 12 can be configured to use, for example, arithmetic addition or cyclic redundancy check (CRC) instead of exclusive OR.

The block encryption unit with adjustment value 13 (mask value generation unit, Tweakable block encryption unit) is generated by the initial vector generation unit 11 using the checksum SUM acquired from the checksum calculation unit 12 as the adjustment value (Tweak, tweak). The initial vector N is encrypted. The adjustment value-added block encryption means 13 can be realized by using a normal n-bit block cipher.

FIG. 3 shows an example of the encryption process performed by the adjustment value-added block encryption means 13. Referring to FIG. 3, the block encryption means with adjustment value 13 includes, for example, an encryption unit 131 that performs encryption using a key K1 and a block cipher E, and an n-bit input / output having a key K2 different from the key K1. A calculation unit 132 that performs a predetermined calculation process using the keyed function H. For the block cipher E, for example, a general block cipher scheme such as AES (Advanced Encryption Standard) can be adopted. This process is also performed by M. Liskov, R. L. Rivest, D. Wagner: Tweakable Block Ciphers.
Advances in Cryptology-CRYPTO 2002, 22nd Annual International Cryptology Conference, Santa Barbara, California, USA, August 18-22, 2002, Proceedings. Lecture Notes in Computer Science 2442 Springer 2002, pp. 31-46.
Is used.

The function H used in the calculation unit 132 has a checksum SUM and a key K2 as arguments. Therefore, the calculation unit 132 performs a calculation process using the checksum SUM acquired from the checksum calculation unit 12 and the key K2 stored in advance. Referring to FIG. 3, the adjustment value-added block encryption means 13 calculates an exclusive OR of H (SUM), which is a calculation result by the calculation unit 132, and the initial vector N after the above processing, and the result. Based on the above, the encryption unit 131 performs encryption. Then, the block encryption means with adjustment value 13 calculates exclusive logic between the result of encryption by the encryption unit 131 and the result of calculation by the calculation unit 132, and then outputs the calculation result as a mask L (mask value). To do. That is, the adjustment value-added block encryption means 13 is configured to calculate the mask L by executing the following processing, for example.
L = E (H (SUM) + N) + H (SUM)
Note that L represents a mask L, SUM represents a checksum SUM, and N represents an initial vector N. + Represents an exclusive OR for each bit (hereinafter the same).

For example, through such processing, the adjustment value-attached block encryption means 13 encrypts the initial vector N and generates the mask L. Thereafter, the block encryption means 13 with adjustment value outputs an n-bit mask L, which is the result of encryption, to the encryption means 14 with mask and the tag generation means 15.

The function H is an expression Pr [H (X) + H (X ′) = c] for any two different inputs x and x ′, where e is a security parameter (e is 0 or more and 1 or less). Must be smaller than e. In such a case, that is, when the function H is an AXU universal hash function, the above configuration realizes a secure block cipher with an adjustment value.

In the above description, an example of the process of the block encryption unit with adjustment value 13 has been described. However, the block encryption unit with adjustment value 13 may be configured to encrypt the initial vector N by a process other than the above. I do not care. For example, in the above description, the case where the key K1 and the key K2 are used has been described. However, the entire key may be a single block cipher key. An example of such a case will be described with reference to FIG. In FIG. 4,
Phillip Rogaway: Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC.Advances in Cryptology-ASIACRYPT 2004, 10th International Conference on the Theory and Application of Cryptology and Information Security, Jeju Island, Korea, December 5-9, 2004, Proceedings . Lecture Notes in Computer Science 3329 Springer 2004, pp. 16-31
The XEX mode described in (1) is used.

Referring to FIG. 4, the adjustment value-attached block encryption means 13 includes, for example, an encryption unit 133 that performs encryption using a key K1 and a block cipher E, an element 2 on a Galois field GF (2 ⁿ ), and a later-described A calculating unit 134 that multiplies the result of encryption by the encrypting unit 135 and an encryption unit 135 that encrypts the checksum SUM using the key K1 and the block cipher E.

According to the above configuration, after the checksum SUM acquired from the checksum calculation means 12 is encrypted by the encryption unit 135, the encrypted result E (SUM) and the element 2 on the Galois field GF (2 ⁿ ) Is multiplied by the calculation unit 134. Thereafter, the block encryption means with adjustment value 13 calculates the exclusive OR of the mul (2, E (SUM)), which is the calculation result by the calculation unit 134, and the initial vector N, and based on the result. The encryption unit 133 performs encryption. Then, the block encryption means with adjustment value 13 calculates the exclusive OR of the result of encryption by the encryption unit 133 and the result of calculation by the calculation unit 134, and then outputs the calculation result as a mask L. That is, the adjustment value-added block encryption means 13 can be configured to calculate the mask L by executing the following processing, for example.
L = E (mul (2, E (SUM)) + N) + mul (2, E (SUM))
Note that mul (2, E (SUM)) represents multiplication of the element 2 on the Galois field GF (2 ⁿ ) and E (SUM).

The encryption unit with mask 14 (plaintext encryption unit) generates the ciphertext C by encrypting the plaintext M acquired from the plaintext input unit 10 using the mask L acquired from the encryption unit with adjustment value 13. For example, the masked encryption unit 14 encrypts each block (M [1] to M [m]) obtained by dividing the plaintext M into n bits. From the viewpoint of security, when the encrypted text with mask 14 decrypts the ciphertext C and the different ciphertext C ′ with the same mask L, at least the decryption result is obtained with high probability for those who do not know the key. It is assumed that encryption is performed so that one block becomes an unpredictable random number.

FIG. 5 shows plaintext M [i] (where i is any value between 1 and m−1) when plaintext M is a sequence of n-bit blocks (M [1],..., M [m]). An example of processing when the masked encryption unit 14 encrypts (value) is shown. Referring to FIG. 5, the encryption means with mask 14 has, for example, a mask L and a constant 2 in the Galois field raised to the i power (in the case of plaintext [i]. I is a value corresponding to the order of the plaintext blocks. ) And an encryption unit 142 that performs encryption using the key K1 and the block cipher E.

According to the above configuration, the calculation unit 141 performs multiplication of the mask L and the power of 2 on the Galois field (i corresponds to a value indicating the order of plaintext blocks). Thereafter, the encryption means with mask 14 calculates an exclusive OR of mul (2 ⁱ , L), which is a calculation result by the calculation unit 141, and plaintext M [i], and encrypts based on the result. Encryption is performed by the unit 142. The masked encryption unit 14 calculates the exclusive OR of the result of encryption by the encryption unit 142 and the result of calculation by the calculation unit 141, and then outputs the calculation result. In other words, the encryption unit with mask 14 is configured to encrypt the plaintext M [i] and output the ciphertext C [i] by executing the following processing, for example.
C [i] = E (mul (2 ⁱ , L) + M [i]) + mul (2 ⁱ , L)
However, C [i] represents ciphertext C [i], and M [i] represents plaintext M [i].

The encryption means with mask 14 performs the above encryption processing from plaintext M [1] to plaintext M [m−1] (see FIG. 6). Also, the final block M [m] when the plaintext M is divided into n-bit blocks may be less than n bits. Therefore, for example, as shown below, the encryption means with mask 14 outputs the exclusive OR of the result of encrypting the constant and the plaintext M [m] as the ciphertext C [m] (see FIG. 6). ).
C [m] = msb_ | M [m] | (E (mul (2 ^m , L))) + M [m]
Here, msb_a (X) is a function for extracting the front a bits of X. | X | is a function representing the bit length of X. That is, msb_ | M [m] | (E (mul (2 ^m , L))) indicates that the front M [m] bits of E (mul (2 ^m , L)) are extracted. The ciphertext C [m] is generated by calculating an exclusive OR of the value extracted by the above process and M [m].

For example, by such a process, the encryption unit with mask 14 encrypts the plaintext M input to the plaintext input unit 10 to generate a ciphertext C. Thereafter, the encryption unit with mask 14 outputs the generated ciphertext C to the ciphertext output unit 16.

It should be noted that the block encryption means with adjustment value 13 has been described above.
L = E (mul (2, E (SUM)) + N) + mul (2, E (SUM))
In the case where the process is performed, the encryption unit with mask 14 needs to use a constant different from the block encryption unit 13 with adjustment value. This is, for example, can be realized by using a ^{mul (2 i + 1, L} ) in place of mul ⁽² i, L). That is, in the above case, for example, the calculation unit 141 is configured to multiply the mask L by 2 ^{i + 1} .

The tag generation unit 15 (tag generation unit) generates a tag T using the mask L acquired from the block encryption unit 13 with adjustment value. The tag T is decrypted into a mask L by a decryption device and used for message authentication and decryption of the ciphertext C. For example, the tag generation unit 15 generates the tag T by encrypting the mask L using a block cipher such as AES. Thereafter, the tag generation unit 15 outputs the generated tag T to the ciphertext output unit 16.

The ciphertext output means 16 concatenates the ciphertext C output from the masked encryption means 14 and the tag T output from the tag generation means 15 and outputs the result to an external device. The ciphertext output unit 16 is connected to, for example, a display device or a printer device, and outputs the ciphertext C and the tag T to the display device or the printer device. Note that the ciphertext output unit 16 may be configured to output the ciphertext C and the tag T to an external device connected via a network, for example.

The above is an example of the configuration of the encryption device with authentication 1. Next, an example of the operation of the encryption device with authentication 1 will be described with reference to FIG.

Referring to FIG. 7, first, plaintext M is input to the plaintext input means 10 (step S101). Then, the plaintext input means 10 outputs the input plaintext M to the checksum calculation means 12 and the masked encryption means 14.

Subsequently, the checksum calculation means 12 calculates a checksum SUM from the plaintext M (step S102). Specifically, for example, the checksum calculation unit 12 calculates the exclusive OR of each plaintext block when the plaintext M acquired from the plaintext input unit 10 is divided into n-bit blocks. Sum SUM is calculated. Thereafter, the checksum calculation unit 12 outputs the calculated checksum SUM to the block encryption unit 13 with adjustment value.

Also, the initial vector generation unit 11 generates an initial vector so that there is no overlap with the value generated by the initial vector generation unit 11 in the past. Then, the initial vector generation unit 11 outputs the generated initial vector to the block encryption unit 13 with adjustment value.

Subsequently, the block encryption unit with adjustment value 13 encrypts the initial vector N generated by the initial vector generation unit 11 using the checksum SUM received from the checksum calculation unit 12 as an adjustment value. Specifically, for example, the adjustment value-added block encryption means 13 encrypts the initial vector N by performing processing represented by the following equation.
L = E (mul (2, E (SUM)) + N) + mul (2, E (SUM))
With this process, the adjustment value-added block encryption means 13 generates a mask L (step S103). Thereafter, the adjustment value-attached block encryption means 13 outputs the generated mask L to the masked encryption means 14 and the tag generation means 15.

The masked encryption unit 14 that has acquired the plaintext M from the plaintext input unit 10 and has acquired the mask L from the block encryption unit 13 with adjustment value encrypts the plaintext M using the mask L and encrypts the ciphertext C. Is generated (step S104). Specifically, the encryption unit with mask 14 encrypts the plaintext M into the ciphertext C by performing a process represented by the following formula, for example.
C [i] = E (mul (2 ⁱ , L) + M [i]) + mul (2 ⁱ , L)
However, i = 1 to m−1
C [m] = msb_ | M [m] | (E (mul (2 ^m , L))) + M [m]
Thereafter, the encryption unit with mask 14 outputs the generated ciphertext C to the ciphertext output unit 16.

Further, the tag generation unit 15 that has acquired the mask L from the block encryption unit with adjustment value 13 generates a tag T by encrypting the mask L (step S105). The tag generation unit 15 generates the tag T by encrypting the mask L using a block cipher such as AES, for example. Thereafter, the tag generation unit 15 outputs the generated tag T to the ciphertext output unit 16.

Thereafter, the ciphertext output means 16 acquires the ciphertext C from the masked encryption means 14. Also, the ciphertext output unit 16 acquires the tag T from the tag generation unit 15. Then, the ciphertext output means 16 connects the acquired ciphertext C and the tag T. Then, the ciphertext output means 16 outputs the ciphertext C and the tag T to an external device such as a display device (step S106).

The above is an example of the operation of the authenticated encryption apparatus 1.

As described above, the authenticated encryption apparatus 1 according to the present embodiment includes a plaintext input unit 10, an initial vector generation unit 11, a checksum calculation unit 12, a block encryption unit 13 with an adjustment value, and an encryption with a mask. Means 14 and tag generation means 15 are provided. With such a configuration, the checksum calculator 12 can calculate the checksum SUM based on the plaintext M input via the plaintext input unit 10. The block encryption unit with adjustment value 13 can generate the mask L by encrypting the initial vector generated by the initial vector generation unit 11 using the checksum SUM as the adjustment value. Furthermore, the encryption means 14 with a mask can generate the ciphertext C by encrypting the plaintext M using the mask L. And the tag production | generation means 15 can produce | generate the tag T by encrypting the mask L. FIG. As a result, the ciphertext output unit 16 can output the generated ciphertext C and the tag T.

Here, the decryption device that has received the ciphertext C and the tag T can generate the mask L by decrypting the tag T. Further, the decryption device can decrypt the ciphertext C into the plaintext M using the generated mask L. Further, the decryption device can calculate the checksum SUM based on the decrypted plaintext M. The decoding apparatus can generate the initial vector N by decoding the mask L by using the mask L and the checksum SUM. As a result, the decoding apparatus can detect the presence or absence of tampering by comparing the generated initial vector N and the initial vector expected value.

In this way, by outputting the ciphertext C and the tag T generated by each configuration of the above-described encrypted encryption apparatus 1, the decryption side decrypts the ciphertext C to generate the plaintext M, and the message Authentication can be performed. That is, with the above configuration, it is possible to combine the tag T and the initial vector N, and it is possible to realize an authenticated cipher that transmits only the ciphertext C and the tag T generated by simple calculation processing. Become. As a result, it is possible to efficiently prevent an increase in bandwidth when using the authenticated encryption method.

In addition, in this embodiment, the case where the encryption apparatus 1 with authentication utilized ECB (Electronic CodeBook) mode was demonstrated. However, the encryption device with authentication 1 may be configured to use, for example, a CBC (Cipher Block Chaining) mode.

[Second Embodiment]
Next, a second embodiment of the present invention will be described with reference to FIGS. FIG. 8 is a block diagram showing an example of the configuration of the decryption apparatus 2 with authentication according to the second embodiment of the present invention. FIG. 9 is a flowchart showing an example of the operation of the authenticating decryption apparatus 2.

In the second embodiment of the present invention, the ciphertext C and the tag T output from the authenticated encryption apparatus 1 described in the first embodiment are decrypted to generate plaintext M and detect the presence / absence of tampering. The authenticating decryption apparatus 2 will be described.

The decryption apparatus 2 with authentication in the present embodiment is an information processing apparatus having an arithmetic device and a storage device. A program is stored in the storage device, and each unit to be described later is realized by the arithmetic device reading and executing the program stored in the storage device.

Referring to FIG. 8, the decryption apparatus with authentication 2 includes a ciphertext input unit 20 (ciphertext input unit), a mask generation unit 21 (mask value calculation unit), a decryption unit with mask 22 (plaintext decryption unit), A checksum calculation unit 23 (adjustment value calculation unit), an adjustment value-added block decoding unit 24 (initial vector generation unit), an initial vector check unit 25 (initial vector check unit), and a plaintext output unit 26. ing.

The ciphertext input unit 20 (ciphertext input unit) is a unit for inputting the ciphertext C and the tag T to be decrypted. The ciphertext input means 20 is configured by a character input device such as a keyboard, for example. The ciphertext input unit 20 may be configured to be able to input the ciphertext C and the tag T from an external device connected via a network or the like, for example.

As described above, the ciphertext C and the tag T are input via the ciphertext input means 20. The ciphertext input unit 20 to which the ciphertext C and the tag T are input outputs the input tag T to the mask generation unit 21 and outputs the ciphertext C to the masked decryption unit 22.

The mask generation unit 21 (mask value calculation unit) generates a mask L using the tag T acquired from the ciphertext input unit 20. For example, the mask generation unit 21 generates the mask L by decrypting the tag T using the block cipher decryption function used in the tag generation unit 15 described in the first embodiment. Thereafter, the mask generating means 21 outputs the generated mask L to the masked decoding means 22 and the adjustment value added block decoding means 24.

The masked decryption means 22 (plaintext decryption unit) decrypts the ciphertext C acquired from the ciphertext input means 20 using the mask L acquired from the mask generation means 21 to generate plaintext M. For example, the decryption unit with mask 22 generates the plaintext M by decrypting the ciphertext C by performing the inverse function D of the encryption unit with mask 14 described in the first embodiment.

For example, the ciphertext C is composed of m n-bit blocks (C [1],..., C [m]), and C [i] = E (mul (2 ⁱ , L)) described in the first embodiment. + M [i]) + mul (2 ⁱ , L)
However, i = 1 to m−1
Assume that encryption is performed using. In this case, the masked decryption means 22 performs, for example, the following processing on each block C [i] (i = 1,..., M−1) of the ciphertext to obtain the ciphertext C ( Decode the last block).
M [i] = D (mul (2 ⁱ , L) + C [i]) + mul (2 ⁱ , L)
Further, the decryption means 22 with mask executes, for example, the following process to decrypt the final block C [m] of the ciphertext C.
M [m] = msb_ | C [m] | (E (mul (2 ^m , L))) + C [m]

For example, by such a process, the decryption means 22 with mask decrypts the ciphertext C input to the ciphertext input means 20 to generate plaintext M. Thereafter, the masked decryption means 22 outputs the generated plaintext M to the checksum calculation means 23 and the plaintext output means 26.

The checksum calculator 23 (adjustment value calculator) calculates an n-bit checksum SUM from the plaintext M acquired from the masked decryptor 22 by simple calculation. Thereafter, the checksum calculation means 23 outputs the calculated checksum SUM to the block decoding means 24 with adjustment value.

The checksum calculation means 23 calculates the checksum SUM by the same process as the checksum calculation means 12 described in the first embodiment. The detailed description of the checksum SUM calculation process performed by the checksum calculation means 23 is the same as that already performed in the first embodiment, and therefore will be omitted.

The adjustment value added block decoding means 24 (initial vector generation section) generates the initial vector N by decoding the mask L using the checksum SUM acquired from the checksum calculation means 23 as the adjustment value (Tweak, tweak). Specifically, the block decryption unit with adjustment value 24 performs the inverse function of the block encryption unit with adjustment value 13 described in the first embodiment, thereby decrypting the mask L and generating the initial vector N. . Thereafter, the adjustment value-added block decoding unit 24 outputs the generated initial vector N to the initial vector checking unit 25.

The adjustment value-added block decrypting means 24 can be realized by using a normal n-bit block cipher as with the adjustment value-added block encryption means 13.

The initial vector check unit 25 (initial vector check unit) is an initial vector expectation that is an initial vector value expected by the decryption side for the pair of the initial vector N acquired from the block decryption unit 24 with adjustment value and the ciphertext C tag T. The value N * is compared to detect the presence or absence of tampering. The initial vector checking means 25 outputs the verification result B (ACK if the test passes, NCK if the test fails) after the comparison between the initial vector N and the initial vector expected value N *, and is necessary. Accordingly, the initial vector expected value N * _new used in the next inspection is generated.

For example, the initial vector checking unit 25 stores the initial vector expected value N * in a storage unit (not shown) in advance, the initial vector N acquired from the adjustment value-added block decoding unit 24, and the initial vector expected value N stored in advance. * And are compared. Then, when the initial vector N and the initial vector expected value N * match, the initial vector checking means 25 determines that there is no falsification and outputs B = ACK (pass inspection). Further, in this case, if the update function of the initial vector N used by the encryption side is f, the initial vector checking means 25 generates a new initial vector expected value N * _new = f (N), and stores the memory (not shown). Store in the department. That is, the initial vector checking means 25 updates the initial vector from N to N + 1, for example, when the test is passed (when the initial vector update function f (N) = N + 1). On the other hand, when the initial vector N and the initial vector expected value N * do not match, the initial vector checking means 25 determines that the falsification has occurred and outputs B = NCK (test failure). In this case, the initial vector checking means 25 does not update the initial vector expected value N *. That is, the new initial vector expected value N * _new = N *.

The initial vector checking means 25 compares the initial vector N and the initial vector expected value N * by the above processing, for example, and outputs the verification result B, which is the comparison result, to the plaintext output means 26. Further, the initial vector checking means 25 updates the initial vector expected value N * when the test is passed.

Note that the method of comparison verification performed by the initial vector inspection unit 25 is not limited to the case described above. For example, the initial vector checking unit 25 stores the threshold value t in advance in a storage unit (not shown), and determines that the test has passed if the absolute value difference between the initial vector N and the initial vector expected value N * is within the threshold value t. You may comprise so that it may do. With this configuration, the initial vector checking unit 25 can cope with information loss such as packet loss on the communication path. In the case of the configuration as described above, the success probability of the attacker who performs the tampering, that is, the probability that the value of the initial vector N when the illegal ciphertext is decrypted accidentally becomes a value close to the initial vector expected value N * is: Approximately t / (2 ⁿ ). Therefore, by making t sufficiently small, it becomes possible to detect tampering with high probability while dealing with information loss.

The plaintext output means 26 outputs the plaintext M acquired from the masked decryption means 22 and the verification result B acquired from the initial vector check means 25 to an external device. The plaintext output means 26 is connected to, for example, a display device or a printer device, and outputs the plaintext M and the verification result B to the display device or printer device.

Specifically, for example, the plaintext output unit 26 outputs the verification result B and the plaintext M when the verification result B = ACK (inspection pass). On the other hand, when the verification result B = NCK (inspection failure), the plaintext output means 26 outputs the verification result B while outputting the plaintext M as an empty string. For example, as described above, the plaintext output unit 26 outputs the verification result B and the plaintext M to an external device. The plaintext output means 26 may be configured to output the verification result B and the plaintext M regardless of the verification result B.

The above is an example of the configuration of the decryption apparatus 2 with authentication. Next, an example of the operation of the authenticating decryption apparatus 2 will be described with reference to FIG.

Referring to FIG. 9, first, the ciphertext C and the tag T are input to the ciphertext input means 20 (step S201). Then, the ciphertext input means 20 transmits the input tag T to the mask generation means 21 and transmits the ciphertext C to the masked decryption means 22.

Subsequently, the mask generation means 21 decodes the tag T and generates a mask L (step S202). Specifically, for example, the mask generation unit 21 generates the mask L by decrypting the tag T using the block cipher decryption function used in the tag generation unit 15 described in the first embodiment. Then, the mask generation unit 21 outputs the generated mask L to the masked decoding unit 22 and the adjustment value-added block decoding unit 24.

When the masked decryption means 22 acquires the mask L from the mask generation means 21, the decrypted ciphertext C acquired from the ciphertext input means 20 is decrypted using the mask L to generate plaintext M (step S203). Specifically, for example, the masked encryption / decryption means 22 decrypts the ciphertext C into plaintext M by performing the processing represented by the following equation.
M [i] = D (mul (2 ⁱ , L) + C [i]) + mul (2 ⁱ , L)
However, i = 1 to m−1
M [m] = msb_ | C [m] | (E (mul (2 ^m , L))) + C [m]
Thereafter, the masked decryption means 22 outputs the generated plaintext M to the checksum calculation means 23 and the plaintext output means 26.

Subsequently, the checksum calculation means 23 calculates a checksum SUM from the acquired plaintext M (step S204). Specifically, for example, the checksum calculation means 23 calculates the checksum SUM by calculating the exclusive OR of each plaintext block when the plaintext M is divided into blocks of n bits. Then, the checksum calculation means 23 outputs the calculated checksum SUM to the block decoding means 24 with adjustment value.

Thereafter, the adjustment value-added block decoding unit 24 acquires the checksum SUM calculated by the checksum calculation unit 23. Then, the adjustment value-added block decoding unit 24 decodes the mask L using the checksum SUM calculated by the checksum calculation unit 23 as an adjustment value to generate an initial vector N (step S205). For example, this process is executed by performing the inverse function of the block encryption means 13 with adjustment value. Thereafter, the adjustment value-added block decoding unit 24 outputs the generated initial vector N to the initial vector checking unit 25.

Then, when the initial vector checking unit 25 acquires the initial vector N from the adjustment value-added block decoding unit 24, the initial vector checking unit 25 determines whether or not the initial vector N and the initial vector expected value N * stored in advance match. (Step S206).

When the initial vector N and the initial vector expected value N * match (step S206, Yes), the initial vector checking means 25 sets the verification result B = ACK (passed inspection) and a new initial vector expected value. The initial vector expected value N * is updated to N * _new = f (N) (step S207). Then, the initial vector checking unit 25 outputs the verification result B = ACK to the plaintext output unit 26. Thereafter, the plaintext output means 26 outputs the plaintext M and the verification result B (step S208).

On the other hand, if the initial vector N and the initial vector expected value N * do not match (No at step S206), the initial vector checking means 25 sets the verification result B = NCK (check failure) and the initial vector expected value. N * is not updated (step S209). Then, the initial vector checking unit 25 outputs the verification result B = NCK to the plaintext output unit 26. Thereafter, the plaintext output means 26 outputs the verification result B while outputting the plaintext M as an empty string (step S210).

The above is an example of the operation of the decryption apparatus 2 with authentication. For example, by such an operation, the decryption apparatus with authentication 2 decrypts the ciphertext C into the plaintext M and detects the presence or absence of tampering.

As described above, the decryption apparatus with authentication 2 in this embodiment includes the ciphertext input unit 20, the mask generation unit 21, the decryption unit 22 with the mask, the checksum calculation unit 23, and the block decryption unit 24 with the adjustment value. , Initial vector checking means 25 and plain text output means 26. With this configuration, the mask generation unit 21 can generate the mask L by decrypting the tag T input via the ciphertext input unit 20. Further, the decryption means with mask 22 can generate plaintext M by decrypting the ciphertext C input via the ciphertext input means 20 using the mask L. Further, the checksum calculation means 23 can calculate the checksum SUM based on the plaintext M, and the adjustment value added block decoding means 24 decodes the mask L into the initial vector N using the checksum SUM as the adjustment value. I can do it. The initial vector checking means 25 can detect the presence or absence of falsification by comparing the initial vector N and the initial vector expected value N *.

As described above, according to the above configuration, it is possible to decrypt the ciphertext C into the plaintext M and detect the presence or absence of tampering only by receiving the ciphertext C and the tag T. As a result, it is possible to efficiently prevent an increase in bandwidth when using the authenticated encryption method.

In addition, in this embodiment, the decryption apparatus 2 with authentication was demonstrated. However, for example, as shown in FIG. 10, the present invention may be realized by an authenticated encryption system that uses the authenticated encryption apparatus 1 and the authenticated decryption apparatus 2 described in the first embodiment at the same time. The configurations of the encryption device with authentication 1 and the decryption device with authentication 2 are the same as those already described, and will be omitted.

Next, a third embodiment of the present invention will be described with reference to FIG.
[Third embodiment]
In the third embodiment, an encrypted encryption device 3 that encrypts and outputs an input plaintext will be described. The encryption device with authentication 3 in the present embodiment is configured to output a ciphertext obtained by encrypting a plaintext and a tag. In the present embodiment, an outline of the configuration of the encryption device with authentication 3 will be described.

Referring to FIG. 11, the encrypted encryption apparatus 3 according to the present embodiment includes a plaintext input unit 31, a fixed length value generation unit 32, a mask value generation unit 33, a plaintext encryption unit 34, and a tag generation unit 35. And have.

The plaintext input unit 31 receives plaintext input. In addition, the fixed length value generation unit 32 generates a new fixed length value that is different from the value generated by the fixed length value generation unit 32 in the past.

The mask value generation unit 33 encrypts the fixed length value generated by the fixed length value generation unit 32 using the adjustment value based on the plain text received by the plain text input unit 31, and generates a mask value. That is, the mask value generation unit 33 acquires plaintext from the plaintext input unit 31. Further, the mask value generation unit 33 acquires a fixed length value from the fixed length value generation unit 32. Then, the mask value generation unit 33 generates a mask value by encrypting the fixed length value using an adjustment value based on plain text.

The plaintext encryption unit 34 encrypts the plaintext using the mask value generated by the mask value generation unit 33 to generate a ciphertext. That is, the plaintext encryption unit 34 acquires the mask value from the mask value generation unit 33. The plaintext encryption unit 34 acquires plaintext from the plaintext input unit 31. Then, the plaintext encryption unit 34 encrypts the plaintext using the mask value and generates a ciphertext.

The tag generation unit 35 encrypts the mask value generated by the mask value generation unit 33 and generates a tag. That is, when the tag generation unit 35 acquires a mask value from the mask value generation unit 33, the tag generation unit 35 encrypts the acquired mask value and generates a tag.

Thereafter, the encryption device with authentication 3 outputs the ciphertext encrypted by the plaintext encryption unit 34 and the tag generated by the tag generation unit 35.

As described above, the encryption device with authentication 3 according to the present embodiment includes the plaintext input unit 31, the fixed length value generation unit 32, the mask value generation unit 33, the plaintext encryption unit 34, and the tag generation unit 35. Have. With such a configuration, the mask value generation unit 33 encrypts the fixed length value generated by the fixed length value generation unit 32 using the adjustment value based on the plain text input to the plain text input unit 31, thereby masking the mask. A value can be generated. Also, the plaintext encryption unit 34 can generate a ciphertext by encrypting the plaintext using the mask value. And the tag production | generation part 35 can produce | generate a tag by encrypting a mask value. As a result, the encryption device with authentication 3 can output a ciphertext and a tag.

Here, the decryption side that has received the ciphertext and the tag can decrypt the tag and generate a mask value. Also, the plaintext can be generated by decrypting the ciphertext using the mask value. Then, it is possible to generate a fixed length value by decrypting the mask value using the adjustment value based on the plain text. As a result, the decoding side can detect the presence or absence of tampering by comparing the generated fixed length value with the expected value that is the expected fixed length value.

Thus, by outputting the ciphertext and tag generated by each configuration of the encryption device with authentication 3, the decryption side decrypts the ciphertext to generate plaintext and performs message authentication Will be able to. That is, with the above-described configuration, it is possible to perform processing that combines a tag and a fixed-length value, and it is possible to realize authenticated encryption that transmits only a ciphertext and a tag that are generated by simple calculation processing. As a result, it is possible to efficiently prevent an increase in bandwidth when using the authenticated encryption method.

In addition, the encryption apparatus 3 with authentication mentioned above is realizable by incorporating a predetermined program in an information processing apparatus. Specifically, a program according to another embodiment of the present invention includes a plaintext input unit 31 that receives plaintext input and a fixed length value that generates a new fixed length value that is different from a value generated in the past. The plaintext is encrypted using the generation unit 32, the mask value generation unit 33 that generates a mask value by encrypting the fixed length value using the adjustment value based on the plaintext, and the mask value generated by the mask value generation unit 33. And a plaintext encryption unit 34 that generates a ciphertext and a tag generation unit 35 that encrypts the mask value generated by the mask value generation unit 33 and generates a tag, and the plaintext encryption unit 34 performs encryption. This is a program that outputs the encrypted text and the tag generated by the tag generation unit 35.

In addition, the authenticated encryption method executed by operating the above-described authenticated encryption apparatus 3 accepts plaintext input, generates a new fixed length value different from the value generated in the past, Using the adjustment value based on this, the fixed-length value is encrypted to generate a mask value, and the generated mask value is used to encrypt plaintext to generate a ciphertext, and the generated mask value is encrypted to generate a tag. The ciphertext and the tag are output.

Even the invention of the program or the authentication-encrypted method having the above-described configuration has the same operation as the authentication-encrypted encryption device 3, and therefore the above-described object of the present invention can be achieved. I can do it.

Next, a fourth embodiment of the present invention will be described with reference to FIG.
[Fourth Embodiment]
In the fourth embodiment, a description will be given of a decryption apparatus with authentication 4 that acquires a ciphertext and a tag, decrypts the ciphertext to generate plaintext, and detects the presence or absence of tampering. In the present embodiment, an outline of the configuration of the decryption apparatus 4 with authentication will be described.

Referring to FIG. 12, the decryption apparatus 4 with authentication in the present embodiment includes a ciphertext input unit 41, a mask value decryption unit 42, a plaintext decryption unit 43, a fixed length decryption unit 44, and a falsification inspection unit 45. ,have.

The ciphertext input unit 41 receives an input of a ciphertext and a tag to be decrypted.

The mask value decryption unit 42 decrypts the tag input to the ciphertext input unit 41 to generate a mask value. That is, the mask value decryption unit 42 acquires a tag from the ciphertext input unit 41. Then, the mask value decoding unit 42 generates a mask value by decoding the tag.

The plaintext decryption unit 43 decrypts the ciphertext using the mask value generated by the mask value decryption unit 42 to generate plaintext. That is, the plaintext decryption unit 43 acquires the mask value from the mask value decryption unit 42. The plaintext decryption unit 43 acquires the ciphertext from the ciphertext input unit 41. The plaintext decryption unit 43 then decrypts the ciphertext using the mask value to generate plaintext.

The fixed-length value decoding unit 44 generates a fixed-length value by decoding the mask value using an adjustment value based on plain text. That is, the fixed length value decoding unit 44 uses the adjustment value based on the plaintext generated by the plaintext decoding unit 43 to decode the mask value generated by the mask value decoding unit 42 to generate a fixed length value.

The falsification inspection unit 45 inspects whether or not falsification has occurred by comparing the fixed length value with the expected value stored in advance. That is, the falsification inspection unit 45 compares the fixed length value generated by the fixed length value decoding unit 44 with the expected value stored in advance. Thereby, the tampering inspection unit 45 inspects whether or not tampering has occurred.

As described above, the decryption apparatus with authentication 4 includes the ciphertext input unit 41, the mask value decryption unit 42, the plaintext decryption unit 43, the fixed length decryption unit 44, and the falsification inspection unit 45. . With this configuration, the mask value decryption unit 42 can decrypt the tag input via the ciphertext input unit 41 and generate a mask value. Further, the plaintext decryption unit 43 can decrypt the ciphertext input via the ciphertext input unit 41 using the mask value to generate plaintext. Further, the fixed length value decoding unit 44 can generate a fixed length value by decoding the mask value using the adjustment value based on the plain text. The tampering inspection unit 45 can detect the presence or absence of tampering by comparing the fixed length value with the expected value.

As described above, according to the above configuration, it is possible to decrypt the ciphertext into plaintext and detect the presence or absence of tampering only by receiving the ciphertext and the tag. As a result, it is possible to efficiently prevent an increase in bandwidth when using the authenticated encryption method.

Note that the above-described decryption apparatus with authentication 4 can be realized by incorporating a predetermined program into the information processing apparatus. Specifically, a program according to another embodiment of the present invention is input to the information processing apparatus into the ciphertext input unit 41 that receives an input of a ciphertext and a tag to be decrypted, and the ciphertext input unit 41. Based on the plaintext, a mask value decryption unit 42 that decrypts the tag to generate a mask value, a plaintext decryption unit 43 that decrypts the ciphertext using the mask value generated by the mask value decryption unit 42, and a plaintext Using the adjustment value, the fixed-length value decoding unit 44 that decodes the mask value to generate a fixed-length value, and the tampering inspection that checks the presence or absence of tampering by comparing the fixed-length value with the expected value stored in advance And the plaintext generated by the plaintext decryption unit 43 are output.

Further, the authenticated decryption method executed by operating the above-described decryption apparatus with authentication 4 accepts input of a ciphertext and a tag to be decrypted, decrypts the tag, generates a mask value, The value is used to decrypt the ciphertext to generate plaintext, and the adjustment value based on the plaintext is used to decrypt the mask value to generate a fixed length value, and the fixed length value and the expected value stored in advance are In this method, the presence or absence of tampering is inspected by comparison, and the presence or absence of tampering and plain text are output.

Even with the invention of the program or the decryption method with authentication having the above-described configuration, the above-described object of the present invention can be achieved because it has the same operation as the decryption apparatus 4 with authentication.

Further, the object of the present invention can be achieved even with an authenticated encryption system including the authenticated encryption apparatus 3 and the authenticated decryption apparatus 4 as shown in FIG. The authenticated cryptographic system uses, for example, a plaintext input unit 31 that accepts input of plaintext, a fixed-length value generation unit 32 that generates a new fixed-length value different from a value generated in the past, and an adjustment value based on plaintext. Then, a mask value generation unit 33 that generates a mask value by encrypting a fixed length value, and a plaintext encryption unit 34 that generates a ciphertext by encrypting the plaintext using the mask value generated by the mask value generation unit 33. A tag generation unit 35 that encrypts the mask value generated by the mask value generation unit 33 and generates a tag, and a ciphertext encrypted by the plaintext encryption unit 34 and a tag generated by the tag generation unit 33 , The ciphertext input unit 41 that receives the input of the ciphertext and the tag output from the authenticated encryption device 3, and the tag input to the ciphertext input unit 41 is decrypted Mask value to calculate the mask value The decryption unit 42, the plaintext decryption unit 43 that decrypts the ciphertext using the mask value calculated by the mask value decryption unit 42, and the adjustment value based on the plaintext, decrypts the mask value A fixed-length value decoding unit 44 that generates a fixed-length value, and a falsification inspection unit 45 that inspects whether or not falsification has occurred by comparing the fixed-length value with a pre-stored expected value. And a decryption device with authentication 4 that outputs the presence / absence of the tampering checked and the plaintext generated by the plaintext decryption unit 43.

<Appendix>
Part or all of the above-described embodiment can be described as in the following supplementary notes. The outline of the encryption apparatus with authentication in the present invention will be described below. However, the present invention is not limited to the following configuration.

(Appendix 1)
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
An authenticated encryption apparatus configured to output a ciphertext encrypted by the plaintext encryption unit and a tag generated by the tag generation unit.

(Appendix 2)
The encryption apparatus with authentication according to attachment 1, wherein
An adjustment value calculation unit that calculates the adjustment value of a fixed length from the plaintext input to the plaintext input unit;
The encryption apparatus with authentication configured to generate the mask value by encrypting the fixed length value using the adjustment value calculated by the adjustment value calculation unit.

(Appendix 3)
The encryption device with authentication according to attachment 2, wherein
The adjustment value calculation unit is configured to calculate the adjustment value by calculating an exclusive OR of each block when the plaintext input to the plaintext input unit is divided into blocks having a predetermined length. Encryption device.

(Appendix 4)
The encryption device with authentication according to any one of appendices 1 to 3,
The plaintext encryption unit includes a value of a plaintext block that is one of blocks when the plaintext is divided into blocks of a predetermined length, a constant of a finite field according to the order of the plaintext blocks in the plaintext, and the mask After calculating the exclusive OR of the multiplication value, which is a value obtained by multiplying the value, encryption is performed using a predetermined block cipher, and the exclusive OR of the encryption result and the multiplication value is calculated. Thus, an encrypted encryption apparatus configured to encrypt the plain text and generate the cipher text.

(Appendix 5)
The encryption device with authentication according to attachment 4, wherein
The plaintext encryption unit is a value calculated based on the result of encrypting a final block, which is the last block when the plaintext is divided into blocks of a predetermined length, and a finite field constant corresponding to the final block. And an encryption device with authentication configured to perform encryption by calculating an exclusive OR of the value and the value of the last block of the plaintext.

(Appendix 6)
A ciphertext input unit that accepts input of a ciphertext and a tag to be decrypted;
A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
A plaintext decryption unit that decrypts the ciphertext and generates a plaintext using the mask value generated by the mask value decryption unit;
A fixed length decoding unit that generates a fixed length value by decoding the mask value using an adjustment value based on the plaintext;
A tamper inspection unit that inspects the presence or absence of tampering by comparing the fixed length value and the expected value stored in advance,
A decryption apparatus with authentication configured to output the presence / absence of falsification inspected by the falsification inspection unit and the plaintext generated by the plaintext decryption unit.

(Appendix 7)
The decryption device with authentication according to attachment 6, wherein
An adjustment value calculation unit that calculates the fixed-length adjustment value from the plaintext decrypted by the plaintext decryption unit;
The decryption apparatus with authentication configured to generate the fixed length value by decoding the mask value using the adjustment value calculated by the adjustment value calculation unit.

(Appendix 7-1)
The decryption apparatus with authentication according to appendix 7,
The tampering inspection unit is a decryption apparatus with authentication for inspecting whether or not tampering has occurred based on an absolute value of a difference between the fixed length value and an expected value stored in advance and a threshold stored in advance.

(Appendix 8)
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
An encrypted device with authentication for outputting the ciphertext encrypted by the plaintext encryption unit and the tag generated by the tag generation unit;
A ciphertext input unit that accepts input of ciphertext and tags;
A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
Using the mask value generated by the mask value decryption unit, the plaintext decryption unit that decrypts the ciphertext that the ciphertext input unit has accepted and generates plaintext;
A fixed length decoding unit that generates a fixed length value by decoding the mask value generated by the mask value decoding unit using an adjustment value based on the plaintext generated by the plaintext decoding unit;
A tampering inspection unit that inspects the presence or absence of tampering by comparing the fixed length value generated by the fixed length value decoding unit and the expected value stored in advance,
An authenticated encryption system comprising: an authenticated decryption device that outputs the presence / absence of tampering inspected by the tampering inspection unit and the plaintext generated by the plaintext decryption unit.

(Appendix 9)
Accepts plaintext input,
Generate a new fixed length value that is different from the value generated in the past,
Using the adjustment value based on the plaintext, the fixed length value is encrypted to generate a mask value,
Using the generated mask value, the plaintext is encrypted to generate a ciphertext,
A tag is generated by encrypting the generated mask value,
An authenticated encryption method for outputting the ciphertext and the tag.

(Appendix 9-1)
Accepts input of ciphertext and tag to be decrypted,
Decoding the tag to generate a mask value;
Using the mask value, decrypt the ciphertext to generate plaintext,
Using the adjustment value based on the plaintext, the mask value is decrypted to generate a fixed length value,
Inspecting the presence or absence of tampering by comparing the fixed length value and the expected value stored in advance,
A decryption method with authentication for outputting the presence / absence of falsification and the plaintext.

(Appendix 9-2)
Accepts plaintext input,
Generate a new fixed length value that is different from the value generated in the past,
Using the adjustment value based on the plaintext, the fixed length value is encrypted to generate a mask value,
Using the generated mask value, the plaintext is encrypted to generate a ciphertext,
A tag is generated by encrypting the generated mask value,
Outputting the ciphertext and the tag;
Accepting the input of the ciphertext and the tag,
Decoding the tag to generate the mask value;
Using the mask value, decrypt the ciphertext to generate the plaintext,
Using the adjustment value based on the plaintext, the mask value is decrypted to generate the fixed length value,
Inspecting the presence or absence of tampering by comparing the fixed length value and the expected value stored in advance,
An authenticated cryptographic processing method for outputting the presence / absence of alteration and the plaintext.

(Appendix 10)
In the information processing device,
A plaintext input unit for receiving plaintext input;
A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
Realizing a tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit;
A program for outputting a ciphertext encrypted by the plaintext encryption unit and a tag generated by the tag generation unit.

(Appendix 10-1)
In the information processing device,
A ciphertext input unit that accepts input of a ciphertext and a tag to be decrypted;
A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
A plaintext decryption unit that decrypts the ciphertext and generates a plaintext using the mask value generated by the mask value decryption unit;
A fixed length decoding unit that generates a fixed length value by decoding the mask value using an adjustment value based on the plaintext;
Realizing a falsification inspection unit that inspects the presence or absence of falsification by comparing the fixed length value with an expected value stored in advance;
A program for outputting presence / absence of falsification inspected by the falsification inspection unit and plaintext generated by the plaintext decryption unit.

Note that the programs described in the above embodiments and supplementary notes are stored in a storage device or recorded on a computer-readable recording medium. For example, the recording medium is a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, and a semiconductor memory.

Although the present invention has been described with reference to the above embodiments, the present invention is not limited to the above-described embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

The present invention enjoys the benefit of the priority claim based on the patent application of Japanese Patent Application No. 2014-221754 filed on October 30, 2014 in Japan, and is described in the patent application. The contents are all included in this specification.

1, 3 Encryption device with authentication 10 Plain text input unit 11 Initial vector generation unit 12 Checksum calculation unit 13 Block encryption unit with adjustment value 131, 133, 135 Encryption unit 132, 134 Calculation unit 14 Encryption unit with mask 141 Calculation unit 142 Encryption unit 15 Tag generation unit 16 Ciphertext output unit 2, 4 Decryption device with authentication 21 Mask generation unit 22 Decryption unit with mask 23 Checksum calculation unit 24 Block decryption unit with adjustment value 25 Initial vector check unit 26 Plaintext Output means 31 Plain text input unit 32 Fixed length value generation unit 33 Mask value generation unit 34 Plain text encryption unit 35 Tag generation unit 41 Cipher text input unit 42 Mask value decryption unit 43 Plain text decryption unit 44 Fixed length value decryption unit 45 Tampering inspection unit

Claims (10)

1. A plaintext input unit for receiving plaintext input;
   A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
   A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
   A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
   A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
   An authenticated encryption apparatus configured to output a ciphertext encrypted by the plaintext encryption unit and a tag generated by the tag generation unit.
2. The encryption device with authentication according to claim 1,
   An adjustment value calculation unit that calculates the adjustment value of a fixed length from the plaintext input to the plaintext input unit;
   The encryption apparatus with authentication configured to generate the mask value by encrypting the fixed length value using the adjustment value calculated by the adjustment value calculation unit.
3. The encryption device with authentication according to claim 2,
   The adjustment value calculation unit is configured to calculate the adjustment value by calculating an exclusive OR of each block when the plaintext input to the plaintext input unit is divided into blocks having a predetermined length. Encryption device.
4. The encryption device with authentication according to any one of claims 1 to 3,
   The plaintext encryption unit includes a value of a plaintext block that is one of blocks when the plaintext is divided into blocks of a predetermined length, a constant of a finite field according to the order of the plaintext blocks in the plaintext, and the mask After calculating the exclusive OR of the multiplication value, which is a value obtained by multiplying the value, encryption is performed using a predetermined block cipher, and the exclusive OR of the encryption result and the multiplication value is calculated. Thus, an encrypted encryption apparatus configured to encrypt the plain text and generate the cipher text.
5. The encryption device with authentication according to claim 4,
   The plaintext encryption unit is a value calculated based on the result of encrypting a final block, which is the last block when the plaintext is divided into blocks of a predetermined length, and a finite field constant corresponding to the final block. And an encryption device with authentication configured to perform encryption by calculating an exclusive OR of the value and the value of the last block of the plaintext.
6. A ciphertext input unit that accepts input of a ciphertext and a tag to be decrypted;
   A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
   A plaintext decryption unit that decrypts the ciphertext and generates a plaintext using the mask value generated by the mask value decryption unit;
   A fixed length decoding unit that generates a fixed length value by decoding the mask value using an adjustment value based on the plaintext;
   A tamper inspection unit that inspects the presence or absence of tampering by comparing the fixed length value and the expected value stored in advance,
   A decryption apparatus with authentication configured to output the presence / absence of falsification inspected by the falsification inspection unit and the plaintext generated by the plaintext decryption unit.
7. The decryption apparatus with authentication according to claim 6,
   An adjustment value calculation unit that calculates the fixed-length adjustment value from the plaintext decrypted by the plaintext decryption unit;
   The decryption apparatus with authentication configured to generate the fixed length value by decoding the mask value using the adjustment value calculated by the adjustment value calculation unit.
8. A plaintext input unit for receiving plaintext input;
   A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
   A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
   A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
   A tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit, and
   An encrypted device with authentication for outputting the ciphertext encrypted by the plaintext encryption unit and the tag generated by the tag generation unit;
   A ciphertext input unit that accepts input of ciphertext and tags;
   A mask value decryption unit that decrypts a tag input to the ciphertext input unit to generate a mask value;
   Using the mask value generated by the mask value decryption unit, the plaintext decryption unit that decrypts the ciphertext that the ciphertext input unit has accepted and generates plaintext;
   A fixed length decoding unit that generates a fixed length value by decoding the mask value generated by the mask value decoding unit using an adjustment value based on the plaintext generated by the plaintext decoding unit;
   A tampering inspection unit that inspects the presence or absence of tampering by comparing the fixed length value generated by the fixed length value decoding unit and the expected value stored in advance,
   An authenticated encryption system comprising: an authenticated decryption device that outputs the presence / absence of tampering inspected by the tampering inspection unit and the plaintext generated by the plaintext decryption unit.
9. Accepts plaintext input,
   Generate a new fixed length value that is different from the value generated in the past,
   Using the adjustment value based on the plaintext, the fixed length value is encrypted to generate a mask value,
   Using the generated mask value, the plaintext is encrypted to generate a ciphertext,
   A tag is generated by encrypting the generated mask value,
   An authenticated encryption method for outputting the ciphertext and the tag.
10. In the information processing device,
    A plaintext input unit for receiving plaintext input;
    A fixed-length value generating unit that generates a new fixed-length value different from values generated in the past;
    A mask value generation unit that generates a mask value by encrypting the fixed length value using an adjustment value based on the plaintext;
    A plaintext encryption unit that encrypts the plaintext and generates a ciphertext using the mask value generated by the mask value generation unit;
    Realizing a tag generation unit that generates a tag by encrypting the mask value generated by the mask value generation unit;
    A program for outputting a ciphertext encrypted by the plaintext encryption unit and a tag generated by the tag generation unit.
    
    

Images