AU716807B2 - Method and apparatus for encrypting data - Google Patents

Description

AUSTRALIA

PATENTS ACT 1990 DIVISIONAL APPLICATION NAME OF APPLICANT(S): Hitachi, Ltd.

ADDRESS FOR SERVICE: DAVIES COLLISON CAVE Patent Attorneys 1 Little Collins Street Melbourne, 3000.

INVENTION TITLE: "Method and apparatus for encrypting data" The following statement is a full description of this invention, including the best method of performing it known to us: Q:\OPER\DH\14952-97.275 2/10/98 la BACKGROUND OF THE INVENTION The present invention relates to data encryption, and more particularly to the improvements in processing efficiency of encryption and cipher strength to any cryptanalysis. Furthermore, the present invention relates to the encryption involving data compression and more particularly to the improvements in processing efficiency of data compression and encryption and strength to cryptanalysis.

With increase of the computerized central ***information of a system and the data communication through a network, importance is now being placed on a technique of encrypting data for keeping the 15 computerized data from being tapped and tampered. As described in pages 27 to 32 of "Introduction to Cryptography Theory" Kyoritu edit., 1993, the encryption is roughly divided into a symmetric key cryptosystem and an asymmetric key cryptosystem. The present invention is intended for the improvement in symmetric cryptosystem which is suitable for encrypting a large amount of data. Later, a secret key cryptosystem is simply called cryptosystem.

At first, the description will be oriented to 2 the basic terms about the cryptosystem. As is described in pages 33 to 59 of the foregoing writing, the cryptosystem is executed to convert plaintext into ciphertext through secret parameters. The decryptosystem is executed to transform the ciphertext into the original plaintext through the effect of reverse transform with the same secret parameters as those used in the cryptosystem. The secret parameters are generally called a crypt-key (or just a key). The encrypting procedure is composed of repetition of one or more kinds of fundamental functions. The repetitive times are called rounds. In applying the encrypting procedure, the input data is divided into parts each of which has the same size and the encrypting procedure is 15 applied to each data part. Each data part is called a crypt-block (or just a block).

In designing and promoting the encryption, an important factor is a defense for various kinds of decrypting methods. The most frequently used 20 decrypting method is an extensive search for keys. In recent days, however, remarks are placed on more efficient differential cryptanalysis and linear cryptanalysis than the extensive search.

In the pages 163 to 166 of the aforementioned writing and the linear cryptanalysis of the DES (Data Encryption Standard) published in "The 1993 Symposium on Cryptography and Information Security", the P:\OPER\DH\87869-98.RS1 8/12/99 -3differential and the linear cryptanalyses utilize the correlation among the plaintext, the ciphertext, and the keys, which are proper to the encrypting system, and is executed to collect lots of inputs and outputs (plaintext and ciphertext) to be encrypted or decrypted by the same key and perform the statistical operation about these inputs and outputs for estimating the key.

The conventional method for defending the differential or linear cryptanalysis in the conventional encrypting system is executed to reduce the correlation among the plaintext, the ciphertext, and the key by increasing the rounds.

SUMMARY OF THE INVENTION According to the present invention there is provided an information encrypting method comprising the steps of: entering or receiving data; entering or receiving a secret key; encrypting at least one portion of said data by using said key or a value derived from the key; providing as a parameter for encrypting another portion (portion pl) of said data, an intermediate result given in the process of encrypting a portion other than said portion pl of said data or a value derived from the intermediate result, and encrypting said portion pl using 20 said initial value; o generating a random number; and setting said random number or value derived from said random number as an initial value for encrypting said data.

25 In another aspect, there is provided an information encrypting apparatus comprising: means for entering or receiving data; means for entering or receiving a secret key; encrypting at least one portion of said data by using said key or a value derived from the key; means for providing as a parameter for encrypting another portion (portion pi) of said P:\OPER\DH\87869-98.RS1 8/12/99 -3Adata, an intermediate result given in the process of encrypting a portion other than said portion pl of said data or a value derived from the intermediate result, and encrypting said portion pl using said initial value; means for generating a random number; and means for setting said random number or value derived from said random number as an initial value for encrypting said data.

In another aspect, there is provided a computer readable recording medium including information encrypted in accordance with the abovedescribed method.

e*

Q•

P:\OPER\DH\14952-97.DIV 2/10/98 -4- As described above, the differential and the linear cryptanalyses can be executed to collect lots of inputs and outputs (plaintext and ciphertext) encrypted and decrypted through the same key and perform a statistical operation about the inputs and outputs for estimating the key. In one example, an information processing method may include the steps of entering or receiving a plaintext and encrypting the plaintext, wherein the method utilizes as a key of a block of the plaintext an intermediate result given in the process of encrypting another block or a value derived on the intermediate result. This method uses a different key to each block depending upon the plaintext data. This method thus disallows execution of the foregoing statical operation and allows the ciphertext to 15 be protected from the differential and the linear cryptanalyses.

The foregoing method disables to use the intermediate result given in the process of encrypting another block for the first block of the plaintext to be encrypted. Hence, 20 the key is constant. The first method, therefore, allows the key of the first block to be estimated by collecting the inputs and the outputs of the first block over lots of plaintext and the overall ciphertext to be cryptanalyzed with the estimated key as a clue. In order to overcome 25 this problem, in accordance with the present invention, an information processing method includes the steps of entering or receiving the plaintext and encrypting the plaintext, wherein the method is executed to generate a random number for each plaintext and use the random number as the key of the first block of the plaintext to be P:\OPER\DH\14952-97.D1V 2/10/98 encrypted. This method, therefore, has a different key of the first block to each plaintext and thus enables to overcome the problem of the foregoing method.

Further, the encryption is often executed in association with data compression. As is described in pages 21 to 247 of "The Data Compression Book" in Japanese Toppan (1994), the compression is executed to replace a bit train of the plaintext with a shorter bit train. A plurality of correspondences are provided between the bit trains of the block of the plaintext and the compressed data.

BRIEF DESCRIPTION OF THE DRAWINGS The invention is more fully described, by way of nonlimiting example only, with reference to the drawings, in which: Fig. 1 is a block diagram showing a functional configuration according to a first encryption method.

20 Fig. 2 is a flowchart showing an operation of a control process executed in the method and apparatus; j r.

Fig. 3 is a diagram showing a Huffman tree indicating *-.correspondence between plaintext data and compressed data; Fig. 4 is a diagram showing a transformation of the Huffman tree; Fig. 5 is a block diagram showing a functional configuration according to the present invention; and Fig. 6 is a flowchart showing an operation ofa control process executed in the method and the apparatus according to the present invention.

P:\OPER\DH\14952-97.DIV 2/10/98 -6- DESCRIPTION OF THE PREFERRED EMBODIMENTS Fig. 1 is a functional arrangement of apparatus used in an encryption method. A block 101 denotes a completed information processing system. A block 102 is a process implemented by a central processing unit and an input/output unit. The block 102 includes an I/O portion 103, a control portion 104, a random number generating portion 105, a key generating potion 106, a correspondence changing portion 107, a compressing portion 108, a pre-encrypting portion 109, and a post-encrypting portion 110. A block 111 is a storage unit such as a RAM or a disk and stores plaintext data 112, random numbers 113, common keys 114, information regarding correspondences 115, work keys 116, and compressed and encrypted data 117.

The I/O portion 103 receives a plaintext data from the outside and puts it in the memory 111.

**ee eo Further, the I/O portion 103 receives a compressing and encrypting instruction and passes it to the control portion 104. On the other hand, the I/O portion 103 reads the compressed and encrypted data 117 from the memory 111 and outputs it to the outside. When the control portion 104 receives the compressing and encrypting instruction from the I/O portion 103, the control portion 104 starts the random number generating portion 105 for generating a random number and then starts the key generating portion 106 for generating a work key. Next, the control portion 104 reads the plaintext data 112 from the memory 111 and iteratively executes the five processes including the compression 108, the pre-encryption 109, the post-encryption 110, the correspondence change 107, and the work key change, thereby compressing and encrypting the plaintext data.

The control portion 104 will be discussed below.

In order to implement the random number generating portion 105, it is possible to use the 20 conventional method for generating a random number as is described in pages 61 to 86 of Japanese literature "Introduction to Cryptography Theory", Kyoritu edition (1993). As an example, this method is executed to set a proper initial value to a random number 113 in the 25 memory 111, read the previous random number 113 each time the random number generating portion 105 is started, apply the cryptanalysis to the previous random g number 113 inside of the random number generating portion 105, and set the encrypted result as a new random number. Further, the random number 113 in the memory 111 is replaced with a new random number.

The key generating portion 106 is executed to generate the work key 116 from the random number 113 and the common key 114. The work key 116 is executed by the method as described in Institution for Electronic, Information and Communication Engineers, Transactions, Vol. E74, No.8, pp2153 to 2159.

The correspondence changing portion 107 is executed to change the correspondence 115 between the bit trains of the plaintext data and the compressed data on the work key. A specific example of the correspondence depends on a specific compression 108.

In this embodiment, the compressing portion 108 utilizes the Huffman compression. The correspondence between the bit trains of the plaintext and the compressed data in the process of the Huffman 20 compression is represented by tree-structure data called a Huffman tree. This Huffman tree is changed with the change of the correspondence 107. The "correspondence changing portion 107 will be discussed below.

The compressing portion 108 utilizes the S• Huffman compression as mentioned above. According to the Huffman tree of the correspondence 115, the bit train of the plaintext data is replaced with the bit train of the compressed data for compressing the plaintext data. The Huffman compression is realized by the conventional method as described in pages 21 to 103 of "Data Compression Handbook", Toppan 1994.

The pre-encrypting portion 109 is executed to encrypt the data with the work key 116 as a parameter as described in the pages 33 to 59 of "Introduction to Cipher Theory", Kyouritu, edition., 1993. Like the pre-encrypting portion 109, the post-encrypting portion 110 is executed to encrypt the data with the work key 116 as a parameter by the conventional method.

Fig. 2 shows the detail of the operation of the control portion 104. At a step 201, the random number generating portion 105 is started for generating a random number. At a step 202, the key generating portion 106 is started for generating the work key and then setting the initial value of the work key 116.

Then, at a step 203, the control portion 104 reads the plaintext data 112.

At a step 204, when the compressing portion 108 is started, the next symbol of the plaintext data is compressed. Herein, for compressing the plaintext data, the compressing portion 108 is executed to 25 transform the symbol (bit train) of the plaintext data into the compressed bit train according to the correspondence 115. At a step 205, it is determined if more of the compressed data than the block size for cryptanalysis is stored. If so, the operation goes to a step 206. If the compressed data is less than the block size, the operation of the step 204 is repeated.

At a step 206, one block of the compressed data is applied to the pre-encrypting portion 109 for encrypting the block. The pre-encrypting portion 109 uses the work key 116 as a parameter. At a step 207, the result of the pre-encrypting portion 109 is stored.

At a step 208, the pre-encrypted result is applied to the post-encrypting portion 110 for encrypting it.

Herein, like the pre-encrypting portion 109, the postencrypting portion 110 uses the work key 116 as a parameter. Then, the additional data of the work key to the compressed and encrypted data is stored as the compressed and encrypted data 117 in the memory 111.

At a step 209, the correspondence 115 between the bit trains of the plaintext data and the compressed data is changed on the pre-encrypted result. At a step 210, the work key 116 is replaced with the preencrypted result. Then, at a step 211, it is determined if the overall plaintext data is processed.

If yes, the process is terminated. If no, the operation goes to a step 212.

At the step 212, it is determined if a given number of encrypting blocks are processed. If yes, the operation returns to the step 201. If no, the operation returns to the step 204. The reason why the .41operation returns to the step 201 will be described below. Computer programs implementing the steps of Fig. 2 may be stored in a recording medium such as a semiconductor memory, a floppy disk or a CD-ROM.

In thisarrangement, the intermediate result (pre-encrypted result) in the process of encrypting one block is made to be a parameter for compressing and encrypting the next block. In decompressing and restoring the compressed and encrypted data that is an output of this embodiment, it is necessary to use the same parameter as that used in compressing and encrypting the data. Hence, the intermediate result given in the process of decrypting one block is required to be set as a parameter for decrypting and decompressing the next block. Hence, if one erroneous bit appears in the compressed and encrypted data while the data is communicated or stored in a file, the intermediate result in the decrypted block containing the erroneous bit is made erroneous. As a result, the parameter for decrypting and decompressing the next *:*:.block is made erroneous. This error is propagated to the last block of the data.

The improvement in the error correcting *o S technique of the communication and the file storage 25 results in substantially protecting an application layer for which the present invention is intended, from being erroneous. Hence, the error propagation is

S.

-12negligible in any system to which the present invention applies. However, the applied systems may be provided where no error correction is done. If the present invention is applied to such systems, it is necessary to restrict the number of the error propagated blocks.

The foregoing returning operation from the steps 212 to 201 meets with this requirement. That is, if the number of the error propagated blocks reaches a given value, at the steps 201 and 202, the operation is executed to reset the work key to a value that is independent of the intermediate result in the encryption of the previous block, which makes it possible to avoid the error propagation.

Next, with reference to Figs. 3 and 4, the operation of the correspondence changing portion 107 will be described. In the Huffman compression, the correspondence 115 between the bit trains of the plaintext data and the compressed data is represented o* S.by the Huffman tree. Fig. 3 shows an example of a Huffman tree. This Huffman tree is a binary tree in **which a right and a left branches are spread at each intermediate node. The right and the left branches contain a value of 0 or 1, respectively. The end node represents one symbol of the plaintext data. The •*go connection of the branch values from the end node to the root node represents a bit train of the compressed data for the symbol represented by the end node. For example, the bit train of the compressed data for i is -13- 1000 and the bi: train of the compressed data for h is 010.

The correspondence changing portion 107 is started by the control portion 104. The correspondence changing portion 107 is executed to add numbers to the intermediate nodes of the Huffman tree. Specifically, the nodes are numbered in such a manner that a first is added to the root node, a second and a third are added to a second-stage node from left to right, a fourth and a fifth are added to a third-stage node from left to right, and so forth. That is, the numbering is executed from top to down and from left to right.

Then, the values given to the right and the left branches of the intermediate node are replaced with each other according to the work key. Specifically, if the i-th bit of the work key is 1, the values given to the right and the left branches of the i-th intermediate node are replaced with each other. (if it is zero, no replacement is done.) In Fig. 4, a block 401 indicates a transformation of the Huffman tree shown in Fig. 3 on the assumption that the work key is 1100100... A block 402 indicates a transformation of the Huffman tree shown in the block 401 on the assumption that the work key is 1010110... The work key is assumed to have a sufficiently large number of bits and if any bit of the work key exceeds the intermediate node number of the -14- Huffman tree, the bit is ignored in the correspondence changing portion 107.

The foregoing description is concerned with the first embodiment of the present invention. The conventional encrypting method has been arranged to secure more rounds for preventing the linear and the differential cryptanalyses. This preventing method, however, has a drawback of increasing the processing time. On the other hand, the method of the foregoing embodiment has been arranged to change the work key for each block. This change makes it impossible to perform a statistical operation for estimating the key, thereby keeping the ciphertext data from the differential and the linear cryptanalyses. The work key for each block is an intermediate result given in the process of encrypting the previous block. This method, hence, does not need an extra processing time for changing the work key. As described above, the method of this embodiment enables to prevent the differential and the 20 linear cryptanalyses without any increase of the processing time, thereby improving the cipher performance and the strength capability to the cryptanalysis.

Further, according to the abovementioned method, 25 in the compressing process, the correspondence between the plaintext data and the compressed data may be changed for each block depending on the intermediate result given in the process of encrypting the previous 'oo* result given in the process of encrypting the previous block. The intermediate result cannot be estimated unless the key is obtained. It means that the correspondence between the plaintext data and the compressed data is not estimated. The method of this embodiment can use the compression as a kind of encryption. The compression may present the same effect as the increase of the rounds and be used for keepig the ciphertex data from the differential and the linear cryptanalyses.

Fig. 5 shows a functional arrangement of a method according to the present invention. This is intended for decrypting and decompressing the encrypted data compressed by the method of the abovedescribed example for obtaining the original plaintext data. A block 501 denotes a completed information processing system. A block 502 denotes a process implemented by a central processing unit and an I/O unit, which process includes an I/O portion 503, a control portion 504, a random number reading portion 505, a key generating portion 506, a correspondence changing portion 507, a decompressing portion 508, a pre-decrypting portion 509, and a post-decrypting portion 510. A block 111 denotes a memory realized by a RAM, a disk, or the like. The memory 111 stores compressed and encrypted data 512, a random number 513, a common key 514, a b' correspondence 515, a work key 516, and plaintext data 517.

9

*O

-16- The I/O portion 503 is executed to apply the compressed and encrypted data from the outside and store it in a memory 511. At a time, the I/O portion 503 is executed to receive a decrypting and decompressing instruction and pass it to the control portion 504. On the other hand, the I/O portion 503 is also executed to read the plaintext data 517 from the memory 511 and put it to the outside. When the control portion 504 receives the decrypting and decompressing instruction from the I/O portion 503, the control portion 504 is executed to start the random number reading portion 505 and read a random number added to the compressed and encrypted data 512. Then, the control portion 504 is executed to start the key generating portion 511 for generating the work key.

Next, the control portion 504 is also executed to read the compressed and encrypted data 512 from the memory 511 and repeat five operations comprised of the predecryption 509, the post-decryption 510, the decompression 508, the correspondence change 507, and the change of the work key, to decrypt and decompress the compressed and encrypted data. The control portion 504 will be discussed later in detail.

The random number reading portion 505 is executed to read the random number added to the compressed and encrypted data 512. This random number has been used for generating the work key in the first described method.

66 666.

The key generating portion 506 is executed to generate a work key 516 from the random number 513 and the common key 514. The common key 514 has the same value as the common key 114 used in the first embodiment. Hence, since the random number and the common key are the same as those used with reference to the example of Figures 1 to 4, the work key 516 to be generated by the method of the invention is the same as the work key 116 used in the first described method.

The correspondence changing portion 507 is executed to change a correspondence 515 between the bit trains of the compressed data and the plaintext data on the basis of the work key. The concrete correspondence depends on the concrete decompression 508. The method of this embodiment uses the Huffman decompression for the decompressing portion 508. As described in pages 21 to 103 of "The Data Compression Book" Toppan (1994), the Huffman decompression is a reverse transform of the Huffman compression. The correspondence between the bit trains of the compressed data and the plaintext data is represented by a Huffman tree. Hence, the correspondence changing portion 507 is S. executed to change the Huffman tree in a similar manner to the correspondence changing portion 107 included in the first described method. Since the correspondence changing portion 507 uses the same work key and method of changing the Huffman tree as those used in the first described method, the changed Huffman tree is the same.

The decompressing portion 508 is executed to perform the Huffman decompression as mentioned above. That is, according to the Huffman tree of the correspondence 515, .ooe the bit train of the compressed data is replaced with that of the plaintext data to decompress the compressed data.

The decompressing portion 508 is a reverse transform of the compressing portion 108 and uses the same Huffman tree as that of the first example. Hence, the decompressing portion 508 enables to transform the data compressed by the method of the first example back to the original data.

The pre-decrypting portion 509 is a reverse transform of the post-encrypting portion included in the method of the first example. The pre-decrypting portion 509 is executed to decrypt the data with the work key 516 as a parameter. The post-decrypting portion 510 is a reverse transform of the preencrypting portion included in the method of the first example. The post-decrypting portion 510 is executed to decrypt the data with the work key 516 as a parameter. As mentioned above, in the second embodiment, the pre-decryption is a reverse transform t of the post-encryption included in the first 9* example, the post-decryption is a reverse transform of the pre-encryption therein, and the same work key as that of the first example is used for the decryption. Hence, the method of the invention enables to decrypt the compressed and encrypted data into the compressed data.

Fig. 6 shows the detail of the operation of the control portion 504. At a step 601, the operation is executed to start the random number reading portion 505 for reading the random number. At a step 602, the key generating portion 506 is started for generating the work key. As a result, the initial value of the work key 516 is set as the same value as the initial value of the work key 116 used in the first example.

Then, at a step 603, the operation is executed to read the compressed and encrypted data 512.

At a step 604, the pre-decrypting portion 509 is started for decrypting one block of the compressed and encrypted text. The pre-decrypting portion 509 S* uses the work key 516 as a parameter. At a step 605, the pre-decrypted result is stored. The pre-decrypting portion 509 is a reverse transform of the postdecrypting portion 110 included in the first embodiment. Hence, the pre-decrypted result has the •same value as the value immediately before the postdecryption performed in the first example, that is, .the pre-decrypted result. At a step 606, the post- *g*o decrypting portion 510 is started to further decrypt the result of the pre-decrypting portion 509. The post-decrypting portion 510 is-a reverse transform of the pre-decrypting portion 110 included in the first example. Hence, the post-decrypted result is the same as the value immediately before the pre-decryption performed in the first example, that is, the compressed text of one block obtained by the compressing portion 108.

At a step 607, the decompressing portion 508 is started to decompress one symbol from the head of the compressed text of one block. The decompressing portion 508 is a reverse transform of the compressing portion 108 included in the first example. As mentioned above, the Huffman tree for representing the correspondence between the compressed text and the plaintext is the same as the tree used in the first example. At the step 607, the operation is executed 9.

to obtain the value before the compression, that is, S 20 the symbol of the plaintext used in the first example. At a step 608, it is determined if the remains of the compressed data of one block are larger than or equal to one symbol of the plaintext. If yes, the operation returns to the step 607 at which the decompression is repeated. If no, the operation returns to the step 609. At this step, the operation .is executed to store the remaining data of one block of ft OO69 OOo the compressed text and add it to the head of the next block of the compressed text if the block is obtained.

At the step 609, the correspondence changing portion 507 is started for changing the correspondence 515, that is, the Huffman tree depending on the predecrypted result. The pre-decrypted result is the same as the result pre-encrypted by the first example.

The correspondence 515 before change is the same as the correspondence 115 of the first example. Hence, the correspondence 515 is the same as that of the first example even after the correspondence 515 is changed. At a step 610, the work key 516 is replaced with the pre-decrypted result. The pre-decrypted result has the same value as the pre-encrypted result used in the method of the first example. Hence, the work key 516 has the same y.vjaye as that used in the method of the first example even after it is changed.

At a step 611, it is determined if the 20 overall data of the compressed and encrypted text is processed. If yes, the operation is terminated. If no, the operation goes to a step 612. At this step 612, it is determined if a given number of blocks have been processed. If yes, the operation returns to the 25 step 601 at which the random number is newly read from the compressed and encrypted text 512. If no, the operation returns to the step 604 at which the the next block of the compressed and encrypted data is 009. block of the compressed and encrypted data is decrypted. The number of blocks used for the determination at the step 612 is set as the same value as that used in the method of the first example. As a result, the period of updating the random number is the same as that used in the method of the first example.

Computer programs for implementing the steps of Fig. 6 may be stored in a recording medium to be loaded in the system.

The foregoing description has been concerned with the present embodiment. As described above, according to the embodiment, the method has been arranged to decompress and decrypt the data compressed and encrypted by the method of the first example for recovering the original plaintext data. Many of the currently used encryptions are arranged to repeat the fundamental functions for encrypting the plaintext data or repeat the reverse functions of those fundamental S. 0 "5 functions for decrypting the ciphertext data. The 20 repetitive times of the reverse functions used in the decryption are equal to the repetitive times of the functions used in the encryption. The method of the first example has been arranged to cope with the o4 b differential and the linear cryptanalyses without s having to increase the rounds (repetitive times of the *tes: fundamental functions). Hence, the method of the embodiment does not need to increase the rounds •go *o P:\OPER\DH\14952-97.DIV 2110/98 -23for the decryption. As described above, the method of the embodiment enables encryption and decryption of data, keeping the high-level encryption without having to increase the processing time.

As is obvious from the foregoing description, the method according to the present invention is arranged to prevent the differential and the linear cryptanalyses without increasing the processing time in the encrypting process and the compressing and encrypting process. This makes it possible to improve the processing performance and the cipher strength to the differential and linear cryptanalyses. The information processing system according to the present invention may include a usually used hardware or software means for allowing down-loading of the programs implementing the steps of Fig. 6.

Throughout this specification and the claims which follow, unless the context requires otherwise, the word "comprise", and variations such as "comprises" and "comprising", will be understood to imply the inclusion of 20 a stated integer or step or group of integers or steps but S.o.

not the exclusion of any other integer or step of group of integers or steps.

@6 0

Claims (19)

1. An information encrypting method comprising the steps of: entering or receiving data; entering or receiving a secret key; encrypting at least one portion of said data by using said key or a value derived from the key; providing as a parameter for encrypting another portion (portion pl) of said data, an intermediate result given in the process of encrypting a portion other than said portion pl of said data or a value derived from the intermediate result, and encrypting said portion pl using said initial value; generating a random number; and setting said random number or value derived from said random number as an initial value for encrypting said data.

2. An encrypting method as claimed in claim 1, wherein said random number is generated by repetitively performing an encrypting process about the initial value.

3. An encrypting method as claimed in claim 1, wherein plural random numbers are 20 generated by repetitively performing the operation of the step for generating said random t number and said random numbers are set as initial values for encrypting various portions of said data. S

4. An encrypting method as claimed in claim 2, wherein plural random numbers are 25 obtained by repetitively performing the operation of the step for generating the random number and said random numbers are set as initial values for encrypting various portions of said data.

An encrypting method as claimed in claim 1, wherein the initial value for encrypting i said data or the information required for deriving the initial value is added to the encrypted P:\OPER\DH\87869-98.RSI 8/12/99 data.

6. An encrypting method as claimed in claim 2, wherein the initial value for encrypting said data or the information required for deriving the initial value is added to the encrypted data.

7. An encrypting method as claimed in claim 3, wherein the initial value for encrypting said data or the information required for deriving the initial value is added to the encrypted data.

8. An encrypting method as claimed in claim 1, wherein the initial value for encrypting said data or the information required for deriving the initial value is used for decrypting said encrypted data.

9. An encrypting method as claimed in claim 2, wherein the initial value for encrypting said data or the information required for deriving the initial value is used for decrypting said encrypted data.

An encrypting method as claimed in claim 3, wherein the initial value for encrypting said data or the information required for deriving the initial value is used for decrypting said encrypted data.

11. An encrypting method as claimed in claim 5, wherein the initial value for encrypting said data or the information required for deriving the initial value is used for 25 decrypting said encrypted data. 9*

12. An encrypting method as claimed in claim 8, wherein the operation of encrypting said data is executed by a different computer from the operation of decrypting said data, and the initial value for encrypting said data or the information required for deriving the initial value 4is rommunicated from the computer for executing the encryption to the other computer for \-I P:\OPER\DH\87869-98.RSI 8/12199 26 executing the decryption.

13. An information encrypting apparatus comprising: means for entering or receiving data; means for entering or receiving a secret key; encrypting at least one portion of said data by using said key or a value derived from the key; means for providing as a parameter for encrypting another portion (portion pl) of said data, an intermediate result given in the process of encrypting a portion other than said portion p1 of said data or a value derived from the intermediate result, and encrypting said portion pl using said initial value; means for generating a random number; and means for setting said random number or value derived from said random number as an initial value for encrypting said data.

14. An encrypting apparatus as claimed in claim 13, further comprising means for adding said initial value or information required for calculating said initial value to an output value from said first encrypting means. °9*

15. An encrypting apparatus as claimed in claim 13, further comprising means for decrypting data with said initial value or the information required for calculating said initial value. o

16. An encrypting apparatus as claimed in claim 14, further comprising means for 25 decrypting data with said initial value or the information required for calculating said initial value.

17. A computer readable recording medium including information encrypted in accordance with the method of any one of claims 1 to 12. 3N P:\OPER\DII\87869-98.RS1 8/12/99 27

18. An information encrypting method substantially as hereinbefore described with reference to the drawings.

19. An information encrypting apparatus substantially as hereinbefore described with reference to the drawings. DATED this 8th day of December, 1999 HITACHI, LTD. By DAVIIES COLLISON CAVE Patent Attorneys for the applicant