JP2000112353A - Hash function system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simplify the operations in an error correction coding means which converts the compressed object data to be inputted into a hash function device. SOLUTION: (2k-n) pieces of m-bit block message and the n pieces of m-bit block hash value with one step delay are inputted. These message and value are coded into 2m pieces of n-bit two dimensional error correcting code languages by an (n, k) two dimensional coder having a BCH code. 2m pieces of n-bit two dimensional error correcting code languages are made into 2n pieces of m-bit blocks. By using n pieces of multiple Davies-Meyer hash function devices, hash values of n pieces of m-bit blocks are outputted. The message consisting of arbitrary plural m-bit blocks are compressed by using an m-bit block cipher and the hash values of multiplexedly linked nm bits are obtained. Since a two dimensional coding is used, extended Galois field computations are unnecessitated and hash computations are simplified.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a hash function system, and more particularly to a hash function system for compressing and signing a message with a compression function in a cryptographic communication system.

[0002]

2. Description of the Related Art When a document is transmitted after being encrypted, it is necessary to prove that the document is authentic and not falsified. For this purpose, a digital signature is added to a document. However, if a digital signature is directly added to the original document, the data length becomes too long. Therefore, the digital signature is added after compressing the document.
In order to compress a document having an arbitrary length to a predetermined length, a hash function using encryption means is used. One example is DSS (Digital Signature Standa).
rd). A document of an arbitrary length is temporarily converted into a hash value of, for example, a 160-bit block by using a hash function. This 160-bit block is signed. For example, a 320-bit signature is added to a 160-bit hash value.

It is necessary to devise a hash function so as not to cause collision. A collision is defined as h (x) = h when x ′ ≠ x
(x ′). There are two definitions of the resistance of a hash function to collisions: weak collision resistance and strong collision resistance. Weak collisonresist is what is called pre-image resistance or 2nd-preimage resistance. For any particular x, h (x) = h
That is how difficult it is to find any x ′ (≠ x) that is (x ′). That is, when there is a document x and its hash value h (x), it is difficult to find another document x ′ having the same hash value h (x) for any document x. If you need to try
The pre-image resistance of the hash function h is said to be N.

[0004] Strong collision resist is what is called collison resistance or resistance to birthday attacks. h
Any input pair (x, x ';) where (x) = h (x')
x ′ ≠ x) is also difficult. That is, if it takes an average of N trials to find a different set of documents with the same hash value, then the hash function is said to be resistant to N birthday attacks. When simply saying collision resistance, it means this strong resistance.

Here, an example of a conventional hash function will be described. FIG. 7 shows a hash function using an m-bit block cipher. 12 is a block encryption means. This is a hash function using the Davies-Meyer method. Let E _k (·) be the encryption algorithm for m-bit encryption, and let the m-bit key be K. The hash function h realized by E _k (·) is called a Davies-Meyer function. Finding a collision for h requires about 2 ^{m / 2} encryptions of an m-bit block, as long as a secure block cipher is used. Also, about 2 ^m encryptions are needed to find the pre-image for h.

The message M _i , the hash value H _i , and 1
The relationship H _i = h (M _i , H _i−1 ) = E _Mi (H _i−1 ) + H _i−1 holds between the hash values H _i−1 before the step. Here, (+) is modulus 2 addition.

FIG. 8 shows a multiple Davis-Meier hash function in which a plurality of Davis-Meier hash functions are arranged in parallel.
Davies-Meyer). In the multiple Davis-Meier method, the following is defined. E _K (・)
Is an m-bit block cipher using a t × m-bit key K where t> 0. _Let h ₁ , h ₂ ,..., h _n be different Davis-Meier functions by taking the keys different values. For a multiple Davis-Meier function, r
The m-bit message inputs are affine transformed and mapped to n pairs (X _i , Y _i ) before input. _{Output, h 1, h 2, ...} , a concatenation of h _n. In a collision or pre-image attack, if the input block forming (X _i , Y _i ) is different from the original data, then h (X _i , Y _i )
Is said to be active. Further, a function in which the variable parameter (X _j , Y _j ) of the function h _j does not change even if the variable parameter (X _i , Y _i ) of the function h _i changes is said to be a function that can be independently attacked. .

[0008] As assumption A, the following is assumed. Suppose a collision or pre-image is found for the multiple Davis-Meier compression function. Let N be the number of active functions, and let (Nv) be the maximum number of N functions that can be attacked independently. In this case, an average of 2 ^{vm / 2} or 2 ^vm encryptions are required to find a collision or pre-image, respectively.

Here, as a conventional example, K & P (L. Knudsen a
nd B. Preneel) will be described. FIG. 9 is a configuration diagram of a compression function of K & P. 1
Is a multi-Davis-Meier hash function unit. 3
Is a memory for delaying the output hash value of the hash function unit 1 by one step. Reference numeral 5 denotes a control circuit that controls each unit. 13 is an (n, k) block encoder. 14
Is an editor comprising a memory for editing the output data of the encoder 13 into 2n m-bit blocks. Length n, number of information symbols k, minimum distance d, (t + 1) k>
n, where t ≧ 1 and m >> log ₂ n GF (2
^Assume that the input block is coded with the (n, k, d) code on ( ^{t + 1} ). Then, as long as assumption A holds, finding collisions against the compression function requires an average of 2 ^{(d-1) m / 2} encryptions. Alternatively, finding the pre-image requires an average of 2 ^{(d-1) m} encryptions. This is described in L. Knudsen and B. Preneel, “Fast and Secure H
ashing Based on Codes "Crypto'97, LNCS1294, pp.485
-498, 1997. This hash function requires nm memory, and the hash rate is (t + 1) (k / n) -1. Note that the hash rate (ha) of the hash function based on the m-bit block cipher is
sh rate) is defined as the ratio of the number of m-bit message blocks processed in one encryption or decryption to the number of blocks of the hash value.

Next, (8, 5, 3) Ham on GF (2 ² )
An example of a configuration using a ming code is shown.

The generation matrix G is

(Equation 1)

Here, 0 = (00), 1 = (01), α
= (10), β = α + 1 = (11). Chained value (ch
The order of aining value) ^{_{is, H i-1 1, M}} i 1, H i-1 3, H
_{^{i-1 4, H i-}} 1 5, H i-1 6, H i-1 7, H i-1 8, H i-1 2, M i 2
Is selected as follows. _{^{H i 1 = f 1 (H}} i-1 1, M i 1) H i 2 = f 2 (H i-1 3, H i-1 4) H i 3 = f 3 (H i-1 5, H _{^{i-1 6) H i 4}} = f 4 (H i-1 7, H i-1 8) H i 5 = f 5 (H i-1 2, M i 2) H i 6 = f 6 (H i _{^{-1 3 + H i-1 5}} + H i-1 7 + H i-1 2, H i-1 4
^{_{+ H i-1 6 + H}} i-1 8 + M i 2) H i 7 = f 7 (H i-1 1 + H i-1 2, M i 1 + M i 2) H i 8 = f 8 (H i-1 ¹ + _Hi-1 ³ + _Hi-1 ⁴ + _Hi-1 ⁶ +
_{^{H i-1 7, M i}} 1 + H i-1 3 + H i-1 5 + H i-1 6 + H i-1 8)

Here, (+) is modulo 2 addition. To obtain H _i ^8, the prompt to f ₈ are necessary operations expanded Galois field. The operation of the extended Galois field is specifically performed as follows. The irreducible polynomial on GF (2 ² ) is (X ² +
X + 1) Therefore, if the root is α, α ² = α + 1. If the input to f ₈ is represented by a polynomial expression, it is as follows. ^{_{(H i-1 1 α +}} M i 1) · 1+ (H i-1 3 α + H i-1 4) · α + (H i-1 5 α + H i-1 6) · (α + 1) + (H i-1 7 ^{_{α + H i-1 8)}} · 1+ (H i-1 2 α + M i 2) · 0 = H i-1 1 α + H i-1 3 (α + 1) + H i-1 4 α + H i-1 5 + H i-1 6 ( _{α + 1) + H i-} 1 7 α + H i-1 8 + M i 1 = (H i-1 1 + H i-1 3 + H i-1 4 + H i-1 6 + H i-1 7) α + (H i-1 ^{_{3 + H i-1 5 +}} H i-1 6 + H i-1 8 + M i 1)

As described above, by using the error correction code, the collision resistance is improved from 2 ^{m / 2} to 2 ^m , or
Since the pre-image resistance is improved from 2 ^m to ^{22 m} , a secure hash function can be easily configured.

[0015]

However, the above-mentioned conventional system has a problem that a binary code such as a BCH code cannot be used. Therefore, software or hardware for executing the operation of the enlarged Galois field was required. Alternatively, as in the case of K & P et al., It was necessary to calculate in advance and store it in a memory as a table.

The present invention solves the above-mentioned conventional problems and provides a BC
It is an object of the present invention to enable the use of a binary code such as an H code so that a hash value can be calculated more easily.

[0017]

In order to solve the above-mentioned problems, in the present invention, a hash function method is used to calculate a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step. A binary encoder that inputs and encodes 2m n-bit binary error correction codewords;
a multi-Davis-Meier hash function unit that inputs m n-bit binary error correction codewords into 2n m-bit blocks and outputs a hash value of n m-bit blocks; And a delay memory for delaying the hash values of the n m-bit blocks by one step.

[0018] With this configuration, Devis-
There is no need to assign an extended Galois field symbol element to two m-bit inputs, which is the basic configuration of Maya, and m inputs are assigned to m codewords of a binary code, and operation is performed using a binary code. Can be simplified.

Also, a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input to obtain (t + 1) m (t ≧ 1) n-bit binary error correcting codewords. And a binary encoder that encodes
+1) m n-bit binary error correction codewords are (t + 1)
A multifunction Davis-Meier hash function unit that inputs n m-bit blocks and outputs a hash value of n m-bit blocks is provided.

With this configuration, the key length tm
A hash value can be easily obtained by using a Bits-Meier hash function unit of bits.

Also, a plurality of m-bit block messages and an am-bit hash value delayed by one step are input into m linear codes of code length (t + a) bits (t ≧ 1, a ≧ 1). Binary encoder to encode, and m (t
+ A) A key length tm for inputting a bit code into (t + a) m-bit blocks and outputting an am-bit hash value
And a bit hash function unit. With such a configuration, it is possible to obtain a hash value having a hash value length of am bits with a collision resistance of 2 ^{m (d-1) / 2} .

Also, a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input and one product of n (t + 1) (t ≧ 1) m-bit blocks is input. The configuration is such that an encoder for encoding the error correction codeword of the code is provided. With this configuration, when a block code of a long key, a tandem DM or an abrest DM is used, the minimum distance of the code is greatly improved by using the product code, and as a result, security is improved. Is greatly improved.

Also, a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input to form one concatenation of n (t + 1) (t ≧ 1) m-bit blocks. The configuration is such that an encoder for encoding the error correction codeword of the code is provided. With this configuration, when using a long key block encryptor, tandem DM, or abrest DM, an MDS (maximum distance separation) code such as a Reed-Solomon code can be used as an outer code. Even with the same configuration, a code with higher performance than a product code can be used, and as a result, security is greatly improved.

[0024]

BEST MODE FOR CARRYING OUT THE INVENTION
In a hash function method in which a message composed of a plurality of m-bit blocks is compressed using an m-bit block cipher to obtain a multiplexed and connected hash value, n messages m and a plurality of m-bit block messages are delayed by one step.
A binary encoder that inputs a hash value of a bit block and encodes it into 2m n-bit binary error correction codewords;
N-bit binary error-correcting codewords are input into 2n m-bit blocks, and a hash function unit of a multiplex Davis-Meier that outputs a hash value of n m-bit blocks is output from the hash function unit. This is a hash function method including a delay memory that delays a hash value of n m-bit blocks by one step, and has an effect of reducing the rate of occurrence of collision.

According to a second aspect of the present invention, there is provided a hash function method for compressing a message composed of a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed concatenated hash value. The message of the m-bit block and the hash value of the n m-bit blocks delayed by one step are input and (t + 1) m (t ≧
(1) a binary encoder for encoding into an n-bit binary error correction codeword, and (t + 1) m n-bit binary error correction codewords as (t + 1) n m-bit blocks and input as n A hash function comprising: a multiple Davis-Meier hash function unit for outputting hash values of m m-bit blocks; and a delay memory for delaying the hash value of n m-bit blocks output from the hash function unit by one step. This method has the effect of reducing the rate of collision.

According to a third aspect of the present invention, there is provided a hash function method for compressing a message comprising a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed and connected hash value. An m-bit block message and a hash value of a (a ≧ 1) m-bit blocks delayed by one step are input to form a m-code length (t + a) bits (t ≧ 1) binary error correction codeword. A binary encoder to be encoded and m error-correcting codewords having a code length of (t + a) bits are input as (t + a) m-bit blocks, and hash values of a m-bit blocks are output. A hash function method including a hash function unit having a key length of tm bits and a delay memory for delaying a hash value of a number of m-bit blocks output from the hash function unit by one step. There has the effect of improving the complexity of collision.

According to a fourth aspect of the present invention, there is provided a hash function system for obtaining a multiply-connected hash value by compressing a message comprising a plurality of m-bit blocks using an m-bit block cipher. The message of the m-bit block and the hash value of the n m-bit blocks delayed by one step are input and n (t + 1) (t ≧
1) an encoder that encodes an error correction codeword of one product code of an m-bit block, and n (t + 1) error correction codewords of an m-bit block, A hash function system comprising a multi-Davis-Meier hash function unit that outputs a hash value, and a delay memory that delays the hash value of n m-bit blocks output from the hash function unit by one step. It has the effect of reducing the rate of occurrence.

According to a fifth aspect of the present invention, there is provided a hash function system for obtaining a multiply-connected hash value by compressing a message comprising a plurality of m-bit blocks by using an m-bit block cipher. The message of the m-bit block and the hash value of the n m-bit blocks delayed by one step are input and n (t + 1) (t ≧
1) an encoder that encodes one concatenated code error correction code word of the m-bit block, and n (t + 1) error correction code words of the m-bit block, and inputs n (t + 1) m-bit block error correction code words. A hash function method comprising: a multi-Davis-Meier hash function unit that outputs a hash value; and a delay memory that delays a hash value of n m-bit blocks output from the hash function unit by one step.
This has the effect of reducing the rate of collision.

Hereinafter, an embodiment of the present invention will be described with reference to FIG.
This will be described in detail with reference to FIGS.

(First Embodiment) In a first embodiment of the present invention, a message of (2kn) m-bit blocks and a hash value of n m-bit blocks delayed by one step are input. Then, the (n, k) binary encoder encodes them into 2m n-bit binary error correction codewords to form 2n m-bit blocks, and converts the 2n m-bit blocks to n
This is a hash function method in which a hash value of n m-bit blocks is output by inputting to a plurality of multiple Davis-Meier hash function units.

FIG. 1 is a diagram showing a hash function system using binary codes according to the first embodiment of the present invention. In FIG. 1, the hash function unit 1 of the multiple Davis-Meier is
It is an n-stage Davis-Meier hash function unit. The binary encoder 2 is means for calculating an (n, k, d) binary code such as a BCH code. The delay memory 3 is a memory for delaying the hash value by one step. Editor 4
Is a memory or wired logic that edits m n-bit codewords into n m-bit blocks. The control circuit 5 is control means for controlling each unit.

An (n, k, d) binary code having a code length n, the number of information symbols k, and a minimum distance d is used. Let n be the number of stages of the Davis-Meier hash function unit. The input to the hash function unit is 2n blocks. Therefore, the input of the binary encoder is 2k blocks. Since the processing time i must use the n hash values of the previous time (i-1), the number r of blocks used for the message block
Since n + r = 2k, r = (2k−n). The hash rate is (2kn) / n.

The hash function method using binary codes according to the first embodiment of the present invention employs two codewords formed from 2m n-bit binary codewords, whereby n pairs of m-bit blocks are used. Is different from the K & P construction method in that it is input to the hash function unit. For convenience of explanation, (15,
(11,3) Hamming code shortened (14,10,3) Hamming
This will be described with reference numerals.

The parity matrix is as follows.

(Equation 2)

The primitive polynomial is (X ⁴ + X + 1). H ¹ = f ₁ (G ¹ , M ¹ ) H ² = f ₂ (G ³ , M ³ ) H ³ = f ₃ (G ⁵ , M ⁵ ) H ⁴ = f ₄ (G ⁷ , G ⁸ ) H ^{5 _{= f 5 (G 9, G}} 10) H 6 = f 6 (G 11, G 12) H 7 = f 7 (G 13, G 14) H 8 = f 8 (G 2, M 2) H 9 = f _{^{9 (G 4, M 4)}} H 10 = f 10 (G 6, M 6) H 11 = f 11 (r 4L, r 4R) H 12 = f 12 (r 3L, r 3R) H 13 = f 13 ( r _2L , r _2R ) H ¹⁴ = f ₁₄ (r _1L , r _1R )

Here, (r _4L , r _4R ), (r _3L ,
(r _3R ), (r _2L , r _2R ), (r _1L , r _1R ) are Hamming
This is a block of code check bits. These are given by the following equations. ^{_{r 4L = G 1 + G 3}} + G 5 + G 9 + G 13 + G 2 r 3L = G 1 + G 3 + G 5 + G 7 + G 11 + G 2 + G 4 r 2L = G 3 + G 5 + G 7 + G 9 + G 13 + G 4 + G 6 r ^{_{1L = G 1 + G 3 +}} G 7 + G 11 + G 13 + G 6 r 4R = M 1 + M 3 + M 5 + G 10 + G 14 + M 2 r 3R = M 1 + M 3 + M 5 + G 8 + G 12 + M 2 + M 4 r 2R = M ^{3 + M 5 + G 8 +} G 10 + G 14 + M 4 + M 6 r 1R = M 1 + M 3 + G 8 + G 12 + G 14 + M 6

The symbol _{^{G i, M i, r iL}} , r iR represents a m-bit blocks. G ⁱ represents a single hash value of the previous time. M ⁱ represents a message block, r _iL , r _iR
Represents the check bits of the Hamming code.

Here, the Hamming code is used for the sake of explanation, but when a double error correction BCH code is considered, the following is obtained. Since the BCH code can have a larger minimum distance than the Hamming code, a more secure hash function can be configured. (31, 21, 5) BCH code is (30, 20, 5) BCH
Shorten to sign. Then, r = 40−30 = 10. The hash rate is 10/30 = 1/3.

Table 1 shows an example using the binary code and a result of the conventional K & P et al. For comparison.

[0040] (The sign of Non-binary is based on the result of K & P et al.)

As described above, in the first embodiment of the present invention, the hash function method is used to calculate the message of (2k−n) m bit blocks and the hash value of n m bit blocks delayed by one step. Is input to the (n, k) binary encoder to encode 2m n-bit binary error correction codewords to form 2n m-bit blocks, and to convert the two m-bit blocks into n The configuration is such that a hash value of n m-bit blocks is output by inputting it to the hash function unit of the multiplex Davis-Meier. , A more secure hash value can be obtained.

(Second Embodiment) In a second embodiment of the present invention, (ka) m-bit block messages and an am-bit hash value delayed by one step are input, In the original encoder, the code length (t + a) bits (t ≧
1, a ≧ 1), the number of information bits k, and the minimum distance d (t +
(a, k, d) Encoding into a linear code to form (t + a) m-bit blocks, input to a hash function unit having a key length of tm bits and a hash value length of am bits, and output an am bit hash value This is a hash function method.

FIG. 2 is a diagram of data of a hash function according to the second embodiment of the present invention. In FIG. 2, a word data 6 is a code word including a k-bit information symbol block and a C-bit check symbol block, and has a hash value of a key of t m-bit blocks and a hash value of a m-bit blocks. Input to the function unit. MISTY encryption data 7 is a code word consisting of C _i of M _i and m bits of the H _i-1 and m-bit m-bit, and the key two m-bit blocks, the hash value of the one m-bit blocks MI
Input to STY encryptor.

The block cipher includes MISTY and IDEA.
, There is a block cipher of 128 bits, that is, t = 2, which is twice the block length 64. Also, Tandem-Davies-Meyer and Abrest-
Like Abreast-Davies-Meyer,
Even if the key is 64 bits, there is a hash method in which the hash value is 128 bits, that is, a = 2.

Generally, an error correction code is applied to a hash value of a block (am bits) using a key length of t blocks (tm bits). An integer k (k> a) is represented by a code length (t + a)
And the minimum distance of the code is d.
Then, the hash value of the a block is obtained for the message block of the message block number r = (ka). For example, in the case of MISTY or IDEA, t =
Since 2, a = 1, encoding by a (3, 2, 2) Hamming code of k = 2 yields a hash function with a hash rate of 1 with r = (2-1) / 1 = 1.

As described above, in the second embodiment of the present invention, the hash function method is performed by inputting (ka) m-bit block messages and an am-bit hash value delayed by one step. , The code length (t +
a) bits, number of information bits k, (t + a,
k, d) to form a (t + a) m-bit block with a key length tm bits and a hash value length am
Since a hash value of am bits is input to a hash function unit of bits and a hash value of am bits is output, the collision resistance is 2
A hash value with a hash value length of am bits of ^{m (d-1) / 2} can be obtained.

(Third Embodiment) In a third embodiment of the present invention, a message of r m-bit blocks and a hash value of n m-bit blocks delayed by one step are input, and n A hash function that encodes (t + 1) (t ≧ 1) m-bit blocks into one product code, inputs n (t + 1) m-bit blocks, and outputs a hash value of n m-bit blocks This is a hash function method including a container.

FIG. 3 is a diagram showing a hash function system configured using a product code according to the third embodiment of the present invention.
In FIG. 3, 8 is a row encoder and 9 is a column encoder. Although FIG. 3 illustrates that the row encoding is performed first, in the case of the product code, the column encoding may be performed first and the row encoding may be performed later.

In the first embodiment, an example is shown in which two m-bit blocks are formed in the row direction and n m columns in the column direction using the binary error correction code. In the embodiment, (t + 1) pieces are used in the row direction and n
A case of forming m m-bit blocks will be described.

In the block cipher, t ≧ 2, that is, MI
Like STY and IDEA encryption, there are m / 64 bits and input / output data bit numbers of 64, but encryption / decryption keys of 128 bits, that is, t = 2. Also,
A tandem DM (Tandem-Davies-Meyer) and an Abrest DM (Abreast-Davies-Meyer) can obtain a 2m-bit hash value using an m-bit key. The input of the hash function is the hash value 2 of the time (i-1).
There are m bits and key input m bits. Also, in general, t ≧
Considering encryption using a key having a key length of t × m bits of 2, a code word having a code length of (t + 1) bits can be used in the row direction.

FIG. 4 is a diagram showing an encoding process of a product code. The parameter of the row code is (t + 1, K, dr), and the parameter of the column code is (n, k, dc). FIG. 4 (A)
Then, the hash values H _i- ¹¹ ,..., H _i-1 ⁿ at the time (i−1)
If the message m _i ¹ is r = 2k-n becomes the new input, ..., a m _i ^r, arranged in a rectangular m-bit blocks of k × K. Here, K = 2. In FIG. 4B,
It is encoded into a binary code in the row direction, and is encoded into m-bit blocks in each row (t + 1). The number of inspection blocks is (t +
1) -K, (t + 1) -K m-bit blocks constitute a check block. In FIG. 3C, encoding of the column code is performed (t + 1) times, and as a whole, n × (t +
1) A product codeword of m-bit blocks is obtained. By doing so, the probability of a collision occurring is greatly reduced.

As described above, in the third embodiment of the present invention, the hash function method is performed by inputting a message of r m-bit blocks and a hash value of n m-bit blocks delayed by one step. , N (t + 1) (t ≧ 1)
, Into one product code of m bit blocks, and n (t
Since +1) m-bit blocks are input and hash values of n m-bit blocks are output, t ≧
In a block code using a long key of 2 or a hash function using a tandem DM or an abrest DM, the minimum distance of the code is greatly improved by using a product code.
As a result, safety is greatly improved.

(Fourth Embodiment) In a fourth embodiment of the present invention, a plurality of m-bit block messages and one
A hash value of n step-delayed m-bit blocks is input and encoded into one concatenated error-correcting codeword of n (t + 1) (t ≧ 1) m-bit blocks.
This is a hash function method in which (t + 1) m-bit blocks are input and hash values of n m-bit blocks are output.

FIG. 5 is a diagram showing a hash function system using concatenated codes according to the fourth embodiment of the present invention. In FIG. 5, reference numeral 10 denotes an outer encoder, and 11 denotes an inner encoder. FIG. 6 is a diagram illustrating an encoding process of a concatenated code.

When a concatenated code is used, it is similar to a product code, but performs encoding in the order of an outer encoder and an inner encoder. When the coding parameters of the inner encoder are (t + 1, K, dI) and the coding parameters of the outer encoder are (n, k, dO), the composite distance D is dI × dO. A Reed-Solomon code on a Galois field GF (2 ^K ) is used as an outer code, and a binary code such as a BCH code, a parity code, and a Hamming code is used as an inner code. Although it has the same configuration as the product code, a Galois field code can be used for the outer code, so that an MDS (maximum distance separation) code such as a Reed-Solomon code can be used, and the composite distance is larger than the product code. I can take it. Therefore, a more secure hash function can be configured. Tables 2 and 3 show examples of configurations using product codes and concatenated codes.
Shown in

[0056]

[0057]

As described above, in the fourth embodiment of the present invention, the hash function method is performed by inputting a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step. , N (t + 1) (t ≧
Since 1) the m-bit block is encoded into one concatenated code error-correcting codeword, n (t + 1) m-bit blocks are input, and the hash value of n m-bit blocks is output. , T ≧ 2, a block code using a long key, or a hash function using a tandem DM or an abrest DM, by using a concatenated code, an MDS such as a Reed-Solomon code is used as an outer code. ) Code can be used, and a code having a higher performance than a product code can be used in the same configuration, and as a result, security is greatly improved.

[0059]

As described above, according to the present invention,
A hash function method of compressing a message composed of a plurality of m-bit blocks using an m-bit block cipher and obtaining a multiplexed and concatenated hash value is described below. A binary encoder that inputs a hash value of a bit block and encodes it into 2m n-bit binary error correction codewords;
A multi-Davis-Meier hash function unit that inputs a binary error-correcting codeword into 2n m-bit blocks and outputs a hash value of n m-bit blocks, and n n-bit units output from the hash function unit Since the configuration is provided with a delay memory that delays the hash value of the m-bit block by one step, the use of the binary code eliminates the need for the operation of the extended Galois field, and provides a more secure hash value with a simple operation. Can be obtained.

A message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input to obtain (t + 1) m (t ≧ 1) n-bit binary error correcting codewords. And a binary encoder that encodes
+1) m n-bit binary error correction codewords are (t + 1)
A multi-Davis-Meier hash function unit that inputs n m-bit blocks and outputs a hash value of n m-bit blocks is provided, so that a Davis-Meier hash function unit with a key length of tm bits is used. The hash value can be easily obtained.

Also, a message of a plurality of m-bit blocks and an am-bit hash value delayed by one step are input to form m linear codes of code length (t + a) bits (t ≧ 1, a ≧ 1). Binary encoder to encode, and m (t
+ A) A key length tm for inputting a bit code into (t + a) m-bit blocks and outputting an am-bit hash value
With a bit hash function, collision resistance is 2
The effect is obtained that a hash value having a hash value length of am bits of ^{m (d-1) / 2} can be obtained.

Further, a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input and one product of n (t + 1) (t ≧ 1) m-bit blocks is input. Since the encoder has an encoder that encodes the code into an error correction codeword, the minimum distance of the code can be reduced by using a product code when using a block code of a long key, a tandem DM or an abrest DM. A significant improvement is achieved, resulting in a significant improvement in safety.

Also, a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step are input, and one concatenation of n (t + 1) (t ≧ 1) m-bit blocks is performed. Since an encoder for encoding a code into an error correction code word is provided, when using a long key block cipher or a tandem DM or an abrest DM, an MDS such as a Reed-Solomon code is used as an outer code. (Maximum distance separation) code can be used, and even with the same configuration, a code with higher performance than the product code can be used. As a result, the effect of greatly improving security can be obtained.

[Brief description of the drawings]

FIG. 1 is a diagram of a hash function method using a binary code according to a first embodiment of the present invention;

FIG. 2 is an explanatory diagram of a hash function method using a linear code according to a second embodiment of the present invention;

FIG. 3 is a diagram of a hash function method using a product code according to a third embodiment of the present invention;

FIG. 4 is a diagram showing an encoding process of a product code according to a third embodiment of the present invention;

FIG. 5 is a diagram of a hash function method using a concatenated code according to a fourth embodiment of the present invention;

FIG. 6 is a diagram showing an encoding process of a concatenated code according to a fourth embodiment of the present invention;

FIG. 7 shows a Davis-Meier hash function unit using a conventional m-bit block cipher;

FIG. 8 shows a conventional multi-Davis-Meier hash function using an m-bit block cipher;

FIG. 9 shows a conventional hash function unit using an error correction code based on K & P.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Multi-Davis-Meier hash function unit 2 Binary encoder 3 Delay memory 4 Editor 5 Control circuit 6 Word 7 Word in the case of MISTY encryption 8 Row encoder 9 Column encoder 10 Outer encoder 11 Inner encoder 12 Encryption Means 13 block encoder 14 editor

[Procedure amendment]

[Submission date] March 25, 1999 (1999.3.2
5)

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Full text

[Correction method] Change

[Correction contents]

[Document Name] Statement

[Title of the Invention] Hash function method

[Claims]

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a hash function system, and more particularly to a hash function system for compressing and signing a message with a compression function in a cryptographic communication system.

[0002]

2. Description of the Related Art When a document is transmitted after being encrypted, it is necessary to prove that the document is authentic and not falsified. For this purpose, a digital signature is added to a document. However, if a digital signature is directly added to the original document, the data length becomes too long. Therefore, the digital signature is added after compressing the document. In order to compress a document having an arbitrary length to a predetermined length, a hash function using encryption means is used. One example is DSS (Digital Signature Standar).
Signing using d). A document of an arbitrary length is temporarily converted into a hash value of, for example, a 160-bit block by using a hash function. This 160-bit block is signed. For example, a 320-bit signature is added to a 160-bit hash value.

It is necessary to devise a hash function so as not to cause collision. A collision is defined as h (x) = h when x ′ ≠ x
(x ′). There are two definitions of the resistance of a hash function to collisions: weak collision resistance and strong collision resistance. Weak collisonresist is what is called pre-image resistance or 2nd-preimage resistance. For any particular x, h (x) = h
That is how difficult it is to find any x ′ (≠ x) that is (x ′). That is, when there is a document x and its hash value h (x), it is difficult to find another document x ′ having the same hash value h (x) for any document x. If you need to try
The pre-image resistance of the hash function h is said to be N.

[0004] Strong collision resist is what is called collison resistance or resistance to birthday attacks. h
Any input pair (x, x ';) where (x) = h (x')
x ′ ≠ x) is also difficult. That is, if it takes an average of N trials to find a different set of documents with the same hash value, then the hash function is said to be resistant to N birthday attacks. When simply saying collision resistance, it means this strong resistance.

Here, an example of a conventional hash function will be described. FIG. 2 shows a hash function using an m-bit block cipher. 12 is a block encryption means. This is a hash function using the Davies-Meyer method. Let E _k (·) be the encryption algorithm for m-bit encryption, and let the m-bit key be K. The hash function h realized by E _k (·) is called a Davies-Meyer function. h
Finding collisions against requires about 2 ^{m / 2} encryptions of m-bit blocks, as long as a secure block cipher is used. Also, about 2 ^m encryptions are needed to find the pre-image for h.

The message M _i , the hash value H _i , and 1
The relationship H _i = h (M _i , H _i−1 ) = E _Mi (H _i−1 ) + H _i−1 holds between the hash values H _i−1 before the step. Here, [+] is modulo 2 addition.

FIG. 3 shows a multiple Davis-Meier hash function in which a plurality of Davis-Meier hash functions are arranged in parallel.
Davies-Meyer). In the multiple Davis-Meier method, the following is defined. E _K (・)
Is an m-bit block cipher using a t × m-bit key K where t> 0. _Let h ₁ , h ₂ ,..., h _n be different Davis-Meier functions by taking the keys different values. For a multiple Davis-Meier function, r
The m-bit message inputs are affine transformed and mapped to n pairs (X _i , Y _i ) before input. _{Output, h 1, h 2, ...} , a concatenation of h _n. In a collision or pre-image attack, if the input block forming (X _i , Y _i ) is different from the original data, then h (X _i , Y _i )
Is said to be active. Further, a function in which the variable parameter (X _j , Y _j ) of the function h _j does not change even if the variable parameter (X _i , Y _i ) of the function h _i changes is said to be a function that can be independently attacked. .

[0008] As assumption A, the following is assumed. Suppose a collision or pre-image is found for the multiple Davis-Meier compression function. Let N be the number of active functions, and let (Nv) be the maximum number of N functions that can be attacked independently. In this case, an average of 2 ^{vm / 2} or 2 ^vm encryptions are required to find a collision or pre-image, respectively.

Here, as a conventional example, K & P (L. Knudsen a
nd B. Preneel) will be described. FIG. 4 is a configuration diagram of a K & P compression function. 1
Is a multi-Davis-Meier hash function unit. 3
Is a memory for delaying the output hash value of the hash function unit 1 by one step. Reference numeral 5 denotes a control circuit that controls each unit. 13 is an (n, k) block encoder. 14
Is an editor comprising a memory for editing the output data of the encoder 13 into 2n m-bit blocks. Length n, number of information symbols k, minimum distance d, (t + 1) k>
n, where t ≧ 1 and m >> log ₂ n GF (2
^Assume that the input block is coded with the (n, k, d) code on ( ^{t + 1} ). Then, as long as assumption A holds, finding collisions against the compression function requires an average of 2 ^{(d-1) m / 2} encryptions. Alternatively, finding the pre-image requires an average of 2 ^{(d-1) m} encryptions. This is described in L. Knudsen and B. Preneel, “Fast and Secure H
ashing Based on Codes "Crypto'97, LNCS1294, pp.48
5-498, 1997. This hash function requires nm memory, and the hash rate is (t + 1) (k / n) -1. Note that the hash rate (ha) of the hash function based on the m-bit block cipher is
sh rate) is defined as the ratio of the number of m-bit message blocks processed in one encryption or decryption to the number of blocks of the hash value.

Next, (8, 5, 3) Ham on GF (2 ² )
An example of a configuration using a ming code is shown.

The generation matrix G is

(Equation 1)

Here, 0 = [00], 1 = [01], α
= [10], β = α + 1 = [11]. Chained value (ch
The order of aining value) ^{_{is, H i-1 1, M}} i 1, H i-1 3, H
_{^{i-1 4, H i-}} 1 5, H i-1 6, H i-1 7, H i-1 8, H i-1 2, M i 2
Is selected as follows. _{^{H i 1 = f 1 (H}} i-1 1, M i 1) H i 2 = f 2 (H i-1 3, H i-1 4) H i 3 = f 3 (H i-1 5, H _{^{i-1 6) H i 4}} = f 4 (H i-1 7, H i-1 8) H i 5 = f 5 (H i-1 2, M i 2) H i 6 = f 6 (H i _{^{-1 3 + H i-1 5}} + H i-1 7 + H i-1 2, H i-1 4
^{_{+ H i-1 6 + H}} i-1 8 + M i 2) H i 7 = f 7 (H i-1 1 + H i-1 2, M i 1 + M i 2) H i 8 = f 8 (H i-1 ¹ + _Hi-1 ³ + _Hi-1 ⁴ + _Hi-1 ⁶ +
_{^{H i-1 7, M i}} 1 + H i-1 3 + H i -1 5 + H i-1 6 + H i-1 8)

Here, [+] is modulo 2 addition. To obtain H _i ^8, the prompt to f ₈ are necessary operations expanded Galois field. The operation of the extended Galois field is specifically performed as follows. The irreducible polynomial on GF (2 ² ) is (X ² + X
+1) Therefore, if the root is α, α ² = α + 1. If the input to f ₈ is represented by a polynomial expression, it is as follows. ^{_{(H i-1 1 α +}} M i 1) · 1+ (H i-1 3 α + H i-1 4) · α + (H i-1 5 α + H i-1 6) · (α + 1) + (H i-1 7 ^{_{α + H i-1 8)}} · 1+ (H i-1 2 α + M i 2) · 0 = H i-1 1 α + H i-1 3 (α + 1) + H i-1 4 α + H i-1 5 + H i-1 6 ( _{α + 1) + H i-} 1 7 α + H i-1 8 + M i 1 = (H i-1 1 + H i-1 3 + H i-1 4 + H i-1 6 + H i-1 7) α + (H i-1 ^{_{3 + H i-1 5 +}} H i-1 6 + H i-1 8 + M i 1)

As described above, by using the error correction code, the collision resistance is improved from 2 ^{m / 2} to 2 ^m , or
Since the pre-image resistance is improved from 2 ^m to ^{22 m} , a secure hash function can be easily configured.

[0015]

However, the above-mentioned conventional system has a problem that a binary code such as a BCH code cannot be used. Therefore, software or hardware for executing the operation of the enlarged Galois field was required. Alternatively, as in the case of K & P et al., It was necessary to calculate in advance and store it in a memory as a table.

The present invention solves the above-mentioned conventional problems and provides a BC
It is an object of the present invention to enable the use of a binary code such as an H code so that a hash value can be calculated more easily.

[0017]

In order to solve the above-mentioned problems, in the present invention, a hash function method is used to calculate a message of a plurality of m-bit blocks and a hash value of n m-bit blocks delayed by one step. A binary encoder that inputs and encodes 2m n-bit binary error correction codewords;
a multi-Davis-Meier hash function unit that inputs m n-bit binary error correction codewords into 2n m-bit blocks and outputs a hash value of n m-bit blocks; And a delay memory for delaying the hash values of the n m-bit blocks by one step.

[0018] With this configuration, Devis-
There is no need to assign an extended Galois field symbol element to two m-bit inputs, which is the basic configuration of Maya, and m inputs are assigned to m codewords of a binary code, and operation is performed using a binary code. Can be simplified.

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION
In a hash function method in which a message composed of a plurality of m-bit blocks is compressed using an m-bit block cipher to obtain a multiplexed and connected hash value, n messages m and a plurality of m-bit block messages are delayed by one step.
A binary encoder that inputs a hash value of a bit block and encodes it into 2m n-bit binary error correction codewords;
N-bit binary error-correcting codewords are input into 2n m-bit blocks, and a hash function unit of a multiplex Davis-Meier that outputs a hash value of n m-bit blocks is output from the hash function unit. This is a hash function method including a delay memory that delays a hash value of n m-bit blocks by one step, and has an effect of reducing the rate of occurrence of collision.

FIG. 1 shows an embodiment of the present invention.
This will be described in detail with reference to FIG.

(Embodiment) An embodiment of the present invention is as follows.
The (2k−n) m-bit block message and the hash value of the n m-bit blocks delayed by one step are input, and the (n, k) binary encoder encodes 2m n-bit 2 bits.
The original error correction codeword is encoded to form 2n m-bit blocks, and the 2n m-bit blocks are input to n multiplexed Davis-Meier hash function units to obtain n m-bit blocks.
This is a hash function method that outputs a hash value of a bit block.

FIG. 1 is a diagram showing a hash function system using a binary code according to an embodiment of the present invention. In FIG. 1, a multiple Davis-Meier hash function unit 1 is an n-stage Davis-Meier hash function unit. The binary encoder 2 is means for calculating an (n, k, d) binary code such as a BCH code. The delay memory 3 is a memory for delaying the hash value by one step. Editor 4
A memory or wired logic that edits m n-bit codewords into n m-bit blocks. The control circuit 5 is control means for controlling each unit.

An (n, k, d) binary code having a code length n, the number of information symbols k, and a minimum distance d is used. Let n be the number of stages of the Davis-Meier hash function unit. The input to the hash function unit is 2n blocks. Therefore, the input of the binary encoder is 2k blocks. Since the processing time i must use the n hash values of the previous time (i-1), the number r of blocks used for the message block
Since n + r = 2k, r = (2k−n). The hash rate is (2kn) / n.

In the hash function method using binary codes according to the embodiment of the present invention, n pairs of m-bit blocks are formed by two codewords formed from 2m n-bit binary codewords. The point input to the hash function unit is
It is different from the construction method of K & P. For convenience of explanation, (15, 11,
3) Hamming code is shortened (14, 10, 3).

The parity matrix is as follows.

H = (α ¹³ , α ¹² , α ¹¹ , α ¹⁰ ,
α ⁹ , α ⁸ , α ⁷ , α ⁶ , α ⁵ , α ⁴ , α ³ , α ² , α
¹ , α ⁰ )

The primitive polynomial is (X ⁴ + X + 1). H ¹ = f ₁ (G ¹ , M ¹ ) H ² = f ₂ (G ³ , M ³ ) H ³ = f ₃ (G ⁵ , M ⁵ ) H ⁴ = f ₄ (G ⁷ , G ⁸ ) H ^{5 _{= f 5 (G 9, G}} 10) H 6 = f 6 (G 11, G 12) H 7 = f 7 (G 13, G 14) H 8 = f 8 (G 2, M 2) H 9 = f _{^{9 (G 4, M 4)}} H 10 = f 10 (G 6, M 6) H 11 = f 11 (r 4L, r 4R) H 12 = f 12 (r 3L, r 3R) H 13 = f 13 ( r _2L , r _2R ) H ¹⁴ = f ₁₄ (r _1L , r _1R )

Here, (r _4L , r _4R ), (r _3L ,
(r _3R ), (r _2L , r _2R ), (r _1L , r _1R ) are Hamming
This is a block of code check bits. These are given by the following equations. ^{_{r 4L = G 1 + G 3}} + G 5 + G 9 + G 13 + G 2 r 3L = G 1 + G 3 + G 5 + G 7 + G 11 + G 2 + G 4 r 2L = G 3 + G 5 + G 7 + G 9 + G 13 + G 4 + G 6 r ^{_{1L = G 1 + G 3 +}} G 7 + G 11 + G 13 + G 6 r 4R = M 1 + M 3 + M 5 + G 10 + G 14 + M 2 r 3R = M 1 + M 3 + M 5 + G 8 + G 12 + M 2 + M 4 r 2R = M ^{3 + M 5 + G 8 +} G 10 + G 14 + M 4 + M 6 r 1R = M 1 + M 3 + G 8 + G 12 + G 14 + M 6 symbols _{^{G i, M i, r iL}} , r iR represents a m-bit blocks. G ⁱ represents a single hash value of the previous time. M ⁱ represents the message block, r _iL, r _iR represent respectively the check bits of Hamming code.

Here, the Hamming code is used for the sake of convenience of explanation, but when considering a double error correction BCH code, it is as follows. Since the BCH code can have a larger minimum distance than the Hamming code, a more secure hash function can be configured. (31, 21, 5) BCH code is (30, 20, 5) BCH
Shorten to sign. Then, r = 40−30 = 10. The hash rate is 10/30 = 1/3.

Table 1 shows an example using a binary code and a result of the conventional K & P et al. For comparison.

[Table 1] Comparison between binary code method and conventional method--------------------------------------------t memory −−−−−−−−−−−−−−−−−−−−−−−−−−−−− GF (2) 2 (25,15,5) 5/25 = 0.20 2 ^2m 25m GF ( 2) 2 (30,20,5) 10/30 = 0.333 2 ^2m 30m GF (2) 2 (62,54,5) 38/62 = 0.613 2 ^2m 62m GF (2 ² ) 1 (5,3,3 ) 1/5 = 0.20 2 ^m 5m GF (2 ⁴ ) 1 (6,4,3) 1/4 = 0.25 2 ^m 6m GF (2 ² ) 1 (8,5,3) 1/4 = 0.25 2 ^m 8m ----- (Non-binary code is based on the result of K & P et al.)

As described above, in the embodiment of the present invention,
The hash function method is configured by inputting a message of (2k−n) m-bit blocks and a hash value of n m-bit blocks delayed by one step, and using an (n, k) binary encoder to obtain 2m n Encoded into a binary error correcting codeword,
Since n m-bit blocks are formed, the two m-bit blocks are input to the n multiple Davis-Meier hash function units, and the hash values of the n m-bit blocks are output. The use of the binary code eliminates the need for an operation on an extended Galois field, and a more secure hash value can be obtained with a simple operation.

[0032]

As described above, according to the present invention,
A hash function method of compressing a message composed of a plurality of m-bit blocks using an m-bit block cipher and obtaining a multiplexed and concatenated hash value is described below. A binary encoder that inputs a hash value of a bit block and encodes it into 2m n-bit binary error correction codewords;
A multi-Davis-Meier hash function unit that inputs a binary error-correcting codeword into 2n m-bit blocks and outputs a hash value of n m-bit blocks, and n n-bit units output from the hash function unit Since the configuration is provided with a delay memory that delays the hash value of the m-bit block by one step, the use of the binary code eliminates the need for the operation of the extended Galois field, and provides a more secure hash value with a simple operation. Can be obtained.

[Brief description of the drawings]

FIG. 1 is a diagram of a hash function method using a binary code according to an embodiment of the present invention;

FIG. 2 shows a Davis-Meier hash function unit using a conventional m-bit block cipher;

FIG. 3 shows a multi-Davis-Meier hash function using a conventional m-bit block cipher;

FIG. 4 shows a conventional hash function unit using an error correction code based on K & P.

[Description of Code] 1 Hash function unit of multiple Davis-Meier 2 Binary encoder 3 Delay memory 4 Editor 5 Control circuit 6 Word 12 Encryption means 13 Block encoder 14 Editor

[Procedure amendment 2]

[Document name to be amended] Drawing

[Correction target item name] All figures

[Correction method] Change

[Correction contents]

FIG.

FIG. 2

FIG. 3

FIG. 4

Continued on the front page F term (reference) 5J065 AD02 AD11 AE08 AH02 AH06 AH08 5J104 AA09 AA18 LA05 NA12 NA23 9A001 CC02 DD10 EE03 EE04 GG01 JJ18 KK56

Claims (5)

[Claims] 1. A hash function method for compressing a message consisting of a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed and connected hash value.
A binary encoder that inputs a plurality of m-bit block messages and a hash value of n m-bit blocks delayed by one step and encodes them into 2m n-bit binary error correction codewords; 2n n-bit binary error correction codeword
Multiplexed Davis-Meier hash function unit that inputs as m m-bit blocks and outputs a hash value of n m-bit blocks, and a hash value of n m-bit blocks output from the hash function unit in one step A hash function method comprising: a delay memory for delaying. 2. A hash function method for compressing a message consisting of a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed and connected hash value.
A plurality of m-bit block messages and a hash value of n m-bit blocks delayed by one step are input and encoded into (t + 1) m (t ≧ 1) n-bit binary error correction codewords 2 Original encoder and (t + 1) m n-bit binary error-correcting codewords into (t + 1) n m-bit blocks and input and output a hash value of n m-bit blocks. A hash function unit,
A delay memory for delaying the hash value of the n m-bit blocks output from the hash function unit by one step. 3. A hash function system for compressing a message comprising a plurality of m-bit blocks by using an m-bit block cipher to obtain a multiplexed and connected hash value.
A binary error correction of m code length (t + a) bits (t ≧ 1) by inputting a plurality of m-bit block messages and a hash value of a (a ≧ 1) m-bit blocks delayed by one step A binary encoder that encodes a codeword, and a binary error-correcting codeword having m code lengths (t + a) bits (t +
a) a hash function unit having a key length of tm bits for inputting as m m-bit blocks and outputting a hash value of a m-bit blocks; and a m function units output from the hash function unit
A delay memory for delaying the hash value of the bit block by one step. 4. A hash function method for compressing a message consisting of a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed and connected hash value,
An error correction code of one product code of n (t + 1) (t ≧ 1) m-bit blocks by inputting a plurality of m-bit block messages and a hash value of n m-bit blocks delayed by one step An encoder that encodes the words, and n (t
+1) a multi-Davis-Meier hash function unit that inputs error correction code words of m bit blocks and outputs hash values of n m bit blocks, and n m bits output from the hash function unit A delay memory for delaying the hash value of the block by one step. 5. A hash function method for compressing a message consisting of a plurality of m-bit blocks using an m-bit block cipher to obtain a multiplexed and connected hash value,
An error correction code for one concatenated code of n (t + 1) (t ≧ 1) m-bit blocks by inputting a plurality of m-bit block messages and hash values of n m-bit blocks delayed by one step An encoder to encode words, and n
A multi-Davis-Meier hash function unit for inputting (t + 1) m-bit block error correction codewords and outputting n m-bit block hash values, and n m output from the hash function unit A delay memory for delaying the hash value of the bit block by one step.