JP2002023623A - Device and method for deciding parameter, ciphering device, and deciphering device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that an S-box and an MDS matrices comprised in a ciphering device as the system components offset their effects against each other in spite of the X-box and the MDS intended to realize optimal complexity according to the design policies independent of each other, therefore, the ciphering device has had a probability of being rather unsafe. SOLUTION: By evaluating complexity of a result of multiplication of each candidate of MDS matrix elements by the matrix elements of a given S-box; evaluating, based on a evaluation result of this complexity, the complexity of the combinations of the matrix element candidates composing the MDS matrix; further, evaluating similar complexity also of an inverse matrix to this MDS matrix; and based on the evaluation results of the complexity of these matrices, a method for determining an MDS matrix giving the optimal complexity in the combination with the S-box, and a ciphering device adopting the MDS matrix obtained by the method are provided.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an encryption device for encrypting digital data for secrecy, and a decryption device used for decrypting as necessary.

[Prior art]

[0002] The encryption system includes a secret key encryption system that uses the same key for encrypting and decrypting a message, and a public key encryption system that uses different keys for encryption and decryption. The best-known secret key cryptosystem is DES (Data Encryption).
ION Standard). Decryption is to obtain a key used for encryption from a set of pairs of a plaintext (message before encryption) and a ciphertext (message after encryption). Decryption requires the inherent redundancy of plaintext (endund
ancy) is often used.

[0003] Claud Elmwood Shan
Non is "Communication Theo
ry of Security Systems "(Be
llSystem Technical Journal
1, Vol. 28, No. 4, 1949, 656-715) describes a technique to make the redundancy of plaintext (messages before encryption) less visible.
And diffusion.

[0004] Confussion makes it difficult to decipher by observing the redundancy and statistical patterns of ciphertext by making the relationship between plaintext and ciphertext invisible. As an example, a method of converting each character of the plain text alphabet into each character by using a substitution table associating each character of the alphabet of the cipher text with a key, a substitution (substitution)
ion). Diffusing is to extend the redundancy of the plaintext to the entire ciphertext. An example is transposition, which replaces the order of plaintext characters.
).

[0005] Even in the DES described above, the encryption processing includes, as basic processing, a confusion processing called an S-box and a diffusion processing called a P-box.

[0006] In recent years, AES
(Advanced Encryption Stan
Work on the specification of a next-generation U.S. standard block cipher called "dard" is underway. The cipher proposed there reflects new knowledge of cryptanalysis since DES, and new concepts have been introduced into confusion and diffusion.

For example, a linear conversion layer is often employed as a design component that functions as a diffusion. Moreover, in order to perform diffusion as efficiently as possible, MDS (Maximum Distance Sepa) is used.
A linear transformation layer using a (ramble) code has been proposed. (Vincent Rijmen, Joan Da
emen, "The Cipher SHARK", F
ast Software Encryption, L
NCS 1039, 99-112, 1996. )

[0008] A linear conversion layer using the MDS code is as follows.
Since it has the property of guaranteeing the lower limit of the number of active S-boxes, there is a feature that the fact can be used to prove the strength of the differential cryptanalysis and the linear cryptanalysis.

[0009] Measures against major decoding methods other than the differential decoding method and the linear decoding method are performed in the substitution layer, and do not become a new constraint on the linear conversion layer.

For example, S-b is secured against differential cryptanalysis, linear cryptanalysis, higher-order cryptanalysis, and interpolation attack.
A method of designing ox as a power function on a finite field or its sum has been proposed. (Shiho Moriai, "One construction method of S-box strong against differential / linear / higher differential / interpolation attack", 1
1. 998 Cryptography and Information Security Symposium,
2. C, 1998. )

Further, in order to secure against interpolation attacks,
A method of constructing an S-box by a power function on a finite field and an affine transformation on a coset ring has been proposed. (M.
Kanda et al. , "E2-A New 12
8-Bit Block Cipher ", IEICE
Trans. Fundamentals. , E83
-A, 1, 48-58, 2000. )

That is, in the current cryptographic design style, as a countermeasure against the differential cryptanalysis and the linear cryptanalysis, the S-box
Although the appropriate selection of and the adoption of the linear transformation layer using the MDS code is performed, as a countermeasure against the decoding methods other than the differential decoding method and the linear decoding method, mainly, only by appropriate selection of the S-box, Therefore, no aggressive selection guide has been given as to what MDS code should be adopted.

When a linear transformation layer using an MDS code is expressed as a matrix, it is called an MDS matrix. Examples of the main design policy for determining the matrix element of the MDS matrix up to now include, as an example, the design policy in the Rijndael cipher which is an AES candidate is the table size when the MDS matrix is implemented by table lookup. , And that the matrix operation of the MDS matrix can be efficiently processed when it is processed by an 8-bit processor. In addition, the design policy of Twofish encryption, which is also an AES candidate, is MDS
PHT (Pseudo-H used immediately after the matrix)
The matrix element is determined from the relationship with the “Adamard Transformation” so as to reduce the probability that the PHT immediately following the number of branches guaranteed by the MDS matrix is reduced.

That is, conventionally, the selection criteria for the matrix elements of the MDS matrix are mainly based on the viewpoints of processing efficiency and mounting cost. The exception was to minimize security against differential and linear cryptanalysis in relation to other special primitives such as PHT. Rijn
As the design policy of the dael cryptography says, on 8-bit processors, matrix operations are implemented not by table lookup but by arithmetic or logical operations of the processor. Some argue that there is a need to choose, but this is a problem limited to special platforms.

If the S-box and the MDS matrix are designed according to different design principles as in the prior art, the S-box is designed to enhance the security, but the MD
There is a risk that the S matrix may be designed to offset its effect.

For example, an S-box is defined as a complex
When trying to increase security by realizing as a number
Think. For example, an S-box having n-bit input / output
In this case, input and output are GF (2ⁿ) And S-box
To GF (2ⁿ) To GF (2 ⁿ)
A function whose expression is simple, specifically a polynomial with a small number of terms
Or the sum of the number of terms in the numerator polynomial and the number of terms in the denominator polynomial is
When it is a small rational expression, interpolation attack is effective
It is known. (Shiho Moriai, Takeshi Shimoyama, Satoshi Kaneko
Shin, "SNAKE Cryptography Interpolation Attack", 1998 Cryptography
Information Security Symposium, 7.2. C, 1998
Year. ) Interpolation attack is a polynomial encryption function with unknown coefficients
Expressions and rational expressions, giving multiple pairs of plaintext-ciphertext
These coefficients are determined by Lagrange interpolation, etc.
It is a decoding method determined by

In order to avoid an interpolation attack, when constructing an S-box, not only a simple power function but also GF
In some cases, processing that does not conform to the algebraic structure of (2 ⁿ ), for example, bit substitution or operation in another algebraic structure is used. In this case, the S-box can be re-expressed as a polynomial using a plurality of power functions. That is, GF
By combining operations different from the algebraic structure of (2 ⁿ ), the effect of substantially increasing the number of terms in the polynomial is obtained.

In this case, the MDS matrix following the S-box is represented by the GF of the output of the S-box as a representation of the input.
If the same expression as (2 ⁿ ) is adopted, MDS
The effect of multiplying the matrix elements of the matrix is merely to multiply each term of the polynomial of the power function expressing the S-box by a constant, and therefore the effect of increasing the number of terms by the S-box Does not cancel out.

However, the expression of the input of the MDS matrix is S
If the output of the box differs from the expression of GF (2 ⁿ ),
For example, if the role of the bit position is different in both representations,
This is the case, for example, when bit substitution is intentionally performed at the input of the DS matrix. In this case, the effect of the combination of different operations performed to increase the number of terms in the S-box is due to the effect of the MDS matrix. There is a possibility that they will be canceled in the calculation.

In other words, the above explanation is similar to the prior art,
The box and the MDS matrix are each designed separately,
He pointed out that taking independent countermeasures against interpolation attacks would conversely offset them.

Next, as another index indicating the complexity of the function, the number of terms when the output bit of the S-box is represented by a logical expression of the input bit can be considered. Although this index is difficult to give a rigorous proof, we believe it is a measure of avalanche.

The avalanche property refers to a property that, when the input changes, the influence is not a part of the output but affects as widely as possible. If the number of terms in the logical representation of bits is large, the output bits are not expected to have a regular structure or simple expression with respect to the input bits. It is expected that high avalanche property can be realized by bringing it.

Also in this case, the S-box and the MDS
If the matrices are independently designed to complicate the logical representation of the bits, the effects may cancel.

SUMMARY OF THE INVENTION The present invention provides an S-box
And MDS matrices are designed according to different design principles, so when viewed at a certain evaluation value, the MDS matrix cancels out the effect, despite the fact that it is designed to enhance security. There was a problem that such a design would result.

The present invention has been made in view of the above problems, and has a parameter determining device, a parameter determining method, and an encrypting device capable of performing a substitution process and a spreading process when applied to an encryption device or a decryption device. , And a decoding device.

In order to achieve the above object, a parameter determining apparatus according to a first aspect of the present invention includes a character conversion process for converting each character of a plaintext into another character using a first parameter; A parameter determining device for determining the second parameter of the diffusion process, wherein the first parameter is used for the substitution process. Input means for inputting a parameter, and a second
A second parameter candidate generating means for sequentially generating two parameter candidates; a first parameter input by the input means; and a second parameter candidate sequentially generated by the second parameter candidate generating means, Calculating means for sequentially calculating an evaluation value by the method described above, and an optimum evaluation value is determined from the obtained evaluation values sequentially calculated by the calculating means, and a second parameter candidate corresponding to the determined evaluation value is determined by the apparatus. And an optimal parameter determining means for determining the second parameter.

The parameter determining apparatus according to the second aspect of the present invention is a character conversion process for converting each character of a plaintext into another character by a first parameter, and a diffusion process for replacing a space between each character of a plaintext by a second parameter. A parameter determining device for determining the first parameter of the substitution processing, the first parameter candidate generating means for sequentially generating a first parameter candidate used for the substitution processing, Input means for inputting the determined second parameter used for the diffusion processing, based on each first parameter candidate sequentially generated by the first parameter candidate generation means, and the second parameter input by the input means Calculating means for sequentially calculating an evaluation value by a predetermined method; and determining an optimum evaluation value from the obtained evaluation values sequentially calculated by the calculating means. The first parameter candidate corresponding to the evaluation value this decision and a optimum parameter determining means for determining the first parameter of the device.

According to a third aspect of the present invention, there is provided a parameter determining apparatus for performing a substitution process for converting each character of a plaintext into another character by using a first parameter, and a diffusion process for replacing each character of a plaintext by using a second parameter. A parameter determining device for determining the first parameter of the substitution processing, the first parameter candidate generating means for sequentially generating a first parameter candidate used for the substitution processing, A second parameter candidate generating means for sequentially generating a second parameter candidate used for the diffusion processing; a first parameter candidate sequentially generated by the first parameter candidate generating means; The second sequentially generated by the submatrix candidate generating means
Calculating means for sequentially calculating the evaluation value by a predetermined method based on the parameter candidates; and calculating the optimum evaluation value from the obtained evaluation values sequentially calculated by the calculation means, and corresponding to the determined evaluation value. Optimum parameter determining means for determining a first parameter candidate and a second parameter candidate to be performed as a first parameter and a second parameter of the device, respectively. The parameter determination device according to claim 4 of the present invention is a device for performing a diffusion process of replacing each character of a plaintext with a matrix, wherein an optimal common factor for the matrix is determined in order to determine the matrix of the diffusion process. An input means for inputting a determined matrix used for the diffusion processing, and a common factor candidate generating means for generating a common factor candidate that can be squeezed out of the matrix of the diffusion processing. Calculating means for sequentially calculating an evaluation value by a predetermined method based on a matrix after extracting the matrix of the diffusion processing by common factor candidates sequentially generated by the common factor candidate generating means; and And an optimal common factor determining unit that determines an optimal evaluation value from the evaluation values calculated by the above and sets a common factor candidate corresponding to the determined evaluation value as a common factor.

According to a fifth aspect of the present invention, there is provided a parameter determining method comprising: a substitution process for converting each character of a plaintext into another character by a first parameter; and a diffusion process for replacing each character of the plaintext by a second parameter. A parameter determining method of a device for performing the first parameter or the second parameter or both such that an evaluation value calculated by a predetermined method determined by a combination of the substitution processing and the diffusion processing is optimized. Parameters were determined.

Further, the encryption device according to the present invention is characterized in that a plurality of substitution processing units for converting each character of the plaintext into another one for encrypting the plaintext, and a diffusion process for replacing between each character of the plaintext. And an encryption device comprising:
An evaluation value obtained by sequentially calculating an evaluation value by a predetermined method based on a determined first parameter used in the substitution processing unit and a second parameter candidate that is sequentially generated and used in the diffusion processing. The optimal evaluation value was determined from among the above, and the second parameter candidate corresponding to the determined evaluation value was used for replacement between each character in the plaintext.

Further, the decryption device according to the ninth aspect of the present invention provides a plurality of substitution processing units for converting each character of the ciphertext into another character in order to decrypt the ciphertext, and a diffusion unit for replacing between each character of the ciphertext. A decoding device comprising: a processing unit;

[0030] The diffusion processing unit is configured to determine a first parameter used in the substitution processing unit and a second parameter candidate that is sequentially generated and used in the diffusion processing.
An optimum evaluation value is determined from evaluation values obtained by sequentially calculating evaluation values by a predetermined method, and a second parameter candidate corresponding to the determined evaluation value is replaced for each character in plain text. To be used.

As a result, when applied to an encryption device or a decryption device, it is possible to provide an encryption device and a decryption device having high-performance substitution processing and diffusion processing.

DESCRIPTION OF THE PREFERRED EMBODIMENTS (First Embodiment)

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, the given S-box
In the following, an apparatus for determining an optimal combination of MDS matrices will be described. First, a basic configuration example of the present embodiment will be described.

FIG. 1 shows a configuration of an apparatus for determining an optimal MDS matrix for a given S-box according to an embodiment of the present invention.

As shown in FIG. 1, the optimal MDS matrix determining device includes an S-box providing means (101), an MDS matrix candidate generating means (102), and a combination evaluation value calculating means (1).
03) and the optimal MDS matrix determining means (104).

FIG. 2 shows a flow of processing performed by the apparatus according to the present embodiment.

First, the S-box providing means receives information specifying a certain S-box, determined by a device other than the present determination device (201).

The S-box is generally an m-bit input n
This is a mapping of bit output. The description of the S-box can be described as a table showing what input values have what output values, and if a simple expression is possible as a function, the function It can also be described in the form. In this case, in any case, information capable of uniquely specifying the S-box is provided.

Next, the MDS matrix candidate generating means sequentially generates MDS matrix candidates to be combined with the assigned S-box (202). Next, the combination evaluation value calculation means calculates the complexity (evaluation value) of the combination of the assigned S-box and the generated MDS matrix candidate (203). Next, it is determined whether or not the currently calculated MDS matrix candidate is the last candidate (204). If still,
If there is a new candidate, the process returns to 201,
Generate a new MDS matrix candidate. In this way, the same process is repeated for a plurality of MDS matrix candidates sequentially generated, and the complexity of the combination is calculated for each of the MDS matrix candidates.

Here, the complexity of the combination is S-box
In terms of complexity for the combination of
This is not the complexity of the box alone or the MDS matrix alone, but the complexity when the combination of both is evaluated as one. Specifically, as an example of the complexity as the evaluation value, S-
When the box is an n-bit input / output, when the input / output of the S-box is expressed as an element of GF (2 ⁿ ), it can be defined by the number of terms of the output of the MDS matrix candidate expressed by the input of the S-box. .

As another example of the complexity, when clearing bit by bit rather than as a source of GF (2 ⁿ ), S−
In some cases, the number of terms in the case where the output bits of the MDS matrix candidate are expressed by a logical expression using the input bits of the box is used. 20
In No. 4, if there is no new candidate, finally, the optimal MDS matrix determining means determines the complexity of each combination of the assigned S-box and the generated plurality of MDS matrix candidates thus determined. The combination having the optimal combination complexity is determined based on the MDS matrix candidate, and
It is determined as a DS matrix (205). In this case, if the evaluation value is the complexity, the value having the largest number of terms is selected as the value.

Here, the number of terms is taken as an example of the evaluation value, but it is easy to realize an apparatus that determines an optimal MDS matrix by the same processing using other evaluation values.

FIG. 3 is a diagram showing the processing flow of the present embodiment in more detail. First, an S-box is input (301). A polynomial expressing the input output in the S-box by the input is obtained (302). Next, MDS
A value that can be taken as a matrix element candidate of a matrix is generated (30
3). The matrix element candidates of the MDS matrix are as follows.
In the case of a matrix on F (2 ⁿ ), elements of GF (2 ⁿ ) may be generated in order. 0 is an element of GF (2 ⁿ ),
If this is assumed to be a matrix element, the matrix cannot be an MDS matrix, so 0 may be excluded from the beginning and generated.

Next, a polynomial is obtained from the result of multiplying the output of the S-box by this matrix element candidate by expressing the output of the S-box by the input (304). Based on the polynomial, the complexity for the combination of the S-box and this matrix element candidate is calculated (305).

As the complexity, input of S-box or S-box
GF (2 ⁿ )
And the number of terms of the multiplication result expressed as a polynomial of the input of the S-box is used. The definition of the complexity based on the number of terms will be described later in detail with reference to FIGS. Of course, the definition of the complexity by the number of terms is an example of the complexity, and another definition of the complexity may be used based on various theoretical grounds or empirical heuristics. For example, the complexity may be defined based on the degree of a polynomial. Further, as another example of the complexity, the complexity may be defined by the number of terms when the output bits are represented by a polynomial of the input bits in units of bits, not as an element of the finite field. At this time, the number of terms may be counted with the same weight as the number of terms of all orders, or may be counted with weight according to the order of terms included in the polynomial. Furthermore, an evaluation value other than the complexity may be defined depending on what kind of attack method the optimization aims to achieve.

Next, it is determined whether another matrix element candidate still exists (306). If another candidate still exists, the process returns to step 303 to generate a new candidate and repeat the same process. If another candidate does not exist, select the required number of candidates from the matrix element candidates,
An MDS matrix candidate is generated (308).

At this time, if MDS matrix candidates are generated by combinations of all matrix element candidates, it is impractical to calculate the complexity for all MDS matrix candidates because there are a very large number of combinations. May be. In that case, according to the complexity calculated in 305, MDS matrix candidates are generated by matrix element candidates selected from a set of matrix element candidates having relatively low complexity, thereby efficiently increasing the complexity. It is also possible to search the MDS matrix (307). In this case, an MDS matrix candidate is generated by selecting a matrix element from the narrowed-down matrix element candidates (308).

Next, it is determined whether or not the MDS matrix candidate thus generated is actually an MDS matrix (309). This determination is made for the MDS matrix candidate by confirming that all the minor determinants are non-zero. If the matrix candidate does not become an MDS matrix, the process returns to step 308 to generate the next matrix candidate and repeat the same process. If the matrix candidate is an MDS matrix, the complexity of the matrix is calculated (310).

The complexity of the matrix is calculated by
Based on the complexity for the combination of the box and the matrix element candidate, the complexity is defined as the sum of the complexity for each of the matrix element candidates belonging to the MDS matrix candidate.

Next, an inverse matrix is obtained (311). Then, for the inverse matrix, the complexity of the combination of the S-box and the matrix is obtained in the same manner as in 310 (312).

In this case, the S-box used in combination with the inverse matrix may be used depending on the assumed encryption processing and decryption processing.
Is also possible to have a modified example in which the reverse of the original S-box is achieved.

From the complexity of the MDS matrix candidate and the complexity of its inverse matrix obtained in this way, by selecting a candidate having a large complexity, an optimal combination of the S-box and the MDS matrix is determined ( 313).

In the above example, the complexity related to the combination of the S-box and the inverse matrix has been evaluated, but a modification in which this is omitted is also possible. In that case, the processing of 311 and 312 can be omitted, and in 313, the optimal combination is determined only from the complexity of the combination of the S-box and the MDS matrix.

FIG. 4 shows a combination of S-box and matrix element candidates.
The complexity when the output is represented by the input polynomial
FIG. 8-bit input / output of S-box
This is an example of the case. The input bits to the S-box of 401
.., i7. 402 matrix element candidates
The output bit of the result of multiplying the output of the S-box is represented by o0,
.., o7. Input and output finite field GF
(2⁸) And consider it as an element on
I = i₇z⁷+ I₆z⁶+ I₅z⁵+ I₄z⁴+
i₃z³+ I₂z²+ I₁z + i₀, O = o₇z⁷+ O
₆z⁶+ O₅z⁵+ O ₄z⁴+ O₃z³+ O₂z²+ O
₁z + o₀, And express. Here, z is a primitive polynomial x⁸
+ X⁶+ X⁵Assume that it is the root of + x + 1 = 0. With evaluation value
A certain complexity, for example, expressed o as a polynomial in i
Is defined as the number of terms in the polynomial in the case. Another definition
In the case where o is expressed as a rational expression of i
Defined as the sum of the number of terms in the numerator polynomial and the number of terms in the denominator polynomial
It is also possible to justify. These complexity factors are
It is known to be a measure of resistance to

Another definition of the complexity is that the output bits, o0, o1,..., O7, are viewed bit by bit, and are expressed by logical expressions of input bits i0, i1,. Is defined as the sum of all the output bits. This seems to be a measure of the avalanche between the input and output. Also, indirectly,
It may also be a measure of resistance to interpolation attacks.

FIG. 5 is a diagram for explaining the complexity in the combination of the S-box and the MDS matrix.

Reference numeral 501 denotes an S-box, and 502 denotes a diffusion layer expressed by an MDS matrix. For example, GF
Explaining the example of the MDS matrix on (2 ⁸ ), the matrix element is an element of the finite field GF (2 ⁸ ). The output of each S-box is multiplied by the matrix element of the MDS matrix by passing through this diffusion layer, and the result of addition in the row direction appears as the output of the diffusion layer. Looking at only the multiplication part of this matrix element, just as shown in FIG.
It can be seen that the combination of -box and matrix element candidate is obtained. Therefore, the complexity of the combination of the S-box and the MDS matrix candidate is calculated for all the matrix elements of the MDS matrix candidate based on the complexity of the combination of the S-box and the matrix element candidate described with reference to FIG. , This complexity is determined, and the result is defined as a sum. Using this definition, if the complexity of the combination of the S-box and the matrix element candidate is determined, the complexity for the combination of the S-box and the MDS matrix candidate can also be determined.

This definition of the complexity of the combination of the S-box and the MDS matrix may use a different definition depending on the rationale or empirical heuristics.
Further, another definition of the evaluation value may be used depending on the assumed attack method.

The definition of complexity described here is an example,
In addition to the above, the present invention can be applied to a case where various complexity and evaluation values based on theoretical grounds and empirical heuristics are defined and used according to an assumed attack method. For example, even if an amount that is a measure of security against cost, speed, and other attacks is adopted, the substitution layer (S-bo
A modification example in which the parameters of the diffusion layer are determined to be optimal by optimizing the evaluation value using a combination of x) and the diffusion layer (MDS matrix) is also possible.

FIG. 6 is a diagram showing a method for realizing a diffusion layer based on the MDS matrix determined by the above-described apparatus or another method or apparatus at a minimum mounting cost or operating at high speed. 2 shows a configuration of a device for extracting a part of an MDS matrix. FIG. 7 shows a processing flow of this apparatus.

Here, the summarization is a process of extracting a common factor from matrix elements belonging to the same row or the same column of the MDS matrix. For example, the matrix elements in the i-th column of the 4-row, 4-column MDS matrix on GF (2 ⁸ ) are a1i, a2i, a
3i and a4i, the common factor a (where a is a non-zero element of GF (2 ⁸ )) is to be defined from this by dividing the matrix elements by the common factor a. And b1i, b2i, b3i, b4i. Here, b1i = a1i / a, b2i = a2i /
a, b3i = a3i / a and b4i = a4i / a.
When the common factor is extracted from a certain column in this way, the matrix changes from the original matrix. However, by renormalizing this common factor a to the S-box placed immediately before the MDS matrix,
When looking at the S-box and the entire matrix, the same processing is performed before and after squeezing.

Here, to factor the factor a into the S-box means that the original S-box outputs an input x and outputs y = f (x)
S-b that renormalizes a
ox is to transform the input x into a mapping that converts it to the output y '= a * f (x).

The reason why the mounting cost is reduced by the summarization will be described. The common factor extracted from a certain column of the MDS matrix corresponds to the S-box input to that column. Then, the common factor extracted from a certain column can be renormalized into the S-box. S-b
ox is often realized by table lookup. In this case, the renormalization of the common factor only requires changing the value of the table, so that the size of the table is not changed and the mounting cost is not affected.

On the other hand, since the MDS matrix generally has a large table size, it is not always realized by table lookup. In the case of implementation by hardware, it is realized by connection, and in the case of software, it is realized by combination of instructions. The cost of this connection and the cost of the combination of instructions depend on the values of the matrix elements of the MDS matrix after the common factors have been factored out. For example, in an MDS matrix of 4 rows and 4 columns on GF (2 ⁸ ), inputs to the matrix are x1, x
2, x3, x4 and the output of the matrix are represented as y1, y2, y3, y
4. Let the matrix element be aij. yi = ai1 × x1 + a
i2 × x2 + ai3 × x3 + ai4 × x4. For example, when ai1 takes 1 as a value, in the multiplication of ai1 × x1, since the value of each bit of x1 becomes the value of each bit of ai1 × a1, hardware corresponding to this multiplication is exclusive between bits. No wiring is required for performing a logical OR operation. Similarly, a combination of software instructions corresponding to the multiplication does not require a bit shift instruction or a mask instruction for performing an exclusive OR operation between bits. That is, the mounting cost when ai1 takes the value 1 is small. For a general value of ai1, ai1 × a1 needs to perform an exclusive OR operation between bits, and the required number of times depends on the value of ai1. Therefore, the implementation cost depends on the value of the matrix element. From this fact, if the conversion into the MDS matrix composed of the matrix elements having a small mounting cost can be performed by categorizing the common factors, the mounting cost of the entire matrix can be reduced.

A fan-in is defined as an evaluation value for the cost in the case of realizing by a combination of connection and software instructions. Fine-in counts how many bits before multiplication are represented by exclusive OR of each bit after multiplication in matrix element multiplication, and sums the results for all matrix elements. . Since the fan-in is determined by the values of the matrix elements of the MDS matrix, if the matrix after squeezing has a small fan-in matrix by squeezing the common factor, the squeezed common factor is the S-box. The implementation cost can be reduced by realizing the renormalized and remaining matrix by actually connecting and combining software instructions.

As shown in FIG. 6, the present apparatus has an MDS matrix adding means (601) and a common factor candidate generating means (602).
And cost evaluation value calculation means (603) and optimum common factor determination means (604).

FIG. 7 shows a processing flow of the apparatus for finding such an optimum common factor. First, an MDS matrix is input by the MDS matrix providing means (70).
1). Next, a common factor candidate to be squeezed is generated by the common factor generation means (702). MD after enumerating this common factor by cost evaluation value calculation means
An S matrix is calculated (703). A cost evaluation value of the obtained MDS matrix is calculated (704). The cost evaluation value includes, for example, the fan-in described above. Depending on the mounting method, another cost evaluation value may be used. Next, an inverse matrix of the MDS matrix after the summarization is obtained (70
5). A cost evaluation value of the inverse matrix is obtained (706). Next, it is determined whether there is another common factor candidate (70).
7). If there is another common factor candidate, the process returns to 702 to generate a new candidate, and the same process is performed. If there is no other common factor candidate, the optimal common factor determining means determines an optimal common factor based on the cost evaluation values obtained so far (708).

In the example of FIG. 7, the common factors are grouped by the MDS matrix, and the cost evaluation value of the inverse matrix is calculated from the result of the grouping. However, the common factor is independently extracted by the MDS matrix and the inverse matrix. Modifications to be made are also possible. This is the S-box for encryption and the S-box for decryption.
In this case, independent common factors can be renormalized.

The common factor may be a factor common to all matrix elements of the MDS matrix, or a different common factor for each column or each row.

An example of an apparatus for deciding an optimum MDS matrix has been described above. FIG. 8 shows an S-box of an optimal combination with an MDS matrix when given.
Is shown. FIG. 9 shows a processing flow of the apparatus. FIG. 10 illustrates the processing flow of the apparatus in more detail.

This apparatus is an MDS matrix providing means (801)
And S-box candidate generating means (802), combination evaluation value calculating means (803), and optimal S-box determining means (804)
Consists of

First, the MDS matrix providing means receives information specifying a certain MDS matrix determined by a device other than the present determination device (901). Next, the S-box candidate generating means sequentially generates S-box candidates to be combined with the assigned MDS matrix (902). Next, the combination evaluation value calculation means calculates the complexity (evaluation value) of the combination of the assigned MDS matrix and the generated S-box candidate (903). Next, the calculated S
Determine whether the box candidate is the last candidate (9
04). If there are still new candidates,
Returning to the process of 901, a new S-box candidate is generated. The same process is repeated for a plurality of S-box candidates that are sequentially generated in this way, and the complexity of the combination is determined for each of the S-box candidates. If there is no new candidate in 904, the optimal S-box determination means
The optimal combination is determined based on the complexity of the combination of the MDS matrix and the S-box candidate obtained so far (90
5).

The processing will be described in more detail. First, MDS
An MDS matrix is input by the matrix providing means (1001). The MDS matrix can be uniquely specified by giving the value of each matrix element.

Next, by the S-box candidate generating means,
An S-box candidate is generated (1002).

Here, an example of a method of generating an S-box candidate and
Then, a table in which the S-box represents the output value with respect to the input value is
Tables with different values can be created sequentially.
There is a way to do this. Generally, the number of input / output bits is large.
Then, the total number of S-boxes generated by this method is very
Generating all possibilities is obsolete
Be practical. So, as an example of another generation method,
S-boxes with some restrictions imposed
There is a method. For example, if the input and output are GF (2 ⁿ)
, The S-box is a power function xk of the input x
Or the sum of power functions with different powers Σck × x^kAs
It is also possible to use a method that generates only those that can be expressed.
In addition, if you want to increase the number generated a little more,
Bit swapped before and after the sum of the multiplicative functions
It is also possible to use a method of generating with restriction. Other, affine
Conversion and the like may be combined.

Next, the combination evaluation value calculation means obtains a polynomial in which the output of the generated S-box candidate is represented by an input (1003). Next, with respect to the result of multiplying the S-box candidate by the matrix element of the MDS matrix, a polynomial based on the input of the S-box candidate is calculated (1004). Based on this polynomial, the complexity for the combination of the S-box candidate and the given MDS matrix is calculated (1005). next,
An inverse matrix of the MDS matrix is obtained (1006).

For 1006, the inverse matrix is calculated once in 1001 given the MDS matrix,
Later, a modification in which the result is repeatedly used is also possible.

Next, a polynomial is calculated for the S-box candidate and its inverse matrix (1007). Next, S-bo
Calculate the complexity of the combination of x candidate and inverse matrix (100
8). Next, it is determined whether or not another S-box candidate still exists (1009). If another candidate still exists, the process returns to the process of 1002, a new candidate is generated, and the same process is repeated. If another candidate does not exist, the optimal S-box determining means determines the S-box
Complexity of combination of box candidate and MDS matrix, S-box
From the complexity of the combination of a candidate and its inverse matrix, by selecting a candidate having a large complexity, an optimal S-bo
The combination of x and the MDS matrix is determined (1010).

In this case, 1006 to 1008
Is omitted, and at 1010, the MDS matrix and S-
A modification is possible in which an optimal S-box is determined only from the complexity of a combination of boxes.

In FIG. 3, it is assumed that an S-box determined by another device is input. However, the S-box is also modified as a device that is selected from a plurality of candidates that are the most suitable combination. Examples are possible.

FIG. 11 shows an S-box for the example of FIG.
FIG. 10 is a diagram illustrating a configuration example of a device modified so as to select an optimal combination including the above. FIG. 12 is a diagram showing the flow of the processing. FIG. 13 is a diagram illustrating the processing in more detail.

The apparatus of this modification includes an S-box candidate generating means (1101), an MDS candidate generating means (1102), a combination evaluation value calculating means (1103), an optimal S-box and MDS matrix determining means (1104). Consists of

The S-box candidate generating means generates an S-box candidate (1201). Next, the MDS matrix candidate generation means sequentially generates MDS matrix candidates to be combined with the generated S-box candidates (1202).
Next, the combination evaluation value calculation means calculates the generated Sb
The complexity (evaluation value) of the combination of the ox candidate and the generated MDS matrix candidate is calculated (1203). Next, it is determined whether the currently calculated MDS matrix candidate is the last candidate (1204). If a new candidate still exists, the process returns to 1202 to generate a new MDS matrix candidate. Thus, a plurality of MDSs sequentially generated
The same processing is repeated for the matrix candidates, and the complexity of the combination is determined for each of them. If it is determined in 1204 that there is no new MDS matrix candidate,
Next, it is determined whether a new candidate exists as an S-box candidate. If there are new candidates, 1
Returning to 201, the same processing is repeated for a new S-box candidate. If at 1204 a new S-bo
If it is determined that there is no x candidate, the optimal S-bo
x and the MDS matrix determining means calculates the MD determined so far.
An optimal combination of the MDS matrix and the S-box is determined based on the complexity of the S candidate and the S-box candidate (120).
6).

The processing will be described in more detail. First, S-b
An ox candidate generation unit generates an S-box candidate (1301). The combination evaluation value calculation means obtains a polynomial in which the output of the generated S-box candidate is represented by an input (1302). Next, the MDS matrix candidate generation means generates a value that can be taken as a candidate for a matrix element of the MDS matrix (1303). Combination evaluation value calculation means,
With respect to the result of multiplying the output of the S-box candidate by the matrix element candidate, a polynomial based on the input of the S-box candidate is calculated (1304). Based on this polynomial, S-bo
The complexity for the combination of the x candidate and this matrix element candidate is calculated (1305). The complexity is GF (2 ⁿ )
And the number of terms of the output polynomial expressed by the input is used. Of course, instead of finding the number of terms, the degree of complexity may be defined by the degree of the polynomial. Another example of the complexity may be defined by the number of terms when the output bits are represented by a polynomial expression of the input bits. At that time, the number of terms is
The terms of all orders may be counted with the same weight, or may be counted with weights according to the order. Next, it is determined whether or not another matrix element candidate still exists (1306).
If another candidate still exists, the process returns to step 1303 to generate a new candidate and repeat the same process. If another candidate does not exist, a required number of candidates are selected from the matrix element candidates, and MDS matrix candidates are generated (1307).

In practice, it is determined whether or not this candidate is an MDS matrix (1308). This determination is made by the candidate of the MDS matrix confirming that all the minor determinants are non-zero. If the matrix candidate does not become the MDS matrix, the process returns to 1307 to generate the next matrix candidate and repeat the same process. Matrix candidate is MDS
If it is a matrix, the complexity of the matrix is calculated (1309). This is the Sb obtained in 1305.
The calculation is performed by adding the complexity of the matrix element candidates belonging to the matrix candidate based on the complexity of the combination of the ox candidate and the matrix element candidate. Next, an inverse matrix is obtained (1310).

Then, for the inverse matrix, the complexity of the matrix is obtained in the same manner as in 1309 (1311). Next, S-bo
It is determined whether this is the last x candidate (13).
12). If there is still a new S-box candidate, the process returns to 1301 to generate a new S-box candidate, and the same processing is repeated. In the case of the last S-box candidate, the optimal S-box and MDS matrix determination means
S-b among combinations of box candidates and MDS matrix candidates
ox candidate and MDS matrix combination complexity and S-box
A combination having a large complexity in any of the combinations of the matrix and the inverse matrix is determined as an optimal combination of the S-box and the MDS matrix (1313). (2nd Embodiment)

Next, FIG. 14 shows the S-box described above.
FIG. 10 is a diagram illustrating a structure of an encryption device that employs an S-box or an MDS matrix determined by a device that provides an optimal combination of the MDS matrix and the MDS matrix. Reference numeral 1401 denotes a portion of the encryption device that performs data agitation, and inputs a plaintext and outputs a ciphertext. 1401 is a substitution layer 140 constituted by a plurality of S-boxes as a part of the structure.
3 and a diffusion layer 1 composed of, for example, an MDS matrix.
It has 404. The diffusion layer 804 is connected to the substitution layer 803 in series. Reference numeral 1402 denotes an encryption processing portion other than 1403 and 1404 in the data agitating portion. 1402
May also include the same structure as 1403 and 1404.

Here, the substitution layer 1403 and the diffusion layer 1404
Has parameters determined by the device that determines one or both of the S-box and / or MDS matrices described in the first embodiment, or both. As a result, the data agitation statement 1401 has excellent security against interpolation attacks, has good avalanche properties, and has desirable properties intended by the definition of the evaluation value selected in the first embodiment. , The optimal combination of the S-box and the MDS matrix is given.

The operation of the data agitation unit 1401 will be described. When a plain text is input to the 1401, the input is subjected to various conversions, and is eventually passed from the 1402 to the substitution layer 1403. The substitution layer 1403 is composed of a plurality of S-boxes, and each S-box outputs a result obtained by performing substitution on the received input. S-
The output of the box is input to the next diffusion layer. Diffusion layer 1
Reference numeral 404 denotes an MDS matrix, outputs a result of performing a matrix operation on the input from the diffusion layer 1403, and returns the output to the remaining encryption processing unit 1402. The remaining encryption processing unit performs further conversion on the data received from the diffusion layer 1404, and finally outputs the data as cipher text.

Here, the remaining encryption section 1402 is expressed as a structure composed of one part. However, a structure separated into two parts, a part before the substitution layer 1403 and a part after the diffusion layer 1404, is shown. May be. One of them may not be provided.

Further, in the description, the substitution layer 1403 and the diffusion layer 1404 are directly connected. However, another processing such as, for example, expansion key addition may be interposed between the two. This is because the extended key addition is equivalent to adding an extended key of another value obtained by linear transformation after the 1404 by exchanging the order with the diffusion layer 1404.

In the above description of the embodiment,
The method of determining the optimal combination by an example in which a diffusion layer follows a substitution layer has been described as an example.However, when a substitution layer follows a diffusion layer, or when a plurality of substitution layers follow, a plurality of diffusion layers are used. In the following case, even in the case where the substitution layer and the diffusion layer are alternately stacked by an arbitrary number in an arbitrary order, a modification example in which the optimization value is obtained by calculating the evaluation value of the combination is also possible.

Although the embodiments of the present invention have been described with reference to the apparatus, they can be realized as software programs operating on a general-purpose computer.

【The invention's effect】

As described above, according to the present invention, conventionally, in an encryption device including an S-box and an MDS matrix as constituent elements, the S-box and the MDS matrix are each optimized by an independent design policy to optimize the complexity. Despite trying to achieve this, there was a risk that the effects would offset each other, resulting in a less secure encryption device. The complexity of the result of multiplying the S-box by the matrix element is evaluated, and based on the result of the complexity evaluation, the complexity of a combination of matrix element candidates constituting the MDS matrix is evaluated. A similar evaluation of complexity is given to the inverse matrix for the MDS matrix, and based on the result of the evaluation of the complexity for these matrices, the optimal S-box and combination give By determining the MDS matrix that gives the complexity, it becomes possible to determine the optimal combination in which the effects of each other do not cancel each other, and thus more secure using the S-box or the MDS matrix determined as such. A simple encryption device.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of an apparatus for determining an MDS matrix of an optimal combination for a given S-box in the present invention.

FIG. 2 is a diagram showing processing of an apparatus for determining an MDS matrix of an optimal combination for a given S-box according to the present invention.

FIG. 3 is a diagram showing details of processing of an apparatus for determining an MDS matrix of an optimal combination for a given S-box according to the present invention.

FIG. 4 is a diagram showing a complexity in a combination of an S-box and a matrix element candidate.

FIG. 5 is a diagram showing a complexity in a combination of an S-box and an MDS matrix.

FIG. 6 is a diagram illustrating a configuration of an apparatus for determining an optimum common factor for a given MDS matrix according to the present invention.

FIG. 7 is a diagram showing processing of an apparatus for determining an optimum common factor for a given MDS matrix according to the present invention.

FIG. 8 is a diagram illustrating a configuration of an apparatus for determining an S-box of an optimal combination for a given MDS matrix according to the present invention.

FIG. 9 is a diagram showing details of processing of an apparatus for determining an S-box of an optimal combination for a given MDS matrix according to the present invention.

FIG. 10 is a diagram showing details of processing of an apparatus for determining an S-box of an optimal combination for a given MDS matrix according to the present invention.

FIG. 11 is a diagram illustrating a configuration of an apparatus that determines an optimal combination of an S-box and an MDS matrix according to the present invention.

FIG. 12 is a diagram showing processing of an apparatus for determining an optimum combination of an S-box and an MDS matrix according to the present invention.

FIG. 13 is a diagram showing details of processing of an apparatus for determining an optimum combination of an S-box and an MDS matrix according to the present invention.

FIG. 14: Optimal S-box or MD in the present invention
FIG. 2 is a diagram illustrating an encryption device using an S matrix or both.

[Explanation of symbols]

 101 S-box providing means 102 MDS matrix candidate generating means 103 Combination evaluation value calculating means 104 Optimal MDS matrix determining means 401 S-box 402 Matrix element candidates 501 S-box 502 MDS matrix 601 MDS matrix providing means 602 Common factor candidate generating means 603 Cost evaluation value calculation means 604 Optimal common factor determination means 801 MDS matrix addition means 802 S-box candidate generation means 803 Combination evaluation value calculation means 804 Optimal S-box and MDS matrix determination means 1101 S-box candidate generation means 1102 MDS matrix Generating unit 1103 Combination evaluation value calculating unit 1104 Optimal S-box and MDS matrix determining unit 1401 Encryption processing unit (data stirring unit) 1402 Other encryption processing units 1403 S-box 1404 MDS matrix

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Kenji Okuma 1 Toshiba R & D Center, Komukai, Saiwai-ku, Kawasaki City, Kanagawa Prefecture (72) Inventor Shinichi Kawamura Komukai, Saiyuki-ku, Kawasaki City, Kanagawa Prefecture No. 1 Toshiba Town F-term in Toshiba R & D Center (reference) 5J104 AA41 JA09 JA17 NA08 NA10

Claims (9)

[Claims] 1. An apparatus for performing a substitution process for converting each character of a plaintext into another character by a first parameter and a diffusion process for replacing each character of the plaintext with a second parameter. A parameter determining device for determining a second parameter, comprising: input means for inputting a determined first parameter used in the substitution process; and a second parameter generation unit for sequentially generating a second parameter candidate used in the diffusion process. Parameter candidate generating means; a first parameter input by the input means;
Each second sequentially generated by the parameter candidate generation means
Calculating means for sequentially calculating the evaluation value by a predetermined method based on the parameter candidates; and determining the optimum evaluation value from the obtained evaluation values sequentially calculated by the calculating means, and corresponding to the determined evaluation value. A parameter determining device for determining a second parameter candidate to be performed as a second parameter of the device. 2. The apparatus according to claim 1, further comprising a substitution process for converting each character of the plaintext into another character using a first parameter, and a diffusion process for replacing each character of the plaintext with a second parameter. A parameter determining device for determining a first parameter, a first parameter candidate generating means for sequentially generating a first parameter candidate used for the substitution process, and a determined second parameter used for the diffusion process. Based on input means for inputting, each first parameter candidate sequentially generated by the first parameter candidate generating means, and the second parameter input by the input means, sequentially calculating an evaluation value by a predetermined method Calculating means, which is sequentially calculated by the calculating means, determines an optimum evaluation value from the obtained evaluation value, and a first parameter corresponding to the determined evaluation value. That complement and a optimum parameter determining means for determining the first parameter of the device parameter determining apparatus according to claim. 3. An apparatus for performing a substitution process for converting each character of a plaintext into another character by using a first parameter and a diffusion process for replacing each character of a plaintext by using a second parameter. A parameter determining device for determining a first parameter, a first parameter candidate generating means for sequentially generating a first parameter candidate used for the substitution processing, and a second parameter candidate for sequentially generating a second parameter candidate used for the diffusion processing A second parameter candidate generating means, a first parameter candidate sequentially generated by the first parameter candidate generating means, and a second parameter candidate sequentially generated by the diffusion processing unit matrix candidate generating means by the second parameter candidate generating means. Calculating means for sequentially calculating an evaluation value by a predetermined method based on the parameter candidates; and Optimal parameter determining means for determining an optimal evaluation value from the evaluation value, and determining a first parameter candidate and a second parameter candidate corresponding to the determined evaluation value as a first parameter and a second parameter of the device, respectively. A parameter determining device. 4. A parameter determination device for performing a diffusion process of replacing each character of a plaintext with a matrix, wherein the parameter determination device determines an optimal common factor for the matrix in order to determine the matrix of the diffusion process. Input means for inputting a determined matrix used for the diffusion processing; common factor candidate generation means for generating common factor candidates that can be grouped out with respect to the matrix of the diffusion processing; Calculating means for sequentially calculating an evaluation value by a predetermined method based on a matrix obtained by extracting the matrix of the diffusion processing by a sequentially generated common factor candidate; A parameter determining device for determining an evaluation value, and an optimum common factor determining means for setting a common factor candidate corresponding to the determined evaluation value as a common factor. 5. A parameter determining method for an apparatus for performing a substitution process for converting each character of a plaintext into another character by using a first parameter and a diffusion process for replacing each character of the plaintext by using a second parameter. Determining a first parameter or a second parameter or both parameters such that an evaluation value calculated by a predetermined method determined by a combination of the substitution processing and the diffusion processing is optimized. Parameter determination method. 6. An apparatus for performing a substitution process for converting each character of a plaintext into another character according to a first parameter and a diffusion process for replacing a space between each character of the plaintext with a matrix. A parameter determining device for determining, comprising: input means for inputting a determined first parameter used in the substitution processing; and sequentially generating a second parameter candidate which is an element of a matrix used in the diffusion processing. A second parameter candidate generating unit; a first parameter input by the input unit;
Each second sequentially generated by the parameter candidate generation means
Calculating means for sequentially calculating the evaluation value by a predetermined method based on the parameter candidates; and determining the optimum evaluation value from the obtained evaluation values sequentially calculated by the calculating means, and corresponding to the determined evaluation value. A parameter determining unit that determines a second parameter candidate to be determined as a second parameter of one element of the matrix, and determines all elements of the matrix. 7. The optimal parameter determining means further comprises:
7. A method according to claim 6, wherein a predetermined number of suitable evaluation values are determined from the obtained evaluation values, and a second parameter candidate corresponding to the determined evaluation value is set as a parameter candidate for another element of the matrix. Parameter determination device. 8. An encryption device comprising: a plurality of substitution processing units for converting each character of a plaintext into another one for encrypting a plaintext; and a diffusion processing unit for replacing a space between each character of the plaintext. The diffusion processing unit sequentially calculates an evaluation value by a predetermined method based on the determined first parameter used in the substitution processing unit and a second parameter candidate that is sequentially generated and used in the diffusion processing. An optimal evaluation value is determined from the evaluation values obtained by calculation, and the second parameter candidate corresponding to the determined evaluation value is used for replacement between each character in plain text. Encryption device. 9. A decryption apparatus comprising: a plurality of substitution processing units for converting each character of a ciphertext into another for decrypting a ciphertext; and a diffusion processing unit for replacing a space between each character of the ciphertext. The diffusion processing unit, based on the determined first parameter used in the substitution processing unit, and a second parameter candidate used in the diffusion process sequentially generated, the evaluation value by a predetermined method The optimal evaluation value is determined from the evaluation values obtained by the successive calculation, and the optimal evaluation value corresponding to the determined evaluation value is determined.
A decoding device wherein two parameter candidates are used for replacement between each character of a plaintext.