JP2005215559A - Cipher system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reset an intermediate key in a cipher system so as to be usable only one time and disposable. <P>SOLUTION: A cipher system comprising a plurality of cryptographic keys (k1, k2) to be kept secret, an initial vector (IV) to be made public, a random number generating section generating a random number hard to be predicted an intermediate key generating section generating the intermediate key, and an encryption processing section is provided. The intermediate key generating section determines and resets the intermediate key according to input items including the plurality of cryptographic keys (k1, k2) and the initial vector (IV) functioning as a reset vector. The random number generating section includes random number generating functions corresponding to the cryptographic keys (k1, k2). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a cryptographic system, and more particularly, to a cryptographic system in which the cryptographic system itself has a key disposable.

1) A system that enables the reuse of encryption keys and the reuse of intermediate keys Common key cryptosystems are based on the basic philosophy of "designing computational security so that keys, that is, short data, can be used repeatedly". Composed. More specifically, as shown in FIG. 1, after key exchange, an intermediate key generation unit 102 that generates an intermediate key using the encryption key 101, and a plaintext 104 using the intermediate key to encrypt a ciphertext 105 And the encryption processing unit 103 for obtaining the initial vector 106 (hereinafter referred to as “IV”) for biasing the entropy is superimposed on the plaintext 104 during the encryption.

  The intermediate key generation unit 102 and the encryption processing unit 103 perform round calculation processing and reuse the intermediate key and encryption key, respectively. By making this processing non-linear, calculation of the encryption key and plaintext is performed. Quantitative safety is ensured. For example, in the case of AES, tools such as ByteSub / ShiftRow / MixColumn are used for nonlinear processing.

  The above structure begins with Death (DES) and remains unchanged until today.

2) Cryptographic system operation The common key cryptosystem of FIG. 1 keeps the intermediate key unchanged during one session, reads plaintext (consisting of multiple blocks or multiple messages), and repeats the encryption process. It is operated by. The intermediate key does not change unless the encryption key is changed.

1) Problem of voice packet communication that a conventional cryptographer has not envisaged When a voice packet is encrypted, a problem that has not been assumed conventionally arises. Voice IP (Voice IP: hereinafter referred to as “VoIP”) ensures sound quality by subdividing voice into several tens of packets per second. Therefore, “silent” packets are mixed there. This means that if the encryption key is the same, there is a packet with the same (similar) bit pattern, which provides internal information of the cryptographic system.

1-1) With an IP (hereinafter referred to as “IP”) telephone, that is, an IP telephone, it is possible to carry out an attack with silence as a known plaintext against VoIP encryption.

  In short, the known plaintext / ciphertext selection attack becomes effective, and in the case of the stream cipher, there is a possibility that the subsequent packet is immediately decrypted and wiretapped.

1-2) Use of IV does not help solve VoIP problems.

  The only way to prevent this is to exchange encryption keys on a packet-by-packet basis. However, execution of the communication protocol for exchanging the encryption key takes 1000 times or more time for the encryption process.

  Therefore, the conventional mode using IV for analog packet processing is inferred, and changing the IV value changes the ciphertext even if the plaintext is the same, so it seems that it can provide security equivalent to exchanging keys. But this reasoning is not correct. The key determines the internal state (intermediate key) of the encryption system, but the IV value is the data to be encrypted as with the plain text data.

For example, DES's ECB mode is expressed in functional form, ciphertext C _i , input plaintext X _i , and encryption function defined by key k as E _k , ciphertext C _i = E _k (X _i ). When IV is introduced here, ciphertext C _i = E _k (M _i + C _i-1 ) and C ₀ = IV are given for an arbitrary natural number i. In other words, the conventional IV is one of the data to be encrypted.

The IV value of IP communication is disclosed on the communication line. When plaintext is known by picking up silence packets, it is both the IV and the plaintext becomes known, the entropy of the ciphertext C _i consisting of the chained mode falls.

  This relationship is shown in FIG. The key determines the internal state of the encryption system, and the IV value is one of the data to be encrypted. In the case of decoding, the IV input position depends on the operation mode. In any case, when voice encryption is performed, there is no security argument other than exchanging encryption keys in units of packets.

2) When the key is reset, the throughput is extremely reduced.

2-1) It takes time to exchange the encryption key once again.

  The key exchange protocol takes about 1000 times more than the encryption process. This protocol is usually used only when opening a session.

2-2) When the encryption key is exchanged, the encryption processing capability itself decreases.

  As a result of testing with an encryption system very similar to R.C. Four (RC4), the encryption throughput decreased to 14% when the encryption key was repeatedly input in response to 64-byte plaintext input.

  This relationship is shown in FIG. Each time plaintext is read, the encryption key is reset in the upper layer of the encryption system. As a result, the encryption key is reset (step 211), thereby resetting the intermediate key (step 212) and encrypting the intermediate key. By using it in the processing unit 213, the plain text 214 is encrypted into the cipher text 215. The reason why the encryption processing capability has decreased to 14% is that it took time for the intermediate key reset operation (step 212).

  From the above, it can be seen that it is difficult to theoretically secure the security of VoIP with conventional cryptosystems.

  For VoIP, a method for resetting an intermediate key that is not based on the conventional key exchange protocol is required, and a method for resetting the intermediate key in a one-time manner is required. When using IV for this, the IV must be overcome because it is public data and must not be involved in the "generation" of the intermediate key.

  The encryption system according to the present invention dares to reset the intermediate key using IV as a reset vector without changing the encryption key. The IV is sent connectionless and is suitable for intermediate key reset.

  In addition, the cryptographic system according to the present invention allows IV to participate in “reset” of the intermediate key and keeps the cryptographic system safe in terms of computational complexity.

  FIG. 4 shows the relationship among the IV, encryption key, and intermediate key that constitute the encryption system according to the present invention. In order to re-use the encryption key, this encryption system biases entropy with a one-time disposable IV and resets the intermediate key as a random number through a hard-to-predict random number generator that satisfies the computational security. Hit it. Using the reset intermediate key in the encryption processing unit, plaintext is converted into ciphertext.

Hereinafter, the components of the cryptographic system according to the present invention are represented by the symbols in FIG. 5 that correspond one-to-one with FIG. In FIG. 5:
There are multiple k1 and k2 encryption keys;
Random number generation functions G () and g () corresponding to those encryption keys are defined as one-way functions (there must be evidence that is certified by a fair third-party organization);
These functions generate random numbers r1 = G (k1), r2 = g (k2, IV);
An intermediate key k3 = r1 | r2 is generated as a composite random number (symbol |) of these random numbers;
The plaintext M is converted into ciphertext C = E _k3 (M) by the encryption process E _k3 using this intermediate key.

  That is, the cryptographic system according to the present invention includes: a plurality of secret keys (k1 and k2) that are kept secret, a public initial vector (IV), a random number generator that generates random numbers that are difficult to predict, and an intermediate key. An intermediate key generation unit for generating; and an encryption processing unit; the intermediate key generation unit including the plurality of encryption keys (k1, k2) and the initial vector (IV) acting as a reset vector The intermediate key is determined and reset according to an item; the random number generation unit includes a random number generation function (G () and g ()) corresponding to the encryption key (k1, k2).

That is, the encryption key k1 is input to G (), the random number r1 is output from G (), and the encryption key k2 and IV are input to g (), and the random number r2 is output from g ():
r1 = G (k1) ------- (1)
r2 = g (k2, IV) ------- (2)
Synthesize the intermediate key k3 from these random numbers r1 and r2:
k3 = r1 | r2 ------- (3)
Using this intermediate key k3, the plaintext M encryption processing unit E _k3 is performed:
C = E _k3 (M) -------- (4).

  Therefore, the cryptographic system according to the present invention is configured as a computer including a program for calculating a mathematical bundle of the above formulas (1) to (4) or a memory storing the program.

  Next, the best mode for carrying out the present invention will be described with reference to FIGS.

  6 is a block diagram of an encryption system according to an embodiment of the present invention, FIG. 7 is a flowchart showing an execution module group of the encryption system according to the embodiment of the present invention, and FIG. 8 is a flowchart of the encryption system according to the embodiment of the present invention. It is a graph which shows the packet length applied to VoIP.

  The cryptographic system of FIG. 6 also shows how to ensure computational security in an embodiment in which IV is involved in the resetting of the intermediate key.

This cryptographic system includes cryptographic keys k1 and k2 as private secret keys, a public initial vector IV, a random number generator that generates random numbers r1 and r2 that are difficult to predict, an intermediate key generator that generates an intermediate key k3, And an encryption processing unit for performing the encryption process E _k3 .

  The encryption keys k1 and k2 and the initial vector IV are input items for determining the intermediate key k3. The encryption keys k1 and k2 are each 256 bits, and the IV is 64 bits. This IV is transmitted together with the ciphertext C over the public network in plaintext.

  The random number generation unit receives a cryptographic key k1 and outputs the random number r1, and a random number generating function g () that inputs the cryptographic key k2 and the initial vector IV and outputs the random number r2. Is provided.

r1 = G (k1) ------- (1)
r2 = g (k2, IV) ------- (2)
For the function g () in FIG. 6 embodiment, a hash function with an output of 128 bits is used. The input is 64 bits for IV and 256 bits for key k2.

k2 = 256bit
IV = 64bit
r2 = 128bit
The random number generation method that compresses such input is a methodology recommended by NIST. Since IV is open to the public, this 64bit only serves as a trigger. 256bit-64bit = 192bit is the entropy of the function g () input. In other words, to estimate the output 128 bits from the 64 bits of IV requires a calculation amount of 192 bits. On the contrary, even if the 128 bits of output are disclosed, to calculate the key k2, a calculation amount of 192 bits-128 bits = 64 bits is still required. However, since the output 128 bits of the function g () is internal data of the cryptographic system, it is not disclosed.

  The function G () in the embodiment of FIG. 6 includes the one-way function described in PCT / JP99 / 00476: 1999.02.04 “IP KEY MANAGEMENT MECHANISM WITH DIVERGENCE BARRIER INCREASING ENTROPY AGAINST COMPUTATIONAL CRYPTO-ANALYSES” The one-way function described in Japanese Patent Application 2003-381395 that intends to apply the provisions of Article 30 (1) is used. The function G () is more efficient than the NIST recommended method because it outputs a 256-bit random number from a 256-bit input. In addition, there is usually a means for generating an unpredictable random number called a key exchange protocol, which may be used, but the speed becomes extremely slow.

k1 = 256bit
r1 = 256bit
The difficulty of prediction is based on the point that when trying to estimate another output of 256 bits from the output of 256 bits, a calculation amount of 128 bits or 256 bits is required.

  The outputs 256bit and 128bit of these functions G () and g () are combined to create a 352bit intermediate key k3 that is difficult to predict.

k3 = r1 | r2 ------- (3)
k3 = 352bit
At this time, 256 bits + 128 bits = 384 bits, but 32 bits are used as IV for synthesis.

Encryption processing E _k3 from plaintext M to ciphertext C is performed using the intermediate key 352 bits as the key k3 of the encryption processing unit.

C = E _k3 (M) -------- (4)
As is clear from the progress of the above expressions (1) to (4), the intermediate key k3 is set to one time with IV as a trigger. Therefore, the encryption process E _k3 is also made one-time. This makes it difficult to decipher plaintext.

The security of the cryptographic processing E _k3 alone is outside the scope of the present invention, but it is assumed that this is also ensured. Touch the safety against known plaintext attacks. E _k3 alone has a key stream generator composed of 10 32-bit registers and 32-bit IV, and creates a ciphertext with exclusive OR [XORing]. Since k3 = 352bit, it boasts 352bit entropy, but it can be reduced to 128bit entropy if a known plaintext attack is performed under the conditions of algorithm disclosure. However, since k3 is one-time, it will recover to the original 352bit. As a result, the security of the encryption key is restored to the specified value.

  Figure 7 shows the relationship with higher-layer VoIP.

  The VoIP RTP packet encryption process consists of the following modules (functions).

init (): E _k3 encryption initialization process: initialization of encryption key and IV
Setprm (): RTP packet information setting processing
encrypt (): E _k3 encryption processing
decrypt (): E _k3 decryption processing
final (): E _k3 encryption end processing These modules are expanded on the CPU memory and deleted when the processing ends.

The content processed in the upper layer is expressed by two functions init () and Setprm ().
The function init () initializes the encryption key and IV. Initialization related to IV is setting of an initial value of a random number generator that generates IV. IV is generated as a random number. Note that the IV may be generated by compressing the output ciphertext. In either case, an initial value is required. Some computer OSs have a function that provides an initial value. For example, a UNIX system has a function Entropy-pool. The function Setprm () sets information about RTP packets.

  The process of FIG. 7 involves functions encrypt (), decrypt (), and final (). The function encrypt () triggers the plaintext and IV generator to read the IV value and places the ciphertext along with the IV value in the RTP packet. The recipient decrypts it with the function decrypt (). The operations of the functions encrypt () and decrypt () are repeated in both. The function final () terminates RTP and releases the execution module group from the CPU memory. In this way, the function encrypt () reads the IV value for each encryption.

  The process shown in FIG. 7 corresponds to an encryption system that performs a process of disposable keys with IV as a trigger.

  The above cryptosystem improves security and enables high-speed processing of the entire cryptosystem by introducing a random number generation method that is difficult to predict.

  Therefore, a benchmark test was performed to compare the ability to reset the intermediate key between the system according to the above embodiment and the conventional system. The results are shown in Table 1.

  When the plaintext data length is 8 bytes (bytes) / 64 bytes / 256 bytes / 1024 bytes / 8192 bytes, the throughput per second was measured to determine how many times each data can be encrypted. The key exchange was performed for each encryption.

As a comparative sample, the stream-type common key encryption software “rc4”, which is available for free, is used. However, this is not an official version of RSA, but only a representative of stream-type encryption.

  From the log-log graph of FIG. 8, the general tendency of the cryptographic system according to the present embodiment in comparison with the conventional example can be seen. This system has high processing power, and the shaded packet length is used in VoIP, where it is about 3 to 4 times faster. In areas with low CPU capability, such as mobile devices, this difference in capability immediately appears in voice quality.

  According to the present invention, it is possible to obtain a one-time keying encryption system in which the encryption system itself has a single-use key, which means that the pseudo one-time pad encryption is practically used. This is a mechanism that surpasses conventional cryptosystems. In addition, it has a high key reset capability and can respond to processing of other data including voice. Applies to all areas of communications.

It is a block diagram of a conventional common key cryptosystem. It is a flowchart which shows the relationship between the key of the conventional common key encryption system, and IV. It is a flowchart which shows the reset method of the key of the conventional common key cryptosystem. It is a flowchart which shows the relationship between the key and IV of the encryption system which concerns on this invention. 3 is a flowchart showing components of a cryptographic system according to the present invention. It is a block diagram of the encryption system which concerns on the Example of this invention. It is a flowchart which shows the execution module group of the encryption system which concerns on the Example of this invention. It is a graph which shows the packet length applied to VoIP of the encryption system based on the Example of this invention.

Explanation of symbols

k1, k2 encryption key
G (), g () random number generation function
r1, r2 random numbers
k3 intermediate key
IV Initial vector that acts as a reset vector
Encryption using E3 _k3 intermediate key
M plaintext
C ciphertext

Claims (2)

A plurality of secret encryption keys, a public initial vector, a random number generation unit that generates random numbers that are difficult to predict, an intermediate key generation unit that generates intermediate keys, and an encryption processing unit,
The intermediate key generation unit determines and resets the intermediate key according to an input item including the plurality of encryption keys and the initial vector that acts as a reset vector,
The random number generation unit includes a random number generation function corresponding to an encryption key.        2. The encryption according to claim 1, comprising an upper layer having the random number generation unit and a lower layer having the intermediate key generation unit and an encryption processing unit, and security means is provided in the lower layer. system.

Images