JP2007184000A - Method and apparatus for encryption, method and apparatus for decryption, and computer-readable recording medium storing program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To arrange a memory 55 provided in parallel with a feedback line 65 which feeds back data from an encrypting module 51 using an encryption key K to a selector 54 in order to encrypt another piece of data during encryption. <P>SOLUTION: When an interrupt IT for processing plaintext block data N<SB>i</SB>of another piece of data is generated while plaintext block data M<SB>i</SB>is processed, ciphertext block data C<SB>i</SB>at timing of generation of the interrupt IT is made to be stored in a register 56. The ciphertext block data C<SB>i</SB>stored in the memory 55 is made to be selected by the selector 54 at timing of completion of processing the plaintext block data N<SB>i</SB>, and thereby processing the plaintext block data M<SB>i+1</SB>is started. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an encryption / decryption device and an encryption / decryption method. In particular, the present invention relates to an invention capable of encrypting and decrypting other data during data encryption and decryption.

  FIG. 43 is a diagram illustrating an encryption apparatus using Cipher Block Chaining Mode (hereinafter referred to as CBC mode).

Encryption method in the CBC mode shown in FIG. 43, by entering the 64-bit plaintext block data M _i in block units, and encrypted by the encryption module 51 using the encryption key K, further, the encrypted encryption An encryption module that uses the encryption key K to calculate the exclusive OR of the sentence block data C _i and the next plaintext block data M _{i + 1} and uses the operation result of the exclusive OR as the input of the next encryption This is a method of encrypting by supplying to 51. Then, the entire plaintext M is encrypted into the ciphertext C by repeating this process and chaining them one after another.

  FIG. 44 is a diagram illustrating a decoding device using the CBC mode.

The decryption device shown in FIG. 44 is a device that decrypts the ciphertext encrypted by the encryption device shown in FIG. The ciphertext block data C ₁ is input to the decryption module 71 using the encryption key K, an exclusive OR with the initial value IV is calculated, and the plaintext block data M ₁ is decrypted. When the ciphertext block data C ₂ is input, it is decrypted by the decryption module 71 using the encryption key K, and is exclusive ORed with the ciphertext block data C _{1 that} is input _first and stored in the register 111. The plaintext block data M ₂ is decrypted.

  Note that the register 111 may be provided inside the selector 73.

Encryption processing using plaintext block data as M _i (i = 1, 2,..., N) and cipher text block data C _i (i = 1, 2,..., N) and using an encryption key K Is E _K , and decryption processing using the encryption key K is D _K , the CBC mode is expressed by the following equation.

C ₁ = E _K (M ₁ EXR IV)
C _i = E _K (M _i EXR C _i-1 ) (i = 2, 3,..., N)
M ₁ = D _K (C ₁ ) EXR IV
M _i = D _K (C _i ) EXR C _i-1 (i = 2, 3,..., N)
Here, EXR is an exclusive OR operation. Further, IV (Initial Value) is an initial value and is used at the time of initial encryption and decryption. The same initial value IV is used on the encryption side and the decryption side.

  FIG. 45 shows an output feedback mode (hereinafter referred to as OFB mode) encryption apparatus.

  FIG. 46 is a diagram illustrating an OFB mode decoding apparatus.

  FIG. 47 is a diagram showing a cipher feedback mode (hereinafter referred to as CFB mode) encryption apparatus.

  FIG. 48 illustrates a CFB mode decoding apparatus.

  Note that the register 111 may be provided inside the selector 73.

  FIG. 49 is a diagram showing a procedure for encrypting plaintext M and plaintext N using a CBC mode encryption apparatus.

Here, the plaintext M is the plaintext block data M _1, plaintext block data M _2, is composed of a plaintext block data M _3, illustrating a case where the plaintext N is composed only of the plaintext block data N _1.

When the encryption of the plaintext block data M ₁ starts, the ciphertext block data C ₁ is output, and the ciphertext block data C ₁ is used for encryption of the plaintext block data M ₂ . As described above, the ciphertext block data C _i is fed back to the encryption of the plaintext block data M _{i + 1} and subjected to chain processing. Accordingly, the plaintext block data N ₁ cannot be encrypted unless the encryption from the plaintext block data M ₁ to the plaintext block data M ₃ is completed.

  FIG. 50 shows a case where encryption is performed in the CBC mode, as in FIG.

The case of FIG. 50 shows a case where it takes time to prepare the plaintext block data M ₁ , the plaintext block data M ₂ , and the plaintext block data M ₃ . On the other hand, the encryption process is completed before the next plaintext block data M _{i + 1} can be prepared, and an idle time (for example, a time period from T1 to T2, T3 to T4) is generated. Yes. Thus, even if the idle time occurs, the ciphertext block data C _i must perform a chain process that is fed back to the next plaintext block data M _{i + 1,} the process of the plaintext block data N ₁ is plaintext Only after the processing of the block data M ₃ is completed can it be performed.

  FIG. 51 is a diagram showing data concealment processing and processing for guaranteeing data integrity. The plaintext M is encrypted into the ciphertext C by, for example, an OFB mode encryption device. The authenticator P is calculated by the CBC mode encryption device, and the authenticator P is added to the end of the ciphertext C. When the encrypted data to which the authenticator P is added is received, the plaintext M is decrypted from the ciphertext C by the decryptor in OFB mode, and the authenticator is decrypted from the ciphertext C by the decryptor in CBC mode. By calculating P and comparing it with the transmitted authenticator P, it can be confirmed that the transmitted C has not been tampered with.

  FIG. 52 is a diagram showing the procedure of the concealment process and the authenticator calculation process shown in FIG.

The plaintext block data M ₁ to plaintext block data M ₃ are sequentially encrypted into ciphertext block data C ₁ to ciphertext block data C ₃ . Thereafter, the ciphertext block data C ₁ to the ciphertext block data C ₃ are sequentially input to calculate the authenticator P.
Japanese Patent Laid-Open No. 9-298736

  The encryption device and decryption device in each mode shown in FIGS. 42 to 48 must feed back the encrypted / decrypted data of the previous block data and use it for the encryption / decryption processing of the next block data. Once the encryption process or decryption process is started, another encryption process or decryption process cannot be started unless the entire process is completed. Therefore, when the encryption / decryption process started first takes a long time, there is a problem that the encryption / decryption process started later is waited for a long time.

  In addition, when the time required for the encryption / decryption process is shorter than the time for preparing the data to be encrypted / decrypted, there is a problem that the idle time occurs in the encryption / decryption apparatus.

  In addition, when performing the concealment process and the integrity guarantee process, the integrity guarantee process must be performed after the concealment process is performed, and there is a problem that it takes a long processing time.

  In a preferred embodiment of the present invention, an object is to obtain an encryption device, a decryption device, an encryption method, and a decryption method capable of performing encryption / decryption processing of other data during encryption / decryption processing of certain data. And

  It is another object of the present invention to preferentially perform encryption / decryption of high priority data.

  It is another object of the present invention to enable the concealment process and the integrity guarantee process to be performed in parallel at high speed.

An encryption device according to the present invention is an encryption device that performs encryption processing between first processing data and second processing data.
A memory for storing the state of the encryption process;
The encryption processing of the second processing data is started before the encryption processing of the first processing data is completed, and the encryption of the first processing data is started when the encryption processing of the second processing data is started. When the processing state is stored in the memory and the encryption processing of the first processing data is resumed, the encryption processing state of the encryption device is changed to the encryption processing of the first processing data stored in the memory. The encryption processing of the first processing data is resumed after returning to the state.

  When the encryption apparatus resumes the encryption process of the first process data before the encryption process of the second process data is completed, and the memory resumes the encryption process of the first process data When the encryption processing state of the second processing data is stored in the memory and the encryption processing of the second processing data is resumed, the encryption processing state of the encryption device is stored in the second processing data stored in the memory. The encryption processing of the second processing data is resumed after returning to the state of the encryption processing.

  The first processing data is a first plaintext, and the second processing data is a second plaintext.

  The encryption apparatus starts encryption processing of the second processing data by interruption.

The encryption apparatus according to the present invention includes plaintext block data M _i (i = 1, 2, 3,...) Constituting the plaintext M and plaintext block data N _j (j = 1, 2, 3, ...) in an encryption device for encrypting
A mechanism for accepting a plaintext N encryption request before the plaintext M encryption process is completed during the plaintext M encryption process;
An encryption unit for encrypting plaintext block data M _i and outputting ciphertext block data C _i ;
A feedback loop for feeding back ciphertext block data C _i output from the encryption unit to the encryption unit via a feedback line;
Provided in parallel with the feedback line of the feedback loop, accepting the plaintext N encryption request and starting the encryption processing of any plaintext block data of plaintext N, the plaintext block data M _{i + 1} becomes plaintext A memory for storing the ciphertext block data C _i to be fed back if it is not encrypted following the block data M _i ;
When the plaintext block data M _{i + 1} is encrypted following the plaintext block data M _i , the ciphertext block data C _i fed back by the feedback line of the feedback loop is selected and supplied to the feedback loop. When the plaintext block data M _{i + 1} is not encrypted after the plaintext block data M _i and is encrypted after any plaintext block data of the plaintext N, it is stored in the memory. And a selector that selects ciphertext block data C _i and supplies it to the feedback loop.

The above memory is
Multiple registers for multiple plaintexts,
And a switch for switching a register corresponding to plain text to be encrypted.

The encryption method according to the present invention uses the ciphertext block data C _i (i = 1, 2, 3,...) Output from the encryption module to use the plaintext block data M _i (1) of the first plaintext M. i = 1, 2, 3, ...),
After encrypting the middle or plaintext block data M _i is encrypted the plaintext block data M _i, the ciphertext block data C _i to be used for encrypting the plaintext block data M _{i + 1} of the first plaintext M Storing in a memory;
Encrypting at least one plaintext block data of the second plaintext N after storing the ciphertext block data C _i used for encrypting the plaintext block data M _{i + 1 in} a memory;
After encrypting at least one plaintext block data of the second plaintext N, the ciphertext block data C _i used for encrypting the plaintext block data M _{i + 1} stored in the memory is input and encrypted. And a step of encrypting plaintext block data M _{i + 1} of the first plaintext M using a module.

The encryption device according to the present invention converts an plaintext composed of one or more plaintext block data into an encrypted unit ciphertext, and generates an authenticator for guaranteeing the integrity of the ciphertext with respect to the ciphertext. In
A first feedback loop that feeds back the ciphertext block data C _i output from the encryption unit to the encryption unit when the plaintext block data is encrypted by the encryption unit; An encryption unit that feeds back the ciphertext block data C _i by performing a feedback loop and performs encryption processing;
It has a second feedback loop that feeds back the result of the authenticator calculation, inputs ciphertext block data every time ciphertext block data is output from the encryption unit, performs data processing, and uses the second feedback loop An authenticator generation unit that feeds back an intermediate result of the authenticator operation and generates an authenticator for guaranteeing the integrity of the ciphertext is provided.

The encryption unit and the authenticator generation unit alternately perform an encryption process and an authenticator generation process using one encryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the encryption process and the authenticator generation process, and
A selector that alternately selects the result of the encryption process and the authenticator generation process from the memory and outputs the result to the encryption module in order to alternately execute the encryption process and the authentication generation process; To do.

The encryption method according to the present invention is an encryption that converts plaintext consisting of one or more plaintext block data into ciphertext by an encryption unit and generates an authenticator for guaranteeing the integrity of the ciphertext with respect to the ciphertext. In the method
A first feedback step of feeding back the ciphertext block data C _i output from the encryption unit to the encryption unit when the plaintext block data is encrypted by the encryption unit; an encryption step of perform an encryption process is fed back the ciphertext block data C _i, and outputs the ciphertext block data by the feedback loop,
A second feedback step for feeding back an intermediate result of the authenticator operation, ciphertext block data is input every time ciphertext block data is output from the encryption step, data processing is performed, and the second feedback step An authenticator generation step of feeding back an intermediate result of the authenticator operation and generating an authenticator for ensuring the integrity of the ciphertext is provided.

The decoding device according to the present invention is a decoding device that performs a decoding process between the first processing data and the second processing data.
A memory for storing the state of the decryption process;
When the decoding process of the second process data is started before the decoding process of the first process data is completed, and the decoding process of the second process data is started, the state of the decoding process of the first process data is changed. When the decoding process of the first processing data is restarted after being stored in the memory, the decoding process of the decoding apparatus is returned to the state of the decoding process of the first processing data stored in the memory. The decryption process of the process data is resumed.

  The decoding apparatus resumes the decoding process of the first processing data before the completion of the decoding process of the second processing data, and the memory performs the second processing when the decoding process of the first processing data is resumed. When the decoding processing state of the processing data is stored and the decoding processing of the second processing data is resumed, the decoding processing state of the decoding device is returned to the decoding processing state of the second processing data stored in the memory. After that, the decoding process of the second process data is resumed.

  The first processing data is a first ciphertext, and the second processing data is a second ciphertext.

  The decoding apparatus is characterized in that the decoding process of the first block data of the second processing data is started by interruption.

In the decryption device according to the present invention, the ciphertext block data C _i (i = 1, 2, 3,...) Constituting the ciphertext C and the ciphertext block data D _j (j = 1) constituting the ciphertext D are provided. , 2, 3,...
A mechanism for accepting a decryption request for ciphertext D at any time during the decryption process for ciphertext C;
A decryption unit that decrypts the ciphertext block data C _i and outputs plaintext block data M _i ;
A feedback loop for feeding back the decoder unit through a feedback line ciphertext block data C _i for decrypting the ciphertext block data C _{i + 1,}
The ciphertext block data C _{i + 1} is provided in parallel with the feedback line of the feedback loop, accepts a decryption request for the ciphertext D, and starts decryption processing of any ciphertext block data of the ciphertext D. If but not decoded following the next ciphertext block data C _i, and a memory for storing the ciphertext block data C _i fed back,
If ciphertext block data C _{i + 1} is decoded following the next ciphertext block data C _i is fed to the feedback loop by selecting the ciphertext block data C _i fed back by the feedback line of the feedback loop When the ciphertext block data C _{i + 1} is not decrypted following the ciphertext block data C _i and is decrypted next to any ciphertext block data of the ciphertext D, the ciphertext block data C _{i + 1} is stored in the memory. And a selector for selecting the stored ciphertext block data C _i and supplying it to the feedback loop.

The above memory is
Multiple registers corresponding to multiple ciphertexts;
And a switch for switching a register corresponding to a ciphertext to be decrypted.

Decoding method according to the present invention includes the steps of decrypting the ciphertext block data C _i of the first ciphertext C using the decryption module (i = 1,2,3, ···),
After decrypting the middle or ciphertext block data C _i is decrypted and the ciphertext block data C _i, the ciphertext block data used for decoding the ciphertext block data C _{i + 1} of the first ciphertext C Storing C _i in memory;
Decrypting at least one ciphertext block data of the second ciphertext D after storing the ciphertext block data C _i used for decryption of the ciphertext block data C _{i + 1 in} a memory;
After decoding at least one ciphertext block data of the second ciphertext D, stored in the memory, enter the ciphertext block data C _i to be used in the decoding ciphertext block data C _{i + 1,} decoded And a step of decrypting the ciphertext block data C _{i + 1} of the first ciphertext C using a module.

The decryption device according to the present invention decrypts a ciphertext composed of one or more ciphertext block data into a plaintext and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext In
A first feedback loop that feeds back the module output block data T _i generated when the data is decrypted by the decryption module to the decryption module, the ciphertext block data is input, and the module output block data is input by the first feedback loop; It is fed back to T _i performs decoding processing, a decoding unit for outputting the plaintext block data,
It has a second feedback loop that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption unit, performs data processing, and outputs the intermediate result of the authenticator operation And an authenticator generation unit that feeds back an intermediate result of the authenticator operation by a second feedback loop and generates an authenticator for confirming the integrity of the ciphertext.

The decryption unit and the authenticator generation unit alternately perform a decryption process and an authenticator generation process by using one decryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the decryption process and the authenticator generation process, and
In order to alternately execute the decryption process and the authentication generation process, a selector is provided that alternately selects the result of the decryption process and the authenticator generation process from the memory and outputs the result to the decryption module.

The decryption method according to the present invention is a decryption method for decrypting a ciphertext composed of one or more ciphertext block data into a plaintext and generating an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext In
A first feedback step of feeding back the module output block data T _i generated when the data is decrypted by the decryption module to the decryption module, the ciphertext block data is input, and the module output block data is transmitted by the first feedback loop; It is fed back to T _i performs decoding processing, a decoding step of outputting the plaintext block data,
It has a second feedback step that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption step, performs data processing, and outputs the intermediate result of the authenticator operation The authenticator generation step of feeding back the result of the authenticator calculation in the second feedback step and generating the authenticator for confirming the integrity of the ciphertext is provided.

The encryption apparatus according to the present invention includes plaintext block data M _i (i = 1, 2, 3,...) Constituting the plaintext M and plaintext block data N _j (j = 1, 2, 3, ...) in an encryption device for encrypting
A mechanism for accepting a plaintext N encryption request before the plaintext M encryption process is completed during the plaintext M encryption process;
An encryption module for outputting data subjected to the encryption processing as the module output block data T _i,
A feedback loop for feeding back module output block data T _i output from the encryption module to the encryption module via a feedback line;
Provided in parallel with the feedback line of the feedback loop, accepting the plaintext N encryption request and starting the encryption processing of any plaintext block data of plaintext N, the plaintext block data M _{i + 1} becomes plaintext A memory for storing the module output block data T _i to be fed back if it is not encrypted following the block data M _i ;
When the plaintext block data M _{i + 1} is encrypted following the plaintext block data M _i , the module output block data T _i fed back by the feedback line of the feedback loop is selected and supplied to the feedback loop. When the plaintext block data M _{i + 1} is not encrypted after the plaintext block data M _i and is encrypted after any plaintext block data of the plaintext N, it is stored in the memory. And a selector for selecting the module output block data T _i and supplying it to the feedback loop.

The above memory is
Multiple registers for multiple plaintexts,
And a switch for switching a register corresponding to plain text to be encrypted.

The encryption method according to the present invention uses the module output block data T _i (i = 1, 2, 3,...) Output from the encryption module to use the plaintext block data M _i (1) of the first plaintext M. i = 1, 2, 3, ...),
After encrypting the middle or plaintext block data M _i is encrypted the plaintext block data M _i, the plaintext block data M _{i + 1} of the module used for encrypting the output block data T _i of the first plaintext M Storing in a memory;
Encrypting at least one plaintext block data of the second plaintext N after storing the module output block data T _i used for encryption of the plaintext block data M _{i + 1 in} a memory;
After encrypting at least one plaintext block data of the second plaintext N, the module output block data T _i used for encryption of the plaintext block data M _{i + 1} stored in the memory is input and encrypted. And a step of encrypting plaintext block data M _{i + 1} of the first plaintext M using a module.

The encryption apparatus according to the present invention is an encryption that generates plaintext consisting of one or more plaintext block data by using an encryption module and generates an authenticator for ensuring the integrity of the ciphertext. In the device
A first feedback loop that feeds back the module output block data T _i output from the encryption module to the encryption module when the plaintext block data is encrypted by the encryption module; An encryption unit that feeds back the module output block data T _i through the feedback loop and performs encryption processing, and outputs ciphertext block data;
It has a second feedback loop that feeds back the result of the authenticator calculation, inputs ciphertext block data every time ciphertext block data is output from the encryption unit, performs data processing, and uses the second feedback loop An authenticator generation unit that feeds back an intermediate result of the authenticator operation and generates an authenticator for guaranteeing the integrity of the ciphertext is provided.

The encryption unit and the authenticator generation unit alternately perform an encryption process and an authenticator generation process using one encryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the encryption process and the authenticator generation process, and
A selector that alternately selects the result of the encryption process and the authenticator generation process from the memory and outputs the result to the encryption module in order to alternately execute the encryption process and the authentication generation process; To do.

The encryption method according to the present invention is an encryption that generates plaintext consisting of one or more plaintext block data as ciphertext by an encryption module, and generates an authenticator for ensuring the integrity of the ciphertext for the ciphertext In the method
A first feedback step of feeding back the module output block data T _i output from the encryption module to the encryption module when the plaintext block data is encrypted by the encryption module; An encryption step of feeding back the module output block data T _i by the feedback loop and performing encryption processing to output ciphertext block data;
A second feedback step for feeding back an intermediate result of the authenticator operation, ciphertext block data is input every time ciphertext block data is output from the encryption step, data processing is performed, and the second feedback step An authenticator generation step of feeding back an intermediate result of the authenticator operation and generating an authenticator for ensuring the integrity of the ciphertext is provided.

In the decryption device according to the present invention, the ciphertext block data C _i (i = 1, 2, 3,...) Constituting the ciphertext C and the ciphertext block data D _j (j = 1) constituting the ciphertext D are provided. , 2, 3,...
A mechanism for accepting a decryption request for ciphertext D at any time during the decryption process for ciphertext C;
A decryption module for outputting the decrypted data as module output block data T _i ;
A feedback loop for feeding back module output block data T _i output from the decoding module to the decoding module via a feedback line;
The ciphertext block data C _{i + 1} is provided in parallel with the feedback line of the feedback loop, accepts a decryption request for the ciphertext D, and starts decryption processing of any ciphertext block data of the ciphertext D. Is not decrypted following the ciphertext block data C _i , a memory for storing the module output block data T _i to be fed back;
When the ciphertext block data C _{i + 1} is decrypted following the ciphertext block data C _i , the module output block data T _i fed back by the feedback line of the feedback loop is selected and supplied to the feedback loop. When the ciphertext block data C _{i + 1} is not decrypted following the ciphertext block data C _i and is decrypted next to any ciphertext block data of the ciphertext D, the ciphertext block data C _{i + 1} is stored in the memory. And a selector for selecting the stored module output block data T _i and supplying it to the feedback loop.

The above memory is
Multiple registers corresponding to multiple ciphertexts;
And a switch for switching a register corresponding to a ciphertext to be decrypted.

The decryption method according to the present invention uses the module output block data T _i (i = 1, 2, 3,...) Output from the decryption module to use the ciphertext block data C _i ( i = 1, 2, 3,...
After decrypting the middle or ciphertext block data C _i is decrypted and the ciphertext block data C _i, the module output block data used for decoding the ciphertext block data C _{i + 1} of the first ciphertext C Storing T _i in memory;
The module output block data T _i to be used in decoding the ciphertext block data C _{i + 1} after storing in the memory, the steps of decoding at least one ciphertext block data of the second ciphertext D,
After decrypting at least one ciphertext block data of the second ciphertext D, the module output block data T _i used for decryption of the ciphertext block data C _{i + 1} stored in the memory is inputted and decrypted. And a step of decrypting the ciphertext block data C _{i + 1} of the first ciphertext C using a module.

The decryption device according to the present invention decrypts a ciphertext composed of one or more ciphertext block data into a plaintext by a decryption unit, and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext In the decoding device
Having a first feedback loop for feeding back the ciphertext block data C _i to the decrypting unit receives the ciphertext block data, performs decoding processing by feeding back the ciphertext block data C _i by the first feedback loop, the plaintext A decoding unit for outputting block data;
It has a second feedback loop that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption unit, performs data processing, and outputs the intermediate result of the authenticator operation And an authenticator generation unit that feeds back an intermediate result of the authenticator operation by a second feedback loop and generates an authenticator for confirming the integrity of the ciphertext.

The decryption unit and the authenticator generation unit alternately perform a decryption process and an authenticator generation process using one decryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the decryption process and the authenticator generation process, and
In order to alternately execute the decryption process and the authentication generation process, a selector is provided that alternately selects the result of the decryption process and the authenticator generation process from the memory and outputs the result to the decryption module.

The decryption method according to the present invention decrypts a ciphertext composed of one or more ciphertext block data into a plaintext by a decryption unit, and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext In the decoding method to
A first feedback step of feeding back the ciphertext block data C _i to the decryption unit, the ciphertext block data is input, the ciphertext block data C _i is fed back by the first feedback loop, and decryption processing is performed; A decoding step of outputting block data;
It has a second feedback step that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption step, performs data processing, and outputs the intermediate result of the authenticator operation The authenticator generation step of feeding back the result of the authenticator calculation in the second feedback step and generating the authenticator for confirming the integrity of the ciphertext is provided.

  The encryption process uses a block encryption algorithm.

  The decryption process uses a block cipher algorithm.

The above memory is the state of encryption processing,
A result of encryption of the first processing data;
An encryption key used for encrypting the first processing data is stored.

The above memory is the state of the decryption process.
A result of decoding the second processing data;
A decryption key used for decrypting the second processing data is stored.

An encryption device according to the present invention includes an encryption unit that inputs and encrypts data and outputs encrypted data;
An authenticator generating unit that inputs the encrypted data output by the encryption unit and generates an authenticator for ensuring the integrity of the ciphertext;
The authenticator generation unit is characterized in that generation of an authenticator is started before data encryption by the encryption unit is completed.

A decoding apparatus according to the present invention includes a decoding unit that inputs and decodes data and outputs decoded data;
An authenticator generation unit that inputs the data input by the decryption unit and generates an authenticator for ensuring the integrity of the ciphertext;
The authenticator generation unit is characterized in that generation of an authenticator is started before the decryption of data by the decryption unit is completed.

The encryption method according to the present invention includes an encryption step of inputting and encrypting data and outputting the encrypted data;
An authenticator generation step for generating an authenticator for inputting the encrypted data output by the encryption step and ensuring the integrity of the ciphertext;
The authenticator generation step is characterized in that generation of an authenticator is started before data encryption by the encryption step is completed.

The decoding method according to the present invention includes a decoding step of inputting and decoding data and outputting decoded data;
An authenticator generation step for generating an authenticator for inputting the data input by the decryption step and guaranteeing the integrity of the ciphertext;
The authenticator generation step is characterized in that generation of an authenticator is started before the decryption of data by the decryption step is completed.

  Further, the present invention is a program for causing a computer to execute processing of each unit of the encryption device and processing of each step of the encryption method. Further, it is a computer-readable recording medium that records the program.

  In addition, the present invention is a program for causing a computer to execute processing of each unit of the decoding device and each step of the decoding method. Further, it is a computer-readable recording medium that records the program.

  As described above, according to the preferred embodiment of the present invention, encryption of plaintext N can be started in the middle of encryption of plaintext M. Further, the decryption of another ciphertext D can be started during the decryption of the ciphertext C.

  According to a preferred embodiment of the present invention, data to be encrypted / decrypted by assigning priorities can be processed at high speed based on the priorities.

  In addition, according to a preferred embodiment of the present invention, high-speed processing can be performed by performing parallel processing of concealment processing and integrity assurance processing. Further, the concealment process and the integrity guarantee process can be performed by a single piece of integrated hardware.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a CBC mode encryption apparatus according to this embodiment.

The encryption apparatus according to this embodiment includes a selector 54, an exclusive OR circuit 58, an encryption module 51 using an encryption key K, and a memory 55. The exclusive OR circuit 58 and the encryption module 51 using the encryption key K constitute an encryption unit 52. The encryption module 51 using the selector 54, the exclusive OR circuit 58, and the encryption key K forms a feedback loop by the feedback line 65, the feedback line 66, and the feedback line 67. The ciphertext block data C _i encrypted by the encryption module 51 using the encryption key K is input again to the exclusive OR circuit 58 by the feedback loop, and the module input data S _i is changed by the exclusive OR circuit 58. Generated. Then, the generated module input data S _i is supplied to the encryption module 51 using the encryption key K.

The memory 55 is provided in parallel with the feedback line 65. The memory 55 includes a register 56 and a switch 57. The switch 57 switches whether the output of the encryption module 51 using the encryption key K is input to the register 56 or ignored. This switching is performed by an interrupt IT, for example. When the interrupt IT is generated, the switch 57 is connected to E, and when the interrupt IT is released, the switch 57 is connected to F. The register 56 inputs and stores the ciphertext block data C _i that has passed through E. The ciphertext block data C _i stored in the register 56 is output to the selector 54. The selector 54 has three inputs A, B, and C, and selects one of the inputs. These selections depend on the interrupt IT as described later.

  FIG. 2 is a diagram showing an operation procedure of the encryption apparatus shown in FIG.

  FIG. 3 is an operation flowchart of the encryption apparatus shown in FIG.

It is assumed that the input of the selector 54 when this encryption apparatus is turned on is set to A, and the switch 57 is connected to E. When there is a plaintext N encryption request, an interrupt IT is generated, and the interrupt IT is kept on until the plaintext N encryption request is canceled. Also, it is assumed that the plaintext M is encrypted using the key K ₁ and the plaintext N is encrypted using the key K ₂ . Also, when the interrupt IT is generated or the interrupt IT is canceled, the key K ₂ or the key K ₁ is re-supplied to the encryption module 51.

At time T0, the key K ₁ is supplied, and the encryption processing of the plaintext block data M ₁ starts. At time T0, when the encryption of the plaintext block data M ₁ is started, after the initial value IV is input once from the input A of the selector 54, the selector 54 is switched to B. Then, it is assumed that an interrupt IT requesting encryption of the plaintext block data N ₁ occurs at a time X in the middle of the plaintext block data M ₁ being encrypted using the key K ₁ . By time T1, the ciphertext block data C ₁ is stored in the memory 55. Then, the key K ₂ is supplied to the encryption module 51 at time T1 due to the generation of the interrupt IT. At time T1, the selector 54 sets the input to A. At time T1, the switch 57 is connected to F. After time T1, the plaintext block data N ₁ is encrypted using the key K ₂ and ciphertext block data D ₁ is output. It is assumed that at time Y, the plaintext block data N ₁ has been encrypted and the interrupt IT has been released. By releasing this interrupt IT, the key K ₁ is supplied to the encryption module 51 at time T2, the input of the selector 54 is switched to C, and the switch 57 is connected to E. When the selector 54 is switched to C, the ciphertext block data C ₁ stored in the memory 55 is input for encryption of the plaintext block data M ₂ , and the plaintext is transmitted by the encryption module 51 using the key K _1. Block data M ₂ is encrypted, and ciphertext block data C ₂ is output. At time T3 before the input of the selector 54 is switched to B, and when encrypting plaintext block data M ₃ are, the ciphertext block data C ₂ fed back from the feedback line 65 of the feedback loop is input, the key The plaintext block data M _{3 is} encrypted by the encryption module 51 using K ₁ and the ciphertext block data C ₃ is output.

When the plaintext M and the plaintext N have the same key (K ₁ = K ₂ ), the key only needs to be supplied once at the start of the encryption process.

  The overall operation will be described with reference to the flowchart of FIG.

In S1, the plaintext M encryption process starts and continues. When the process is completed up to the last block data, the process is terminated. In S2, the occurrence of an interrupt IT that occurs at an arbitrary time is monitored. If no interrupt IT is generated, the process of S1 is continued. When the interrupt IT is generated during the processing of the plaintext block data M _i, at S3, stores the ciphertext block data C _i plaintext block data M _i currently being processed in the register 56 of the memory 55. In S4, the plaintext N encryption process requested by the interruption IT is performed. The encryption process in S4 is continuously performed until the interrupt IT is released as shown in S5. If the interrupt IT is released, encryption processing of M _{i + 1} is performed using the ciphertext block data C _i stored in the register 56 of the memory 55 in S6. The subsequent processing returns to S1, and the encryption processing is continued.

  FIG. 4 is a diagram showing an operation process of the selector 54.

When the power is turned on, the input is set to A as shown in S11. If encryption starts in S12, the input is set to B in S13. That is, the ciphertext block data C _i fed back by the feedback line 65 of the feedback loop is used. If it is determined in S14 that the block data currently being processed is the last, the process returns to S11 and returns to the same state as when the power is turned on. If it is confirmed in S15 that an interrupt IT has occurred, the input is set to A in S16, and if the encryption is started, the input is set to B in S18. The operation is performed with the input set to B until the interrupt IT is released. That is, the ciphertext block data C _i fed back by the feedback line 65 of the feedback loop is used. If it is detected in S19 that the interrupt IT has been released, the input is set to C in S20. By setting this input to C, the ciphertext block data C _i stored in the memory 55 is input. When the encryption by the input from C starts, the process returns to S13 and the input is set to B.

  In this way, the selector 54 can be switched based on the occurrence of the interrupt IT.

  The plaintext M encryption process may also be started at an arbitrary time by the interrupt IT.

  FIG. 5 is a flowchart of the interrupt process of the switch 57.

The switch 57 is connected to E when the power is turned on and for the first plaintext encryption process thereafter. In S31, if an interrupt IT occurs, the switch 57 is connected from E to F. If the release of the interrupt IT is detected in S33, the switch 57 is connected from F to E. In this manner, the switch 57 ignores the ciphertext block data C _i from the generation to the cancellation of the interrupt IT. Accordingly, the ciphertext block data C _i generated when the interrupt IT occurs is continuously stored in the register 56 of the memory 55.

As described above, the encryption apparatus shown in FIG. 1 to FIG. 5 has the plaintext block data M _i (i = 1, 2, 3,...) Constituting the plaintext M and the plaintext block data constituting the plaintext N. In the encryption apparatus that encrypts N _j (j = 1, 2, 3,...), The plaintext N encryption request is accepted before the plaintext M encryption process is completed during the plaintext M encryption process. The interrupt handling mechanism is shown.

Further, the encryption apparatus shown in Figures 1-5, performs an encryption process of the plaintext block data M _i, the cryptographic module 51 for outputting the ciphertext block data C _i, which is output from the encrypting module 51 Feedback loops 65 and 66 for feeding back the ciphertext block data C _i to the encryption unit 52 via the feedback line 65 and the feedback line 65 of the feedback loop are provided in parallel. When the plaintext block data M _{i + 1} is not encrypted following the plaintext block data M _i by accepting and starting encryption processing of any plaintext block data of the plaintext N, the ciphertext to be fed back And a memory 55 for storing the block data C _i .

1 to 5, when the plaintext block data M _{i + 1} is encrypted after the plaintext block data M _i , it is fed back by the feedback line 65 of the feedback loop. The ciphertext block data C _i is selected and supplied to the encryption unit 52 through the feedback loop, and the plaintext block data M _{i + 1} is not encrypted following the plaintext block data M _i , and the plaintext N Is selected next to the plaintext block data, the selector 54 selects the ciphertext block data C _i stored in the memory 55 and supplies it to the encryption unit 52 via the feedback loop. is doing.

  The memory 55 is a memory that stores the state of the encryption device when the interrupt IT occurs. Since the memory 55 stores the state of encryption processing, even when other data is encrypted during encryption of certain data, the processing can return to the encryption processing of certain data again. it can. That is, by using the data stored in the memory 55, the encryption device can be returned to the same state as when the encryption is interrupted, and the interrupted encryption process can be continued.

  FIG. 6 is a diagram illustrating another example of the memory 55.

  The memory 55 includes an interrupt control unit 52, an input switch 96, an output switch 97, and a plurality of registers (REG1, 2, 3). Thus, by having a plurality of registers, it is possible to accept a plurality of interrupts.

  FIG. 7 is a diagram illustrating an interrupt processing operation of the memory 55.

  When the interrupt IT occurs, the number k of the register k currently in use is stored in S41. In S42, the input switch 96 and the output switch 97 are connected to the register 1 other than the register k. In this state, encryption of plaintext N is continued. Further, it is monitored whether another interrupt has occurred during the plaintext N encryption. If it is detected in S43 that another interrupt IT has occurred, the process of S40 that is itself is called again. In this way, each time an interrupt IT is generated, it is possible to perform interrupt processing of a plurality of layers by calling itself S40 recursively. In S44, it is detected whether the interrupt is released. If the interrupt is released, the input switch 96 and the output switch 97 are switched to the register k using the number k stored. In the case shown in FIG. 6, since there are three registers, three layers of interrupt processing can be performed.

  FIG. 8 is a diagram illustrating another example of the memory 55.

  The memory 55 has a stack 64. The stack 64 is a first-in last-out (FILO) register. When an interrupt IT occurs while using the stack 1, the data of the stack 1 is moved to the stack 2, and the subsequent data is stacked on the stack 1, and when the interrupt IT is released, the stack 1 Data is output, and the data in stack 2 is returned to stack 1. The case shown in FIG. 8 shows a case where four levels of interrupt processing can be performed.

  As shown in FIG. 6, when multiple levels of interrupt processing can be performed, priority can be given to each interrupt. For example, by setting interrupt IT1 to priority level 1 and interrupt IT2 to priority level 2 which is lower than priority level 1, if priority level 1 interrupt IT1 occurs, processing of priority level 2 is delayed. Can do.

  FIG. 9 shows a case where priority level 1 encryption processing is prioritized over priority level 2 encryption processing. The encryption process with priority 1 is terminated first.

  FIG. 10 shows a case of encryption processing in which both priorities are equal.

  When the priorities are equal, the block data of the two plaintexts are alternately encrypted.

  FIG. 11 shows a case where priority level 1 data and two priority level 2 data are encrypted.

  As shown in FIGS. 9 to 11, it is possible to realize an encryption processing procedure that is considered desirable by the user by giving priority to interrupts. In the case of urgent data or short data, efficient processing can be performed by increasing the priority.

  FIG. 12 shows the case where the memory 55 is placed in parallel with the feedback line 66.

  The exclusive OR circuit 58 and the encryption module 51 using the encryption key K constitute an encryption unit 52.

  FIG. 13 is a diagram showing an operation procedure of the encryption apparatus of FIG.

  The first selector 61 and the second selector 62 perform the same selection operation as the selector 54 of FIG. 1 by the following selective connection.

First selector 61 + second selector 62 = selector 54
A + D = A
B + D = B
A + C = C
B + C = C
In FIG. 13, when the second selector 62 selects D, the selection (A or B) of the first selector 61 is valid, and when the second selector 62 selects C, The contents of the memory 55 are output. That is, the second selector 62 may select C when it is desired to use the contents of the memory 55 (when the interrupt IT is released and the encryption returns from the plaintext N to the original plaintext M).

  FIG. 14 shows a case where the memory 55 is placed in parallel with the feedback line 67.

  FIG. 15 is a diagram showing an operation procedure of the encryption apparatus of FIG.

When the time X when the interrupt IT occurs is before the exclusive OR operation is performed by the exclusive OR circuit 58, the memory 55 stores the module input data obtained by performing the exclusive OR operation by the exclusive OR circuit 58. S _i is stored. Then, the plaintext block data N ₁ is encrypted. Next, the module input data S _i stored in the memory 55 is selected by the second selector 62, input to the encryption module 51 using the encryption key K, encrypted, and the ciphertext block data C ₁ is output.

  As shown in FIGS. 1, 12, and 14, the memory 55 may be provided in parallel with any of the feedback line 65, the feedback line 66, and the feedback line 67. The memory 55 remembers the state immediately before starting encryption of other data when the encryption device starts encryption of other data during encryption processing of certain data. If the encryption apparatus can be restored to the original state using the data stored in the memory 55 when the data encryption process is completed, the memory 55 may be provided in any location. The memory 55 may be provided at a plurality of locations.

As described above, the encryption apparatus according to this embodiment has the first processing data (plain text M) composed of one or more block data M _i (i = 1, 2, 3,..., M). In the encryption device that performs encryption processing with the second processing data (plain text N) composed of one or more block data N _j (j = 1, 2, 3,..., N) A memory 55 for storing the processing state is provided, and the encryption of the first block data N ₁ of the second processing data is completed before the encryption processing of all the block data (M _{1 to} M _m ) of the first processing data is completed. When the encryption process is started and the encryption process of the first block data N ₁ of the second process data is started, the state of the encryption process of the first process data (for example, the encrypted block data C _i ) is changed. Store in the memory 55 and re-encrypt the first process data. When the encryption processing of the encryption device is restored to the state of the encryption processing of the first processing data stored in the memory, the encryption processing of the first processing data is resumed. Features.

The encryption device resumes the encryption processing of the first processing data before the encryption processing of all the block data (N _{1 to} N _n ) of the second processing data is completed, and the memory 55 When the encryption process of the first process data is resumed, the encryption process state of the second process data (for example, the encrypted block data D _j ) is stored, and the encryption process of the second process data is resumed In this case, the encryption processing of the second processing data is resumed after the encryption processing state of the encryption device is returned to the encryption processing state of the second processing data stored in the memory. And

  FIG. 16 is a block diagram of an OFB mode encryption apparatus.

Compared to FIG. 45, a feature is that a memory 55 is added. The memory 55 stores module output data T ₁ output from the encryption module 51.

FIG. 16 shows plaintext block data M _i (i = 1, 2, 3,...) Constituting plaintext M and plaintext block data N _j (j = 1, 2, 3,...) Constituting plaintext N. ) And an interrupt processing mechanism that accepts a plaintext N encryption request before the plaintext M encryption process is completed during the plaintext M encryption process, and a module for processing the encrypted data. an encryption module 51 for outputting as output block data T _i, feedback loops 65 and 66 is fed back to the encryption module via a feedback line 65 the output modules output block data T _i from the cryptographic module 51, the feedback loop It is provided in parallel with the feedback line 65, accepts the above plaintext N encryption request, and receives any plaintext block of plaintext N. When the plaintext block data M _{i + 1} is not encrypted after the plaintext block data M _i , the memory 55 for storing the module output block data T _i to be fed back is started. When the plaintext block data M _{i + 1} is encrypted following the plaintext block data M _i , the module output block data T _i fed back by the feedback line 65 of the feedback loop is selected and the feedback loop is executed. The plaintext block data M _{i + 1} is not encrypted after the plaintext block data M _i and is encrypted after any plaintext block data of the plaintext N. If the feed select the module output block data T _i stored in the memory 55 Via Kkurupu it is characterized in that a selector 54 is supplied to the encryption module 51.

  FIG. 17 is an explanatory diagram of the operation of the OFB mode encryption apparatus of FIG.

  In FIG. 17, the operation in the CBC mode in FIG. 2 is changed to the operation in the OFB mode, and other operations are the same as those in FIG.

  FIG. 18 is a diagram illustrating a CFB mode encryption apparatus.

47 is characterized in that a memory 55 is provided. The memory 55 stores the ciphertext block data C _i output from the exclusive OR circuit 58.

  The exclusive OR circuit 58 and the encryption module 51 using the encryption key K constitute an encryption unit 52.

FIG. 18 shows plaintext block data M _i (i = 1, 2, 3,...) Constituting plaintext M and plaintext block data N _j (j = 1, 2, 3,...) Constituting plaintext N. in) the encryption apparatus for encrypting, and interrupt handling mechanism for accepting a encryption request of the plaintext N during encrypting process of the plaintext M before encryption processing completion of the plaintext M, encryption of the plaintext block data M _i an encryption unit 52 for outputting the ciphertext block data C _i performs a feedback loop 65 and 66 is fed back to the encrypting process via a feedback line 65 the ciphertext block data C _i output from the encryption module, a feedback A parallel loop feedback line 65 is provided to accept the plaintext N encryption request and encrypt any plaintext block data in plaintext N. By starting, if the plaintext block data M _{i + 1} is not encrypted subsequent to the next plaintext block data M _i, and a memory 55 for storing the ciphertext block data C _i fed back, the plaintext block data M _{When i + 1} is encrypted following the plaintext block data M _i , the ciphertext block data C _i fed back by the feedback line 65 of the feedback loop is selected and the encryption unit is passed through the feedback loop. When the plaintext block data M _{i + 1} is not encrypted after the plaintext block data M _i and is encrypted after any plaintext block data of the plaintext N, the memory select ciphertext block data C _i stored in the 55 supplied to the enciphering unit 52 via a feedback loop Characterized in that a that the selector 54.

  FIG. 19 is an explanatory diagram of the operation of the CFB mode encryption apparatus of FIG.

  FIG. 19 shows the operation of the CBC mode in FIG. 2 changed to the operation of the CFB mode, and the other operations are the same as those in FIG.

  FIG. 20 shows a CBC mode decoding apparatus.

  Compared to FIG. 44, a feature is that a memory 75 is provided.

  The memory 75 includes a register 76 and a switch 77.

  In addition, a decryption unit 72 is configured by the exclusive OR circuit 78 and the decryption module 71 using the key K.

  Note that the register 111 may be provided inside the selector 74.

The decryption apparatus shown in FIG. 20 includes ciphertext block data C _i (i = 1, 2, 3,...) Constituting ciphertext C and ciphertext block data N _j (j = 1) constituting ciphertext D. , 2, 3,...) Has an interrupt processing mechanism that accepts a decryption request for ciphertext D at any time during decryption processing for ciphertext C.

Further, the decoding apparatus shown in FIG. 20, a decoding module 71 for outputting the data subjected to the decoding processing of the ciphertext block data C _i as module output block data T _i, for decrypting ciphertext block data C _{i + 1} the feedback loop 85,111,82,86 be fed back to the ciphertext block data C _i decoding unit via a feedback line 85,111,82 72, provided in parallel with the feedback line 85,111,82 of the feedback loop, By accepting the decryption request for the ciphertext D and starting the decryption process for any ciphertext block data of the ciphertext D, the ciphertext block data C _{i + 1} continues to the ciphertext block data C _i. Memory 71 for storing the block data to be fed back Have.

Further, the decoding apparatus shown in FIG. 20, when the ciphertext block data C _{i + 1} is decoded following the next ciphertext block data C _i, fed back by the feedback line 85,111,82 of the feedback loop Ciphertext block data C _i is selected and supplied to the cipher unit 72 via a feedback loop, and the ciphertext block data C _{i + 1} is not decrypted following the ciphertext block data C _i , A selector 74 that selects the ciphertext block data C _i stored in the memory and supplies the ciphertext block data C _i to the cipher unit 72 via a feedback loop when decrypted next to any ciphertext block data of D; Yes.

In the description of FIG. 20 described above, the terms “feedback line” and “feedback loop” are used, but they are not “feedback” in the sense of “making their own output their own input”. Here, the term "feedback", after decrypting the ciphertext block data C _i, in order to decode the ciphertext block data C _{i + 1,} which is used in the sense that once again supplying the ciphertext block data C _i And

  FIG. 21 is a diagram showing an operation procedure of the decoding device of FIG.

If an interrupt IT occurs while the ciphertext block data C ₁ is being decrypted using the cipher key (also referred to as a decryption key) K ₁ , the ciphertext block data C ₁ is stored in the register of the memory 75. 76 is stored. Thereafter, the ciphertext block data D ₁ is decrypted using the encryption key (also referred to as a decryption key) K ₂ , and the plaintext block data N ₁ is decrypted. Then, the ciphertext block data C ₁ stored in the register 76 of the memory 75 is read, the ciphertext block data C ₂ is decrypted, and the plaintext block data M ₂ is decrypted. The operation of the selector 74 is the same as that shown in FIG. The operation of the switch 77 is the same as that shown in FIG.

  FIG. 22 is a diagram illustrating an OFB mode decoding apparatus.

FIG. 22 shows ciphertext block data C _i (i = 1, 2, 3,...) Constituting the ciphertext C and ciphertext block data D _j (j = 1, 2, 3) constituting the ciphertext D. ,...), An interrupt processing mechanism that accepts a decryption request for ciphertext D at any time during decryption processing of ciphertext C, and module output block data T _In parallel with the decoding module 71 output as _i , the feedback loops 85 and 86 for feeding back the module output block data T _i output from the decoding module 71 to the decoding module 71 via the feedback line 85, and the feedback line 85 of the feedback loop. Provided, accepts a decryption request for the ciphertext D, and When the ciphertext block data C _{i + 1} is not decrypted after the ciphertext block data C _i by starting the decryption process, a memory 75 for storing the module output block data T _i to be fed back, and a cipher When the text block data C _{i + 1} is decrypted subsequent to the cipher text block data C _i , the module output block data T _i fed back by the feedback line 85 of the feedback loop is selected and passed through the feedback loop. Is supplied to the decryption module 71, and the ciphertext block data C _{i + 1} is not decrypted following the ciphertext block data C _i but decrypted next to any ciphertext block data of the ciphertext D. If selects the module output block data T _i stored in the memory 75 Feedback Characterized in that a selector 74 is supplied to the decoding module 71 through the-loop.

  FIG. 23 is an explanatory diagram of the operation of the OFB mode encryption apparatus of FIG.

  In FIG. 23, the operation in the CBC mode in FIG. 21 is changed to the operation in the OFB mode, and the other operations are the same as those in FIG.

  FIG. 24 is a diagram illustrating a CFB mode decoding apparatus.

  In addition, a decryption unit 72 is configured by the exclusive OR circuit 78 and the decryption module 71 using the key K.

  Note that the register 111 may be provided inside the selector 74.

FIG. 24 shows ciphertext block data C _i (i = 1, 2, 3,...) Constituting the ciphertext C and ciphertext block data D _j (j = 1, 2, 3) constituting the ciphertext D. , ...) and in the decoding apparatus for decoding, and the interrupt handling mechanism for accepting at any time the decryption request ciphertext D during decrypting process of the ciphertext C, was carried out a decoding process of the ciphertext block data C _i Feedback data and decoding module 71 for outputting the module output block data T _i, the decoding unit 72 via the feedback line 85,111,82 of the ciphertext block data C _i for decrypting the ciphertext block data C _{i + 1} Provided in parallel with the feedback loops 85, 111, 82, 86 and the feedback lines 85, 111, 82 of the feedback loop, By accepting a decryption request for D and starting decryption processing for any ciphertext block data in ciphertext D, the ciphertext block data C _{i + 1} is not decrypted following ciphertext block data C _i. The ciphertext block data C _i to be fed back, and when the ciphertext block data C _{i + 1} is decrypted following the ciphertext block data C _i , the feedback line of the feedback loop The ciphertext block data C _i fed back by 85, 111, 82 is selected and supplied to the decryption module 71 via a feedback loop, and the ciphertext block data C _{i + 1} is next to the ciphertext block data C _i . In the case where decryption is not performed continuously and decrypted next to any ciphertext block data of the ciphertext D, the data is stored in the memory 75. And a selector 74 that selects the stored ciphertext block data C _i and supplies it to the decryption module 71 via a feedback loop.

In the description of FIG. 24 described above, the terms “feedback line” and “feedback loop” are used, but they are not “feedback” in the sense of “making their own output their own input”. Here, the term "feedback", after decrypting the ciphertext block data C _i, in order to decode the ciphertext block data C _{i + 1,} which is used in the sense that once again supplying the ciphertext block data C _i And

  FIG. 25 is a diagram for explaining the operation of the CFB mode encryption apparatus of FIG.

  In FIG. 25, the operation in the CBC mode in FIG. 21 is changed to the operation in the CFB mode, and other operations are the same as those in FIG.

  FIG. 26 is a diagram showing an improved example of the CBC mode encryption apparatus shown in FIG.

In the encryption apparatus of FIG. 26, a selector 154 and a memory 155 are added. In the case of FIG. 1, the case where the key K ₁ is supplied from the outside when the interrupt IT is canceled is shown, but here, the case where the key K ₁ once supplied from the outside is stored and reused will be described. .

  The memory 155 includes a register 156 and a switch 157. The switch 157 switches whether the encryption key K is input to the register 156 or ignored. This switching is performed by an interrupt IT, for example. When the interrupt IT is generated, the switch 157 is connected to E, and when the interrupt IT is released, the switch 157 is connected to F. The register 156 inputs and stores the key K that has passed through E. The key K stored in the register 156 is output to the selector 154. The selector 154 has two inputs A and C, and selects one of the inputs. These selections depend on the interrupt IT as described later.

  FIG. 27 is a diagram showing an operation procedure of the encryption apparatus shown in FIG.

Assume that the inputs of the selector 54 and the selector 154 when the encryption apparatus is turned on are set to A, and the switches 57 and 157 are connected to E. When there is a plaintext N encryption request, an interrupt IT is generated, and the interrupt IT is kept on until the plaintext N encryption request is canceled. Also, it is assumed that the plaintext M is encrypted using the key K ₁ and the plaintext N is encrypted using the key K ₂ . It is assumed that the key K ₁ or the key K ₂ is supplied to the encryption module 51.

At time T0, the key K ₁ is paid from the outside as the key KI. Since the selector 154 is connected to A, the selector 154 outputs the key KI as the key K to the encryption module 51. Since the switch 157 is connected to E, the key K ₁ is stored in the register 156. Then, the encryption process of the plaintext block data M ₁ is started. At time T0, when the encryption of the plaintext block data M ₁ is started, after the initial value IV is input once from the input A of the selector 54, the selector 54 is switched to B. Then, it is assumed that an interrupt IT requesting encryption of the plaintext block data N ₁ occurs at a time X in the middle of the plaintext block data M ₁ being encrypted using the key K ₁ . By time T1, the ciphertext block data C ₁ is stored in the memory 55. Then, at time T1 by the occurrence of an interrupt IT, the key K ₂ is paid from the outside as the key KI encryption module 51. Since the selector 154 is connected to A, the selector 154 outputs the key KI as the key K to the encryption module 51. At time T1, the selector 54 sets the input to A. At time T1, the switch 57 and the switch 157 are connected to F. Therefore, the key K ₂ is not stored in the register 156. After time T1, the plaintext block data N ₁ is encrypted using the key K ₂ and ciphertext block data D ₁ is output. It is assumed that at time Y, the plaintext block data N ₁ has been encrypted and the interrupt IT has been released. By canceling the interrupt IT, the input of the selector 54 is switched to C at time T2, and the switch 57 is connected to E. Accordingly, the key K ₁ is output from the register 156 to the selector 154 as the key KI, and the key K ₁ is supplied from the selector 154 to the encryption module 51 as the key K. Further, when the selector 54 is switched to C, the ciphertext block data C ₁ stored in the memory 55 is input for encrypting the plaintext block data M ₂ , and the encryption module 51 using the key K ₁ is used. As a result, the plaintext block data M ₂ is encrypted, and the ciphertext block data C ₂ is output. At time T3 before the input of the selector 54 is switched to B, and when encrypting plaintext block data M ₃ are, the ciphertext block data C ₂ fed back from the feedback line 65 of the feedback loop is input, the key plaintext block data M ₃ by the encrypting module 51 using the K ₁ is encrypted, is output ciphertext block data C _3.

  Prior to time T3, the input of the selector 154 is switched to A.

  The operation process of the selector 154 will be described.

When the power is turned on, the input is set to A. Further, even when the occurrence of the interrupt IT is confirmed, the input is continuously set to A. The selector 154 operates with the input set to A until the interrupt IT is released. The selector 154 sets the input to C when it is detected that the interrupt IT has been released. By setting this input to C, the key K ₁ stored in the memory 55 is input to the encryption module 51 as the key K. When the encryption by the key input from C starts, the selector 154 sets the input to A.

  In this way, the selector 154 can be switched based on the occurrence of the interrupt IT.

  Next, the interrupt processing operation of the switch 157 will be described.

When the power is turned on, and in the first plaintext M encryption process thereafter, the switch 157 is connected to E and the plaintext M key K ₁ is stored in the register 156. If an interrupt IT occurs at time X, the switch 157 is connected from E to F at time T ₁ , and the plaintext N key K ₂ is ignored. If release of the interrupt IT is detected at time Y, the switch 157 is connected from F to E at time T2. In this way, the switch 157 ignores the plaintext N key K ₂ from the generation to the cancellation of the interrupt IT. Accordingly, the plaintext M key K ₁ continues to be stored in the register 156 of the memory 155.

FIG. 28 shows a configuration when the key K ₁ is stored and reused in the decryption apparatus shown in FIG.

  FIG. 28 is obtained by adding a selector 174 and a memory 175 to FIG. The operations of the selector 174 and the memory 175 are the same as those of the selector 154 and the memory 155 shown in FIG.

  The memory 55 and the memory 155 are an example of a memory that stores the state of the encryption device when the interrupt IT occurs. As described above, the memory 55 and the memory 155 store the state of the encryption process, so that even when another data is encrypted during the encryption of a certain data, the encryption of the certain data is performed again. It is possible to return to processing. That is, by using the data stored in the memory 55 and the key K stored in the memory 155, the encryption device can be restored to the same state as when the encryption was interrupted, and the interrupted encryption Processing can be continued.

Note that the memory 155 and the memory 175 may have the same configuration as the memory 55 shown in FIGS. Although not shown, the key K ₁ may be stored by adding the configuration shown in FIGS. 26 and 28 to FIGS. 16, 18, 22, and 24.

  Further, since the memory 55 and the memory 155 in FIG. 26 operate in the same manner, they may be integrated into one memory. Further, since the memory 75 and the memory 175 of FIG. 28 operate in the same manner, they may be integrated into one memory.

As described above, the decryption apparatus according to this embodiment has the first processing data (ciphertext C) composed of one or more block data C _i (i = 1, 2, 3,..., M). And a decryption device that decrypts the second processing data (ciphertext D) composed of one or more block data D _j (j = 1, 2, 3,..., N). A memory 75 for storing the state is provided, and the decoding process of the first block data D ₁ of the second processing data is started before the decoding processing of all the block data (C _{1 to} C _m ) of the first processing data is completed. In addition, when the decoding process of the first block data D ₁ of the second processing data is started, the state of the decoding process of the first processing data is stored in the memory, and the decoding process of the first processing data is resumed. The state of the decoding process of the decoding device is stored in the memory The decoding processing of the first processing data is resumed after the state is restored to the state of the decoding processing of the first processing data.

The decoding apparatus resumes the decoding process of the first process data before the decoding process of all the block data (D _{1 to} D _n ) of the second process data is completed, and the memory 74 The state of the decoding process of the second process data is stored when the decoding process of the first process data is restarted, and the state of the decoding process of the decoding device is stored in the memory when the decoding process of the second process data is restarted The decoding process of the second process data is resumed after returning to the state of the decoding process of the stored second process data.

Here, the state of the encryption process is, for example,
In the CBC mode of FIG. 1, the encrypted block data C _i (and key K ₁ )
In the OFB mode of FIG. 16, module output data T _i (and key K ₁ )
In the CFB mode of FIG. 18, the encrypted block data C _i (and key K ₁ )
In addition, the state of the decoding process is, for example,
In the CBC mode of FIG. 20, the encrypted block data C _i (and key K ₁ )
In the OFB mode of FIG. 22, module output data T _i (and key K ₁ )
In the CFB mode of FIG. 24, the encrypted block data C _i (and key K ₁ )
That is.

In the above description, the encryption device and the decryption device in the case of the three modes have been described. However, the above three modes are examples, and these modes are improved or these modes are modified. It may be a thing. In particular, the feature is that the block data C _i or M _i or T _i generated when the previous block data is encrypted or decrypted is the encryption of the next block data M _{i + 1} or C _{i + 1} . In an encryption / decryption method used as feedback data for decryption processing, a memory 55 for storing the state of encryption / decryption is provided, and block data C _i, M _i, or T _i is used after encryption / decryption processing of other data. It is possible to return to the original state again. Therefore, the encryption mode and the decryption mode are not particularly limited.

  Note that, instead of using the interrupt IT, an encryption request may be received using another mechanism such as a polling method or a token acquisition method, and interactive parallel processing of two or more encryption / decryption processes may be performed.

  Further, although the case of the encryption / decryption process using the encryption key K has been shown, the case of the encryption / decryption process not using the encryption key K may be used.

Embodiment 2. FIG.
In this embodiment, a case will be described in which the encryption apparatus performs a concealment process and a data integrity guarantee process.

  The data concealment process is to encrypt data so that the meaning is not understood even if the data is wiretapped or stolen. The data integrity guarantee means that data is not replaced by anyone. When data is transmitted, there is a case where it is desired to perform data concealment processing and guarantee data integrity. The data concealment process is performed by encrypting the data. The data integrity guarantee process is performed by adding an authenticator (MAC: Message Authentication Code) to the end of the data and verifying the authenticator to find falsification.

  FIG. 29 shows a case where the encryption process is performed by the encryption unit 100 in the OFB mode and the authentication code (MAC) is generated by the authentication code generation unit 200 in the CBC mode.

FIG. 29 shows a plaintext in an encryption device that generates plaintext composed of one or more plaintext block data by the encryption module 51 and generates an authenticator for guaranteeing the integrity of the encrypted text. A first feedback loop 65 for feeding back the module output block data T _i output from the encryption module 51 when the block data is encrypted by the encryption module 51 to the encryption module 51 to the encryption module; enter the data, by the first feedback loop 65 performs the encryption process is fed back to the module output block data T _i, an encryption unit 100 for outputting the ciphertext block data C _i, the authenticator intermediate computation result T _i The encryption unit 1 has a second feedback loop 66 for feedback. 0 Enter the ciphertext block data C _i each time a ciphertext block data C _i is output from, performs authenticator processing, is fed back to the authenticator intermediate computation result T _i by the second feedback loop 66, encryption An authenticator generation unit 200 that generates an authenticator P for guaranteeing sentence integrity is provided.

  FIG. 30 is a diagram showing an operation procedure of the encryption apparatus shown in FIG.

The plaintext block data M ₁ is first encrypted into ciphertext block data C ₁ . Next, plaintext block data M ₂ is input and encrypted into ciphertext block data C ₂ . The ciphertext block data C ₁ is input at the same time as the encryption of the plaintext block data M ₂ and the operation of the authenticator starts. Time T1 and encryption of the plaintext block data M ₂ between T2 and authenticator based on the ciphertext block data C ₁ operation is performed. Further, between the times T2 and T3, the calculation of the encryption of the plaintext block data M ₃ and the authenticator based on the ciphertext block data C ₂ are performed. At time T3, operation authenticator based on the ciphertext block data C ₃ is performed and authenticator P is output.

The feature of FIG. 29 is that the ciphertext block data C _i output from the exclusive OR circuit 58 is input to the exclusive OR circuit 59 through the feed line 69. By combining the encryption processing in the OFB mode and the CBC mode through the feed line 69, the concealment processing and the integrity authentication processing are executed by pipeline processing as shown in FIG. In the case shown in FIG. 52, it took a processing time at time T6, but in the case of FIG. 30, the processing is completed at time T4 and high-speed processing is performed.

  FIG. 31 is an operation flowchart of the encryption apparatus shown in FIG.

In S51, the block data counter i is set to 1. S52 is the operation of the encryption unit 100, encryption unit 100, the plaintext block data M _i enter the encrypting plaintext block data M _i, the ciphertext block data to generate ciphertext block data C _i C _i is output. S53 is an operation of the authenticator generation unit 200, which inputs the ciphertext block data C _i , encrypts the ciphertext block data C _i , and calculates the authenticator. In S54, it is determined whether or not the block data counter i indicates the last block data n. If it is not the last block data, the block data counter i is incremented in S55, and the process returns to S52 again. That is, the processes of the encryption unit 100 and the authenticator generation unit 200 are repeated. In S54, the end of the case where the processing of the block data is completed, since authenticator immediately before is computed in S53 is the final authenticators, at S56, the authenticator of the ciphertext block data C _i last Append to As shown in FIG. 31, every time the encryption unit 100 generates the ciphertext block data C _i , the authenticator generation unit 200 inputs the ciphertext block data C _i and calculates the authenticator, thereby performing pipeline processing. And high-speed processing is performed.

  FIG. 32 is a combination of the encryption unit 100 and the authenticator generation unit 200 shown in FIG. That is, the encryption unit 100 and the authenticator generation unit 200 are also used as the encryption module 51, and the encryption unit 100 and the authenticator generation unit 200 are also used as the exclusive OR circuits 58 and 59. Furthermore, the feedback line 65 of the encryption unit 100 and the feedback line 66 of the authenticator generation unit 200 are combined.

  The first selector 61 selects the initial value IV at the start of the concealment process. The second selector 62 selects the initial value IV at the start of the integrity guarantee process. The third selector 63 selects the concealment process and the integrity guarantee process alternately. The third selector 63 can perform the concealment process by setting the input to E. In addition, the third selector 63 can perform integrity guarantee processing by setting the input to F.

Memory 93 is to record the module output data T _i output from the encrypting module 51 using the encryption key K. The memory 93 includes an input switch 96, an output switch 97, a first register 98, and a second register 99. The input switch 96 and the output switch 97 are synchronized with the switching of the third selector 63, and the input switch 96 and the output switch 97 are switched each time the third selector 63 is switched.

  FIG. 33 is a diagram showing an operation procedure of the encryption apparatus shown in FIG.

Security processing of the plaintext block data M ₁ between times T0 and T1 are performed. Module output data generated during the concealment process is stored in the first register 98. Between times T1 and T2, calculation of the authenticator based on the ciphertext block data C ₁ are performed. The authenticator calculation intermediate result generated by the integrity guarantee process is stored in the second register 99. Next, between times T2 and T3, the plaintext block data M ₂ is concealed based on the module output data and the plaintext block data M ₂ stored in the first register 98. Then, between times T3 and T4, the authenticator intermediate calculation result and the ciphertext block data C ₂ stored in the second register 99 is inputted, the calculation of the authenticator is carried out. By repeating this operation, the concealment process and the integrity authentication process are completed, and the ciphertext and the authenticator P are output. In the case shown in FIG. 33, the processing is completed by time T6 and the time is not shortened, but as shown in FIG. 32, the encryption module 51 using the encryption key K and the exclusive OR circuit 58 Since the feedback lines 67 and 68 (feedback loop) are also used, the circuit scale can be reduced.

  FIG. 34 is a diagram illustrating a decryption apparatus including the decryption unit 300 in the OFB mode and the authenticator generation unit 400 in the CBC mode.

  This authenticator generation unit 400 has the same configuration as that of the authenticator generation unit 200.

FIG. 34 illustrates a ciphertext in a decryption device that decrypts a ciphertext composed of one or more ciphertext block data into plaintext and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext. It has a first feedback loop 65 that feeds back the module output block data T _i generated when the block data C _i is decrypted by the decryption module 71, receives the ciphertext block data C _i , and receives the first feedback loop 65. The module output block data T _i is fed back to perform decryption processing, the plaintext block data M _i is output, and the decryption unit 300 has a second feedback loop 66 that feeds back the authenticator calculation intermediate result T _i. enter the same ciphertext block data with the ciphertext block data C _i input to the 300, certification Outputs authenticator intermediate computation result T _i performs child processing, is fed back to the authenticator intermediate computation result T _i by the second feedback loop 66, generates a authenticator Q to confirm the integrity of the ciphertext An authenticator generation unit 400 is provided.

The ciphertext block data C _i is input to the exclusive OR circuit 78 of the decryption unit 300 and simultaneously input to the authenticator generation unit 400 through the feed line 69. With such a configuration, the processes of the decryption unit 300 and the authenticator generation unit 400 are simultaneously executed in parallel, and the processing speed is improved.

  FIG. 35 integrates the decryption unit 300 and the authenticator generation unit 400 of the decryption apparatus shown in FIG.

  FIG. 35 shows a case where the decryption module 71 using the encryption key K and the feedback lines 87 and 88 (feedback loop) are also used.

  The first selector 81 selects the initial value IV at the start of the decoding process. The second selector 82 selects the initial value IV at the start of the integrity guarantee process. The third selector 83 alternately selects the decoding process and the integrity guarantee process. The third selector 83 can perform the decoding process by setting the input to E. The third selector 83 can perform integrity guarantee processing by setting the input to F.

Memory 93 is to record the module output data T _i output from the encrypting module 51 using the encryption key K. The memory 93 includes an input switch 96, an output switch 97, a first register 98, and a second register 99. The input switch 96 and the output switch 97 are synchronized with the switching of the third selector 83, and the input switch 96 and the output switch 97 are switched each time the third selector 83 is switched.

  FIG. 36 is a diagram showing an operation procedure of the decoding apparatus shown in FIG.

  The decryption device inputs the ciphertext and the authenticator P.

Saving to decoding the register 111 of the ciphertext block data C ₁ of the ciphertext block data C ₁ is carried out between the time T0 and T1. Module output data generated during the decoding process is stored in the first register 98. Between times T1 and T2, an authenticator is calculated based on the ciphertext block data C ₁ stored in the register 111. The authenticator calculation intermediate result generated by the integrity guarantee process is stored in the second register 99. Then, between times T2 and T3, the ciphertext block data C ₂ is stored in the register 111, the plaintext block data M ₂ on the basis of the stored module output data and the ciphertext block data C ₂ to the first register 98 The decoding process is performed. Next, between times T3 and T4, the authenticator intermediate calculation result stored in the second register 99 and the ciphertext block data C ₂ stored in the register 111 are input, and the authenticator is calculated. By repeating this operation, plaintext and authenticator Q are output. The authenticator Q is compared with the authenticator P. If the authenticator P and the authenticator Q match, the data integrity can be authenticated. This completes the decryption process and the integrity authentication process.

  FIG. 37 shows a case where the OFB mode encryption unit 100 of FIG. 29 is changed to a CBC mode encryption unit 100.

FIG. 37 shows an example of encrypting plaintext block data in an encryption device that generates plaintext consisting of one or more plaintext block data as ciphertext and generates an authenticator for ensuring the integrity of the ciphertext. The first feedback loop 65 feeds back the ciphertext block data C _i output from the encryption module 51 when encrypted by the unit 52, and the plaintext block data M _i is input, and the first feedback loop 65 An encryption unit 100 that performs ciphertext block data C _i feedback to perform ciphertext block data C _i and outputs ciphertext block data C _{i ;} and a second feedback loop 66 that feeds back an authenticator computation intermediate result T _i ; enter the ciphertext block data C _i each time a ciphertext block data C _i from the encrypting unit 100 is output Performs authenticator processing, is fed back to the authenticator intermediate computation result T _i by the second feedback loop 66, and a authenticator generating unit 400 that generates the authenticator P to ensure the integrity of the ciphertext It is characterized by that.

  FIG. 38 is obtained by changing the OFB mode decoding unit 300 of FIG. 34 to a CBC mode decoding unit 300.

FIG. 38 shows a ciphertext in a decryption device that decrypts a ciphertext composed of one or more ciphertext block data into a plaintext and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext. having a first feedback loop 85,82 for feeding back the block data C _i, and inputs the ciphertext block data C _i, the first feedback loop 85,82 decoding by feeding back the ciphertext block data C _i The decryption unit 300 that outputs the plaintext block data M _i and the second feedback loop 66 that feeds back the authenticator calculation intermediate result T _i , and is the same as the ciphertext block data C _i input to the decryption unit 300 Ciphertext block data C _i is input, authenticator calculation processing is performed, and an authenticator calculation intermediate result T _i is output. It is fed back to the authenticator intermediate computation result T _i by flop, characterized by comprising an authentication code generation unit 400 for generating the authenticator Q to confirm the integrity of the ciphertext.

  As described above, in FIGS. 29 and 37, data is input and encrypted, and an encryption unit that outputs encrypted data and encrypted data output by the encryption unit are input and the integrity of the ciphertext is guaranteed. An authenticator generating unit for generating an authenticator for the authentication, and the authenticator generating unit starts generating the authenticator before the encryption of data by the encryption unit is completed. Show.

  34 and 38 show a decryption unit that inputs and decrypts data and outputs the decrypted data, and generates an authenticator that inputs the data input by the decryption unit and guarantees the integrity of the ciphertext. An authenticator generation unit is provided, and the authenticator generator starts generation of an authenticator before decoding of data by the decryption unit is completed.

  Although not shown, the OFB mode encryption unit 100 or decryption unit 300 may be used.

  Although not shown, the authenticator generation unit 200 in the OFB mode or the CFB mode may be used.

  FIG. 39 is a configuration diagram of the encryption module 51 or the decryption module 71.

The encryption module 51 includes a key schedule unit 511 and a data randomization unit 512. The key schedule unit 511 inputs one key K and generates _n expanded keys ExtK _{1 to} ExtK _n . The data randomizing unit 512 generates a random number using the function F and the XOR circuit. The function F performs non-linear data conversion by inputting an expanded key.

In the encryption module 51 of the encryption device, for example,
(1) DES (Data Encryption Standard), or
(2) MISTY, which is a block cipher algorithm disclosed in International Publication No. WO 97/9705 (US Patent Application No. 08/83640), or
(3) KASUMI (which is a block cipher algorithm which is a 64-bit block cipher based on the block cipher algorithm MISTY and which has been decided to be adopted as an international standard cipher (IMT2000) for next-generation mobile phones). //Www.3gpp.org/About_3GPP/3gpp.html), or
(4) Camellia, a block cipher algorithm described in Japanese Patent Application No. 2000-64614 (filing date: March 9, 2000)
A block cipher algorithm such as can be used. The decryption module 71 of the decryption apparatus can also use a block cipher algorithm such as DES, MISTY, KASUMI, or Camellia.

  FIG. 40 is a diagram illustrating a mounting format of the above-described encryption device or decryption device.

  FIG. 40 shows a case where the above-described encryption device and decryption device are implemented in an FPGA, IC, or LSI. That is, the above-described encryption device and decryption device can be realized by hardware. Although not shown, it can be realized by a printed circuit board.

  FIG. 41 shows a case where the above-described encryption device and decryption device are realized by software.

  The encryption apparatus described above can be realized by the encryption program 47. The encryption program 47 is stored in a ROM (Read Only Memory) 42 (an example of a recording medium). The encryption program 47 may be recorded on a RAM (Random Access Memory) or another recording medium such as a flexible disk or a fixed disk. The encryption program 47 may be downloaded from a server computer. The encryption program 47 functions as a subroutine. The encryption program 47 is called and executed by a subroutine call from the application program 46 stored in the RAM 45. Alternatively, the encryption program 47 may be activated upon occurrence of an interrupt received by the interrupt control unit 43. The memory 55 may be a part of the RAM 45. The application program 46 and the encryption program 47 are programs executed by the CPU 41.

  FIG. 42 shows a mechanism by which the application program 46 calls the encryption program 47.

  The application program 46 calls the encryption program 47 using the key K, initial value IV, plaintext M, and ciphertext C as parameters. The encryption program 47 inputs the key K, the initial value IV, and the plaintext M, and returns the ciphertext C. When the encryption program 47 and the decryption program are the same, the encryption program 47 is called using the key K, initial value IV, ciphertext C, and plaintext M as parameters.

  Although not shown, the encryption program 47 may be realized by a digital signal processor and a program read and executed by the digital signal processor. That is, the encryption program 47 may be realized by a combination of hardware and software.

  40, 41, and 42 have mainly described the case of the encryption device, but the decryption device can also be realized by the same method.

  The encryption device and the decryption device as shown in FIGS. 40 and 41 can be installed in the electronic device. For example, it can be installed in any electronic device such as a personal computer, a facsimile machine, a mobile phone, a video camera, a digital camera, or a television camera. In particular, the feature of this embodiment can be exhibited when data from a plurality of channels is encrypted and decrypted. Alternatively, it is effective when data from multiple users arrives at random and decrypts, or when data for multiple users occurs at random and each data is encrypted in real time. is there. That is, when the number of encryption / decryption devices is smaller than the number of data to be encrypted / decrypted, the encryption device and the decryption device of the above-described embodiment are very effective. For example, the encryption device and the decryption device described above are very effective for server computers that must support many client computers and base stations and line controllers that must collect and deliver data from many mobile phones. .

  In addition, you may make it perform the parallel process of an encryption process and a decoding process instead of the parallel process of encryption processes and decryption processes.

  Moreover, although the case of the combination of the encryption unit (or decryption unit) in OFB mode and the authenticator generation unit in CBC mode has been shown, OFB mode, CBC mode, CFB mode, improved modes of these modes, and other modes Any combination of modes may be used.

  Further, although the case where the authenticator generation unit performs encryption using the encryption key K has been shown, the authenticator generation unit may perform data agitation, calculation, and other data processing.

3 is a diagram showing a CBC mode encryption apparatus according to Embodiment 1. FIG. The figure which shows the operation | movement procedure of the encryption apparatus of CBC mode. The operation | movement flowchart figure of the encryption apparatus of CBC mode. The operation | movement flowchart figure of the selector 54. FIG. FIG. 14 is a flowchart of interrupt processing of the switch 57. The figure which shows the other example of the memory 55. FIG. The interrupt process flowchart figure of the memory 55. FIG. The figure which shows the other example of the memory 55. FIG. The figure which shows a priority process. The figure which shows a priority process. The figure which shows a priority process. The figure in which the memory 55 is provided in parallel with the feedback line 66. The figure which shows the operation | movement procedure of the encryption apparatus of FIG. The figure in which the memory 55 is provided in parallel with the feedback line 67. The figure which shows the operation | movement procedure of the encryption apparatus of FIG. The figure which shows the encryption apparatus of OFB mode. The figure which shows the operation | movement procedure of the encryption apparatus of FIG. The figure which shows the encryption apparatus of CFB mode. The figure which shows the operation | movement procedure of the encryption apparatus of FIG. The figure which shows the decoding apparatus of CBC mode. The figure which shows the operation | movement procedure of the decoding apparatus of FIG. The figure which shows the decoding apparatus of OFB mode. The figure which shows the operation | movement procedure of the decoding apparatus of FIG. The figure which shows the decoding apparatus of CFB mode. The figure which shows the operation | movement procedure of the decoding apparatus of FIG. The figure which shows the encryption apparatus of the CBC mode which preserve | saves a key. The figure which shows the operation | movement procedure of the encryption apparatus of CBC mode. The figure which shows the decoding apparatus of the CBC mode which preserve | saves a key. FIG. 4 is a diagram illustrating an encryption apparatus having an encryption unit 100 and an authenticator generation unit 200 according to the second embodiment. The figure which shows the operation | movement procedure of the encryption apparatus which has the encryption part 100 and the authenticator production | generation part 200. FIG. The flowchart figure of the encryption apparatus which has the encryption part 100 and the authenticator production | generation part 200. The figure which shows the encryption apparatus which made the encryption part 100 and the authenticator production | generation part 200 into one. The figure which shows the operation | movement procedure of the encryption apparatus which made the encryption part 100 and the authenticator production | generation part 200 into one. The figure which shows the decoding apparatus which has the decoding part 300 and the authenticator production | generation part 400. FIG. The figure which shows the decoding apparatus which combined the decoding part 300 and the authenticator production | generation part 400 into one. The figure which shows the operation | movement procedure of the decoding apparatus which combined the decoding part 300 and the authenticator production | generation part 400 into one. FIG. 4 is a diagram illustrating an encryption apparatus having an encryption unit 100 and an authenticator generation unit 200 according to the second embodiment. The figure which shows the decoding apparatus which has the decoding part 300 and the authenticator production | generation part 400. FIG. The typical block diagram of the encryption module 51 using the encryption key K. FIG. The figure which shows the hardware implementation example of an encryption apparatus and a decoding apparatus. The figure which shows the hardware implementation example of an encryption apparatus and a decoding apparatus. The figure which shows the case where the encryption program 47 is called by the application program 46. FIG. The figure which shows the encryption apparatus of the conventional CBC mode. The figure which shows the decoding apparatus by the conventional CBC mode. The figure which shows the encryption apparatus of the conventional OFB mode. The figure which shows the decoding apparatus by the conventional OFB mode. The figure which shows the encryption apparatus of the conventional CFB mode. The figure which shows the decoding apparatus by the conventional CFB mode. The figure which shows the conventional encryption procedure. The figure which shows the conventional encryption procedure. The figure explaining a concealment process and an integrity guarantee process. The figure which shows the operation | movement procedure of the conventional secrecy process and an integrity guarantee process.

Claims (22)

In an encryption device that generates plaintext consisting of one or more plaintext block data as encrypted unit ciphertext and generates an authenticator for guaranteeing the integrity of the ciphertext with respect to the ciphertext,
A first feedback loop that feeds back the ciphertext block data C _i output from the encryption unit to the encryption unit when the plaintext block data is encrypted by the encryption unit; An encryption unit that feeds back the ciphertext block data C _i by performing a feedback loop and performs encryption processing;
It has a second feedback loop that feeds back the result of the authenticator calculation, inputs ciphertext block data every time ciphertext block data is output from the encryption unit, performs data processing, and uses the second feedback loop. An encryption device comprising: an authenticator generation unit that feeds back an intermediate result of an authenticator operation and generates an authenticator for guaranteeing the integrity of a ciphertext. The encryption unit and the authenticator generation unit alternately perform an encryption process and an authenticator generation process using one encryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the encryption process and the authenticator generation process, and
A selector that alternately selects the result of the encryption process and the authenticator generation process from the memory and outputs the result to the encryption module in order to alternately execute the encryption process and the authentication generation process; The encryption device according to claim 1. In an encryption method for generating plaintext consisting of one or more plaintext block data into a ciphertext by an encryption unit and generating an authenticator for ensuring the integrity of the ciphertext with respect to the ciphertext,
A first feedback step of feeding back the ciphertext block data C _i output from the encryption unit to the encryption unit when the plaintext block data is encrypted by the encryption unit; an encryption step of perform an encryption process is fed back the ciphertext block data C _i, and outputs the ciphertext block data by the feedback loop,
A second feedback step for feeding back an intermediate result of the authenticator operation, ciphertext block data is input every time ciphertext block data is output from the encryption step, data processing is performed, and the second feedback step An encryption method comprising: an authenticator generation step of feeding back an intermediate result of an authenticator operation and generating an authenticator for guaranteeing the integrity of a ciphertext. In a decryption device that decrypts a ciphertext composed of one or more ciphertext block data into a plaintext and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext,
A first feedback loop that feeds back the module output block data T _i generated when the data is decrypted by the decryption module to the decryption module, the ciphertext block data is input, and the module output block data is input by the first feedback loop; It is fed back to T _i performs decoding processing, a decoding unit for outputting the plaintext block data,
It has a second feedback loop that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption unit, performs data processing, and outputs the intermediate result of the authenticator operation A decryption apparatus comprising: an authenticator generation unit that feeds back an intermediate result of an authenticator operation by a second feedback loop and generates an authenticator for confirming ciphertext integrity. The decryption unit and the authenticator generation unit alternately perform a decryption process and an authenticator generation process using one decryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the decryption process and the authenticator generation process, and
A selector for alternately selecting a result of the decryption process and the authenticator generation process from the memory and outputting the result to the decryption module in order to alternately execute the decryption process and the authentication generation process. 4. The decoding device according to 4. In a decryption method for decrypting a ciphertext composed of one or more ciphertext block data into plaintext and generating an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext,
A first feedback step of feeding back the module output block data T _i generated when the data is decrypted by the decryption module to the decryption module, the ciphertext block data is input, and the module output block data is transmitted by the first feedback loop; It is fed back to T _i performs decoding processing, a decoding step of outputting the plaintext block data,
It has a second feedback step that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption step, performs data processing, and outputs the intermediate result of the authenticator operation A decryption method comprising: an authenticator generation step of generating an authenticator for feeding back an intermediate result of the authenticator operation in the second feedback step and confirming the integrity of the ciphertext. In an encryption device that converts plaintext consisting of one or more plaintext block data into a ciphertext by an encryption module and generates an authenticator for guaranteeing the integrity of the ciphertext for the ciphertext
A first feedback loop that feeds back the module output block data T _i output from the encryption module to the encryption module when the plaintext block data is encrypted by the encryption module; An encryption unit that feeds back the module output block data T _i through the feedback loop and performs encryption processing, and outputs ciphertext block data;
It has a second feedback loop that feeds back the result of the authenticator calculation, inputs ciphertext block data every time ciphertext block data is output from the encryption unit, performs data processing, and uses the second feedback loop. An encryption device comprising: an authenticator generation unit that feeds back an intermediate result of an authenticator operation and generates an authenticator for guaranteeing the integrity of a ciphertext. The encryption unit and the authenticator generation unit alternately perform an encryption process and an authenticator generation process using one encryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the encryption process and the authenticator generation process, and
A selector that alternately selects the result of the encryption process and the authenticator generation process from the memory and outputs the result to the encryption module in order to alternately execute the encryption process and the authentication generation process; The encryption device according to claim 7. In an encryption method for generating plaintext consisting of one or more plaintext block data into a ciphertext by an encryption module and generating an authenticator for ensuring the integrity of the ciphertext with respect to the ciphertext,
A first feedback step of feeding back the module output block data T _i output from the encryption module to the encryption module when the plaintext block data is encrypted by the encryption module; An encryption step of feeding back the module output block data T _i by the feedback loop and performing encryption processing to output ciphertext block data;
A second feedback step for feeding back an intermediate result of the authenticator operation, ciphertext block data is input every time ciphertext block data is output from the encryption step, data processing is performed, and the second feedback step An encryption method comprising: an authenticator generation step of feeding back an intermediate result of an authenticator operation and generating an authenticator for guaranteeing the integrity of a ciphertext. In a decryption device that decrypts a ciphertext composed of one or more ciphertext block data into a plaintext by a decryption unit, and generates an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext,
Having a first feedback loop for feeding back the ciphertext block data C _i to the decrypting unit receives the ciphertext block data, performs decoding processing by feeding back the ciphertext block data C _i by the first feedback loop, the plaintext A decoding unit for outputting block data;
It has a second feedback loop that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption unit, performs data processing, and outputs the intermediate result of the authenticator operation A decryption apparatus comprising: an authenticator generation unit that feeds back an intermediate result of an authenticator operation by a second feedback loop and generates an authenticator for confirming ciphertext integrity. The decryption unit and the authenticator generation unit alternately perform a decryption process and an authenticator generation process using one decryption module and one feedback loop.
The one feedback loop is
A memory for recording and outputting the results of the decryption process and the authenticator generation process, and
A selector for alternately selecting a result of the decryption process and the authenticator generation process from the memory and outputting the result to the decryption module in order to alternately execute the decryption process and the authentication generation process. The decoding device according to 10. In a decryption method for decrypting a ciphertext composed of one or more ciphertext block data into a plaintext by a decryption unit and generating an authenticator for confirming the integrity of the ciphertext with respect to the ciphertext,
A first feedback step of feeding back the ciphertext block data C _i to the decryption unit, the ciphertext block data is input, the ciphertext block data C _i is fed back by the first feedback loop, and decryption processing is performed; A decoding step of outputting block data;
It has a second feedback step that feeds back the intermediate result of the authenticator operation, inputs the same ciphertext block data as the ciphertext block data input to the decryption step, performs data processing, and outputs the intermediate result of the authenticator operation A decryption method comprising: an authenticator generation step of generating an authenticator for feeding back an intermediate result of the authenticator operation in the second feedback step and confirming the integrity of the ciphertext.   A computer-readable recording medium on which a program for causing a computer to execute each step of the encryption method according to claim 3 is recorded.   A computer-readable recording medium on which a program for causing a computer to execute each step of the decoding method according to claim 6 is recorded.   A computer-readable recording medium on which a program for causing a computer to execute each step of the encryption method according to claim 9 is recorded.   A computer-readable recording medium on which a program for causing a computer to execute each step of the decoding method according to claim 12 is recorded. An encryption unit that inputs and encrypts data and outputs encrypted data;
An authenticator generating unit that inputs the encrypted data output by the encryption unit and generates an authenticator for ensuring the integrity of the ciphertext;
The authenticator generation unit starts generating an authenticator before data encryption by the encryption unit is completed. A decoding unit for inputting and decoding data and outputting decoded data;
An authenticator generation unit that inputs the data input by the decryption unit and generates an authenticator for ensuring the integrity of the ciphertext;
The authenticator generation unit starts generating an authenticator before the decoding of data by the decryption unit is completed. An encryption process for inputting and encrypting data and outputting encrypted data;
An authenticator generation step for generating an authenticator for inputting the encrypted data output by the encryption step and ensuring the integrity of the ciphertext;
The authenticator generation step starts the generation of the authenticator before the data encryption by the encryption step is completed. A decoding step of inputting and decoding the data and outputting the decoded data;
An authenticator generation step for generating an authenticator for inputting the data input by the decryption step and guaranteeing the integrity of the ciphertext;
The authenticator generation step starts generation of an authenticator before the decryption of data by the decryption step is completed.   A computer-readable recording medium on which a program for causing a computer to execute each step of the encryption method according to claim 19 is recorded.   A computer-readable recording medium recording a program for causing a computer to execute each step of the decoding method according to claim 20.

Images