JP2009188794A - Message authenticator generating device, message authenticator verifying device, message authenticator generating method, message authenticator verifying method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a message authenticator generating method in which the number of calling the compressibility function exceeding m/b times does not depend on m while securing high safety. <P>SOLUTION: The message authenticator generating device includes: a padding part; a message dividing part; a first checksum calculation part; an intermediate variable calculation part; a second checksum calculation part; and a post-processor. The first checksum calculation part regards an exclusive OR of data m<SB>1</SB>, ..., m<SB>N</SB>as a first checksum S<SB>1</SB>. The intermediate variable calculation part determines a first intermediate variable v<SB>0</SB>of c bits, and repeats calculation for finding an intermediate variable v<SB>n</SB>from an intermediate variable v<SB>n-1</SB>using a bit string Δ<SB>n</SB>N times so as to find an intermediate variable v<SB>N</SB>. The second checksum calculation part regards an exclusive OR of the intermediate variable v<SB>1</SB>, ..., v<SB>N</SB>as a second checksum S<SB>2</SB>. The post-processor finds a message authenticator τ using the bit string Δ'<SB>j</SB>from the first checksum S<SB>1</SB>, the intermediate variable v<SB>N</SB>and the second checksum S<SB>2</SB>. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a message authenticator generation device, a message authenticator verification device, a message authenticator generation method, and message authentication for enabling authentication of a sender or a data creator for data on a communication path or a recording medium. The present invention relates to a child verification method, a program, and a recording medium.

In message authentication, the message authentication code MAC generates a message authenticator τ from a k-bit key K and data M having an arbitrary bit length (τ ← MAC _K (M)). By sharing the message authentication code MAC and the key K, the sender and the receiver or the data creator and the data user can perform authentication and verification of the data contents as follows.

  A sender or a data creator generates a message authenticator τ from a key K (usually one key but may be two or more) and data M with a message authenticator generating device. Then, the data M and the message authenticator are transmitted or stored. The receiver or the data user generates a message authenticator τ ′ from the key K and the data M by the message authenticator verification device. Then, τ and τ ′ are compared. If τ = τ ′, it is assumed that the authentication of the sender or the data creator and the consistency of the data contents are verified. If τ ≠ τ ′, it is determined that the sender or the data creator is misrepresented or the data is falsified.

The conventional message authentication code, is applied twice a hash function H _MD using Merkle Dangado repeat that improve safety (non-patent document 1), and the like. The message authentication code MAC _K (M) of Non-Patent Document 1 calculates a message authenticator τ as shown in the following equation.

ただし、“‖”はビット列の結合を意味する記号、“０^ｃ−ｋ”は“０”がｃ−ｋ個並んだビット列を示す記号、ＩＰＡＤとＯＰＡＤはｃビットのあらかじめ定められた定数である。このメッセージ認証コードは、圧縮関数の擬似乱数性に基づく耐偽造安全性証明が可能である（非特許文献２）。図１は、式（１）の処理を行うメッセージ認証子生成装置の機能構成例を示す図である。メッセージ認証子生成装置９００は、鍵パディング手段９１０とハッシュ手段９２０とを備える。鍵パディング手段９１０は、式（１）の１行目を実行し、ｋビットの鍵をｄビットにする。ハッシュ手段９２０は、式（１）の２行目と３行目を実行し、メッセージ認証子τを出力する。図２は、ハッシュ手段９２０の機能構成例である。ハッシュ手段９２０は、パディング部９２１、メッセージブロック生成部９２２、初期設定部９２３、中間変数計算部９２４から構成されている。パディング部９２１は、ハッシュ関数Ｈ_ＭＤへ入力されたビット列Ｄを、パディングによりＮ×ｂビットのビット列Ｍ^＊に変換する（ただし、Ｎとｂは正の整数）。メッセージブロック生成部９２２は、ビット列Ｍ^＊をＮ個のｂビットのメッセージブロックｍ_ｎに分割する（ただし、ｎは１以上Ｎ以下の整数）。初期設定部９２３は、最初の中間変数ｖ_０をあらかじめ定めた定数に設定する。中間変数計算部９２４は、
ｖ_ｎ←ｈ（ｖ_ｎ−１‖ｍ_ｎ） （２）
をｎ＝１からｎ＝Ｎまで繰り返し、ｖ_Ｎを求め、出力する。中間変数ｖ_ｎはｃビットのビット列であり、ｈは（ｃ＋ｂ）ビットのビット列をｃビットのビット列に圧縮する圧縮関数である。なお、このメッセージ認証コードに用いる圧縮関数ｈの場合、ｃとｂの値に対する制約はなく、ｃ＞ｂでもｃ＜ｂでもかまわない。また、このメッセージ認証コードは、圧縮関数の擬似乱数性に基づく耐偽造安全性証明が可能である（非特許文献２、非特許文献３）。しかし、非特許文献１のメッセージ認証コードＭＡＣ_Ｋ（Ｍ）の安全性は、誕生日限界と呼ばれるレベルまでしか保証されておらず、実際に誕生日攻撃に弱い。

However, “‖” is a symbol indicating a combination of bit strings, “0 ^ck ” is a symbol indicating a bit string in which “ ^k ” is arranged “0”, and IPAD and OPAD are predetermined constants of c bits. . This message authentication code can be forged security-proof based on the pseudo randomness of the compression function (Non-Patent Document 2). FIG. 1 is a diagram illustrating a functional configuration example of a message authenticator generation device that performs the processing of Expression (1). The message authenticator generation device 900 includes key padding means 910 and hash means 920. The key padding means 910 executes the first line of the equation (1) and changes the k-bit key to d bits. The hash unit 920 executes the second and third lines of the formula (1) and outputs a message authenticator τ. FIG. 2 is a functional configuration example of the hash unit 920. The hash means 920 includes a padding unit 921, a message block generation unit 922, an initial setting unit 923, and an intermediate variable calculation unit 924. The padding unit 921 converts the bit string D input to the hash function _HMD into a bit string M ^* of N × b bits by padding (where N and b are positive integers). The message block generation unit 922 divides the bit string M ^* into N b-bit message blocks _mn (where n is an integer from 1 to N). The initial setting unit 923 sets the first intermediate variable v ₀ to a predetermined constant. The intermediate variable calculation unit 924
v _n <-h (v _n−1 ‖m _n ) (2)
Are repeated from n = 1 to n = _N to obtain vN and output. Intermediate variable v _n is the bit string c bits, h is a compression function that compresses the bit string of (c + b) bits in the bit string of c bits. In the case of the compression function h used for this message authentication code, there are no restrictions on the values of c and b, and c> b or c <b may be used. In addition, this message authentication code can be forged security-proof based on the pseudo-randomness of the compression function (Non-Patent Document 2, Non-Patent Document 3). However, the security of the message authentication code MAC _K (M) of Non-Patent Document 1 is only guaranteed to a level called the birthday limit, and is actually vulnerable to birthday attacks.

As a message authentication code using a compression function and having high security exceeding the so-called birthday limit, there is a configuration method of Non-Patent Document 3, for example.
M. Bellare, R. Canetti, H. Krawczyk, “Keying hash functions for message authentication,” CRYPTO 1996, LNCS vol.1109, pp.1-15, Springer, Heidelberg (1996). M. Bellare, “New proofs for NMAC and HMAC: Security without collision-resistance,” CRYPTO 2006, LNCS vol.4117, pp.602-619, Springer, Heidelberg (2006). K. Yasuda, “Multilane HMAC-Security beyond the Birthday Limit,” INDOCRYPT 2007, LNCS vol.4859, pp.18-32, Springer, Heidelberg (2007).

  In the message authentication code shown in Non-Patent Document 1, since Merkle Dungard iteration is used as the iteration method, in order to process m-bit data M, a compression function is performed about m / b times with one hash function. It is necessary to call (repeat) h. And the method of the nonpatent literature 3 which has high safety | security makes the frequency | count of calling a compression function more than m / b times. In addition, since the portion where the compression function is called more than m / b times also depends on m, there is a problem that the processing amount increases.

  An object of the present invention is to provide a message authenticator generation method in which the number of calls of a compression function exceeding m / b times does not depend on m while ensuring high security.

The message authenticator generation device of the present invention outputs a message authenticator τ for data D. The message authenticator generation device includes a padding unit, a message division unit, a first checksum calculation unit, an intermediate variable calculation unit, a second checksum calculation unit, and a post-processing unit. The padding unit performs predetermined padding on the data D, so that b × N bits (where b is a predetermined integer and N is an integer in which b × N is longer than the message length of the data D). Data M is generated. The message dividing unit divides the data M into N pieces, and generates b-bit data m ₁ ,..., _{M N.} The first checksum calculator is an exclusive OR of the data m ₁ ,..., _{M N}

を計算し、第１チェックサムＳ_１とする。中間変数計算部は、ｃビット（ただし、ｃはあらかじめ定めた整数）の最初の中間変数ｖ_０を定め、中間変数ｖ_ｎ−１から中間変数ｖ_ｎを求める計算

It was calculated, and the first checksum _{S 1.} The intermediate variable calculation unit determines the first intermediate variable v ₀ of c bits (where c is a predetermined integer), and calculates the intermediate variable vn from the intermediate variable v _{n −1.}

（ただし、ｎは１以上Ｎ以下の整数、ｆ_ｋはｃビットの鍵ｋを用いてｂビットのビット列をｃビットのビット列に圧縮する圧縮関数、“‖”はビット列の結合を意味する記号、“０^ｂ−ｃ”は“０”がｂ−ｃ個並んだビット列、Δ_ｎはｂビットのあらかじめ定めたビット列）をＮ回繰り返して中間変数ｖ_Ｎを求める。第２チェックサム計算部は、中間変数ｖ_１，…，ｖ_Ｎの排他的論理和

(Where n is an integer greater than or equal to 1 and less than or equal to N, f _k is a compression function that compresses a b-bit bit string into a c-bit bit string using a c-bit key k, “‖” is a symbol that means a combination of bit strings, ^{"0 b-c"} is "0" b-c or aligned bit strings, delta _n obtains the intermediate variable _{v n} a b a predetermined bit string of bits) is repeated n times. Exclusive of the second checksum calculation unit intermediate variable v _1, ..., v _N

を計算し、第２チェックサムＳ_２とする。後処理部は、計算

It was calculated, and the second checksum _{S 2.} The post-processing section calculates

（ただし、Δ’_ｊはｂビットのあらかじめ定めたビット列、ｊは１から３の整数）によってメッセージ認証子τを求める。

Here, the message authenticator τ is obtained by (Δ ′ _j is a predetermined bit string of b bits and j is an integer of 1 to 3).

  The message authenticator verification device of the present invention includes the message authenticator generation device of the present invention and a comparison unit, and receives the data M and the message authenticator τ as input and verifies the data M. The message authenticator generating device generates a message authenticator τ ′ from the data M. The comparison unit compares the message authenticator τ and the message authenticator τ ′ and outputs a verification result of the data M.

  According to the message authenticator generation method of the present invention, in order to process m-bit data M, the number of calls of the compression function exceeding m / b times can be reduced to a small number independent of m. Also, high safety can be secured.

  Below, in order to avoid duplication of description, the same number is given to the structural part which has the same function, and the process step which performs the same process, and description is abbreviate | omitted.

[First Embodiment]
FIG. 3 shows a functional configuration example of the message authenticator generation device of the present invention. FIG. 4 shows an example of a processing flow of the message authenticator generation device of the present invention. Furthermore, FIG. 5 shows the flow of processing in each component. The message authenticator generation device 100 outputs a message authenticator τ for data D having an arbitrary bit length (message length). The message authenticator generation device 100 includes a padding unit 110, a message division unit 120, a first checksum calculation unit 130, an intermediate variable calculation unit 140, a second checksum calculation unit 150, and a post-processing unit 160.

The padding unit 110 performs predetermined padding on the data D so that b × N bits (where b is a predetermined integer and N is an integer in which b × N is longer than the message length of the data D). ) Data M is generated (S110). The message dividing unit 120 divides the data M into N pieces, and generates b-bit data m ₁ ,..., _{M N} (S120). The first checksum calculation unit 130 performs an exclusive OR of the data m ₁ ,..., _{M N}

を計算し、第１チェックサムＳ_１とする（Ｓ１３０）。中間変数計算部１４０は、まず、ｃビット（ただし、ｃはあらかじめ定めた整数）の最初の中間変数ｖ_０を定める。例えば、ｃ個の“０”からなるビット列とあらかじめ定めておいてもよい。ｎ＝１からｎ＝Ｎまで順番に、中間変数ｖ_ｎ−１から中間変数ｖ_ｎを求める計算

It was calculated, and the first checksum _{S 1} (S130). The intermediate variable calculation unit 140 first determines the first intermediate variable v ₀ of c bits (where c is a predetermined integer). For example, it may be determined in advance as a bit string composed of c “0” s. Calculation to obtain intermediate variable v _n from intermediate variable v _{n −1 in} order from n = 1 to n = N

を行う。この繰り返し処理で、中間変数ｖ_Ｎを求める（Ｓ１４０）。ただし、ｎは１以上Ｎ以下の整数、ｆ_ｋはｃビットの鍵ｋを用いてｂビットのビット列をｃビットのビット列に圧縮する圧縮関数、“‖”はビット列の結合を意味する記号、“０^ｂ−ｃ”は“０”がｂ−ｃ個並んだビット列、Δ_ｎはｂビットのあらかじめ定めたビット列である。例えば、ｆ_ｋ（ｍ）は、（ｃ＋ｂ）ビットのビット列をｃビットのビット列に圧縮する圧縮関数ｆを用いて、
ｆ_ｋ（ｍ）：＝ｆ（ｋ‖ｍ） （９）
のように定義すればよい。また、代表的な圧縮関数には、ｃ＝１６０、ｂ＝５１２のｓｈａ１やｃ＝２５６、ｂ＝５１２のｓｈａ２５６などがある（NIST, “Secure hash standard.” FIPS PUB 180-2 (2002)）。

I do. In this repetitive processing, obtaining the intermediate variable _{v N} (S140). Here, n is an integer of 1 to N, f _k is a compression function that compresses a b-bit bit string into a c-bit bit string using a c-bit key k, “‖” is a symbol that means a combination of bit strings, “ 0 ^b-c "is" 0 "b-c or aligned bit stream, the delta _n is a predetermined bit string of b bits. For example, f _k (m) is expressed by using a compression function f that compresses a bit string of (c + b) bits into a bit string of c bits.
f _k (m): = f (k‖m) (9)
Should be defined as follows. Typical compression functions include sha1 of c = 160, b = 512, sha = 256 of b = 512, and sha256 of b = 512 (NIST, “Secure hash standard.” FIPS PUB 180-2 (2002)). .

を計算し、第２チェックサムＳ_２とする（Ｓ１５０）。後処理部１６０は、計算 The second checksum calculation unit 150 performs exclusive OR of intermediate variables v ₁ ,..., V _N.

It was calculated, and the second checksum _{S 2} (S150). The post-processing unit 160 calculates

によってメッセージ認証子τを求める（Ｓ１６０）。ただし、Δ’_ｊはｂビットのあらかじめ定めたビット列、ｊは１から３の整数である。なお、Δ_１，…，Δ_Ｎ、およびΔ’_１，Δ’_２，Δ’_３は互いに異なるビット列である。

To obtain a message authenticator τ (S160). However, Δ ′ _j is a predetermined bit string of b bits, and j is an integer of 1 to 3. Note that Δ ₁ ,..., Δ _N and Δ ′ ₁ , Δ ′ ₂ , Δ ′ ₃ are different bit strings.

For example, if the compression function is b = 512 such as sha1 or sha256, Δ ₁ ,..., Δ _N , and Δ ′ ₁ , Δ ′ ₂ , Δ ′ ₃ may be determined as follows. Consider a multiplicative group of extension fields of a finite field GF (2) represented by a remainder ring of the irreducible polynomial x ⁵¹² + x ¹² + x ⁷ + x ² +1 on the finite field GF (2). Considering the element of the monomial x (the equivalence class) in this multiplicative group, the element x generates almost all non-zero elements, but does not generate a subgroup of order 17. On the other hand, the element x + 1 generates a subgroup of order 17. Therefore, first, the bit string Δ _{0 is set} to

で求められるビット列の先頭のｂビットとする。そして、ビット列Δ_ｎをｘ^ｎ・Δ_０、ビット列Δ’_ｊをｘ^Ｎ・（ｘ＋１）^ｊ・Δ_０とする。ただし、“・”は拡大体の乗算を示す記号である。

The first b bits of the bit string obtained in step. Then, the bit string Δ _{n is set} to x ⁿ · Δ ₀ , and the bit string Δ ′ _{j is set} to x ^N · (x + 1) ^j · Δ ₀ . However, “·” is a symbol indicating multiplication of the extension field.

  With this configuration, the message authenticator generation device of the present invention has high security exceeding the birthday limit. Further, as can be seen from FIG. 5, the message authenticator generation device of the present invention calls the compression function N + 3 times in order to obtain the message authenticator τ of data M of b × N bits (message length m). In other words, the portion where the compression function is called more than m / b times (corresponding to N times) is only three times. The constant is not dependent on the message length m.

[Second Embodiment]
FIG. 6 shows a functional configuration example of the message authenticator verification device of the present invention. FIG. 7 shows a processing flow example of the message authenticator verification device of the present invention. The message authenticator verification device 500 includes the message authenticator generation device 100, the comparison unit 510, and the recording unit 590 shown in the first embodiment, and the data M and the message authenticator τ are input and the verification result is output.

  The message authenticator generation device 100 in the message authenticator verification device 500 generates a message authenticator τ ′ from the data D (S100). The comparison unit 510 compares the message authenticator τ and the message authenticator τ ′. If τ = τ ′, the authentication of the sender or the data creator and the consistency of the data contents are verified. If τ ≠ τ ′, it is determined that the sender or the data creator is misrepresented or the data is falsified. Then, the verification result is output (S510). The recording unit 590 may not be provided, and these pieces of information may be recorded by other constituent units.

  With this configuration, the message authenticator verification device 500 can achieve the same effects as the message authenticator generation device 100.

  FIG. 8 shows a functional configuration example of a computer. Note that the message authenticator generation device and the message authenticator verification device of the present invention cause the recording unit 2020 of the computer 2000 to read a program that causes the computer 2000 to operate as each component of the present invention, and the processing unit 2010 and the input unit 2030. This can be realized by operating the output unit 2040 or the like. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

The figure which shows the function structural example of the conventional message authenticator production | generation apparatus. The figure which shows the function structural example of the hash means 920. FIG. The figure which shows the function structural example of the message authenticator production | generation apparatus of this invention. The figure which shows the example of a processing flow of the message authenticator production | generation apparatus of this invention. The figure which shows the flow of a process in each structure part of the message authenticator production | generation apparatus of this invention. The figure which shows the function structural example of the message authenticator verification apparatus of this invention. The figure which shows the example of a processing flow of the message authenticator verification apparatus of this invention. The figure which shows the function structural example of a computer.

Explanation of symbols

100, 900 Message authenticator generation device 110, 921 Padding unit 120 Message dividing unit 130 Checksum calculation unit 140, 924 Intermediate variable calculation unit 150 Checksum calculation unit 160 Post-processing unit 500 Message authenticator verification device 510 Comparison unit 590 Recording unit 910 Key padding means 920 Hash means 922 Message block generation section 923 Initial setting section

Claims (8)

A message authenticator generating device that outputs a message authenticator τ for data D,
By performing predetermined padding on the data D, data M of b × N bits (where b is a predetermined integer and N is an integer in which b × N is longer than the message length of the data D). A padding part for generating
A message dividing unit that divides the data M into N pieces and generates b-bit data m ₁ ,..., _{M N} ;
Exclusive OR of the data m ₁ ,..., _{M N}

Was calculated, and the first checksum calculator for the first checksum S _1,
Calculation for determining the first intermediate variable v ₀ of c bits (where c is a predetermined integer) and determining the intermediate variable v _n from the intermediate variable v _{n −1}

(Where n is an integer greater than or equal to 1 and less than or equal to N, f _k is a compression function that compresses a b-bit bit string into a c-bit bit string using a c-bit key k, “‖” is a symbol that means a combination of bit strings, "0 ^b-c" is "0" b-c or aligned bit strings, delta _n is an intermediate variable calculation unit for obtaining the intermediate variable v _n a b a predetermined bit string of bits) is repeated n times,
Exclusive OR of intermediate variables v ₁ , ..., v _N

And calculating a second checksum S2 as a _second checksum S2,
Calculation

And a post-processing unit for obtaining a message authenticator τ according to (where Δ ′ _j is a predetermined bit string of b bits and j is an integer of 1 to 3). The message authenticator generation device according to claim 1,
The bit string Δ ₀ is an element of a multiplicative group of an extension field of a finite field GF (2) where b is 512 and x is expressed by a remainder ring of an irreducible polynomial over the finite field GF (2).

When the first b bits of the bit string obtained in (2), “·” is a symbol indicating multiplication of an extension field,
A message authenticator generating device characterized in that a bit string Δ _n is x ⁿ · Δ ₀ and a bit string Δ ′ _j is x ^N · (x + 1) ^j · Δ ₀ . A message authenticator verification device that receives data D and a message authenticator τ and performs verification of data D,
The message authenticator generation device according to claim 1 or 2, wherein a message authenticator τ 'is generated from the data D;
A message authenticator verification device comprising: a comparison unit that compares the message authenticator τ and the message authenticator τ ′ and outputs a verification result of data D. A message authenticator generation method for outputting a message authenticator τ for data D,
The padding section performs predetermined padding on the data D, so that b × N bits (where b is a predetermined integer, N is an integer in which b × N is longer than the message length of the data D). ) Padding step for generating data M;
A message dividing step for dividing the data M into N pieces and generating b-bit data m ₁ ,..., _{M N} ;
The first checksum calculation unit performs an exclusive OR of the data m ₁ ,..., _{M N}

And calculating a first checksum S1 as a _first checksum S1;
The intermediate variable calculation unit determines the first intermediate variable v ₀ of c bits (where c is a predetermined integer), and calculates the intermediate variable v _n from the intermediate variable v _{n −1.}

(Where n is an integer greater than or equal to 1 and less than or equal to N, f _k is a compression function that compresses a b-bit bit string into a c-bit bit string using a c-bit key k, “‖” is a symbol that means a combination of bit strings, "0 ^b-c" is "0" b-c or aligned bit strings, delta _n is an intermediate variable calculation step of obtaining an intermediate variable v _n a b a predetermined bit string of bits) is repeated n times,
The second checksum calculator calculates the exclusive OR of the intermediate variables v ₁ ,..., V _N

And calculating a second checksum S ₂ as a _second checksum S ₂ ,
Post-processing section calculates

(Where Δ ′ _j is a predetermined bit string of b bits, j is an integer from 1 to 3), and a post-processing step for obtaining a message authenticator τ. The message authenticator generation method according to claim 4, wherein
The bit string Δ ₀ is an element of a multiplicative group of an extension field of a finite field GF (2) where b is 512 and x is expressed by a remainder ring of an irreducible polynomial over the finite field GF (2).

When the first b bits of the bit string obtained in (2), “·” is a symbol indicating multiplication of an extension field,
Message authentication code generation method characterized by the bit string Δ ^{_n x} _n · Δ _0, the bit string delta _'j and ^{x N · (x + 1)} j · Δ 0. A message authenticator verification method for inputting data D and a message authenticator τ and verifying data D,
Each step of the message authenticator generation method according to claim 4 or 5, wherein a message authenticator τ 'is generated from the data D;
A comparison step of comparing the message authenticator τ and the message authenticator τ ′ and outputting a verification result of the data D in the comparison unit.   A program for operating a computer as the apparatus according to claim 1.   A computer-readable recording medium on which the program according to claim 7 is recorded.

Images