JP2010034682A - Encryption processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent any side channel attack without altering the arithmetic formula itself of encryption. <P>SOLUTION: A numerical value M is applied to an input part 110, a numerical value C is determined by performing an exponentiation remainder operation using a secret key D by an arithmetic execution part 130, and the numerical value C is output from an output part 120. The secret key D expressed by binary digits is read from a storage part 150, and a numerical value d of one digit is re-encoded into a redundant k-order digit which becomes a value within the range of "0≤d≤dmax (dmax>k-1)" by a re-encoding part 140. In this case, since re-encoding using a random number R generated by a random number generation part 160 is performed, the numerical value of each digit configuring the secret key D to be used for an actual arithmetic operation by an arithmetic execution part 130 is selected at random each time. Even when an arithmetic operation based on the same arithmetic formula is performed by using the same numerical value D to the same numerical value M by the arithmetic execution part 130, a power consumption pattern is made different each time, and analysis based on power consumption is invalidated. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a cryptographic processing apparatus, and in particular, generates a second numerical value C by performing an operation using a numerical value D serving as a secret key on the first numerical value M given from the outside. The present invention relates to an encryption processing apparatus that performs processing to be output to the outside.

  Encryption is a technique that has been used for a long time in order to ensure the confidentiality of communication. In recent years, encryption is becoming an indispensable technique for communication between digital devices. For example, many of the IC cards that are currently used for various purposes have an encryption process using a secret key, and the data given from the outside is encrypted or decrypted internally. It has a function to do.

  One of the most widely used encryption methods for IC cards and the like at present is the RSA encryption method, which is a typical public key encryption method. The process of encryption or decryption by the RSA encryption method includes a remainder operation including an exponential function, and safety is ensured by the complexity of this operation. For example, Patent Documents 1 and 2 below disclose a technique for speeding up the encryption or decryption operation by the RSA encryption method.

  On the other hand, the existence of a technology that is a threat to security called “side channel attack” that threatens security based on such an encryption method has also been confirmed. In general, an IC chip incorporated in a digital device such as an IC card is composed of a large number of transistor circuits, and the complicated remainder calculation including the exponential function described above is executed by the transistor circuits. For this reason, while a digital device such as an IC card is executing an encryption or decryption process, the power consumption of the device is monitored from the outside to statistically analyze the processing performed internally. It becomes possible to estimate by a simple method. As such illegal analysis methods, methods such as simple power analysis (SPA) and differential power analysis (DPA) are known. By using these methods, it is possible to estimate the value of the built-in secret key by performing a statistical analysis on an illegally obtained IC card.

As a method against such a side channel attack, for example, the following Patent Document 3 discloses a method of incorporating a random number into an operation, and the following Patent Document 4 includes a more complicated combination of remainder operations. The technique to do is disclosed. Patent Document 5 below discloses a technique that makes it difficult to distinguish whether or not a dummy multiplication is performed by adding a dummy multiplication that is not originally necessary and updating the multiplier in the middle of a power. .
Japanese Unexamined Patent Publication No. 7-129085 JP-A-8-254949 JP-T-2002-519722 JP 2006-217193 A JP 2007-316491 A

  As described above, as a method against the side channel attack, conventionally, various methods using more complicated arithmetic expressions have been proposed by devising arithmetic expressions used for encryption and decryption. However, the more complicated arithmetic expressions are used, the more harmful the calculation burden becomes.

  Therefore, an object of the present invention is to provide an encryption processing apparatus that can prevent a side channel attack without modifying the arithmetic expression itself used for encryption or decryption.

(1) The first aspect of the present invention generates a second numerical value C by performing an operation using a numerical value D as a secret key on the first numerical value M given from the outside, In the cryptographic processing device that performs processing to output to the outside,
An input unit for inputting the first numerical value M from outside;
A secret key storage unit for storing a numerical value D as a secret key;
A random number generator for generating a random number R;
Using the generated random number R, the numerical value D is expressed by a redundant k-ary number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. A re-encoding unit for re-encoding into random n-digit data;
An operation execution unit for obtaining a second numerical value C by performing a predetermined operation using at least the numerical value M and the re-encoded numerical value D;
An output unit for outputting the second numerical value C obtained by the calculation execution unit to the outside;
Is provided.

(2) According to a second aspect of the present invention, in the cryptographic processing device according to the first aspect described above,
Arithmetic execution unit, by performing a calculation based on the arithmetic expression of the scalar multiplication to elliptic curve cryptography scalar value D the rational point P that is determined based on a predetermined arithmetic expression or M includes a term of M ^D, second numerical C is obtained.

(3) According to a third aspect of the present invention, in the cryptographic processing device according to the second aspect described above,
Arithmetic execution unit, by performing a calculation based on the arithmetic expression C = M ^D modZ indicating the modular exponentiation of time obtained by dividing the M ^D at a predetermined numerical Z, is obtained so as to obtain a second numeric C.

(4) According to a fourth aspect of the present invention, in the cryptographic processing device according to the third aspect described above,
The re-encoding unit sequentially converts the numerical value D into d [n−1], d [n−2], d [n−3],..., D [2], d [1] in order from the upper digit side. , D [0] to perform re-encoding into n-digit data,
The calculation execution unit performs a calculation based on the calculation formula C = M ^D modZ.
C = ((... (((1 * M ^{d [n−1]} ) ^k
* M ^{d [n-2]} modZ) ^k
* M ^{d [n-3]} modZ) ^k
.....
* M ^{d [2]} modZ) ^k
* M ^{d [1]} modZ) ^k
* M ^{d [0]} modZ
Is executed in order from the operation inside the parentheses.

(5) According to a fifth aspect of the present invention, in the cryptographic processing device according to the first aspect described above,
The operation execution unit obtains the second numerical value C by performing an operation for generating RSA encryption, Diffie Hellman encryption, EL Gamal encryption, or elliptic curve encryption.

(6) According to a sixth aspect of the present invention, in the cryptographic processing device according to the first to fifth aspects described above,
The arithmetic execution unit obtains the second numerical value C by repeatedly executing in order an operation that extracts and uses a single-digit numerical value d from the n-digit data re-encoded by the re-encoding unit. It is a thing.

(7) According to a seventh aspect of the present invention, in the cryptographic processing device according to the first to sixth aspects described above,
Each time the input unit inputs the first numerical value M from the outside, the random number generation unit generates a new random number R, the re-encoding unit performs new re-encoding, and the operation execution unit newly re-encodes The calculation for obtaining the second numerical value C is performed using the numerical value D.

(8) According to an eighth aspect of the present invention, in the cryptographic processing device according to the first to seventh aspects described above,
Re-encoding unit
A random data generation element that generates n-digit random data by repeating a process of generating a value within a range of “0 ≦ d ≦ dmax” using the random number R n times;
A numerical confirmation element for determining whether or not the generated random data is equal to the numerical value D;
Random data generation element repeatedly executes random data generation until it is determined that the numerical confirmation elements are equal, and the random data when the numerical confirmation elements are equal is output as re-encoded data A control element;
It is constituted by.

(9) According to a ninth aspect of the present invention, in the cryptographic processing device according to the first to seventh aspects described above,
Re-encoding unit
a register holding n digits of data;
By expressing a numerical value D as a secret key with a normal k-adic number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ k−1”, n-digit data is prepared, An initial data setting element for setting the prepared data in the register as initial data;
A digit selection element for selecting any one digit among n digits of the register as a selection digit using the generated random number R;
An increase / decrease determination element that determines either increase correction or decrease correction using the generated random number R;
When increase correction is determined by the increase / decrease determination factor, d <dmax is satisfied for the numerical value d of the selected digit, and a predetermined increase correction amount δ (where δ ≦ dmax−d) is obtained by adjusting other digits. On the condition that it is possible to cancel out, an increase correction execution element for adding an increase correction amount δ to the selected digit and adjusting other digits to cancel the increase correction amount δ,
When the decrease correction is determined by the increase / decrease determining element, d ≠ 0 is satisfied for the numerical value d of the selected digit, and a predetermined decrease correction amount δ (where δ ≦ d) is canceled by adjusting other digits. A reduction correction execution element that performs a correction that subtracts the decrease correction amount δ by adjusting the other digits by subtracting the decrease correction amount δ from the selected digit on the condition that it is possible to
Until the predetermined condition is satisfied, the digit selection by the digit selection element, the increase / decrease determination by the increase / decrease determination element, the correction by the increase correction execution element or the decrease correction execution element are repeatedly executed, and the register in the register when the predetermined condition is satisfied a control element that outputs n-digit data as re-encoded data;
It is constituted by.

(10) According to a tenth aspect of the present invention, in the cryptographic processing device according to the first to seventh aspects described above,
Re-encoding unit
A numerical value D holding element for holding the numerical value D as a binary number of m × n bits (m and n are integers);
A numerical value E generation element for generating an arbitrary numerical value E satisfying “E <D” as a binary number of m × n bits using the random number R;
A numerical value A generation element for generating a new numerical value A by replacing the lower m bits of the numerical value E with 0;
A numerical value B generating element for generating a numerical value B consisting of an m × n-bit binary number by an operation of B = D−A;
Counting m bits of consecutive numbers from the (m × (i + 1)) th bit down to the lower order of the bits constituting the numerical value A, from the lower bits of the bits constituting the numerical value B A numerical value consisting of 2m bits in which the numerical value for m bits continuous from the (m × i) -th bit to the lower order is the lower bit (provided that i = 1 to n, and for numerical value A, m the a supplement) 0 bits, to generate a n-digit data to the i-th digit as counted from the lower side, the redundant data generation output as data indicating the numerical D expressing this in redundant 2 ^m ary Elements and
It is constituted by.

  (11) According to an eleventh aspect of the present invention, the cryptographic processing apparatus according to the first to tenth aspects described above is built in an IC card.

  (12) In a twelfth aspect of the present invention, the cryptographic processing apparatus according to the first to tenth aspects described above is configured by incorporating a dedicated program into a computer.

(13) According to a thirteenth aspect of the present invention, a first numerical value M is given from the outside to an arithmetic processing unit having a numerical value D as a secret key, and at least the numerical value M is provided inside the arithmetic processing unit. In a cryptographic processing method for generating a second numerical value C by executing an operation using a numerical value D and a numerical value D, and outputting the second numerical value C to the outside,
Random data in which the numerical value D is expressed by a redundant k-ary number in which the numerical value d takes a value in the range of “0 ≦ d ≦ dmax (where dmax> k−1)” within the arithmetic processing unit. Is generated, and an operation for generating the second numerical value C is executed using the random data.

(14) In the fourteenth aspect of the present invention, a first numerical value M is given from the outside to an IC card having a numerical value D as a secret key and having an arithmetic processing function and a random number generation function. In the cryptographic processing method for generating a second numerical value C by executing an operation using at least the numerical value M and the numerical value D and outputting the same to the outside,
Inside the IC card, random data expressing a numerical value D in redundant k-ary numbers in which a numerical value d of one digit takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. The random number generation function is used to generate the second numerical value C using this random data.

  According to the present invention, the numerical value D serving as a secret key is re-encoded into random n-digit data expressed in redundant k-adic numbers and then applied to an arithmetic expression used for encryption or decryption. If redundant k-adic numbers are used, the same numerical value D can be expressed by a plurality of notation methods. Therefore, even if the operation based on the same arithmetic expression is repeated using the same numerical value D, a specific example performed by the transistor circuit is performed. The typical computation process will be different each time. For this reason, even if a statistical method based on power analysis such as SPA or DPA is applied, it is difficult to estimate the numerical value D that is a secret key. Therefore, a side channel attack can be prevented without modifying the arithmetic expression itself used for encryption or decryption.

  Hereinafter, the present invention will be described based on the illustrated embodiments.

<<< §1. General RSA cryptographic operations >>>
First, for convenience of explanation, cipher processing performed inside the IC card will be described using a general RSA cipher operation as an example. The RSA cipher is one of the public key ciphers based on the fact that the problem of prime factorization of a composite number with a large number of digits is difficult. FIG. 1 is a block diagram showing an encryption and decryption process using a general public key cryptosystem. As shown in the figure, the plaintext M to be encrypted is encrypted using the key D and converted into a ciphertext C. On the other hand, the ciphertext C is decrypted using another key E and returned to the plaintext M. Usually, one of the keys D and E is used as a public key and the other as a secret key.

  FIG. 2 is a diagram showing a modular exponentiation expression that should be used in a general RSA encryption method. Expression (1) shows an arithmetic expression for generating the ciphertext C by encrypting the plaintext M. Both plaintext M and ciphertext C are actually given as some numerical values. A numerical value D is a key for encryption, and Z is a predetermined constant. On the other hand, Expression (2) represents an arithmetic expression for decrypting the ciphertext C to generate plaintext M. The numerical value E is a key for decryption, and is a value uniquely determined according to the numerical value D. Z is a constant used in the formula (1).

  Note that the distinction between plaintext M and ciphertext C and the distinction between encryption and decryption are distinctions for convenience from the user's side, and are mathematically equivalent. The expression (1) in FIG. 2 simply indicates that the numerical value C can be obtained by the operation on the numerical value M, and the expression (2) in FIG. 2 simply indicates that the numerical value M can be obtained by the operation on the numerical value C. Is shown. Which of the numerical values C and M is called plaintext and which is called ciphertext is convenient for the user, and which of formulas (1) and (2) is called encryption and which is called decryption? It is convenience on the side. Therefore, in the present specification, for the sake of convenience, an example of “encrypting plaintext M to obtain ciphertext C” will be described below using formula (1). Of course, the present invention expresses formula (2) as follows. It can also be applied to an example of “decrypting ciphertext C to obtain plaintext M”.

  FIG. 3 is a block diagram showing a general system using the RSA encryption method for authentication between the IC card 10 and the external device 20. As shown in the drawing, a control unit 11 and a cryptographic processing device 12 are provided in the IC card 10, and an authentication processing unit 21 and a cryptographic processing device 22 are provided in the external device 20. When the IC card 10 is a contact type, an electrical connection is made to the external device 20 via a contact terminal provided on the surface, and communication between the two is performed. In addition, when the IC card 10 is a non-contact type, wireless communication is performed between the two by placing the IC card 10 within the communication range of the external device 20.

  Actually, the IC card 10 and the external device 20 incorporate various elements in addition to the components shown in FIG. The components shown as blocks in FIG. 3 are only the components necessary for performing the authentication process of the IC card 10 by the external device 20.

  When the external device 20 starts communication with the IC card 10, the external device 20 authenticates whether or not the IC card 10 is a legitimate device. Specifically, first, the first numerical value M is generated by the authentication processing unit 21 on the external device 20 side (usually a random number is used), and this is transmitted to the IC card 10 side together with a predetermined authentication command. . The control unit 11 that has received the authentication command and the numerical value M hands over the numerical value M to the cryptographic processing device 12 to execute encryption processing. The cryptographic processing device 12 executes a calculation (in this example, the calculation shown in the equation (1) in FIG. 2) using the numerical value D that is the secret key for the given first numerical value M to obtain the second value. The numerical value C is generated. The control unit 11 transmits the generated numerical value C to the external device 20 as a response to the authentication command.

  On the other hand, the external device 20 passes the generated first numerical value M to the cryptographic processing device 22 to execute encryption processing. The cryptographic processing device 22 performs an operation using the numerical value D that is a secret key on the given first numerical value M (in this example, the operation that is also represented by the equation (1) in FIG. 2). A numerical value C of 2 is generated. The authentication processing unit 21 compares the numerical value C transmitted from the IC card 10 side with the numerical value C generated by the cryptographic processing device 22, and if both match, the IC card 10 is regarded as a legitimate device. It can be authenticated. Alternatively, for the numerical value C transmitted from the IC card 10 side, the cryptographic processing device 22 is caused to execute the decryption operation shown in the equation (2) in FIG. 2 to generate the numerical value M, and this numerical value M is authenticated. You may confirm that the process part 21 corresponds with the numerical value M produced | generated initially.

  By the same method, the IC card 10 side can also authenticate that the external device 20 currently in communication is a legitimate device. Thus, if it is possible to authenticate that the other party is a legitimate party, communication for various processes is performed between the two. At this time, encryption or decryption using the numerical value D as a secret key can be performed on the data to be communicated as necessary.

  The authentication process and the encryption / decryption process described above are processes that are already widely used in systems that already use IC cards. The numerical value D serving as a secret key is stored in the cryptographic processing device 12 in the IC card 10 and normally has a specification that is never read out to the outside. Therefore, even if the IC card 10 reaches the unauthorized person, the secret key D should not be known to the unauthorized person. However, in practice, as described above, the value of the secret key D may be estimated by a “side channel attack” such as simple power analysis (SPA) or power difference analysis (DPA).

In particular, when the calculation performed inside the cryptographic processing device 12 is a calculation including a term “M ^D ” that is a power of the secret key D with respect to the first numerical value M, there is a high risk that the value of the secret key D is estimated. Become. This calculation based on a predetermined arithmetic expression including a term of M ^D, in fact, to be performed by repeated calculation using the digits of numbers D, statistical time change in power consumption of the IC card 10 This is because the estimation of the value of each digit of the numerical value D is permitted.

For example, if the RSA cryptosystem described above, inside the cryptographic processing unit 12, calculation shown in the equation of FIG. 2 (1), i.e., calculation formula C indicating the modular exponentiation of time obtained by dividing the M ^D at a predetermined numerical Z = it is necessary to perform a calculation based on the M ^D modZ. However, in order to execute such a modular exponentiation with a computer, it is actually necessary to perform an arithmetic operation using an equivalent arithmetic expression as shown in FIG. That is, the numerical value C based on the arithmetic expression C = M ^D modZ is actually
C = ((... (((1 * M ^{d [n−1]} ) ²
* M ^{d [n-2]} modZ) ²
* M ^{d [n-3]} modZ) ²
.....
* M ^{d [2]} modZ) ²
* M ^{d [1]} modZ) ²
* M ^{d [0]} modZ
It is obtained by executing in order from the operation inside the parentheses using the equivalent operation expression. Here, d [n−1], d [n−2], d [n−3],..., D [2], d [1], d [0] described as power terms are , Each digit of n digits when the numerical value D is expressed in binary (arranged in order from the upper digit side), and “*” is a multiplication symbol.

  FIG. 5 is a diagram showing a specific calculation procedure when the secret key D of 22 [decimal] is applied in binary notation in the calculation formula shown in FIG. That is, if 22 [decimal] is expressed in binary, “10110” is obtained. Therefore, in order to obtain the value of the numerical value C by the above equivalent arithmetic expression, n = 5, d [4] = 1, d [ 3] = 0, d [2] = 1, d [1] = 1, d [0] = 0.

The equivalent arithmetic expression shown in the lower part of FIG. 5 is an example in which such substitution is performed. If executed in order from the operation inside the parentheses, first, (1 * M ¹ ) ² is executed, then, with the operation result as X, (X * M ⁰ modZ) ² is executed, then (X * M ¹ modZ) ² is executed with the operation result as X, then (X * M ¹ modZ) ² is executed with the operation result as X, and finally, the operation result as X , (X * M ⁰ modZ) is executed. However, since M ⁰ = 1 while M ¹ = M, when calculating (X * M ⁰ modZ) ² and when calculating (X * M ¹ modZ) ² , The calculation burden is greatly different, resulting in a difference in power consumption. Therefore, if the power consumption inside the IC card is monitored by “side channel attack” and is statistically analyzed, the arrangement order of the bits 0 and 1 constituting the secret key D may be estimated. is there.

On the other hand, an operation in which the numerical value D is handled in numerical notation other than binary numbers is possible, but it is still vulnerable to the “side channel attack”. For example, FIG. 6 is a diagram illustrating an example of an actual arithmetic expression when a power-residue operation using the quaternary secret key D is executed inside the cryptographic processing apparatus. That is, a numerical sequence of all n digits when the numerical value D is expressed in quaternary is expressed as d [n-1], d [n-2], d [n-3], ..., d [2], d. If [1] and d [0], the numerical value C based on the arithmetic expression C = M ^D modZ is actually
C = ((... (((1 * M ^{d [n−1]} ) ⁴
* M ^{d [n-2]} modZ) ⁴
* M ^{d [n-3]} modZ) ⁴
.....
* M ^{d [2]} modZ) ⁴
* M ^{d [1]} modZ) ⁴
* M ^{d [0]} modZ
It is obtained by executing in order from the operation inside the parentheses using the equivalent operation expression.

  FIG. 7 is a diagram showing a specific calculation procedure when the secret key D of 22 [decimal] is applied in the quaternary notation in the calculation formula shown in FIG. That is, if 22 [decimal] is expressed in quaternary form, it becomes “112”. Therefore, in order to obtain the value of the numerical value C by the above equivalent arithmetic expression, n = 3, d [2] = 1, d [ 1] = 1, d [0] = 2 may be substituted.

The equivalent arithmetic expression shown in the lower part of FIG. 7 is an example in which such substitution is performed. If the operations inside the parentheses are executed in order, first, (1 * M ¹ ) ⁴ is executed, then, (X * M ¹ modZ) ⁴ is executed with the operation result as X, and finally, The calculation result is X, and (X * M ² modZ) is executed. In the case of quaternary notation, each digit constituting the secret key D takes a numerical value of 0 to 3, but M ³ = M * M * M, M ² = M * M, M ¹ = Since M and M ⁰ = 1, there will be a difference in power consumption depending on the numerical value taken by each digit, and each digit constituting the secret key D is 0-3 by the “side channel attack”. There is a possibility that it is estimated.

Such vulnerability to the “side channel attack” cannot be fundamentally eliminated even if the numerical value D is expressed in any number system. FIG. 8 is a diagram illustrating an example of an actual arithmetic expression when a power-residue operation using a secret key D in k-decimal is generally executed inside the cryptographic processing apparatus. That is, the numerical sequence of all n digits when the numerical value D is expressed in k is represented by d [n-1], d [n-2], d [n-3], ..., d [2], d. If [1] and d [0], the numerical value C based on the arithmetic expression C = M ^D modZ is actually
C = ((... (((1 * M ^{d [n−1]} ) ^k
* M ^{d [n-2]} modZ) ^k
* M ^{d [n-3]} modZ) ^k
.....
* M ^{d [2]} modZ) ^k
* M ^{d [1]} modZ) ^k
* M ^{d [0]} modZ
It is obtained by executing in order from the operation inside the parenthesis using the equivalent arithmetic expression as follows, but there is no change in the power consumption depending on the numerical value taken by each digit, and by `` side channel attack '' Each digit constituting the secret key D may be estimated.

  As described above, it has been explained that when performing power-residue calculation by a general RSA encryption method, a vulnerability due to “side channel attack” occurs. However, such problems include Diffie Hellman encryption method, EL Gamal encryption method, etc. This is a problem common to other cryptosystems that use exponentiation. Recently, the elliptic curve cryptosystem is also used, but the elliptic curve cryptosystem is still vulnerable to the “side channel attack”. The present invention proposes a new technique capable of dealing with such “side channel attacks” in various cryptographic schemes.

<<< §2. Basic concept of the present invention >>
An important feature of the present invention resides in that a numerical value D serving as a secret key is expressed in redundant k-adic numbers and used for actual calculation. Now, let us consider expressing the numerical value D in an arbitrary k-ary number as shown in FIG. In the figure, d [n-1], d [n-2], d [n-3],..., D [2], d [1], d [0] This is a numerical sequence of all n digits when expressed, and the value of the numerical value D expressed as this all n-digit numerical sequence is as shown in the figure:
D = d [n−1] * k ⁿ⁻¹
+ D [n-2] * k ^n-2
+ D [n-3] * k ^n-3
.....
+ D [2] * k ²
+ D [1] * k ¹
+ D [0] * k ⁰
It becomes.

Here, if the value of the i-th digit is d [i],
0 ≦ d [i] ≦ dmax
In the case of normal k-ary representation, dmax = k−1 is set. For example, in the case of binary representation, since dmax = 1 is set, the numerical value d [i] of each digit is either 0 or 1. In the case of the quaternary representation, dmax = 3 is set, so that the numerical value d [i] of each digit is 0 to 3, and in the case of the hexadecimal representation, dmax = 6 is set. The numerical value d [i] of each digit is one of 0-6.

On the other hand, in the case of redundant k-ary representation, dmax> k−1 is set. For example, in the case of redundant binary representation, dmax = 2 or more is set. As shown in FIG. 10 (a), in the case of normal binary representation, dmax = 1, so the numerical value d [i] of each digit is
0 ≦ d [i] ≦ 1 (value of each digit is 0 to 1)
However, in the case of redundant binary representation, if dmax = 3 is set, as shown in FIG.
0 ≦ d [i] ≦ 3 (value of each digit is 0-3)
It becomes.

  Of course, dmax in the redundant binary representation may be set to any number as long as it is 2 or more. If dmax = 5 is set, the numerical value d [i] of each digit is 0 to 5. Similarly, in the case of redundant quaternary representation, dmax = 4 or more may be set. For example, when dmax = 7, the numerical value d [i] of each digit is set to any one of 0-7. Thus, if dmax = 9 is set, the numerical value d [i] of each digit is one of 0-9.

  The important point here is that the same numerical value D can be expressed by a plurality of notation methods using redundant k-ary representation. FIG. 11 is a diagram illustrating an example in which the numerical value D = 22 [decimal] is represented by a normal binary expression and a redundant binary expression. “10110” in FIG. 11 (a) normally indicates a notation method in binary representation, whereas “10022” in FIG. 11 (b1), “01222” in FIG. 11 (b2), and FIG. “02030” of b3) indicates a redundant binary representation method (in addition to this, there is a redundant binary representation method of numerical value D = 22 [decimal]. Of course, FIG. a) “10110” is also included in one form of redundant binary representation). Comparing the notation methods, the five-digit numbers are different from each other. However, as is apparent from the calculation result on the right side, they all have the same numerical value D = 22 [decimal]. ing.

FIG. 12 is an example of a quaternary number. As shown in FIG. 12 (a), in the case of normal quaternary expression, dmax = 3, so the numerical value d [i] of each digit is
0 ≦ d [i] ≦ 3 (value of each digit is 0-3)
However, in the case of redundant quaternary representation, for example, if dmax = 7 is set, as shown in FIG.
0 ≦ d [i] ≦ 7 (value of each digit is 0-7)
It becomes.

  FIG. 13 is a diagram illustrating an example in which the numerical value D = 22 [decimal] is represented by a normal quaternary expression and a redundant quaternary expression. “112” in FIG. 13 (a) usually indicates a notation method in quaternary expression, whereas “106” in FIG. 13 (b1) and “052” in FIG. 13 (b2) are both. A notation method using a redundant quaternary representation is shown (in addition to this, there is a redundant quaternary notation method with a numerical value D = 22 [decimal]. Of course, “112” in FIG. (It will be included in a form of decimal expression). When the notation methods are compared, the configuration of the three-digit numbers is different from each other. However, as is apparent from the calculation result on the right side, they are common in that they all show the same numerical value D = 22 [decimal]. ing.

  In this way, even if the same numerical value D = 22 [decimal], if it is expressed using a redundant k-decimal number, it can be expressed by a plurality of notation methods. If any one of the notation methods is selected and used, even if the calculation based on the same arithmetic expression is repeated using the same numerical value D, the specific calculation process performed by the transistor circuit is Will be different. For this reason, even if a statistical method based on power analysis such as SPA or DPA is applied, it is difficult to estimate the numerical value D that is a secret key. This is the basic principle of the present invention.

  As described in §1, FIG. 5 is a diagram illustrating a procedure for performing an operation for obtaining the numerical value C using the normal binary notation “10110” of the secret key D of 22 [decimal]. On the other hand, FIG. 14 is a diagram showing a procedure for performing an operation for obtaining a numerical value C using “10022” which is one of redundant binary representations of the secret key D of 22 [decimal]. Since both are the same arithmetic expression and the numerical value of the secret key D is exactly the same, the calculation result of the numerical value C obtained is exactly the same in both cases. Therefore, even if the calculation shown in FIG. 14 is executed instead of the calculation shown in FIG. 5, there is no problem as a cryptographic processing calculation.

However, although the same numerical values M, D, and Z are given and the calculation based on the same calculation formula is executed, the calculation shown in FIG. 5 and the calculation shown in FIG. The power consumption during the calculation is different. That is, in the case of FIG. 5, (1 * M ¹ ) ² is executed, and (X * M ⁰ modZ) ² is executed with the operation result as X, and (X * M ¹ modZ) ² with the operation result as X. And (X * M ¹ modZ) ² is executed with the operation result as X, and (X * M ⁰ modZ) is executed with the operation result as X. In the case of FIG. 1 * M ¹ ) ² is executed, (X * M ⁰ modZ) ² is executed with the operation result as X, and (X * M ⁰ modZ) ² is executed with the operation result as X. (X * M ² modZ) ² is executed as X, and (X * M ² modZ) is executed with the operation result as X.

  Of course, as shown in FIG. 11, there are “01222”, “02030”, etc., as redundant binary representations of the secret key D of 22 [decimal], so these multiple redundant binary representations are selected at random. If the calculation is used for the calculation, the power consumption pattern will be different every time even though the same numerical values M, D, and Z are given and the calculation based on the same calculation formula is executed. . Therefore, even if a “side channel attack” is performed in which the power consumption inside the IC card is monitored and statistically analyzed, the uniformity of the obtained power consumption pattern is lost. It becomes difficult to estimate the value D by statistical analysis.

  Of course, the present invention is not limited to the example using redundant binary notation. As described in §1, FIG. 7 shows a procedure for performing an operation for obtaining the numerical value C using the normal quaternary notation “112” of the secret key D of 22 [decimal]. On the other hand, FIG. 15 is a diagram showing a procedure for performing an operation for obtaining the numerical value C using “106” which is one of the redundant quaternary representations of the secret key D of 22 [decimal]. Since both are the same arithmetic expression and the numerical value of the secret key D is exactly the same, the calculation result of the numerical value C obtained is exactly the same in both cases. Therefore, even if the calculation shown in FIG. 15 is executed instead of the calculation shown in FIG. 7, there is no problem as a cryptographic processing calculation.

However, although the same numerical values M, D, and Z are given and the calculation based on the same calculation formula is executed, the calculation shown in FIG. 7 and the calculation shown in FIG. The power consumption during the calculation is different. That is, in the case of FIG. 7, (1 * M ¹ ) ⁴ is executed, and (X * M ¹ modZ) ⁴ is executed with the operation result as X, and (X * M ² modZ) ² with the operation result as X. In the case of FIG. 15, (1 * M ¹ ) ⁴ is executed, and the operation result is executed as X (X * M ⁰ modZ) ⁴ and the operation result is set as X ( X * M ⁶ modZ) ² is executed.

Of course, the redundant quaternary representation of the secret key D of 22 [decimal] is “106”, “052”, etc. as shown in FIG. If it is used for the calculation, the power consumption pattern will be different every time even though the same numerical values M, D, and Z are given and the calculation based on the same calculation formula is executed. , Measures against “side channel attacks” are effective. In addition, the arithmetic expression used for the encryption process can be the same arithmetic expression “C = M ^D modZ”. Thus, an important feature of the present invention is that a side channel attack can be prevented without modifying the arithmetic expression itself used for encryption or decryption.

  After all, the essential technical idea of the present invention is that a first numerical value M is given from the outside to an arithmetic processing device having a numerical value D as a secret key, and at least the numerical value is given inside the arithmetic processing device. In the cryptographic processing method for generating a second numerical value C by executing an operation using M and the numerical value D and outputting the second numerical value C to the outside, the numerical value D is converted into one digit within the arithmetic processing unit. Random data expressed in redundant k-adic numbers in which the numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)” is generated, and the second numerical value C is generated using this random data. The point is to execute the operation to generate.

  In particular, if an IC card is used as an arithmetic processing unit, a numerical value D as a secret key is built in, and a first numerical value M is given from the outside to the IC card having an arithmetic processing function and a random number generation function. In an encryption processing method for generating a second numerical value C by executing an operation using at least the numerical value M and the numerical value D inside the IC card, and outputting the second numerical value C to the outside, Using random number generation function, random data expressing a numerical value D in redundant k-ary numbers in which a numerical value d of one digit takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)” And generating the second numerical value C using this random data.

<<< §3. Cryptographic processing apparatus according to the present invention >>
FIG. 16 is a block diagram showing the configuration of the cryptographic processing apparatus 100 according to the present invention. This cryptographic processing apparatus 100 can be incorporated in the IC card 10 as the cryptographic processing apparatus 12 shown in FIG. 3, for example. However, each block shown in FIG. 16 is actually a component that can be realized by hardware for a computer and a program incorporated in the computer. For example, an OS program or an application program is stored in the IC card 10. It will be realized by incorporating.

  The basic function of the cryptographic processing apparatus 100 shown in FIG. 3 is to generate a second numerical value C by performing an operation using a numerical value D as a secret key on the first numerical value M given from the outside. The process of outputting this to the outside is performed. Therefore, as illustrated, the cryptographic processing apparatus 100 includes an input unit 110 that inputs the first numerical value M from the outside, an output unit 120 that outputs the generated second numerical value C to the outside, and a second numerical value C. And a re-encoding unit 140, a secret key storage unit 150 that stores a numerical value D as a secret key, and a random number generation unit 160 that generates a random number R.

  Here, the re-encoding unit 140 is a component that re-encodes the numerical value D stored in the secret key storage unit 150 using the random number R generated by the random number generation unit 160. Re-encoding is a random n-digit number in which a numerical value D is represented by a redundant k-ary number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. It is done by expressing it as data.

  For example, the numerical value D stored in the private key storage unit 150 is D = 22 [decimal] (in the illustrated example, the numerical value D is stored in the private key storage unit 150 in the form of a normal binary number “10110”). If this is re-encoded into a form expressed in a redundant binary number (when the operation execution unit 130 performs an operation using the secret key D expressed in binary), Using the random number R, the re-encoding unit 140 uses “10022” in FIG. 11 (b1), “01222” in FIG. 11 (b2), “02030” in FIG. By randomly selecting one of “redundant binary notation corresponding to 22 [decimal]” (normally including “10110” in binary notation), an n-digit numerical value expressed in redundant binary notation is used. The process which produces | generates this data is performed. A specific method of such re-encoding will be described in §4.

The operation execution unit 130 uses a predetermined value at least using the numerical value M input by the input unit 110 and the numerical value D (n-digit numerical value expressed in redundant k-ary notation) re-encoded by the re-encoding unit 140. It is a component that generates the second numerical value C by performing an operation. Here, as described above, since the embodiment of the RSA encryption method is shown, the calculation execution unit 130 uses the predetermined constant Z set in advance to perform the calculation based on the calculation formula C = M ^D modZ. By doing so, the second numerical value C is obtained.

  As already described, this calculation is actually performed by iterative calculation using an equivalent calculation formula as shown in FIG. That is, the arithmetic execution unit 130 extracts the second numerical value by sequentially performing operations that extract and use the single-digit numerical value d from the n-digit data re-encoded by the re-encoding unit 140. C will be calculated.

  In the embodiment shown here, each time the input unit 110 inputs the first numerical value M from the outside, the random number generation unit 160 generates a new random number R, and the re-encoding unit 140 generates a new re-encoding. The calculation execution unit 130 performs a calculation to obtain the second numerical value C using the newly re-encoded numerical value D. Therefore, each time the first numerical value M is given, the combination of the n-digit numerical values constituting the numerical value D is renewed, and the operation execution unit 130 performs an operation using the renewed numerical value D. Will do.

  Of course, the combination of the n-digit numerical values constituting the numerical value D does not necessarily need to be updated every time the first numerical value M is input from the outside. For example, every time the first numerical value M is input three times. However, in order to effectively take measures against the “side channel attack”, as described above, the first numerical value M is updated every time it is input from the outside. Is preferred.

<<< §4. Specific method of re-encoding >>>
Finally, a specific procedure of the re-encoding process is illustrated by showing some specific configuration examples of the re-encoding unit 140 shown in FIG. However, the specific examples described below are merely examples, and the configuration of the re-encoding unit 140 used in the present invention is not limited to these examples.

<Example 1>
FIG. 17 is a block diagram illustrating a first configuration example of the re-encoding unit 140 of the cryptographic processing device illustrated in FIG. 16. As illustrated, in this example, the re-encoding unit 140A includes a control element 141A, a numerical value confirmation element 142A, and a random data generation element 143A.

  The random data generation element 143A has a function of generating n-digit random data by repeating the process of generating a value within the range of “0 ≦ d ≦ dmax” n times using the random number R given from the random number generation unit 160. Fulfill. The random data generated here is given to the numerical confirmation element 142A. The numerical value confirmation element 142A determines whether or not the random data generated by the random data generation element 143A is equal to the numerical value D read from the secret key storage unit 150, and reports the result to the control element 141A. The control element 141A causes the random data generation element 143A to repeatedly generate random data until it is determined that the numerical value confirmation element 142A is equal, and the random data when the numerical value confirmation element 142A is determined to be equal is determined. The data is output as re-encoded data (the numerical value D is an n-digit numerical value in redundant k-ary notation).

  18 is a flowchart for explaining the operation of the re-encoding unit 140A shown in FIG. First, in step S11, an n-digit random data generation process is performed by the random data generation element 143A. For example, as shown in FIG. 11, if random data consisting of a 5-digit number in which each numerical value ranges from 0 to 3 is generated, a random number having an integer value in the range from 0 to 3 is generated. This process is repeated five times, and the generated five integers are arranged and output as random data. In other words, random data is generated by rolling n dice having integer eyes from 0 to dmax and arranging the exited eyes as they are.

  Subsequently, in step S12, a comparison process by the numerical value confirmation element 142 is performed. That is, the numerical value indicated by the generated random data is compared with the numerical value D read from the secret key storage unit 150 (the value is determined by the addition shown in FIG. 9). Then, the control element 141A performs control such that the process of step S11 is repeated until it is determined to be equal in step S13. When it is determined that the control element 141A is equal, the process proceeds to step S14. It is output as re-encoded data.

  In short, the method exemplified as the first embodiment can be said to be a method of continuously rolling the dice until random data equal to the desired numerical value D is obtained. This method is a very simple method. However, when the value of the number of digits n or the value of k is large, it takes a long time until random data equal to the numerical value D is obtained. Absent.

<Example 2>
FIG. 19 is a block diagram illustrating a second configuration example of the re-encoding unit 140 of the cryptographic processing device illustrated in FIG. 16. As illustrated, in this example, the re-encoding unit 140B includes the control element 141B, the register 142B, the initial data setting element 143B, the increase correction execution element 144B, the decrease correction execution element 145B, the digit selection element 146B, and the increase / decrease determination element 147B. It is constituted by.

  The register 142B is a component for temporarily holding data consisting of k-ary n digits, which is a target of the re-encoding process. An initial value is set in the register 142B by an initial data setting element 143B. That is, the initial data setting element 143B uses the secret key D read out from the secret key storage unit 150 (in the illustrated example, the binary numeric value D), and the single digit numeric value d is “0 ≦ d ≦ k−1”. In this case, n-digit data is prepared, and the prepared data is set in the register 142B as initial data.

  On the other hand, the digit selection element 146B functions to select any one digit among the n digits of the register 142B as a selected digit using the random number R generated by the random number generator 160. Since the random number R is used, any one digit out of n digits is selected at random. The increase / decrease determination element 147B functions to determine either increase correction or decrease correction using the random number R generated by the random number generator 160. Since the random number R is also used here, increase correction or decrease correction is selected at random. The selection ratio between the increase correction and the decrease correction need not be 1: 1. Practically, it is preferable to set so that the selection frequency of increase correction is higher than the selection frequency of decrease correction.

  When the increase correction is determined by the increase / decrease determination element 147B, the increase correction execution element 144B satisfies d <dmax with respect to the numerical value d of the selected digit selected by the digit selection element 146B, and is determined by adjustment of other digits. Assuming that it is possible to cancel the increase correction amount δ (where δ ≦ dmax−d), the increase correction amount δ is added to the selected digit and the other digits are adjusted to cancel the increase correction amount δ. This is a component that performs correction.

  On the other hand, when the decrease correction is determined by the increase / decrease determination element 147B, the decrease correction execution element 145B satisfies d ≠ 0 for the numerical value d of the selected digit selected by the digit selection element 146B and On the condition that the predetermined reduction correction amount δ (where δ ≦ d) can be canceled by adjusting the digit, the reduction correction amount δ is subtracted from the selected digit, and the other digits are adjusted to decrease the correction correction amount. This is a component that performs correction to cancel δ.

  The control element 141B repeatedly executes the digit selection by the digit selection element 146B, the increase / decrease determination by the increase / decrease determination element 147B, and the correction by the increase correction execution element 144B or the decrease correction execution element 145B until a predetermined condition is satisfied. This is a component that outputs n-digit data in the register 142B when a predetermined condition is satisfied as re-encoded data.

  The basic policy of the re-encoding process performed by the re-encoding unit 140B shown here is that n-digit data representing a numerical value D in a normal k-ary number is first prepared in the register 142B, and is randomly selected in this register. The numerical value of the digit is corrected to increase / decrease within an allowable range in the redundant k-ary representation, and the adjustment is repeatedly executed so that the increase / decrease is offset by the increase / decrease of the numerical value of another digit. Since the increase / decrease in the value of the selected digit is offset by the increase / decrease in the value of another digit, the value of the data held in the register is always maintained at the value D.

  FIG. 20 is a flowchart for explaining the operation of the re-encoding unit 140B shown in FIG. First, in step S21, an initial value is set by the initial data setting element 143B. That is, n-digit data in normal k-ary notation corresponding to the numerical value D as the secret key is set in the register 142B.

  Subsequently, in step S22, digit selection is performed by the digit selection element 146B. In subsequent step S23, either increase correction or decrease correction is determined by the increase / decrease determination element 147B. When the increase correction is determined, the processes of steps S24 to S26 are executed by the increase correction execution element 144B. When the decrease correction is determined, the processes of steps S27 to S29 are executed by the decrease correction execution element 145B. Is done.

  That is, when increase correction is determined, a condition determination is made in step S24 as to whether or not increase correction is possible. Executed. If it is determined to be impossible, the process proceeds to step S30 without executing the increase correction through step S25. On the other hand, when the reduction correction is determined, in step S27, a condition judgment is made as to whether or not the reduction correction is possible. Executed. If it is determined that it is impossible, the process proceeds to step S30 without executing the decrease correction through step S28.

  In step S30, it is determined whether or not to end this procedure. That is, when a predetermined end condition set in advance is satisfied, it is determined that the procedure is ended, and the process proceeds to step S31. When the end condition is not satisfied, the procedure from step S22 is repeated. As the termination condition, for example, a condition based on the number of repetitions “the procedure from step S22 is repeated Q times” can be set. In this case, the count value of the counter is updated each time step S22 is executed, and when the value of the counter becomes equal to Q, it is determined that “the end condition is satisfied”. If the end condition is satisfied and the process proceeds to step S31, the n-digit numerical value stored in the register at that time is output as data indicating the re-encoded numerical value D (redundant k-ary notation). It will be.

  On the other hand, the condition determination in step S24 is somewhat complicated. Basically, d <dmax is satisfied for the numerical value d of the selected digit, and a predetermined increase correction amount δ (where δ ≦ dmax−d) can be canceled by adjusting other digits. Judgment may be made. The former condition is a condition for determining whether or not the value of the selected digit can be increased. When performing a redundant k-ary expression in which the numerical value d of one digit takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”, the numerical value of the selected digit is determined unless d <dmax. It cannot be increased any further. On the other hand, the latter condition is a condition for canceling the value corresponding to the increase correction amount δ with the decrease correction for other digits when the numerical value of the selected digit is increased by δ.

  A more specific example of such condition determination is shown in the flowchart of FIG. In other words, the illustrated example is a simple example in which the increase correction amount δ = k is always set, and the numerical value d of the selected digit imposes a stricter condition of d + k ≦ dmax. This is a condition for preventing dmax from being exceeded even if an increase correction amount k is added to the numerical value of the selected digit. On the other hand, with regard to the condition determination “whether or not the increase correction k can be canceled by adjusting other digits”, the condition determination “whether there is a non-zero digit in the upper part of the selected digit” is made. Substituting. This is because, in the case of data expressed in k-adic, the correction for adding k to the numerical value of the selected digit can be surely canceled by the correction of subtracting 1 from the numerical value of the immediately higher digit (adjacent upper digit) of the selected digit. (In k-ary notation, the numerical value k of the selected digit corresponds to the numerical value 1 of the adjacent upper digit).

  If it is determined that such a condition is satisfied, the increase correction shown in step S26 is executed. Specifically, an increase correction that adds k to the selected digit is performed, and an offset process is performed to subtract 1 from the adjacent upper digit (even if the adjacent upper digit is 0, it is not a 0 that exists further above it) Subtraction using digits).

  On the other hand, in the condition determination in step S27, basically, d ≠ 0 is satisfied for the numerical value d of the selected digit, and a predetermined decrease correction amount δ (where δ ≦ d) is canceled by adjusting other digits. What is necessary is just to judge that it is possible to do. The former condition is a condition for determining whether or not the numerical value of the selected digit can be decreased. When the numerical value d of the selected digit is 0, it cannot be further reduced. On the other hand, the latter condition is a condition for canceling the value corresponding to the decrease correction amount δ by increasing correction for other digits when the numerical value of the selected digit is decreased by δ.

  The flowchart of FIG. 20 shows a specific example of condition determination regarding the reduction correction. That is, the example shown in the drawing is a simple example in which the decrease correction amount δ = 1 is always set, and the condition judgment “whether or not the decrease correction amount 1 can be offset by adjusting other digits” is determined. Substitutes the condition judgment “d + k ≦ dmax for adjacent lower digits”. This is because, in the case of data expressed in the k-ary notation, the correction of subtracting 1 from the numerical value of the selected digit can always be canceled by the correction of adding k to the numerical value of the digit immediately below the selected digit (adjacent lower digit) ( In k-ary notation, the numerical value 1 of the selected digit corresponds to the numerical value k of the adjacent lower digit).

  If it is determined that such a condition is satisfied, the reduction correction shown in step S29 is executed. Specifically, a decrease correction for subtracting 1 from the selected digit is performed, and an offset process for adding k to the adjacent lower digits is performed.

  FIG. 21 is a transition diagram showing an example of re-encoding processing of binary data based on the flowchart of FIG. Here, as shown in the first line, it is assumed that data “10110” in which D = 22 [decimal] is normally expressed in binary is set in the register as initial data, dmax = 3 is set, and 1 Consider a case where re-encoding is performed to random five-digit data represented by a redundant binary number in which a numerical value d of one digit takes a value in a range of “0 ≦ d ≦ 3”. In the figure, (+) indicated above a specific digit indicates that the digit is a selected digit to be subject to increase correction, and (-) indicated above the specific digit indicates that the digit is reduced correction. It shall indicate that the selected digit is the target.

  Now, as shown in the second line of the figure, if the selection for increasing correction is performed for the second digit from the right, the selection satisfies the condition of step S24 in FIG. That is, since the numerical value d of the selected digit is 1, k = 2, and dmax = 3, the condition “d + k ≦ dmax” is satisfied, and there is a non-zero digit above the selected digit. Therefore, the increase correction in step S26 is executed, and the first transition occurs as shown in the third line of the figure. “10030” obtained in the register is a redundant binary number, and its value remains D = 22 [decimal].

  Next, as shown in the fourth line in the figure, if the selection for increasing correction is performed for the fourth digit from the right, the selection also satisfies the condition of step S24 in FIG. That is, the numerical value d of the selected digit is 0, and k = 2 and dmax = 3. Therefore, the condition “d + k ≦ dmax” is satisfied, and there is a non-zero digit above the selected digit. Therefore, the increase correction in step S26 is executed, and the second transition occurs as shown in the fifth line of the figure. “02030” obtained in the register is a redundant binary number, and its value remains D = 22 [decimal].

  Subsequently, as shown in the sixth line of the figure, if the selection for increasing correction is performed for the fifth digit from the right, the selection does not satisfy the condition of step S24 in FIG. That is, since the numerical value d of the selected digit is 0, and k = 2 and dmax = 3, the condition “d + k ≦ dmax” is satisfied. However, no digit other than 0 exists in the upper part of the selected digit. Therefore, the process returns from step S25 to step S22 via step S30, and selection is performed again. Here, as shown in the seventh line of the figure, if the selection for increasing correction is performed for the fourth digit from the right, the selection still does not satisfy the condition of step S24 in FIG. That is, since the value d of the selected digit is 2, k = 2, and dmax = 3, the condition “d + k ≦ dmax” is not satisfied, and there is one non-zero digit in the upper part of the selected digit. do not do. Therefore, the process returns from step S25 to step S22 via step S30, and selection is performed again.

  Therefore, as shown in the eighth line in the figure, if the selection for increasing correction is performed for the first digit from the right, the selection satisfies the condition of step S24 in FIG. That is, the numerical value d of the selected digit is 0, and k = 2 and dmax = 3. Therefore, the condition “d + k ≦ dmax” is satisfied, and there is a non-zero digit above the selected digit. Therefore, the increase correction in step S26 is executed, and the third transition occurs as shown in the ninth line of the figure. “0202” obtained in the register is a redundant binary number, and its value remains D = 22 [decimal].

  Next, as shown in the 10th line in the figure, if the selection for performing the reduction correction is performed for the third digit from the right, the numerical value d of the selected digit is 0, so that the selection is performed in step S27 in FIG. Does not meet the conditions. Therefore, the process returns from step S28 to step S22 through step S30, and selection is performed again. Here, as shown in the eleventh line in the figure, if the selection for performing the reduction correction is performed for the second digit from the right, the selection still does not satisfy the condition of step S27 in FIG. That is, since the numerical value d of the selected digit is 2, although the condition of d ≠ 0 is satisfied, the numerical value d = 2 of the adjacent lower digit (that is, the first digit from the right) is “d + k” for the adjacent lower digit. The condition “≦ dmax” is not satisfied. Therefore, the process returns from step S28 to step S22 through step S30, and selection is performed again.

  In this case, as shown in the twelfth line of the figure, if the selection for performing the reduction correction is performed for the fourth digit from the right, the selection satisfies the condition of step S27 in FIG. That is, since the numerical value d of the selected digit is 2, the condition that d ≠ 0 is satisfied, and the numerical value d = 0 of the adjacent lower digit (that is, the third digit from the right) is “d + k ≦ The condition “dmax” is also satisfied. Therefore, the decrease correction in step S29 is executed, and the fourth transition occurs as shown in the thirteenth line of the figure. “01222” obtained in the register is a redundant binary number, and its value remains D = 22 [decimal].

  By executing such a transition process, the 5-digit numerical value stored in the register at the time when the termination condition in step S30 is satisfied is re-encoded as data indicating the numerical value D (redundant binary notation). Will be output. In either case, the value remains unchanged at D = 22 [decimal].

  Here is another example of quaternary cases. FIG. 22 is a transition diagram showing an example of quaternary data re-encoding processing based on the flowchart of FIG. Here, as shown in the first line, it is assumed that data “112” in which D = 22 [decimal] is normally expressed in a quaternary notation is set in the register as initial data, dmax = 7 is set, and 1 Consider a case where re-encoding is performed to random three-digit data expressed by a redundant quaternary number in which a numerical value d of one digit takes a value in a range of “0 ≦ d ≦ 7”.

  First, as shown in the second line of the figure, if the selection for performing the reduction correction is performed for the second digit from the right, the selection satisfies the condition of step S27 in FIG. That is, since the numerical value d of the selected digit is 1, the condition that d ≠ 0 is satisfied, and the numerical value d = 2 of the adjacent lower digit (that is, the first digit from the right) is “d + k ≦ The condition “dmax” is also satisfied. Therefore, the decrease correction in step S29 is executed, and the first transition occurs as shown in the third line of the figure. “106” obtained in the register is a redundant quaternary number, and its value remains D = 22 [decimal].

  Next, as shown in the fourth line of FIG. 20, if the selection for reducing the second digit from the right is performed again, the numerical value d of the selected digit is 0. The condition of S27 is not satisfied. Therefore, the process returns from step S28 to step S22 through step S30, and selection is performed again. Here, as shown in the fifth line in the figure, if the selection for increasing correction is performed for the third digit from the right, the selection does not satisfy the condition of step S24 in FIG. That is, the numerical value d of the selected digit is 1, and k = 4 and dmax = 7. Therefore, although the condition “d + k ≦ dmax” is satisfied, no digit other than 0 exists in the upper part of the selected digit. Therefore, the process returns from step S25 to step S22 via step S30, and selection is performed again.

  Now, as shown in the sixth line of the figure, if the selection for performing the reduction correction is performed for the third digit from the right, the selection satisfies the condition of step S27 in FIG. That is, since the numerical value d of the selected digit is 1, the condition that d ≠ 0 is satisfied, and the numerical value d = 0 of the adjacent lower digit (that is, the second digit from the right) is “d + k ≦ The condition “dmax” is also satisfied. Therefore, the reduction correction in step S29 is executed, and the second transition occurs as shown in the seventh line of the figure. “046” obtained in the register is a redundant quaternary number, and its value remains D = 22 [decimal].

  By executing such a transition process, the three-digit numerical value stored in the register at the time when the termination condition in step S30 is satisfied is re-encoded as data indicating the numerical value D (redundant quaternary notation). Will be output. In either case, the value remains unchanged at D = 22 [decimal].

  The example using the conditions exemplified in steps S24 and S27 of FIG. 20 has been described above. As described above, in this example, the increase correction amount δ in the case of the increase correction is always set to k, and the case of the decrease correction is performed. In this example, the reduction correction amount δ is always set to 1, and the amount of increase / decrease is canceled only by adjusting the numerical value of the adjacent upper digit or the adjacent lower digit. Therefore, practically, more flexible increase / decrease correction can be performed by setting more flexible conditions.

  The example shown in the eighth and subsequent lines in FIG. 22 is an example in which more flexible increase / decrease correction is performed in this way. For example, the eighth line shows an example in which selection for increasing correction with an increasing correction amount δ = 1 is performed for the second digit from the right. As shown in the 9th line as a result of the third transition, such an increase correction is actually possible. In this example, in order to increase the numerical value of the selected digit by 1 and cancel this, adjustment is performed by subtracting 4 from the numerical value of the adjacent lower digit (first digit from the right). “052” obtained in the register is a redundant quaternary number, and its value remains D = 22 [decimal].

  In the following 10th line, an example is shown in which the selection for performing the increase correction with the increase correction amount δ = 1 is performed for the third digit from the right. As shown in the eleventh line as a result of the fourth transition, such an increase correction is actually possible. In this example, in order to increase the numerical value of the selected digit by 1 and cancel this, adjustment is performed by subtracting 4 from the numerical value of the adjacent lower digit (second digit from the right). “112” obtained in the register is the same data as the initial data, and normally takes a quaternary form, but this is still one of the representation forms of redundant quaternary numbers.

  The next 12th line shows an example in which the increase correction amount δ = 4 is selected for the first digit from the right, and the 13th line is shown as the fifth transition result. As shown, in order to increase the numerical value of the selected digit by 4 and cancel this, adjustment is performed by subtracting 1 from the numerical value of the adjacent upper digit (second digit from the right). “106” obtained in the register is the same data as the first transition result. However, the results of the first transition were data obtained as a result of the decrease correction for the second digit from the right, whereas the results of the fifth transition were an increase correction for the first digit from the right. It is the data obtained as a result of.

<Example 3>
FIG. 23 is a block diagram illustrating a third configuration example of the re-encoding unit 140 of the cryptographic processing device illustrated in FIG. 16. As illustrated, in this example, the re-encoding unit 140C includes a redundant data generation element 141C, a numerical value B generation element 142C, a numerical value A generation element 143C, a numerical value D holding element 144C, and a numerical value E generation element 145C. .

  The basic policy of the re-encoding process by the re-encoding unit 140C shown here is that the numerical value D is first divided into two numerical values A and B that satisfy D = A + B, and these numerical values A and B are usually expressed in binary notation. Then, the specific bit part of the numerical value A and the specific bit part of the numerical value B are added with the digits slightly shifted to determine the one-digit numerical value of the redundant data.

  In order to prevent side channel attacks, it is most effective to prevent clues relating to the secret key D from being obtained even if statistical analysis is performed. For this purpose, it is preferable that the n-digit numerical value constituting the data re-encoded by the redundant k-ary representation is a numerical value selected completely at random. In other words, it is ideal to make the appearance frequency of numerical values between 0 and dmax uniform for each of n-digit numerical values. In the method of the second embodiment described above, normal k-ary data is used as initial data that is the starting point of the transition process, and therefore, the appearance frequency of numerical values between 0 and dmax tends to be biased.

On the other hand, according to the method of the third embodiment described here, there is an advantage that the appearance frequency of the numerical value between 0 and dmax can be made uniform. In this regard, the method of the third embodiment described here is a method that the inventor considers the most preferable embodiment. However, since this method is premised on re-encoding for an arbitrary integer m under the conditions of k = 2 ^m and dmax = 2 ^2m −1, the numerical value of each digit is 0 to 0 in the redundant 2 ^m- ary number. The precondition that it takes a value in the range of 2 ^{2 m} −1 is required. For example, when m = 1 is set, re-encoding with a redundant binary number in which the numerical value of each digit takes a value in the range of 0 to 3 is assumed. When m = 2 is set, This is premised on re-encoding with a redundant quaternary number in which a numerical value is in a range of 0 to 15.

  In FIG. 23, a numerical value D holding element 144C is a component that holds the numerical value D read from the secret key storage unit 150 as a binary number of m × n bits (m and n are integers), and a numerical value E generation element 145C. Is a component that generates an arbitrary numerical value E satisfying “E <D” as an m × n-bit binary number using the random number R generated by the random number generation unit 160. Also, the numerical value A generation element 143C is a component that generates a new numerical value A by replacing the lower m bits (m bits on the least significant side) of the numerical value E with 0, and the numerical value B generation element 142C is It is a component that generates a numerical value B consisting of an m × n-bit binary number by an operation of B = DA.

On the other hand, the redundant data generation element 141C counts a numerical value for m bits continuous from the (m × (i + 1))-th bit to the lower order when counting from the lower order side of the bits constituting the numerical value A, and the numerical value B A numerical value consisting of 2 m bits in which the numerical value for m bits continuous from the (m × i) -th bit toward the lower side counted from the lower side of the constituting bits is a lower bit (where i = 1 to n, For the numerical value A, the upper digit is supplemented with m bits of 0), the n-th digit data is generated as the i-th digit counted from the lower side, and this is a numerical value D expressed in redundant 2 ^m base numbers. This is a component that is output as data indicating.

  FIG. 24 is a flowchart for explaining the operation of the re-encoding unit 140C shown in FIG. Step S41 shows processing performed by the numerical value D holding element 144C, and the numerical value D is prepared as a binary number of m × n bits (m and n are integers). Step S42 shows processing performed by the numerical value E generation element 145C, and an arbitrary numerical value E satisfying “E <D” is generated as a m × n-bit binary number using the random number R. The numerical value E shown here and the key E shown in FIGS. 1 and 2 happen to use the same sign, but they are completely irrelevant values. Step S43 shows processing performed by the numerical value A generation element 143C, and a new numerical value A is generated by replacing the lower m bits (the lowest m bits) of the numerical value E with 0. Step S44 shows processing performed by the numerical value B generation element 142C, and a numerical value B composed of an m × n-bit binary number is generated by an operation of B = DA.

Further, step S45 are executed by the redundant data generation element 141C is carried out by combining each bit of the numerical A, B, data consisting of n-digit redundant 2 ^m binary numbers is generated. Specifically, as described above, a numerical value for m bits consecutive from the (m × (i + 1))-th bit to the lower order counted from the lower order side of the bits constituting the numerical value A is the upper bit, and the numerical value B is A numerical value consisting of 2 m bits in which the numerical value for m bits continuous from the (m × i) -th bit toward the lower side counted from the lower side of the constituting bits is a lower bit (where i = 1 to n, As for the numerical value A, n-digit data is generated in which the upper side is supplemented with m bits of 0) and the i-th digit is counted from the lower side.

  As described above, the operation of the re-encoding unit 140C illustrated in FIG. 23 has been described as a general theory. Next, the operation will be described in detail by exemplifying a specific numerical value D.

  FIG. 25 is a transition diagram showing an example of re-encoding processing of binary data based on the flowchart of FIG. In this example, m = 1 and n = 4 are set. Since this is an example of m = 1, it is assumed that k = 2 and dmax = 3 are set (that is, re-encoding in redundant binary notation in which each digit takes a value of 0 to 3 is assumed).

  First, in step S41, the numerical value D is prepared as an m × n-bit binary number. Here, a case where a numerical value of D = 11 [decimal] is prepared as a 4-bit normal binary number “1011” is considered. In the subsequent step S42, a numerical value E is generated as a m × n-bit binary number satisfying “E <D” using the random number R. Here, as shown in the figure, it is assumed that a numerical value E represented by a normal binary number “0111” is generated. In the next step S43, a new numerical value A is generated by replacing the lower m bits of the numerical value E with 0. In this example, since m = 1, the numerical value A “0110” is generated by replacing the lower 1 bit of the numerical value E “0111” with 0. In step S44, a numerical value B consisting of an m × n-bit binary number is generated by an operation of B = DA. In this example, a numerical value B “0101” composed of a 4-bit binary number is generated by the operation of B = DA.

  Thus, two numerical values A “0110” and numerical value B “0101” are generated, and these two numerical values A and B are values obtained by dividing the original numerical value D into two. In other words, A + B = D. It should also be noted that the lower m bits (1 bit) of the numerical value A are 0.

  The lower part of FIG. 25 schematically shows the process of step S45 in the case where such specific numerical values A “0110” and numerical values B “0101” are used. As described above, the processing in step S45 is performed by using m bits of numerical values that are consecutive from the (m × (i + 1))-th bit as counted from the lower order side of the bits constituting the numerical value A to the upper bits and the numerical value B. A numerical value consisting of 2 m bits, where m is a numerical value for m bits continuous from the (m × i) -th bit to the lower order, counting from the lower side of the bits constituting i (where i = 1 to n) The numerical value A is supplemented with m bits of 0 on the upper side), and n-digit data is generated as the i-th digit counted from the lower side.

  If this process is applied to a specific case of m = 1 and i = 1, a numerical value for 1 bit continuous from the second bit toward the lower side counted from the lower side of the bits constituting the numerical value A is obtained. The upper bit and the numerical value consisting of 2 bits counting from the lower side of the bits constituting the numerical value B, starting from the first bit and continuing to the lower bit, are the lower bits. It will be the first digit. As shown in the figure, in this case, since the upper bit is “1” and the lower bit is “1”, the numerical value “3” consisting of two bits “11” is the numerical value of the first digit counted from the lower side. become.

  Similarly, if applied to a specific case where m = 1 and i = 2, the numerical value for one bit continuous from the third bit toward the lower side counted from the lower side of the bits constituting the numerical value A A numerical value consisting of 2 bits, counting from the lower side of the bit and the bit constituting the numerical value B, with the lower bit being a numerical value for one bit continuous from the second bit toward the lower side, is counted second. This is the second digit. As shown in the figure, in this case, since the upper bit is “1” and the lower bit is “0”, the numerical value “2” consisting of 2 bits “10” is the numerical value of the second digit counted from the lower side. become.

  Further, if applied to a specific case where m = 1 and i = 3, the numerical value for one bit continuous from the fourth bit toward the lower order when counted from the lower order side of the bits constituting the numerical value A is the upper bit. , Counting from the lower side of the bits that make up the numerical value B, the third bit counting from the lower side is a numerical value consisting of 2 bits, with the lower bit being the numerical value for one bit continuous from the third bit toward the lower side. It will be a digit. As shown in the figure, in this case, the upper bit is “0” and the lower bit is “1”, so the numerical value “1” consisting of 2 bits “01” is the numerical value of the third digit counted from the lower side. become.

  Finally, if applied to a specific case of m = 1 and i = 4, the fifth bit counted from the low order side of the bits constituting the numerical value A (the numerical value A is 0 for 1 bit on the high order side). The numerical value for one bit that continues from the bottom to the lower bit is counted from the lower side of the bits that make up the numerical value B, and the numerical value that continues from the fourth bit toward the lower is the lower bit. , A 2-bit numerical value is counted as the fourth digit from the lower order side. As shown in the figure, in this case, the upper bits are supplemented “0” and the lower bits are “0”, so the numerical value “0” consisting of two bits “00” is counted from the lower side to the fourth. It becomes a numerical value of digits.

  Thus, in the process of step S45, redundant binary data “0123” is generated. The value of this data matches D = 11 [decimal]. This is because, as shown in the lower part of FIG. 25, the redundant binary data “0123” is data obtained by addition of numerical value A and numerical value B (combined addition by shifting bits). Naturally. Although the rightmost bit of the numerical value A is not used for addition, since the lower 1 bit of the numerical value A is originally set to be 0, there is no problem even if this bit is not subject to addition. (This is why the lower m bits are replaced with 0 in step S43).

  FIG. 26 is a transition diagram showing another example of binary data re-encoding processing based on the flowchart of FIG. Here, an example in which m = 1 and n = 4 is shown, and the setting of k = 2 and dmax = 3 is assumed.

  In this example, a case where a numerical value D = 5 [decimal] is prepared as a 4-bit normal binary number “0101” and a numerical value E expressed by a normal binary number “0010” is generated is illustrated. ing. In this case, the numerical value A “0010” is generated by replacing the lower 1 bit of the numerical value E with 0. However, since the lower 1 bit of the numerical value E was originally 0, the numerical value A is not different from the numerical value E in practice. On the other hand, the numerical value B “0011” is generated by the calculation of B = DA. Thus, two numerical values A “0010” and numerical value B “0011” are generated, and A + B = D.

  The lower part of FIG. 26 schematically shows the process of step S45 when using such specific numerical values A “0010” and B “0011”. Eventually, redundant binary data “0013” is generated. The value of this data matches the original numerical value D = 5 [decimal].

  FIG. 27 is a transition diagram showing an example of re-encoding processing of quaternary data based on the flowchart of FIG. In this example, m = 2 and n = 3 are set. Since it is an example of m = 2, it is assumed that k = 4 and dmax = 15 are set (that is, re-encoding by redundant quaternary notation in which each digit takes a value of 0 to 15 is assumed).

  First, in step S41, the numerical value D is prepared as an m × n-bit binary number. Here, consider a case where a numerical value of D = 53 [decimal] is prepared as a 6-bit normal binary number “110101”. In the subsequent step S42, a numerical value E is generated as a m × n-bit binary number satisfying “E <D” using the random number R. Here, as shown in the figure, it is assumed that a numerical value E represented by a normal binary number “011010” is generated. In the next step S43, a new numerical value A is generated by replacing the lower m bits of the numerical value E with 0. In this example, since m = 2, the numerical value A “011000” is generated by replacing the lower 2 bits of the numerical value E “011010” with 0. In step S44, a numerical value B consisting of an m × n-bit binary number is generated by an operation of B = DA. In this example, a numerical value B “011101” composed of a 6-bit binary number is generated by the operation of B = DA.

  Thus, two numerical values A “011000” and numerical value B “011101” are generated. Again, A + B = D. It should also be noted that the lower m bits (2 bits) of the numerical value A are 0.

  The lower part of FIG. 27 schematically shows the process of step S45 in the case where such specific numerical values A “011000” and numerical values B “011101” are used. As described above, the processing in step S45 is performed by using m bits of numerical values that are consecutive from the (m × (i + 1))-th bit as counted from the lower order side of the bits constituting the numerical value A to the upper bits and the numerical value B. A numerical value consisting of 2 m bits, where m is a numerical value for m bits continuous from the (m × i) -th bit toward the lower side, counting from the lower side of the bits constituting i (where i = 1 to n) The numerical value A is supplemented with m bits of 0 on the upper side), and n-digit data is generated as the i-th digit counted from the lower side.

  If this process is applied to a specific case of m = 2 and i = 1, a numerical value for 2 bits continuous from the fourth bit toward the lower side counted from the lower side of the bits constituting the numerical value A is obtained. Counting from the low order side, a 4-bit numerical value, starting from the low order side of the 2nd bit starting from the 2nd bit, counting from the low order side of the high-order bits and the bits constituting the numerical value B It will be the first digit. As shown in the figure, in this case, the upper bit is “10” and the lower bit is “01”, so the numerical value “9” consisting of 4 bits “1001” is the numerical value of the first digit counted from the lower side. become.

  Similarly, if applied to a specific case where m = 1 and i = 2, the numerical value for 2 bits continuous from the sixth bit toward the lower side counted from the lower side of the bits constituting the numerical value A A numerical value consisting of 4 bits, in which the numerical value of 2 bits continuous from the 4th bit toward the lower side is counted as the lower bit from the lower side of the bits constituting the bit and the numerical value B, is counted from the lower side. This is the second digit. As shown in the figure, in this case, since the upper bits are “01” and the lower bits are “11”, the numerical value “7” consisting of 4 bits “0111” is the numerical value of the second digit counted from the lower side. become.

  Finally, if applied to a specific case of m = 1, i = 3, the eighth bit counted from the lower side of the bits constituting the numerical value A (the numerical value A is 0 for 2 bits on the upper side). 2 bits continuous from the 6th bit to the lower order, counting from the lower order side of the bits that make up the numerical value B. , A numerical value consisting of 4 bits is counted as the third digit from the lower side. As shown in the figure, in this case, the upper bits are supplemented “00” and the lower bits are “01”, so the numerical value “1” consisting of 4 bits “0001” is the third number counted from the lower side. It becomes a numerical value of digits.

  Thus, in the process of step S45, redundant quaternary data “179” is generated. The value of this data matches D = 53 [decimal]. This is because, as shown in the lower part of FIG. 27, the redundant quaternary data “179” is data obtained by the addition of numerical value A and numerical value B (combined addition with shifted bits). Naturally. Although the lower 2 bits of the numerical value A are not used for addition, since the lower 2 bits of the numerical value A are originally set to be 0, there is no problem even if these bits are not to be added (step). This is why the lower m bits are replaced with 0 in S43).

<Other examples>
As described above, some specific configuration examples of the re-encoding unit 140 illustrated in FIG. 16 have been illustrated. However, the configuration of the re-encoding unit 140 used in the present invention is not limited to these examples. Various other configuration examples can be used.

  In the configuration examples described so far, a new re-encoding process is executed each time. However, a plurality of variations in which the secret key D is written in a redundant k-ary system is stored in advance as a list. It is also possible to use a random number by selecting one from the list at random. For example, the form of expressing D = 22 [decimal] in the redundant binary system is “10110”, “10022”, “01222”, “02030”,... As shown in FIG. For example, in the case of a cryptographic processing apparatus storing a value D = 22 [decimal] as a secret key D, data corresponding to the above variations is stored as a list. The re-encoding unit 140 may perform a process of randomly selecting any one piece of data on the list based on the random number R and delivering it to the operation execution unit 130.

  However, as one of the side channel attacks, a technique for statistically analyzing the addressing process performed inside the cryptographic processing apparatus is known. In other words, when the CPU accesses the memory, it is possible to estimate the accessed address by statistically analyzing the power consumption using a phenomenon in which the power consumption varies depending on the address value. Therefore, as described above, a plurality of variations representing the secret key D in redundant k-ary notation are stored in advance as a list, and one is randomly selected from this list and used. Information on which data on the list was used may be estimated by statistical analysis of power consumption. In order to counter such a side channel attack, it is preferable to execute a new re-encoding process each time as in the embodiments described above.

<<< §5. Various modifications >>
As mentioned above, although this invention was demonstrated based on some specific Examples, of course, this invention is not limited to these Examples. For example, the modular exponentiation method described in §1 and §2 is an arithmetic method generally called “Left to Right Exponentiation” (an arithmetic method that processes exponents sequentially from left to right). However, instead of this method, it is also possible to adopt a calculation method called “Right to Left Exponentiation” in which exponents are processed sequentially from right to left. Further, in the embodiments described so far, the example in which the present invention is applied to the power-residue calculation expression including the term of M raised to the D power has been described. Of course, the cryptographic processing apparatus according to the present invention has been described in the embodiments. The present invention is not limited to application to a specific arithmetic expression, and can be applied to any arithmetic expression including a numerical value M and a numerical value D.

  For example, the present invention can be applied to the calculation of elliptic curve cryptography. Elliptic curve cryptography is recently attracting attention as the next-generation public key cryptosystem, and is a set of numbers (x, y) (referred to as “rational points”) that satisfy a three-variable cubic equation called “elliptic curve”. All the various ciphers that can be realized with an arithmetic expression that handles (note that the numbers x and y in this expression are not real numbers but discrete numbers such as Galois field GF (p)). In this arithmetic expression that handles rational points, “point addition” is defined, in which two rational points are input and one other rational point is output, and one rational point is added multiple times. The process of “multiplication” is included.

  Scalar multiplication of rational points is a basic process used in all elliptic curve cryptography. In elliptic curve cryptography, the number of scalars that determines how many rational points are added when performing scalar multiplication. Becomes secret information. From this point of view, the scalar number is secret information corresponding to an index for performing a power residue such as RSA encryption.

  The present invention is also effective for protecting the scalar number, which is secret information in the above-described elliptic curve cryptography calculation, from power analysis. The scalar multiplication process in this elliptic curve encryption calculation is very similar to the above-described calculation process for calculating the power residue, and the fundamental idea is common. That is, when the present invention is applied to elliptic curve cryptography, first, the input point (rational point) determined based on the numerical value M is set to P, the scalar number is set to D, and the re-encoding method described above is applied to the scalar number D. However, it may be used as an input for a scalar multiplication operation.

In general, the operation of multiplying a rational point P by a scalar value [D] is
[D] * P = P + P +... + P (However, D on the right side is D)
This is done by copying D rational points P and adding the points. Specifically, the scalar value [D] is expressed using a binary number of (n + 1) bits,
[D] = d [n] * 2 ⁿ + d [n-1] * 2 ^(n-1) + ...
+ D [1] * 2 + d [0]
(The numerical value d [i] of the i-th bit is 0 or 1), d [n] = 1, and adopting a method similar to the RSA described above,
[D] * P = [2] * ([2] ... * ([2] * ([2] * ([2] * P
+ D [n-1] * P)
+ D [n-2] * P)
+ D [n-3] * P)
+ ..................
+ D [1] * P)
+ D [0] * P
The scalar multiplication that multiplies the rational point P by D can be executed by the repeated calculation.

  Therefore, if the present invention is applied to the above repetitive calculation, a method of re-encoding the scalar value [D] with a redundant k-adic number may be employed. If redundant binary numbers are used, the ith bit indicating [D] is set to d [i], and for example, re-encoding is performed so that d [i] ε0, 1, 2, 3 Good. In this case, if values such as [2] * P, [3] * P are previously obtained by calculation and stored, these stored values can be used in actual calculation.

Various calculation methods are known for the process of obtaining twice the rational point P and the process of adding two different rational points. For example, the first rational point P is P = (x ₁ , y ₁ ), the second rational point Q is Q = (x ₂ , y ₂ ), and the sum of the two is (x ₃ , y ₃ ) Then, it is known that the sum “P + Q” = (x ₃ , y ₃ ) can be obtained by the following calculation.
x ₃ = λ ² -x ₁ -x ₂
y ₃ = λ (x ₁ −x ₃ ) −y ₁
λ = (y ₂ −y ₁ ) / (x ₂ −x ₁ ) (when P ≠ Q)
λ = (3 × ₁ ² + a) / (2y ₁ ) (when P = Q)
xi, yi, a∈GF (p) (where i = 1, 2, or 3)
Char (GF (p)) ≠ 2,3
Various other methods are known as specific calculation methods for such elliptic curve cryptography, but detailed description thereof is omitted here.

  An important point in applying the present invention to elliptic curve cryptography is that the scalar value [D] is re-encoded with a redundant k-ary number and then each bit d [i] constituting the re-encoded [D] is used. The point is that the above operation is repeatedly executed. Therefore, a specific arithmetic expression is not limited to the above example.

  Of course, the present invention is not limited to use for so-called encryption and decryption processing, and can be used for, for example, DSA (Digital Signature Algorithm).

  In the present invention, it is a very important concept to express the numerical value D in a redundant k-adic number using the random number R. Here, the redundant k-adic number is a number in which the numerical value d of one digit takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. However, it is not always necessary to use all integers in the range of 0 to dmax, and only a part of the integers in the range may be limited. For example, in a redundant quaternary number, when dmax = 19 is set, the numerical value d of one digit is an integer that takes a value in the range of 0 to 19, and all integers in this range are used as candidates. The numerical value d is one of 20 integers from 0 to 19. At this time, for example, it is possible to make an arrangement such as “4 to 15 are not used”, in which case the numerical value d is 0, 1, 2, 3, 16, 17, 18, 19 Thus, re-encoding is performed so as to be one of the eight kinds of integers. Specifically, if the decimal number “181” is expressed by a redundant quaternary number using the above eight integers, it becomes a 4-digit numerical value of “1/2/17/17”. Thus, the “redundant k-ary number” referred to in the present invention is a number in which the numerical value d of one digit takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. Although it is necessary, the candidates for the numerical value d are not necessarily all integers in the range of 0 to dmax, and may be partial integers in the range.

It is a block diagram which shows the process of the encryption and decoding using a general public key encryption system. It is a figure which shows the modular multiplication formula which should be utilized with the general RSA encryption system. 1 is a block diagram showing a general system using an RSA encryption method for authentication between an IC card 10 and an external device 20. FIG. It is a figure which shows an example of the actual arithmetic expression at the time of performing the power-residue calculation using the binary secret key D inside a cryptographic processing apparatus. FIG. 5 is a diagram illustrating a specific calculation procedure when the secret key D of 22 [decimal] is applied in binary notation in the calculation formula illustrated in FIG. 4. It is a figure which shows an example of the actual arithmetic expression at the time of performing the power-residue calculation using the secret key D of a quaternion number inside a cryptographic processing apparatus. FIG. 7 is a diagram illustrating a specific calculation procedure when the secret key D of 22 [decimal] is applied in the quaternary notation in the calculation formula illustrated in FIG. 6. It is a figure which shows an example of the actual arithmetic expression at the time of performing the power-residue calculation using the secret key D of the k-ary number inside the encryption processing apparatus. It is a figure which shows the structure of each digit at the time of expressing numerical value D in k notation. It is a figure which shows the difference between normal binary expression and redundant binary expression. It is a figure which shows the example which represented numerical value D = 22 [decimal] by normal binary expression and redundant binary expression. It is a figure which shows the difference with normal quaternary expression and redundant quaternary expression. It is a figure which shows the example which represented numerical value D = 22 [decimal] by normal quaternary expression and redundant quaternary expression. FIG. 5 is a diagram showing a specific calculation procedure when the secret key D of 22 [decimal] is applied in redundant binary notation in the calculation formula shown in FIG. 4. FIG. 7 is a diagram illustrating a specific calculation procedure when the secret key D of 22 [decimal] is applied in redundant quaternary notation in the calculation formula illustrated in FIG. 6. It is a block diagram which shows the structure of the encryption processing apparatus which concerns on this invention. It is a block diagram which shows the 1st structural example of the re-encoding part 140 of the encryption processing apparatus shown in FIG. 18 is a flowchart illustrating an operation of a re-encoding unit 140A illustrated in FIG. It is a block diagram which shows the 2nd structural example of the re-encoding part 140 of the encryption processing apparatus shown in FIG. 20 is a flowchart for explaining the operation of a re-encoding unit 140B shown in FIG. FIG. 21 is a transition diagram illustrating an example of re-encoding processing of binary data based on the flowchart of FIG. 20. FIG. 21 is a transition diagram illustrating an example of quaternary data re-encoding processing based on the flowchart of FIG. 20. It is a block diagram which shows the 3rd structural example of the re-encoding part 140 of the encryption processing apparatus shown in FIG. It is a flowchart explaining the operation | movement of the re-encoding part 140C shown in FIG. FIG. 25 is a transition diagram illustrating an example of re-encoding processing of binary data based on the flowchart of FIG. 24. It is a transition diagram which shows another example of the re-encoding process of binary data based on the flowchart of FIG. FIG. 25 is a transition diagram illustrating an example of re-encoding processing of quaternary data based on the flowchart of FIG. 24.

Explanation of symbols

10: IC card 11: control unit 12: cryptographic processing device 20: external device 21: authentication processing unit 22: cryptographic processing device 100: cryptographic processing device 110: input unit 120: output unit 130: calculation execution unit 140: re-encoding Unit 140A: Re-encoding unit 141A: Control element 142A: Numerical value confirmation element 143A: Random data generation element 140B: Re-encoding unit 141B: Control element 142B: Register 143B: Initial data setting element 144B: Increase correction execution element 145B: Decrease Correction execution element 146B: Digit selection element 147B: Increase / decrease determination element 140C: Re-encoding unit 141C: Redundant data generation element 142C: Numerical value B generation element 143C: Numerical value A generation element 144C: Numerical value D holding element 145C: Numerical value E generation element 150 : Secret key storage unit 160: random number generation unit A: numerical value B used for re-encoding Value C used in the No. of: second numerical (ciphertext)
D: Secret key d: Each digit of the secret key dmax: Maximum value of d E: Public key M: First numerical value (plain text)
R: random numbers S11 to S45: each step in the flowchart Z: constant

Claims (14)

An encryption processing device that performs processing using a numerical value D serving as a secret key on a first numerical value M given from outside to generate a second numerical value C and output it to the outside. There,
An input unit for inputting the first numerical value M from outside;
A secret key storage unit for storing a numerical value D as a secret key;
A random number generator for generating a random number R;
Using the generated random number R, the numerical value D is expressed by a redundant k-ary number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. A re-encoding unit that re-encodes the generated random n-digit data;
An operation execution unit for obtaining a second numerical value C by performing a predetermined operation using at least the numerical value M and the re-encoded numerical value D;
An output unit for outputting the second numerical value C obtained by the calculation execution unit to the outside;
A cryptographic processing apparatus comprising: The cryptographic processing device according to claim 1,
Arithmetic execution unit, by performing a calculation based on the arithmetic expression of the scalar multiplication to elliptic curve cryptography scalar values D a rational point P determined based on a predetermined arithmetic expression or M includes a term of M ^D, second numerical A cryptographic processing device characterized by obtaining C. The cryptographic processing device according to claim 2,
Arithmetic execution unit, by performing a calculation based on the arithmetic expression C = M ^D modZ indicating the modular exponentiation of time obtained by dividing the M ^D at a predetermined numerical Z, encryption processing and obtaining a second value C apparatus. The cryptographic processing device according to claim 3,
The re-encoding unit sequentially converts the numerical value D into d [n−1], d [n−2], d [n−3],..., D [2], d [1] in order from the upper digit side. , D [0] to perform re-encoding into n-digit data,
The calculation execution unit performs a calculation based on the calculation formula C = M ^D modZ.
C = ((... (((1 * M ^{d [n−1]} ) ^k
* M ^{d [n-2]} modZ) ^k
* M ^{d [n-3]} modZ) ^k
.....
* M ^{d [2]} modZ) ^k
* M ^{d [1]} modZ) ^k
* M ^{d [0]} modZ
An encryption processing apparatus that executes in order from an operation inside a parenthesis using an equivalent operation expression. The cryptographic processing device according to claim 1,
An encryption processing apparatus, wherein the operation execution unit obtains the second numerical value C by performing an operation for generating RSA encryption, Diffie Hellman encryption, EL Gamal encryption, or elliptic curve encryption. In the cryptographic processing device according to any one of claims 1 to 5,
The calculation execution unit obtains the second numerical value C by repeatedly executing in order the calculation using the single-digit numerical value d extracted from the n-digit data re-encoded by the re-encoding unit. A cryptographic processing device characterized by the above. The cryptographic processing device according to any one of claims 1 to 6,
Each time the input unit inputs the first numerical value M from the outside, the random number generation unit generates a new random number R, the re-encoding unit performs new re-encoding, and the operation execution unit newly re-encodes A cryptographic processing apparatus that performs an operation for obtaining a second numerical value C using the numerical value D. In the cryptographic processing device according to any one of claims 1 to 7,
The re-encoding unit
A random data generation element that generates n-digit random data by repeating a process of generating a value within a range of “0 ≦ d ≦ dmax” using the random number R n times;
A numerical confirmation element for determining whether or not the generated random data is equal to the numerical value D;
Data obtained by re-encoding the random data when the random number generation element is repeatedly determined to determine that the numerical value confirmation elements are equal, and the random data generation element repeatedly generates random data. A control element to output as
A cryptographic processing device comprising: In the cryptographic processing device according to any one of claims 1 to 7,
The re-encoding unit
a register holding n digits of data;
By expressing a numerical value D as a secret key with a normal k-adic number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ k−1”, n-digit data is prepared, An initial data setting element for setting the prepared data in the register as initial data;
A digit selection element that selects any one digit among the n digits of the register as a selection digit using the generated random number R;
An increase / decrease determination element that determines either increase correction or decrease correction using the generated random number R;
When the increase correction is determined by the increase / decrease determination element, d <dmax is satisfied for the numerical value d of the selected digit, and a predetermined increase correction amount δ (where δ ≦ dmax− an increase correction execution element for performing correction for adding the increase correction amount δ to the selected digit and adjusting the other digits to cancel the increase correction amount δ on the condition that d) can be canceled ,
When the decrease correction is determined by the increase / decrease determining element, d ≠ 0 is satisfied for the numerical value d of the selected digit, and a predetermined decrease correction amount δ (where δ ≦ d) is obtained by adjusting other digits. On the condition that it is possible to cancel out, the reduction correction execution element that performs the correction to subtract the decrease correction amount δ by adjusting the other digit by subtracting the decrease correction amount δ from the selected digit,
Until the predetermined condition is satisfied, the digit selection by the digit selection element, the increase / decrease determination by the increase / decrease determination element, the correction by the increase correction execution element or the decrease correction execution element are repeatedly executed, and the register when the predetermined condition is satisfied A control element that outputs n-digit data as re-encoded data,
A cryptographic processing device comprising: In the cryptographic processing device according to any one of claims 1 to 7,
The re-encoding unit
A numerical value D holding element for holding the numerical value D as a binary number of m × n bits (m and n are integers);
A numerical value E generation element for generating an arbitrary numerical value E satisfying “E <D” as a binary number of m × n bits using the random number R;
A numerical value A generation element for generating a new numerical value A by replacing the lower m bits of the numerical value E with 0;
A numerical value B generating element for generating a numerical value B consisting of an m × n-bit binary number by an operation of B = D−A;
Counting m bits of consecutive numbers from the (m × (i + 1)) th bit down to the lower order of the bits constituting the numerical value A, from the lower bits of the bits constituting the numerical value B A numerical value consisting of 2m bits in which the numerical value for m bits continuous from the (m × i) -th bit to the lower order is the lower bit (provided that i = 1 to n, and for numerical value A, m the a supplement) 0 bits, to generate a n-digit data to the i-th digit as counted from the lower side, the redundant data generation output as data indicating the numerical D expressing this in redundant 2 ^m ary Elements and
A cryptographic processing device comprising:   An IC card incorporating the cryptographic processing device according to claim 1.   A program for causing a computer to function as the cryptographic processing apparatus according to claim 1. A first numerical value M is given from the outside to an arithmetic processing unit having a numerical value D serving as a secret key, and an arithmetic operation using at least the numerical value M and the numerical value D is performed inside the arithmetic processing unit. In the cryptographic processing method for generating the second numerical value C by executing it and outputting it to the outside,
Inside the arithmetic processing unit, the numerical value D is expressed by a redundant k-ary number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. A cryptographic processing method characterized by generating random data and executing an operation for generating a second numerical value C using the random data. A numerical value D serving as a secret key is incorporated, and a first numerical value M is given from the outside to an IC card having an arithmetic processing function and a random number generation function, and at least the numerical value M and the numerical value D are provided inside the IC card. In a cryptographic processing method for generating a second numerical value C by performing an operation using and outputting this to the outside,
Inside the IC card, the numerical value D is represented by a random k-ary number in which a single-digit numerical value d takes a value within the range of “0 ≦ d ≦ dmax (where dmax> k−1)”. A cryptographic processing method, wherein data is generated using the random number generation function, and an operation for generating a second numerical value C using the random data is executed.

Images