JP2012018210A - Rijndael type 192-bit block encryption device, method, and program thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a Rijndael type 192-bit block encryption device capable of adding a rounding difference to more bytes in a process of calculation of a Rijndael type 192-bit block cipher and having the same encryption processing capability as that of a conventional device.SOLUTION: A Rijndael type 192-bit block encryption device comprises: a RoundKey storage unit in which a RoundKey for each round is stored in advance; and a ciphertext generation unit for generating a ciphertext by using a Rijndael type 192-bit block encryption algorithm for applying a round function in which four calculations of a ByteSub, a ShiftRow, a MixColumn, and an AddRoundKey are set as one round, to an inputted 192-bit plaintext repeatedly in a plurality of rounds by using the RoundKey read from the RoundKey storage unit for each round. A ShiftRow parameter (s,s,s,s) of the ShiftRow calculation is (0,1,3,4).

Description

  The present invention relates to a more secure block cipher design technique, and more particularly, to a Rijndael type 192bit block encryption apparatus, method, and program thereof, which is more secure against a round-off differential attack of a Rijndael type 192bit block cipher. .

A block cipher E _k of block size N-bit is converted from N-bit plain text P to N-bit cipher text E _k (P) using a secret key K shared in advance between the sender and the receiver. This is a K-dependent replacement process to be generated.

In the algorithm of the Rijndael type 192bit block cipher (see Non-Patent Document 1), E _k repeatedly applies a process called a round function R _{k to} a 192bit input block for a plurality of rounds (preferably 12 rounds or more). It is. That is, the encryption process for plaintext P blocked in 192-bit units can be described as follows using 192-bit variables X _i (i = 0, 1,..., T−1).

X ₀ ← P
X _{i + 1} ← R _k (X _i )
E _k (P) ← X _t
In the Rijndael type 192-bit block cipher algorithm, 1 byte (8 bits) is handled as one element, and as shown in FIG. 4, a 192-bit block is expressed as a 4 × 6 matrix consisting of 24 elements (bytes). Here, each row in the horizontal direction of the matrix is i ^th row (i = 0,1,2,3), and each column in the vertical direction is j ^th column (j = 0,1,2,3,4,5). The entire 192 bits (24 bytes) is called a state.

The round function R _k is a function that applies four operations of ByteSub, ShiftRow, MixColumn, and AddRoundKey in this order.

  ByteSub is non-linear bit transposition, and performs bit transposition inside each byte.

ShiftRow is a non-linear transposition process, and as shown in FIG. 5A, each byte in the i-th row is cyclically shifted to the left by s _i bytes. The four variables s ₀ , s ₁ , s ₂ , and s ₃ are called ShiftRow parameters. In Non-Patent Document 1, (s ₀ , s ₁ , s ₂ , s ₃ ) = (0, 1, 2,3).

  The MixColumn performs a process of multiplying each Column by a 4 × 4 matrix as shown in FIG. The 4 × 4 matrix here is a predetermined one in Non-Patent Document 1.

  AddRoundKey is input with 4 × 6 matrix after MixColumn operation and RoundKey, which is a 4 × 6 matrix generated for each round from secret key K by a predetermined method in Non-Patent Document 1, and each element of both matrices Output the exclusive OR of.

Joan Daemen, Vincent Rijmen, "AES Proposal: Rijndael", NIST AES Proposal, 1998, last updated at 1999

When two different plaintexts P and P ′ are encrypted, an exclusive OR (xor) for each bit between a value calculated for P and a value calculated for P ′ is called a difference. . For example, the plaintext difference is represented by P xor P ′, and the ciphertext difference is represented by E _k (P) xor E _k (P ′). Differences in the middle of computation can be defined similarly.

  When two different plaintexts P and P ′ are encrypted, it is desirable that the values of the two encryption calculation processes and the calculation results behave independently and randomly. That is, it is not desirable that the difference is a biased value, that is, the difference is small as a whole of the calculation process.

  The difference is used as one important index in evaluating the security of the block cipher. A block cipher that can easily find a plaintext pair with bias in the difference is evaluated as insecure, and a block cipher that is difficult to find is evaluated as safe.

  As an extension of the idea of difference, a plurality of bits, such as byte units, are considered at the same time, and one that indicates whether there is a difference in any one bit or there is no difference in all bits is called a rounding difference. The existence of an attack method based on this rounding difference is known for encryption schemes that perform processing in byte units, such as the Rijndael type 192-bit block cipher (rounding differential attack).

  It can be said that in the calculation process, the larger the cumulative number of bytes having rounding differences, the safer the differences are. Therefore, the designer of the block cipher needs to design such that the difference is as biased as possible, that is, the cumulative number of bytes having the rounding difference is as large as possible.

However, in the Rijndael type 192-bit block cipher disclosed in Non-Patent Document 1, only 42 bytes (for the sake of simplicity, only the number of bytes at the beginning of each R _k process is counted) is rounded by a 5-round conversion process using the round function R _k. There is a problem in that there is a rounding difference propagation path that does not have a difference.

FIG. 6 illustrates a process in which the cumulative rounding difference is 42 bytes in the conversion processing (# 1 to 5) of 5 rounds. The gray part is a byte having a rounding difference, and when there is a rounding difference only in the upper right corner byte before processing as shown in FIG. 6, the cumulative number of rounding differences after the conversion processing of 5 rounds is minimized. The rounding difference that was 1 byte before processing is 4 bytes in the first round, from 4 bytes to 16 bytes in the second round, 16 bytes are maintained in the third round, and from 16 bytes to 4 bytes in the fourth round, 4 bytes in the fifth round. It is 1 byte. Therefore, the cumulative total is 42 (= 1 + 4 + 16 + 16 + 4 + 1) bytes. Of the four operations of the round function R _k , ByteSub and AddRoundKey are processes within each byte, and are not related to propagation of the rounding difference to other bytes, so a byte having a rounding difference before and after the calculation. No change will occur. In addition, the calculation of MixColumn is that if there is no rounding difference in all 4 bytes of input, there is no rounding difference in all 4 bytes of output, otherwise there is a rounding difference in at least 5 bytes in the total of 8 bytes of input and output. Although having a property called MDS, the MixColumn operation of each round in FIG. 6 satisfies the property of the rounding difference byte number of MDS.

  An object of the present invention is to provide a Rijndael type 192-bit block encryption apparatus and method which can give a rounding difference to a larger number of bytes in the process of Rijndael type 192-bit block cipher operation and have the same encryption processing capability as in the past. And providing the program.

The Rijndael type 192-bit block encryption device of the present invention uses four operations of ByteSub, ShiftRow, MixColumn, and AddRoundKey as one round for the RoundKey storage unit in which the RoundKey for each round is stored in advance and the input 192-bit plaintext. A round function, using a RoundKey read from the RoundKey storage unit for each round, and a ciphertext generation unit that generates a ciphertext using a Rijndael type 192-bit block encryption algorithm that repeatedly applies multiple rounds,
The ShiftRow parameters (s ₀ , s ₁ , s ₂ , s ₃ ) of the ShiftRow operation are ( ₀ , ₁ , ₃ , 4).

  According to the present invention, by appropriately selecting the ShiftRow parameter, a larger number of bytes have a rounding difference in the calculation process. Since the change of ShiftRow parameter does not affect the encryption processing capacity, it provides the Rijndael type 192bit block encryption device, method, and program thereof that are safer than before while ensuring the same encryption processing capacity as before. be able to.

The figure which shows the mode of transition of the byte which has a rounding difference at the time of applying the round function of this invention which optimized the ShiftRow parameter to the input sentence 5 rounds. 1 is a block diagram showing a configuration example of a Rijndael type 192-bit block encryption device 100. FIG. The figure which shows the example of a processing flow of the Rijndael type | mold 192bit block encryption apparatus 100. FIG. The figure which shows the image which makes a 192bit variable a 4x6 matrix. The figure which shows the image of ShiftRow calculation and MixColumn calculation. The figure which shows the mode of transition of the byte which has a rounding difference at the time of applying the round function of a prior art 5 rounds to an input sentence.

The present invention optimizes the ShiftRow parameter used for the ShiftRow operation in the round function R _k in order to give more bytes a rounding difference in the process of the Rijndael type 192-bit block cipher operation. Specifically, ( ₀ , ₁ , ₃ , 4) is used as the ShiftRow parameter (s ₀ , s ₁ , s ₂ , s ₃ ).

FIG. 1 shows a rounding difference in a 5-round conversion process (# 1 to 5) when (0,1,3,4) is used as the ShiftRow parameter (s ₀ , s ₁ , s ₂ , s ₃ ). It shows how a byte with has transitioned. The gray part is a byte having a rounding difference, and when there is a rounding difference only in the upper right corner byte before processing as shown in FIG. 1, the cumulative number of rounding differences after the 5-round conversion processing is minimized. The rounding difference, which was 1 byte before processing, is 4 bytes in the first round, from 4 bytes to 16 bytes in the second round, from 16 bytes to 24 bytes in the third round, from 24 bytes to 8 bytes in the fourth round, and 8 bytes in the fifth round. It is 2 bytes. Therefore, the cumulative total is 55 (= 1 + 4 + 16 + 24 + 8 + 2) bytes.

Thus, by using ( ₀ , ₁ , ₃ , ₄ ) as the ShiftRow parameters (s ₀ , s ₁ , s ₂ , s ₃ ), a pattern that generates a 42-byte rounding difference shown in FIG. 6 cannot be formed. Instead, the pattern shown in FIG. 1 generates a minimum rounding difference of 55 bytes.

  FIG. 2 is a block diagram illustrating a configuration example of the Rijndael type 192-bit block encryption device 100 that performs encryption using the ShiftRow parameter. FIG. 3 shows an example of the processing flow (S1 to S7). Other than the applied ShiftRow parameter, the configuration and processing flow are the same as in the case of the prior art.

  The Rijndael type 192bit block encryption apparatus 100 includes a ByteSub operation unit 110 that performs ByteSub operation, a ShiftRow operation unit 120 that performs ShiftRow operation, a MixColumn operation unit 130 that performs MixColumn operation, an AddRoundKey operation unit 140 that performs AddRoundKey operation, and a RoundKey for each round. Is provided with a RoundKey storage unit 150 stored in advance. RoundKey is a 4 × 6 matrix generated for each round from the secret key K by a predetermined method.

The plain text is input in blocks of 192 bits (S1), and encryption processing is performed for each block. In processing, each block is handled as a 4 × 6 matrix in byte units as shown in FIG. The 192-bit block converted into a 4 × 6 byte matrix is first initialized by taking the exclusive OR with the RoundKey of the first round read from the RoundKey storage unit 150 by the AddRoundKey calculation unit 140 (S2). This initialized matrix is input to the ByteSub 110, and the ByteSub operation is first performed (S3). Subsequently, the ShiftRow operation unit 120 sets ( ₀ , ₁ , ₁ ) as the ShiftRow parameters (s ₀ , s ₁ , s ₂ , s ₃ ). 3) is performed (S4), then the MixColumn operation unit 130 performs the MixColumn operation (S5), and then the AddRoundKey operation unit 140 reads the data from the RoundKey storage unit 150. An exclusive OR with the RoundKey of the second round is taken (S6). Then, after repeating the processes of S3 to S6 for a plurality of rounds (preferably 12 rounds or more) using the RoundKey of each round, the obtained result is output as ciphertext (S7).

  As described above, according to the present invention, by appropriately selecting the ShiftRow parameter, a larger number of bytes are given a rounding difference in the course of calculation. Since the change of ShiftRow parameter does not affect the encryption processing capacity, it provides the Rijndael type 192bit block encryption device, method, and program thereof that are safer than before while ensuring the same encryption processing capacity as before. be able to.

  Each of the above processes is not only executed in time series according to the description, but may also be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. In addition, it can change suitably in the range which does not deviate from the meaning of this invention.

  Further, when the Rijndael type 192-bit block encryption apparatus of the present invention is realized by a computer, the processing contents of the functions possessed by each part of the apparatus are described by a program. The program is stored in, for example, a hard disk device, and necessary programs and data are read into a RAM (Random Access Memory) at the time of execution. The read program is executed by the CPU, whereby each processing content is realized on the computer. Note that at least a part of the processing content may be realized by hardware.

Claims (5)

A RoundKey storage unit in which the RoundKey for each round is stored in advance,
A Rijndael type 192bit that applies a round function that uses four rounds of ByteSub, ShiftRow, MixColumn, and AddRoundKey to one round to the input 192bit plaintext, using the RoundKey read from the RoundKey storage unit for each round. A ciphertext generator that generates ciphertext using a block encryption algorithm;
A Rijndael type 192bit block encryption device comprising:
The Rijndael type 192-bit block encryption device, wherein the ShiftRow parameters (s ₀ , s ₁ , s ₂ , s ₃ ) of the ShiftRow operation are ( ₀ , ₁ , ₃ , 4). In the Rijndael type 192bit block encryption device according to claim 1,
The Rijndael type 192bit block encryption device characterized in that the number of rounds to which the round function is applied is 12 or more. The ciphertext generator uses the RoundKey that is read from the RoundKey storage unit for each round as a round function that takes four operations of ByteSub, ShiftRow, MixColumn, and AddRoundKey as one round to the input 192-bit plaintext. A Rijndael type 192bit block encryption method for generating ciphertext using a Rijndael type 192bit block encryption algorithm to be repeatedly applied,
The Rijndael type 192-bit block encryption method, wherein ShiftRow parameters (s ₀ , s ₁ , s ₂ , s ₃ ) of the ShiftRow operation are ( ₀ , ₁ , ₃ , 4). In the Rijndael type 192bit block encryption method according to claim 3,
The Rijndael type 192bit block encryption method characterized in that the round number of round functions is 12 or more.   A program for causing a computer to function as the Rijndael type 192-bit block encryption device according to claim 1.