JP2014197785A - Encryption processing circuit, decryption processing circuit, method therefor, and program therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a circuit capable of cutting back a redundant part in encryption processing, and capable of reducing a mask value storage region by improving a processing speed.SOLUTION: An initial mask arithmetic unit exclusive-OR's plain text and an initial mask value. A first permutation unit sorts input to a non-linear conversion unit. The non-linear conversion unit masks input to a plurality of non-linear conversion tables, performs non-linear conversion in conformity with the table, and outputs a value derived by masking the non-linearly converted value with an output-side mask. A second permutation unit sorts output from the non-linear conversion unit. A linear conversion unit applies linear conversion to the value outputted from the second permutation unit. A key arithmetic unit performs an arithmetic operation on the value outputted from the linear conversion unit and a round key. An unmask unit exclusive-OR's the output of the key arithmetic unit after the termination of round processing and an unmask value, and outputs the result as a cryptogram.

Description

  The present invention relates to an encryption processing circuit, a decryption processing circuit, a method thereof, and a program thereof, and more particularly to an encryption processing circuit, a decryption processing circuit, a method thereof, and a program thereof in consideration of tamper resistance.

  As information is converted into electronic data, encryption is an indispensable technology for information protection and confidential communication. In order to maintain the security of encryption, it is necessary to prevent secret information such as keys from being easily guessed. Cryptographic analysis methods such as exhaustive key search, linear decryption that performs mathematical decryption, and differential decryption are known. However, it can be said that this kind of cryptographic analysis method makes it impossible to perform analysis in a realistic time.

  On the other hand, in devices (encryption modules) that implement cryptographic functions such as portable terminals, side channels are assumed under the assumption that attackers can accurately measure side channel information such as processing time, power consumption, and leakage electromagnetic waves. Side-channel attacks that attempt to acquire confidential information from information and countermeasures have become a major research theme.

  As a side channel attack, there is a power analysis attack that measures the power consumption of a cryptographic module and analyzes secret information such as a key from the power consumption. Among them, differential power analysis, in which analysis is performed by performing statistical processing on a plurality of power consumption waveforms, is regarded as a particularly powerful attack method (Non-Patent Document 1).

  In a cryptographic module, when there is a bias in the transition probability of logic gates, it is said that there is a correlation between the number of bits that become 1 in the data string (Hamming weight) and power consumption (Non-Patent Document). 2). In addition, when generating a ciphertext by executing a predetermined encryption process a predetermined number of times, it is said that there is a correlation between register bit transition (Hamming distance) and power consumption before and after the encryption process (non- Patent Document 3). Therefore, there is a problem that the secret key can be analyzed by paying attention to the Hamming weight and the Hamming distance.

  A masking technique has been proposed as an example of a countermeasure technique against an attack focusing on the Hamming weight and the Hamming distance (Non-Patent Document 4). In the masking technique, when calculating using an input value and a key, a random number called a mask value is calculated together with the input value and the key. Further, round processing is performed using an intermediate value masked by the mask value. Nonlinear conversion during round processing is performed using, for example, a conversion table. A table used for nonlinear conversion is generated every time the mask value changes. The table used for the non-linear transformation receives a value obtained by masking the intermediate value, and outputs a value obtained by re-masking the value obtained by non-linear transformation of the original intermediate value. Since the intermediate value is masked, the correlation between the power consumption and the intermediate value decreases. For this reason, the secret key cannot be analyzed due to the Hamming weight or the like, and the security is increased.

  Patent Document 1 discloses a fixed value mask method as a method for solving the problem of the masking method using random numbers. In the fixed value mask method, two or more fixed values are prepared in advance as a mask. Next, a table with a mask to be paired with each mask is prepared. This table with a mask receives as input a value obtained by multiplying an intermediate value by a mask value that forms a set, and outputs a value obtained by multiplying the original intermediate value by a non-linear transformation and the mask value that forms a set. Then, at the start of encryption processing, a set of mask and table is selected according to the random number, and encryption processing is performed using the selected mask and table. The mask value is switched by re-assigning the random number each time encryption processing is performed. By preparing a mask value and a table as fixed values, it is possible to solve the problems of a decrease in processing speed and an increase in a RAM (Random Access Memory) area, which are problems in the technique of Non-Patent Document 4.

  Non-Patent Document 5 proposes a Rotating Sboxes Masking (RSM) method as a countermeasure method in AES (Advanced Encryption Standard). In the RSM method, similarly to the fixed value mask method, a plurality of mask values and a table (SBOX) with a mask are prepared. At the time of cryptographic processing, the plurality of mask values and tables are used in parallel. In RSM, the input data string is shifted before processing in the table to rotate the mask value to be used and the table. After processing in the table, an output data string with a mask is output. The data string with the mask is returned to the original data position by reversely shifting the data string of the output result. By rotating the table to be used, the mask value applied to each byte of data can be exchanged. In addition, since the unused mask value and table are not output, the use efficiency of the circuit is increased.

  In Patent Document 2, as a configuration for reducing the processing time and the circuit scale necessary for preventing the decryption of the secret key in the common key encryption process, the first path selection means is a random number generated by the random number generation means. A plurality of extended key mask values are randomly rearranged according to the value of the key, and the extended key calculation means excludes the rearranged plurality of extended key mask values, the data string representing the extended key, and the input data string The second path selection means rearranges the exclusive OR data string by performing the reverse sorting of the first path selection means according to the random number value, and nonlinearly The converting unit 104 performs non-linear conversion of the rearranged data sequence and outputs a data sequence masked by a plurality of non-linear conversion mask values, and the third path selecting unit outputs the first data according to the random number value. Do the same sort as In encryptor is disclosed sort masked data sequence.

JP 2002-366029 A (Patent No. 4596686) JP 2008-131108 A

P. Kocher, J. Jaffe and B. Jun, "Introduction to Differential Power Analysis and Related Attacks," 1998. Akihiko Sasaki, Kimiaki Abe, "Evaluation of algorithm level resistance against power difference analysis attacks on cryptographic circuits," 2006. E. Brier, C. Clavier, and F. Olivier, "Correlation Power Analysis with a Leakage Model," 2004. Thomas S. Messerges, "Securing the AES Finalists Against Power Analysis Attacks," 2000. M. Nassar, Y. Souissi, S. Guilley and J.-L. Danger, "RSM: a Small and Fast Countermeasure for AES, Secure against 1st and 2nd -order Zero-Offset SCAs," 2012. NAKAHARA Jorge Jr, "3D: A Three-Dimensional Block Cipher," 2008.

  The analysis of related technology is given below.

  In the masking method using random numbers disclosed in Non-Patent Document 4, it is necessary to recalculate a table used for nonlinear conversion every time the mask value (random number) changes. For this reason, there are problems of a reduction in processing speed and an increase in necessary storage capacity (RAM (Random Access Memory) area).

  In the method of Patent Document 1, since it is necessary to prepare a plurality of mask values and tables as many as the number of mask values, a ROM (Read Only Memory) area for storing the mask values and tables is required. In addition, since any one of a plurality of mask value and table sets is selected, the mask value and the table that are not selected become redundant portions during the encryption process.

  The RSM method disclosed in Non-Patent Document 5 has a problem that a lot of ROM area is required to store the mask. In the RSM method, linear processing (ShiftRows, MixColumns, AddRoundKey) is performed after table processing. Then, after those processes, the mask changed by the linear process is released (unmasked). Furthermore, it is necessary to reapply the mask value used in the next round process (remasking). It is necessary to store a mask value for the unmask and remask in the ROM. It is necessary to prepare mask values for the shift width types. Therefore, the ROM area for storing the mask value becomes large. Further, processing time and a circuit for performing unmasking and remasking are required, and the cost increases in terms of time and circuit scale.

  Also in the method of Patent Document 2, when performing a linear process and a nonlinear process repeatedly, an exclusive OR of a data string for canceling the mask for the previous linear process and a plurality of new mask values is performed. It requires a mask calculation means to generate, a ROM area for storing a data string for releasing the mask and a new mask value, a processing time and a circuit for releasing the mask and applying again, and an RSM. Similarly, the cost increases in terms of time and circuit scale.

  Accordingly, the present invention has been made in view of the above problems, and its purpose is to enable reduction of redundant portions in cryptographic processing, increase of processing speed, and reduction of mask value storage area. It is an object to provide an encryption processing circuit, a decryption processing circuit, a method thereof, and a program thereof.

According to the present invention,
A random number generator for generating random numbers;
A selection unit that sets an initial value of a selection value using the random number as an input, and updates the next selection value every time round processing ends,
An initial mask operation unit that selects an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and performs an exclusive OR of the selected initial mask and the input plaintext;
A first permutation unit for rearranging the pattern corresponding to the selection value from the selection unit to the input data string and outputting the rearranged result;
A non-linear transformation unit including a plurality of tables each for non-linear transformation of a value obtained by dividing the output of the first permutation unit into a plurality of values;
A second reordering of the pattern opposite to the first permutation unit is performed on the data string obtained by combining a plurality of output values of the non-linear transformation unit according to the selection value from the selection unit. The permutation part of
A linear transformation unit that performs linear transformation on the output of the second permutation unit;
A key calculation unit for calculating the output of the linear conversion unit and a round key;
With
In the first round process, the output of the initial mask calculation unit is input to the first permutation unit. In the second and subsequent round processes, the first permutation unit receives the previous round. The output of the key calculation unit in the process is input,
In the non-linear conversion unit, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear conversion value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round processing by the first permutation unit, the nonlinear conversion unit, the second permutation unit, the linear conversion unit, and the key calculation unit is performed a specified number of times,
An unmask value corresponding to the selection value from the selection unit is selected from a plurality of unmask values, and the selected unmask value is exclusive of the output of the key calculation unit after completion of the specified number of round processes An encryption processing circuit including an unmask operation unit that takes a logical sum and outputs a ciphertext is provided. In this encryption processing circuit, while repeating the round processing, the operation for invalidating the mask for the data string and newly applying the mask is unnecessary.

According to the present invention, an encryption processing method by a data processing apparatus,
A random number generating step for generating a random number;
A selection step of setting an initial value of a selection value using the random number as an input, and updating a next selection value every time round processing ends,
An initial mask operation step of selecting an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and taking an exclusive OR of the selected initial mask and input;
A first permutation step of rearranging the pattern corresponding to the selected value from the selection step to the input data string and outputting the rearranged result;
A non-linear transformation step for non-linear transformation of a plurality of values obtained by dividing the output value of the first permutation step into a plurality of tables;
In accordance with a selection value from the selection step, a second rearrangement of the pattern opposite to the first permutation step is performed on a data string obtained by combining a plurality of output values of the nonlinear transformation step. The permutation process,
A linear transformation step for performing a linear transformation on the output of the second permutation step;
A key calculation step for calculating the output of the linear transformation step and a round key;
Including
In the first round process, the output of the initial mask calculation process is input to the first permutation process,
In the second and subsequent round processes, the output of the key calculation process in the previous round process is input to the first permutation process,
In the non-linear conversion step, the table performs non-linear conversion according to the table using a value obtained by performing an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round process by the first permutation step, the nonlinear transformation step, the second permutation step, the linear transformation step, and the key calculation step is performed a prescribed number of times,
An exclusive logic of selecting an unmask value corresponding to the selection value from the selection step from among a plurality of unmask values, and the output of the key operation step after the specified number of round processing ends There is provided an encryption processing method including an unmask operation step of taking a sum and outputting as ciphertext. In this encryption processing method, it is not necessary to perform an operation of invalidating a mask for a data string and applying a new mask while repeating round processing.

According to the present invention, a program for causing a data processing apparatus to execute encryption processing,
Random number generation processing for generating random numbers;
A selection process in which an initial value of a selection value is set using the random number as an input, and the next selection value is updated every round of round processing;
Selecting an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and initial mask operation processing for taking an exclusive OR of the selected initial mask and input;
A first permutation process for rearranging the pattern corresponding to the selection value from the selection process to the input data string and outputting the rearranged result;
A non-linear transformation process that non-linearly transforms values obtained by dividing the output value of the first permutation process into a plurality of tables, respectively;
In accordance with a selection value from the selection process, a second rearrangement of the pattern opposite to the first permutation process is performed on a data string obtained by combining a plurality of output values of the nonlinear conversion process. Permutation processing,
A linear transformation process for performing a linear transformation on the output of the second permutation process;
A key operation process for calculating an output of the linear transformation process and a round key;
Including
In the first round process, the output of the initial mask calculation process is input to the first permutation process,
In the second and subsequent round processes, the first permutation process receives the output of the key calculation process in the previous round process,
In the non-linear conversion process, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with the mask value on the input side for the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round processing by the first permutation processing, the nonlinear transformation processing, the second permutation processing, the linear transformation processing, and the key calculation processing is performed a prescribed number of times,
Select an unmask value corresponding to the selection value from the selection process from among a plurality of unmask values, and exclusive logic between the selected unmask value and the output of the key operation process after the specified number of rounds have been completed There is provided an encryption processing program including unmask operation processing that takes the sum and outputs the result as ciphertext. In this encryption processing program, it is not necessary to perform an operation of invalidating a mask for a data string and applying a new mask while repeating round processing. According to the present invention, a computer-readable medium (for example, a semiconductor memory, a magnetic / optical disk, etc.) on which the encryption processing program is recorded is provided.

According to the present invention,
A random number generator for generating random numbers;
A selection unit that sets an initial value of a selection value using the random number as an input, and updates the next selection value every time round processing ends,
In accordance with a selection value from the selection unit, an unmask value is selected from a plurality of unmask values, and the selected unmask value and an unmask operation unit that performs exclusive OR with the ciphertext;
In the first round, the output of the unmask calculation unit, and in the second and subsequent rounds, a reordering result in the second permutation unit in the previous round, and a key calculation unit that calculates the round key;
A linear conversion unit that performs linear conversion on the output of the key calculation unit;
A first permutation unit that rearranges the pattern corresponding to the selection value from the selection unit and outputs the rearranged result with respect to the output of the linear conversion unit;
A non-linear conversion unit including a plurality of tables that non-linearly convert values obtained by dividing the output value of the first permutation unit into a plurality of values,
In accordance with a selection value from the selection unit, a second reordering of the pattern opposite to the first permutation unit is performed on a data string obtained by combining a plurality of output values of the nonlinear conversion unit. The permutation section,
With
In the non-linear conversion unit, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear conversion value Output the value obtained by taking the exclusive OR with the mask value on the output side,
Round processing by the key calculation unit, the first permutation unit, the non-linear conversion unit, and the second permutation unit is performed a specified number of times,
An initial mask value is selected from a plurality of initial mask values according to a selection value from the selection unit, and the selected initial mask value and the second permutation unit after the prescribed number of round processes are completed There is provided a decoding processing circuit including an initial mask operation unit that performs an exclusive OR with the rearrangement result of In this decoding processing circuit, it is not necessary to perform an operation of invalidating a mask for a data string and applying a new mask while repeating round processing.

According to the present invention, there is provided a decryption processing method by a data processing apparatus,
A random number generating step for generating a random number;
A selection step of setting an initial value of a selection value using the random number as an input, and updating a next selection value every time round processing ends,
In accordance with a selection value from the selection step, an unmask value is selected from a plurality of unmask values, and the selected unmask value and an unmask operation step for taking an exclusive OR with the ciphertext;
In the first round, the output of the unmask calculation step, and in the second and subsequent rounds, the rearrangement result in the second permutation step in the previous round and the key calculation step for calculating the round key,
A linear transformation step for performing a linear transformation on the output of the key operation step;
A first permutation step of rearranging the pattern corresponding to the selection value from the selection step and outputting the rearranged result with respect to the output of the linear transformation step;
A non-linear transformation step including a plurality of tables each for non-linear transformation of values obtained by dividing the output value of the first permutation step into a plurality of values;
In accordance with a selection value from the selection step, a second rearrangement of the pattern opposite to the first permutation step is performed on a data string obtained by combining a plurality of output values of the nonlinear transformation step. The permutation process,
Including
In the non-linear conversion step, the table performs non-linear conversion according to the table using a value obtained by performing an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
Round processing by the key calculation step, the first permutation step, the nonlinear transformation step, and the second permutation step is performed a specified number of times,
An initial mask value is selected from a plurality of initial mask values according to the selection value from the selection step, and the selected initial mask value and the second permutation step after the prescribed number of round processes are completed There is provided a decoding processing method including an initial mask operation step of performing an exclusive OR with the rearrangement result of. In this decoding processing method, it is not necessary to perform an operation of invalidating a mask for a data string and applying a new mask while repeating round processing.

According to the present invention, a program for causing a data processing device to execute a decryption process,
Random number generation processing for generating random numbers;
A selection process in which an initial value of a selection value is set using the random number as an input, and the next selection value is updated every round of round processing;
In accordance with the selection value from the selection process, an unmask value is selected from a plurality of unmask values, and the selected unmask value and an unmask operation process for taking an exclusive OR with the ciphertext;
In the first round, the output of the unmask calculation process, and in the second and subsequent rounds, the reordering result in the second permutation process in the previous round and the key calculation process for calculating the round key;
A linear transformation process for performing a linear transformation on the output of the key operation process;
A first permutation process for rearranging a pattern corresponding to a selection value from the selection process and outputting a rearranged result for the output of the linear transformation process;
A non-linear transformation process including a plurality of tables each for non-linear transformation of values obtained by dividing the output value of the first permutation process into a plurality of values;
In accordance with a selection value from the selection process, a second rearrangement of the pattern opposite to the first permutation process is performed on a data string obtained by combining a plurality of output values of the nonlinear conversion process. Permutation processing,
With
In the non-linear conversion process, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with the mask value on the input side for the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
A round process by the key calculation process, the first permutation process, the nonlinear transformation process, and the second permutation process is performed a specified number of times,
An initial mask value is selected from a plurality of initial mask values according to the selection value from the selection process, and the selected initial mask value and the second permutation process after the prescribed number of round processes have been completed There is provided a decoding processing program including an initial mask calculation process for obtaining an exclusive OR with the rearrangement result of. This decoding processing program eliminates the need to invalidate the mask for the data string and repeat the new mask while repeating the round processing. According to the present invention, a computer-readable medium (for example, a semiconductor memory, a magnetic / optical disk, etc.) on which the decoding processing program is recorded is provided.

  According to the present invention, it is possible to reduce redundant portions during encryption processing, improve processing speed, and reduce a mask value storage area.

It is a figure which illustrates the structure of the encryption processing circuit which concerns on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the encryption part which concerns on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the initial mask calculating part which concerns on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the unmask calculating part which concerns on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the nonlinear transformation part which concerns on the 1st Embodiment of this invention. It is the figure which replaced the nonlinear conversion table which concerns on the 1st Embodiment of this invention by the exclusive OR and the nonlinear conversion table. It is a figure which illustrates the structure of the key calculating part which concerns on the 1st Embodiment of this invention. It is a flowchart for demonstrating the operation | movement of the 1st Embodiment of this invention. This is the result when rearrangement of cyclic shifts of multiples of 4 bytes is performed on AES, a column is formed every 4 bytes, and rearrangement is performed by the same cyclic shift in each column. It is a figure which illustrates the structure of the encryption part of a 1st comparative example (no mask). It is a figure which illustrates the structure of the nonlinear transformation part of a 1st comparative example. It is a figure which illustrates the structure of the encryption part of the 2nd comparative example (RSM method). It is a figure which illustrates the structure of the nonlinear transformation part of the 2nd comparative example (RSM method). It is the figure which replaced the nonlinear transformation table of the 2nd comparative example (RSM method) with the exclusive OR and the nonlinear transformation table. It is a figure which illustrates the structure of an encryption part when a pre-processing part is installed after the initial mask calculating part based on the 1st Embodiment of this invention. It is a figure which illustrates the structure of an encryption part when the post-processing part is installed in front of the unmask calculating part based on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the encryption part which concerns on Example 1 of this invention. It is a figure which illustrates the structure of the nonlinear transformation part which concerns on Example 1 of this invention. It is the figure which replaced the nonlinear conversion table which concerns on Example 1 of this invention by the exclusive OR and the nonlinear conversion table. In the first embodiment of the present invention, when rearrangement of cyclic shifts of multiples of 4 bytes is performed, a column is formed every 4 bytes, and rearrangement is performed by the same cyclic shift in each column. It is a result. It is a figure which illustrates the case where it rearranges in each selection value in the permutation part 3301 which concerns on Example 1 of this invention. It is a figure which illustrates the case where it rearranges in each selection value in the permutation part 3302 which concerns on Example 1 of this invention. It is a figure which illustrates the initial mask table in the initial mask calculating part which concerns on Example 1 of this invention. It is a figure which illustrates the unmask table in the unmask calculating part which concerns on Example 1 of this invention. It is a figure which illustrates the table for the update of the selection value in the selection part which concerns on Example 1 of this invention. It is a flowchart for demonstrating operation | movement of Example 1 of this invention. It is FIG. (1) which shows the example of the data transition when R = 0 based on Example 1 of this invention. It is FIG. (2) which shows the example of the data transition at the time of R = 0 based on Example 1 of this invention. It is FIG. (3) which shows the example of the data transition at the time of R = 0 based on Example 1 of this invention. It is FIG. (4) which shows the example of a data transition at the time of R = 0 based on Example 1 of this invention. It is FIG. (1) which shows the example of the data transition when R = 7 based on Example 1 of this invention. It is FIG. (2) which shows the example of the data transition when R = 7 based on Example 1 of this invention. It is FIG. (3) which shows the example of a data transition when R = 7 based on Example 1 of this invention. It is FIG. (4) which shows the example of the data transition when R = 7 based on Example 1 of this invention. FIG. 6 is a diagram (part 1) illustrating an example of data transition at the time of AES. FIG. 10 is a second diagram illustrating an example of data transition in the case of AES. FIG. 11 is a third diagram illustrating an example of data transition in the case of AES. FIG. 10 is a diagram (part 4) illustrating an example of data transition in the case of AES; It is a figure which illustrates the structure of the encryption part of an AES encryption circuit. It is a figure which illustrates the structure of the nonlinear transformation part of an AES encryption circuit. It is a figure which illustrates the structure of the encryption part of the encryption circuit of 3D encryption. It is a figure which illustrates the structure of the nonlinear transformation part of the encryption circuit of 3D encryption. It is a flowchart of 3D encryption. It is a figure which illustrates the structure of the encryption part based on Example 2 of this invention. It is a figure which illustrates the structure of the nonlinear transformation part based on Example 2 of this invention. It is the figure which replaced the nonlinear conversion table based on Example 2 of this invention by the exclusive OR and the nonlinear conversion table. It is a figure which illustrates the structure of the nonlinear transformation part based on Example 2 of this invention. (Two nonlinear conversion units) It is a figure which illustrates arrangement | positioning of the mask based on Example 2 of this invention. According to Embodiment 2 of the present invention, rearrangement of cyclic shifts of multiples of 16 bytes is performed, followed by rearrangement of cyclic shifts of multiples of 4 bytes within a slice, and a column is formed every 4 bytes. This is the result when rearrangement is performed by the same cyclic shift in each column. It is a flowchart for demonstrating operation | movement of Example 2 of this invention. It is a figure which illustrates the structure of the decoding processing circuit which concerns on the 1st Embodiment of this invention. It is a figure which illustrates the structure of the decoding part which concerns on the 1st Embodiment of this invention.

  According to the first aspect of the present invention, an encryption processing circuit for encrypting plaintext in a plurality of rounds using an encryption key includes an initial mask operation unit (1101), a register (1200), first, second Permutation units (1301, 1302), nonlinear transformation unit (1400), linear transformation unit (1500), key computation unit ((1600), unmask computation unit (1102), selection unit (1700), random number generation unit (1800).

  The initial mask calculation unit (1101) reads the initial mask from the initial mask table (1111) according to the output value (selection value) of the selection unit (1700), takes an exclusive OR of the read initial mask and plaintext, Put plain text on the mask.

  The register (1200) stores an intermediate value for each round process.

  In the first round process, the calculation result of the initial mask calculation unit (1101) is input to the register (1200). In the second and subsequent round processing, the output of the key calculation unit (1600) in the previous round processing is input to the register.

  The first permutation unit (1301) rearranges the data strings using the values stored in the register (1200) as input values. At this time, what sort is performed depends on the selection value of the selection unit (1700).

  The non-linear conversion unit (1400) includes a plurality of tables (non-linear conversion tables with masks) (S1 to St, 1411 to 1414). In each table (S1 to St) (1411 to 1414), an output value corresponding to the input value is output according to the table.

Each table (1411 to 1414) of the non-linear conversion unit (1400) includes an input side mask (M = m _{1 to} m _t ), a non-mask non-linear conversion table (S, 1420), and an output side mask (N = n _1). ~ N _t ). The input value is converted to a value before masking by applying an input side mask (M = m _{1 to} m _t ) to the input of the table (1411-1414), and the table (S, 1420) is performed. A value obtained by multiplying the output of the table (S, 1420) by the mask on the output side (N = n _{1 to} n _t ) is output. The masked nonlinear conversion tables (S1 to St, 1411 to 1414) use this input / output relationship as a table.

  The second permutation unit (1302) inputs a plurality of values output from the plurality of tables (S1 to Sn) of the nonlinear conversion unit (1400), and rearranges the data strings. At this time, what sort is performed depends on the selection value of the selection unit (1700). Note that the rearrangement is performed in the reverse order to that of the first permutation unit (1301).

  The linear transformation unit (1500) performs linear transformation of the output value of the second permutation unit (1302).

  The key calculation unit (1600) adds the output of the linear conversion unit (1500) and the round key (Ki) (takes an exclusive OR).

  Round processing by the first permutation unit (1301), the nonlinear transformation unit (1400), the second permutation unit (1302), the linear transformation unit (1500), and the key calculation unit (1600) is performed. The specified number of times is performed (for example, AES-128, AES-192, and AES-256 round processing times are 10 times, 12 times, and 14 times). According to the present invention, it is not necessary (unnecessary) to invalidate a mask for a data string and repeat a new mask while repeating the round process.

  The unmask operation unit (1102) reads the unmask value from the unmask table (1113) according to the output value (selection value) of the selection unit (1700), and performs an exclusive OR operation between the data string after the round processing and the unmask value. And unmask the data string. Output the result of exclusive OR as ciphertext.

  The selection unit (1700) outputs the selection value using the random number value of the random number generation unit (1800) as an initial value. Further, the selection value is updated every round of round processing.

  The mask values of the initial mask calculation unit (1101) and the unmask calculation unit (1102) are selected according to the selection value. Further, the rearrangement pattern of the first permutation section (1301) and the second permutation section (1302) is selected according to the selection value.

  The random number generation unit (1800) generates a random number at the start of encryption processing, and outputs the generated random number to the selection unit (1700). Random number generators that use LFSR (LinearFeedbackShiftRegister), those that use a one-way function, those that use chaotic sequences, or those that read random numbers stored in advance in ROM, etc. Is used.

  The first and second permutation units (1301, 1302) have a plurality of rearrangement patterns, and which pattern is to be rearranged depends on the selection value of the selection unit (1700).

When the selection value of the selection unit (1700) is sv, the rearrangement of the second permutation unit (1302) is P2sv (•), the linear transformation is L (•), and the first is when the selection value is sv ′. The permutation unit 1301 is rearranged as P1sv ′ (•), and when there is a selection value sv of the selection unit (1700), the next selection value is sv ′. For the input side mask (M) and the output side mask (N) of the non-linear transformation unit (1400), rearrangement patterns that satisfy the following relationship are represented as first and second permutation units (1301, 1302). Give it to.
M = P1sv '(L (P2sv (N)))

  In the rearrangement pattern of the first and second permutation units (1301, 1302), reverse rearrangement is performed on the same selection value. Thereby, the position of the data moved by the first permutation unit can be returned to the original position by the second permutation unit.

  The input side mask (M) and the output side mask (N) of the nonlinear conversion unit (1400) define the following relationship. The output side mask value (N) is rearranged by any of the rearrangement patterns of the second permutation unit (1302), and the rearranged mask value (N) is linearized by the linear conversion unit (1500). A result obtained by rearranging the result of the transformation and the linear transformation by any one of the rearrangement patterns of the first permutation unit (1301) is defined as the input side mask (M).

  According to the above aspect of the present invention, the non-linear conversion unit includes the non-linear conversion table with a mask, so that it is not necessary to recalculate the table to change the mask. (RAM area) increase is suppressed. Further, the nonlinear conversion unit includes a table having different masks, and further replaces the data input to the table by permutation, thereby exchanging the masks for each part of the data for each round process. By not providing unused mask values and tables, the ROM area and circuit scale can be reduced.

  The relationship between the input side mask value (M) and the output side mask value (N) in the non-linear conversion table with mask of the non-linear conversion unit is defined, and the permutation is further conditioned. Thus, according to the present invention, mask work such as unmasking and remasking for each round becomes unnecessary, and it is not necessary to store work mask values in a storage device such as a ROM. As a result, an improvement in processing speed and a reduction in circuit scale can be expected.

  As described above, according to the present invention, the processing speed is improved, the circuit scale and the ROM area are reduced, the analysis by the side channel attack based on the Hamming weight and the Hamming distance is made difficult, and the security of the cryptographic module is improved. Can do. Hereinafter, some embodiments will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a diagram illustrating a configuration of an encryption processing circuit according to the first embodiment of this invention. The encryption processing circuit of the present embodiment includes an encryption unit 1000 and a key generation unit 2000.

FIG. 2 is a diagram illustrating a configuration of the encryption unit 1000 of FIG. Referring to FIG. 2, the encryption unit 1000 includes an initial mask calculation unit 1101, a register 1200, a permutation unit 1301, 1302, a nonlinear conversion unit 1400, a linear conversion unit 1500, a key calculation unit 1600, a selection unit 1700, and A random number generation unit 1800 is provided. In the present specification, the following notation is used as an operation in each conversion unit.
Nonlinear transformation: S (・),
Linear transformation: L (・),
Permutation (1301, 1302): P1 (•), P2 (•).

  Referring to FIG. 1, the encryption unit 1000 encrypts data based on the input plaintext and the round key (Ki) received from the key generation unit 2000, and outputs a ciphertext.

  With reference to FIG. 2, the encryption unit 1000 first performs processing in the initial mask calculation unit 1101.

  FIG. 3 is a diagram illustrating a configuration of the initial mask calculation unit 1101 of FIG. Referring to FIG. 3, the initial mask calculation unit 1101 includes an initial mask table 1111 storing a plurality of initial masks, and an exclusive OR calculation unit (Exclusive OR: XOR) 1112. The initial mask table 1111 selects and outputs one of a plurality of initial masks based on the input selection value. The exclusive OR calculator 1112 calculates an exclusive OR (bitwiseXOR: bitwise XOR) between the initial mask output from the initial mask table 1111 and the plain text. The initial mask table 1111 stores as many initial mask data strings as the number of values that the selection unit 1700 can take.

  Referring to FIG. 2 again, next, round processing is repeated by the permutation unit 1301, the non-linear conversion unit 1400, the permutation unit 1302, the linear conversion unit 1500, and the key calculation unit 1600 for the specified number of rounds. The intermediate value during the round process is stored in the register 1200.

  After the round process, the unmask calculation unit 1102 performs the process.

  FIG. 4 is a diagram illustrating a configuration of the unmask calculation unit 1102 in FIG. Referring to FIG. 4, the unmask operation unit 1102 includes an unmask table 1113 storing a plurality of unmasks and an exclusive OR operation unit 1114. The unmask table 1113 selects and outputs one of a plurality of unmasks based on the input selection value. The exclusive OR operation unit 1114 calculates the exclusive OR (bitwiseXOR) of the unmask output from the unmask table 1113 and the round process output result (the output result of the key operation unit 1600 stored in the register 1200). And output ciphertext. Similar to the initial mask table 1111, the unmask table 1113 stores as many unmasked data strings as the number of values that the selection value can take.

  As described above, in FIG. 2, the initial mask calculation unit 1101 and the unmask calculation unit 1102 select the mask value from the initial mask table 1111 and the unmask table 1113 based on the selection value, respectively, and the selected mask value and the input data string The exclusive OR (bitwiseXOR) is calculated, and the calculation result is output. The initial mask calculation unit 1101 calculates an exclusive OR of the plain text and the initial mask. The unmask calculation unit 1102 calculates an exclusive OR of the round process result and the unmask.

  In FIG. 2, a register 1200 stores an intermediate value of round processing. In the first round process, the output of the initial mask calculation unit 1101 is stored. In the second and subsequent round processes, the output of the key calculation unit 1600 is stored.

  The permutation unit 1301 and the permutation unit 1302 have a plurality of rearrangement patterns, select the rearrangement pattern according to the selection value, rearrange the input data string according to the selected pattern, and rearrange Output the result. The rearrangement includes rearrangement in bit units, byte units, and arbitrary data length units. The permutation unit 1301 rearranges the data in the register 1200. The permutation unit 1302 rearranges the output values (Y) of the nonlinear conversion unit 1400, and outputs the rearranged result (P2 (Y)).

  The non-linear conversion unit 1400 performs non-linear conversion on the input value (X) and outputs a conversion result (Y).

  FIG. 5 is a diagram illustrating a configuration of the nonlinear conversion unit 1400 of FIG. Referring to FIG. 5, the nonlinear conversion unit 1400 includes t (t is a predetermined positive integer) nonlinear conversion tables (S1 to St) 1411 to 1414. Partial data x1 to xt of the input value X are respectively input to the t non-linear conversion tables 1411 to 1414, and non-linear conversion is performed in each non-linear conversion table. As a method for extracting a part of the data, the data is divided in bit units, byte units, and an arbitrary data length, and the data X is divided into t pieces of data x1 to xt in total. x1 to xt do not overlap with each other, and become X by combining (connecting) the bit strings (or byte strings, etc.) of x1 to xt. For example, when X is 32 bits, x1 is 0 to 3 bits of X, x2 is 4 to 7 bits of X, ..., x8 is 29 to 31 bits of X, etc. To divide.

  As the conversion results of the non-linear conversion tables 1411 to 1414, t output values y1 to yt are output. As will be described later, the nonlinear conversion tables 1411 to 1414 perform mask operations on the input and output of the table and are also referred to as masked nonlinear conversion tables. A combination of n output values y1 to yt is the output value Y of the nonlinear converter 1400.

FIG. 6 is a diagram illustrating the input / output relationship of the t non-linear conversion tables (S1 to St) 1411 to 1414 in FIG. Referring to FIG. 6, the nonlinear conversion table 1411 includes an input side mask m ₁ , an output side mask n ₁ , an exclusive OR operation unit 1431, a lookup table type nonlinear conversion table (S) 1421, and , An exclusive OR operation unit 1435 is provided. Similarly, other nonlinear conversion tables 1412 to 1414 include input side masks m _{2 to} m _t , output side masks n _{2 to} n _t , exclusive OR operation units 1432 to 1434, and look-up table methods. Nonlinear conversion tables (S) 1422-1424 and exclusive OR operation units 1436-1438 are provided. The bit width of the mask m ₁ ~m _t is equal to the data x1~xt bits wide.

In FIG. 6, in the nonlinear conversion table (S1) 1411, the exclusive OR operation unit 1431 calculates an exclusive OR (bitwise XOR) x1 (XOR) m ₁ between the input value x1 and the input side mask m _1. Take. Note that taking an exclusive OR with a mask value is also referred to as applying a mask.

The non-linear conversion table (S) 1421 receives the exclusive OR operation result x1 (XOR) m ₁ in the exclusive OR operation unit 1431, and converts the input to the non-linear conversion result S (x1 (XOR) m ₁ ) is output.

The exclusive OR operation unit 1435 outputs an exclusive OR S (x1 (XOR (XOR)) between the conversion result S (x1 (XOR) m ₁ ) output from the nonlinear conversion table (S) 1421 and the mask n ₁ on the output side. ) m ₁ ) (XOR) n ₁ is taken and the operation result is output as y1. Thus, the nonlinear conversion table (S1) 1411 converts the input value x1 into y1 and outputs it. Similarly to S1, the other nonlinear conversion tables (S2 to Sn) 1412 to 1414 perform three operations of exclusive OR, nonlinear conversion, and exclusive OR on x2 to xt, respectively, and y2 to Output yt. The masks n _{1 to} n _t are equal to the bit width of the output of the nonlinear conversion table (S) (for example, the bit widths of the masks m _{1 to} m _t may be equal).

M what each mask m ₁ ~m _t of the input side coupled (connected),
N, which is a combination (concatenation) of the masks n _{1 to} n _t on the output side
And

When the non-linear conversion table 1411 is mounted on the memory device, for the input x1,
Output y1 = S (x1 (XOR) m ₁ ) (XOR) n ₁ is output. As described above, each of S1 to Sn in FIG. 6 performs exclusive OR operation, non-linear transformation, and exclusive OR operation.

Referring to FIG. 2 again, the linear conversion unit 1500 linearly converts the output value (P2 (Y)) output from the permutation unit 1301 and outputs a conversion result (Z). If the linear transformation function is L,
Z = L (P2 (Y))
It becomes.

  The key calculation unit 1600 obtains an exclusive OR Q = Z (XOR) Ki (i is the current value) between the round key (Ki) output from the key generation unit 2000 of FIG. 1 and the output (Z) of the linear conversion unit 1500. Indicates the number of rounds). The exclusive OR operation Z (XOR) Ki is an addition of Z and Ki.

  FIG. 7 is a diagram illustrating a configuration of the key calculation unit 1600 of FIG. Referring to FIG. 7, the key calculation unit 1600 includes a plurality of exclusive OR calculation units 1611 to 1614. The exclusive OR operation unit 1611 calculates an exclusive OR z1 (XOR) ki1 of ki1 that is a part of the round key Ki and z1 that is a part of the input value Z, and calculates the operation result (addition result). Output as q1. Similarly, the other exclusive OR operation units 1612 to 1614 also perform exclusive OR of a part kij (j = 2 to t) of the round key Ki and a part zj (j = 2 to t) of the input value Z. zj (XOR) kij is calculated and the calculation result is output as qj (j = 2 to t).

  In FIG. 2, the selection unit 1700 outputs a selection value using the random number output from the random number generation unit 1800 as an initial value. The selection value is used in the initial mask calculation unit 1101, permutation units 1301 and 1302, and unmask calculation unit 1102.

  In the selection unit 1700, examples of the method for updating the selection value include the following (however, they are not limited to the following).

1) A method of incrementing (decreasing) by 1 every round and looping to the minimum value (maximum value) when the maximum value (minimum value) is exceeded.

2) A method in which a table is prepared and the next selection value is determined from the table by using the selection value in the current round or the initial value and the current round number as arguments.

3) A method in which an update formula is prepared and the next selection value is calculated from the update formula using the selection value in the current round or the initial value and the current round number as arguments.

  In FIG. 2, a random number generation unit 1800 generates a random number at the start of encryption processing. The generated random number is input to the selection unit 1700.

  The key generation unit 2000 in FIG. 1 generates a round key (Ki) to be used by the encryption unit 1000 based on the input secret key. The round key (Ki) is input to the key calculation unit 1600 in FIG.

  FIG. 8 is a flowchart for explaining the operation of the first embodiment. The operation of this embodiment will be described with reference to FIG. 8 and FIGS. 1 to 7.

  First, the plaintext and the secret key are input to the encryption processing circuit, and the plaintext is input to the encryption unit 1000 in FIG. 1 and the secret key is input to the key generation unit 2000 in FIG. 1 (step A1).

  When the cryptographic process is started, the random number generation unit 1800 in FIG. 2 generates a random number and inputs the random number to the selection unit 1700 (step A2).

  The selection unit 1700 in FIG. 2 outputs a selection value based on the input random number (step A3).

  2 selects an initial mask based on the selection value from the initial mask table 1111 of FIG. 3, and calculates an exclusive OR of the plaintext and the initial mask. The plaintext is masked by this exclusive OR operation (addition operation) (step A4). The plain text with the mask is stored in the register 1200.

  After the mask processing, steps A5 to A11 are performed as round processing. First, the permutation unit 1301 in FIG. 2 rearranges the data string based on the selected value (step A5).

Next, the nonlinear transformation unit 1400 in FIG. 2 performs nonlinear transformation on the output value of the permutation unit 1301, and outputs a nonlinear transformation output (Y) (step A6). In the nonlinear conversion unit 1400, the output value of the permutation unit 1301 is divided into t pieces, and x1 to xt are input to the nonlinear conversion tables (S1 to St) 1411 to 1414. These non-linear conversion tables are non-linear conversion tables with a mask. The result of the non-linear conversion table (S1) 1411 is obtained by calculating an exclusive OR of x1 and m ₁ , performing non-linear conversion on the operation result by non-linear conversion S (•), and exclusive of n ₁ with the result of non-linear conversion. The result is a logical sum.

Here, the initial mask value applied to plaintext in step A4, binding the m ₁ ~m _t (concatenate) the mask value _{M (= m 1 || m 2} || ··· || m t; however, || In the exclusive OR operation units 1431 to 1434 in FIG. 6 cancels the initial mask and M (exclusive OR between the matching values). It becomes 0). For this reason, the non-linear conversion tables 1421 to 1424 perform non-linear conversion on the original plaintext. Then, a mask N (= n ₁ || n ₂ ||...) Obtained by connecting n _{1 to} n _t to the result of nonlinear transformation of the original plain text by the exclusive OR operation units 1435 to 1438 in FIG. | n _t ).

  A value obtained by rearranging the mask values M is stored as each mask value stored in the initial mask table 1111 in FIG. 3, and the initial mask is made to match the array of the mask values M in the permutation unit 1301 in FIG. 2. By performing the rearrangement in this way, the above-described initial mask and M can be offset.

  The permutation unit 1302 in FIG. 2 rearranges the output Y of the nonlinear conversion unit 1400 based on the selected value (step A7). The rearrangement performed in the permutation unit 1302 is reverse to the permutation unit 1301. By performing the reverse rearrangement, the data order can be returned to the order before being input to the permutation unit 1301. In addition, the arrangement of the mask applied to the data is rearranged.

  The linear conversion unit 1500 in FIG. 2 performs linear conversion on the output value (Y ′) of the permutation unit 1302 and outputs the conversion result (Z) (step A8).

  2 calculates an exclusive OR of the output (Z) of the linear conversion unit 1500 and the round key (Ki) sent from the key generation unit 2000, and calculates the calculation result (Q). Output (step A9). The calculation result (Q) in the key calculation unit 1600 is stored in the register 1200.

  After the calculation by the key calculation unit 1600, it is determined whether or not the round processing has been repeated for the specified number of rounds (round processing end) (step A10). In this determination, the counter set to the prescribed number of rounds may be counted down by one for each calculation in the key calculation unit 1600, and when the count value becomes 0, it may be determined that the round process has ended. You may make it control by the control part etc. which are not shown in figure which control each part of FIG. As a result of the determination, if the round processing has not been completed for the specified number of times, the selection unit 1700 updates the selection value (step A11), returns to step A5, and repeats the round processing again. On the other hand, when the round processing is completed for the specified number of times, the process proceeds to Step A12.

  When repeating round processing, first, the permutation unit 1301 in FIG. 2 rearranges the results (Q) of the key calculation unit 1600 in FIG. 2 (P1 (Q)) (step A5).

  Next, nonlinear transformation is performed on the rearranged data string (P1 (Q)) by the nonlinear transformation unit 1400 in FIG. 2, and a transformation result (Y) is output (step A6).

  The output (P1 (Q)) of the permutation unit 1301 is also divided into t pieces as pq1 to pqt, in the same way as the input value (X) is divided into t pieces (x1 to xt). Although not particularly limited, for example, when P1 (Q) is 32 bits, pq1 is 0 to 3 bits of P1 (Q), pq2 is 4 to 7 bits of P1 (Q) in 4-bit units, ..., pq8 is Divide into 29 to 31 bits of P1 (Q).

  pq1 to pqt are input to the nonlinear conversion tables (S1 to St) 1411 to 1414 as x1 to xt in FIG. 5, respectively, and nonlinear conversion processing with a mask is performed.

In the non-linear conversion table (S1) 1411 in FIG. 6, for example, calculates the exclusive OR pq1 (XOR) m ₁ of PQ1 and m _1, the operation result, and non-linear transformation by the nonlinear conversion S (·) (operation result pq1 (XOR) m ₁ is input to the table, and the result of nonlinear transformation is read from the table), and the result of the exclusive OR of the result of nonlinear transformation S (pq1 (XOR) m ₁ ) and n ₁ S (pq1 (XOR) m ₁ ) (XOR) n ₁

Here, the mask N applied in step A6 (see FIG. 8) in the first round is the permutation unit 1302 and linear transformation unit 1500 (see FIG. 2) in the first round, and the permutation unit 1301 in the second round. Let N 'be the result of the conversion. mask M m ₁ input coupled to ~m _t is 'if it matches the in exclusive OR operation unit 1431 to 1434 of FIG. 6, N' N so that M and is offset (to match If the exclusive OR of the values is taken, it becomes 0).

  Therefore, when the mask M matches N ′, the nonlinear transformations 1421 to 1424 in FIG. 6 are equivalent to performing nonlinear transformation on the original data (value before masking). Then, the mask N is applied to the result of nonlinear transformation of the original data by the exclusive OR operation units 1435 to 1438 in FIG.

  Therefore, in the present embodiment, the result N ′ obtained by converting the mask N applied in step A6 of FIG. 8 by the permutation unit 1302, the linear conversion unit 1500, and the permutation unit 1301 of FIG. As the mask M, non-linear conversion tables (S1 to Sn) 1411 to 1414 including M and N (see FIGS. 5 and 6) are mounted.

  By doing so, the work (processing) of once canceling the mask that has been changed by the linear processing or the like in the linear conversion unit 1500 during the round processing and applying the mask again becomes unnecessary.

  The permutation unit 1302 in FIG. 2 rearranges the transformation results (Y) of the nonlinear transformation unit 1400 based on the selected value, and outputs the rearranged results (P2 (Y)) (step A7).

  The linear conversion unit 1500 in FIG. 2 performs linear conversion on the output (P2 (Y)) of the permutation unit 1302 and outputs the conversion result (Z) (step A8).

  2 calculates the exclusive OR of the output (Z) of the linear conversion unit 1500 and the round key (Ki) sent from the key generation unit 2000, and outputs the calculation result (Q). (Step A9).

  When the round process has been performed a predetermined number of times, the process proceeds from step A10 to step A12 in FIG.

  After the round process is completed, the unmask calculation unit 1102 in FIG. 2 selects an unmask based on the selection value from the unmask table 1113 in FIG. 4, and the output (Q) of the key calculation unit 1600, which is the result of the round process, Is calculated, and the calculation result is output as ciphertext (step A12). This exclusive OR with the unmask cancels the mask applied to Q and obtains the original ciphertext C.

  The mask applied to the output (Q) of the key calculation unit 1600, which is the result of the round processing, is a value N obtained by rearranging the mask N applied in step A6 in FIG. 8 by the permutation unit 1302 and converting it by the linear conversion unit 1500. 'Is. Accordingly, the original ciphertext C can be obtained by performing an exclusive OR operation between Q and the unmask value in the unmask operation unit 1102.

  Depending on the encryption algorithm, the content of processing may change in the last round. In that case, a value obtained by applying only permutation processing and linear processing performed on the mask N to N in the last round is used as the unmask value.

  For example, in AES, MixColumns, which is one of linear transformations, is not performed in the last round. For this reason, the result of applying only the permutation and ShiftRows, which are other operations, to the mask value N becomes the unmask value.

  Finally, ciphertext C is output and the process ends (step A13).

As a mask value used in this embodiment,
・ Initial mask,
・ Unmask,
・ Mask M on the input side of the nonlinear conversion table,
-Non-linear conversion table output mask N,
There is. The relationship between the mask values will be described.

  Each initial mask stored in the initial mask table 1111 (FIG. 3) of the initial mask calculation unit 1101 is rearranged by any of the rearrangement patterns that can be taken by the permutation unit 1301. 1411 to 1414) is equal to the input side mask M (= m1 || m2 || ... | mt).

  The association between the initial mask table 1111 (FIG. 3) of the initial mask calculation unit 1101 and the permutation unit 1301 is performed by the selection value of the selection unit 1700. The initial mask selected by a certain selection value sv is rearranged according to the rearrangement pattern of the permutation unit 1301 selected by the same selection value sv, so that the input side of the nonlinear transformation table (1411-1414 in FIG. 6) Equal to mask M.

  Each unmask stored in the unmask table 1113 (FIG. 4) of the unmask calculation unit 1102 is the mask N (= n1 || n2 || ...) on the output side of the nonlinear conversion table (1411 to 1414 in FIG. 6). | nt) is rearranged by any of the rearrangement patterns that can be taken by the permutation unit 1302, and is converted by the linear transformation unit 1500 in the last round.

  The association between the unmask table 1113 (FIG. 4) and the permutation unit 1302 is performed by the selection value of the selection unit 1700. When the mask N on the output side is rearranged according to the rearrangement pattern of the permutation unit 1302 selected with a certain selection value sv, an unmask selected with the same selection value sv and a nonlinear conversion table (1411-1414 in FIG. 6) ) Output side mask N becomes equal.

  The mask N (= n1 || n2 || ... | nt) on the output side of the nonlinear conversion table (1411 to 1414 in FIG. 6) includes the permutation unit 1302, the linear conversion unit 1500, and the next round. The result converted by the permutation unit 1301 is set as a mask M on the input side of the nonlinear conversion table of the next round.

  The masks M and N on the input side and the output side of the nonlinear conversion table (1411 to 1414 in FIG. 6), the rearrangement pattern of the permutation units 1301 and 1302 in FIG. 2, and the selection value by the selection unit 1700 are as follows: As related.

  As a result of processing the output side mask (P2 (N)) rearranged by the permutation unit 1302 with the rearrangement pattern corresponding to sv in the selection value sv by the selection unit 1700 by the linear conversion unit 1500, L (P2 (N )) And the selection value is updated from sv to sv 'in the next round. In the next round, permutation section 1301 rearranges L (P2 (N)) with the rearrangement pattern corresponding to sv ′ (P1 (L (P2 (N))), where M = P1 (L The selection value and permutation rearrangement pattern, and M and N are set so that (P2 (N)).

  Next, the permutation performed in this embodiment will be described. The permutation units 1301 and 1302 in FIG. 2 determine the rearrangement pattern according to the selection value of the selection unit 1700.

  The permutation unit 1301 is an arrangement for matching the correspondence between the mask value applied to the data string and the mask M on the input side applied in each of the nonlinear conversion tables 1411 to 1414 (FIG. 6) of the nonlinear conversion unit 1400. Change. Therefore, the selection value of the selection unit 1700 indicates the arrangement of the masks in the permutation unit 1301. Then, the permutation unit 1301 rearranges the data string input from the register 1200 according to the selection value.

  The permutation unit 1302 performs rearrangement that is the reverse of the rearrangement processing performed in the permutation unit 1301 and matches the original data position. In this way, by matching with the original data position in the permutation unit 1302, the original when the mask is not used in the linear processing in the subsequent linear conversion unit 1500 and the key calculation in the key calculation unit 1600. This makes it possible to eliminate the need for additional processing.

  Further, as a limitation on the rearrangement of the permutation units 1301 and 1302, it is necessary to rearrange the mask M so that the mask M can be derived from the mask N of the nonlinear transformation unit 1400 (or the mask N can be derived from the mask M).

  The permutation unit 1302 performs rearrangement based on various rearrangement patterns, and it is assumed that any rearrangement pattern is used as the mask N on the output side of each of the nonlinear conversion tables 1411 to 1414 (FIG. 6). However, after passing through the subsequent linear processing, it is necessary that the mask M can be derived by rearrangement in the permutation unit 1301 in the next round processing.

  When the selection value of the selection unit 1700 is sv, the permutation unit 1302 is rearranged by P2sv (•), the linear transformation is L (•), and the permutation unit 1301 is rearranged when the selection value is sv ′. Let P1sv '(•). Here, in the present embodiment, when there is a selection value sv of the selection unit 1700, it is assumed that the next selection value is sv ′. Mutations 1301 and 1302 are provided.

M = P1sv '(L (P2sv (N)))

  For example, when applied to AES, the permutation units 1301 and 1302 perform rearrangement by cyclic shifts of multiples of 4 bytes, and further form columns every 4 bytes, and the same cyclic shift in each column. Sorting can be applied by FIGS. 9A to 9D show the results when the above-described rearrangement is performed on the AES data array. Fig. 9 (A) shows the original AES data array, (B) shows the result of rearrangement by a cyclic shift of multiples of 4 bytes (4 * 2 byte cyclic shift), and (C) shows a column every 4 bytes. Result of rearrangement by the same cyclic shift in each column (2-byte cyclic shift in each column), (D) is rearranged by a cyclic shift of multiples of 4 bytes, and further, every 4 bytes , And the result of rearranging by the same cyclic shift in each column (after 4 * 2 byte cyclic shift, 2 byte cyclic shift in each column) is shown.

  Here, this embodiment is compared with the comparative example shown in FIG. 10 (comparative example 1: prototype example of an encryption processing circuit that does not perform masking). Referring to FIG. 10, this comparative example includes a register 1200, a nonlinear conversion unit 1401 (no mask), a linear conversion unit 1500, and a key calculation unit 1600. In the embodiment shown in FIG. 2, an initial mask calculation unit 1101, an unmask calculation unit 1102, a permutation unit 1301, 1302, a selection unit 1700, and a random number generation unit 1800 are added to the circuit of FIG. Yes.

  Unlike the present embodiment, the non-linear conversion unit 1401 in FIG. 10 is a non-linear conversion table in which a mask is not reflected in input / output. FIG. 11 is a diagram illustrating a configuration of the nonlinear conversion unit 1401 of FIG. The nonlinear conversion unit 1401 includes nonlinear conversion tables (S) 1421 to 1424. When the nonlinear conversion table 1400 in FIG. 2 has a nonlinear conversion table mounted in a memory, there is no difference in processing time and circuit scale from the comparative example in FIGS.

  Regarding processing time, first, random number generation and selection value output, initial mask calculation, finally unmask calculation, and processing time of data permutation twice during round processing are added. Among these, the permutation process is particularly equivalent to an increase in the processing time in the present embodiment.

  As for the circuit scale, the initial mask calculation unit 1101, the unmask calculation unit 1102, the permutation units 1301, 1302, the selection unit 1700, the random number generation unit 1800, and the ROM area for storing the mask value in FIG. To be added. However, two types of ROM areas, an initial mask table and an unmask table, may be prepared.

  Here, it compares with the structure by the RSM method disclosed by the nonpatent literature 5. FIG. FIG. 12 shows a configuration example (comparative example 2) of an encryption processing circuit based on the RSM method. The difference between the circuit of the RSM method of FIG. 12 and the present embodiment of FIG. 2 is that the permutation units 1301 and 1302 of FIG. 2 are barrel shifts 1303 and 1304 in the comparative example of FIG. The MMSj + 1 adder 1103 is added.

Further, the mask arrangement of the nonlinear converter 1402 in FIG. 12 is also different from that of the nonlinear converter 1400 in FIG. FIG. 13 is a diagram exemplifying a configuration of the nonlinear conversion unit 1402 of the RSM method. FIG. 14 is a diagram illustrating the configuration of t nonlinear conversion tables (S1 to St) 1441 to 1444 in FIG.
In the RSM method non-linear converter 1402 in FIG. 14, the output side mask M = {m1, m2,... {m2, m3, ..., mt, m1}.

  In the RSM method of FIG. 12, rearrangement is performed by barrel shift. In the RSM method, first, the number of bytes to be shifted by a random number is selected, the selection of the initial mask and the number to be shifted in the first round barrel shift 1303 are determined according to the selected number.

  The barrel shift 1304 returns the data position to the original by shifting the same number in the opposite direction to the barrel shift 1303.

  From the second round onward, the barrel shifts 1303 and 1304 shift by one more than the number shifted in the previous round. If the shift number exceeds the data width, the shift number becomes zero. In the RSM method of FIG. 12, since the mask on the output side is changed by the linear conversion unit 1500, the mask is canceled by the mask M in the nonlinear conversion unit 1402 of the next round, and the nonlinear conversion tables 1421-1424 (FIG. 14). ) Cannot be processed correctly.

  Therefore, in the RSM method, the MMSj + 1 addition unit 1103 performs a process of canceling once the mask N that has been changed by the linear process, and reapplying the next round mask M for each round process.

  Compare the processing time. Compared with the circuit of the comparative example (RSM method) in FIG. 12, the present embodiment does not require the arithmetic processing by the MMSj + 1 adding unit 1103 for each round process. For this reason, the time required for the calculation processing for the number of rounds is reduced.

  Next, the circuit scale of the cryptographic processing circuit based on the RSM method of FIG. 12 is compared with this embodiment. Regarding the circuit scale, the MMSj + 1 addition unit 1103 is a difference from the present embodiment. Therefore, the circuit scale of the present embodiment is smaller than that of the RSM method only for the part related to the MMSj + 1 adder 1103.

Next, the ROM area is compared. In the cryptographic processing circuit based on the RSM method of FIG. 12, the initial mask Mj, the mask MMSj + 1 used in the MMSj + 1 addition unit 1103 in the middle, and the last unmask MSj + n change depending on how many bytes are shifted by the barrel shift. come. For example, in the case of AES128, if the shift width pattern is 16 patterns of 0 to 15 bytes, 16 masks are required for 3 masks, and the ROM area is
T * 16 * 3 (T = 16 bytes)
Minutes are required.

On the other hand, also in the present embodiment, the ROM area of the initial mask or unmask varies depending on the number of patterns of selection values of the selection unit 1700 in FIG. If the number of selected value patterns is the same as the number of shifts in the RSM method, the ROM area is reduced by the amount of the mask MMSj + 1 used in the MMSj + 1 adder 1103 compared to the RSM method. Can do. For example, in the case of AES128, if the selection value pattern of the selection unit 1700 is 16 patterns, the number of masks is 16 for two masks, and the ROM area is
T * 16 * 2 (T = 16 bytes)
Minutes are required.

  In this embodiment, only round processing is performed, and only the initial mask and unmask operations are performed before and after the round processing. However, depending on the encryption, pre-processing and post-processing may be performed. In this case, a configuration in which pre-processing is added before and after the initial mask calculation unit 1101 or post-processing is added before and after the unmask calculation unit 1102 may be provided. In the example of FIG. 15, a preprocessing unit 1901 that performs preprocessing of round processing is provided between the initial mask calculation unit 1101 and the register 1200. In the example of FIG. 16, a post-processing unit 1902 that receives the output of the register 1200 after the end of the specified number of rounds is provided in the preceding stage of the unmask operation unit 1102.

Example 1
As a specific example of the first embodiment described with reference to FIG. 2 and the like, an encryption processing circuit when 128-bit AES (AES128) is used will be described.

  FIG. 17 is a diagram illustrating the configuration of the encryption unit of the encryption processing circuit according to the first embodiment. The encryption unit includes an initial mask calculation unit 3101, an unmask calculation unit 3102, a register 3200, permutation units 3301 and 3302, a nonlinear conversion unit 3400 having 16 masked SBOXs, and ShiftRows corresponding to the linear conversion unit 1500 in FIG. 2. A calculation unit 3501, a MixColumns calculation unit 3502, key calculation units 3601 and 3602 for adding round keys by exclusive OR, a selection unit 3700, and a random number generation unit 3800 are provided.

  The initial mask calculation unit 3101 and the unmask calculation unit 3102 have the same configurations as those in FIGS.

  In AES128, since it is necessary to perform key addition before round processing, a key addition calculation unit 3601 is added between the initial mask calculation unit 3101 and the register 3200.

  As linear processing, ShiftRows and MixColumnss are used. Therefore, the ShiftRows calculation unit 3501 and the MixColumns calculation unit 3502 are provided as the linear processing unit 1500 in FIG. In addition, since processing in MixColumns is not performed in the final round, a route for avoiding the MixColumns calculation unit 3502 is provided in the final round.

  As permutation in AES128, two types of cyclic operations are performed by performing a reordering by a cyclic shift of multiples of 4 bytes, and forming a column every 4 bytes and performing a reordering by the same cyclic shift in each column Adopt a sort that combines shifts.

  In AES128, 16 bytes of data may be divided into 1 byte, and each byte of data may be represented by 4x4 data. In the present embodiment, a cyclic shift of bytes that is a multiple of 4 is defined as a cyclic shift in the horizontal direction, a column is formed every 4 bytes, and the same cyclic shift in each column is defined as a cyclic shift in the vertical direction.

  FIG. 20 shows two types of cyclic shifts in 16-byte data represented by 4 × 4. FIG. 20 (A) shows the original AES data array, (B) shows the result of rearrangement by a cyclic shift of multiples of 4 bytes (4 * 2 byte cyclic shift), and (C) shows a column every 4 bytes. Result of rearrangement by the same cyclic shift in each column (2-byte cyclic shift in each column), (D) is rearranged by a cyclic shift of multiples of 4 bytes, and further, every 4 bytes , And the result of rearranging by the same cyclic shift in each column (after 4 * 2 byte cyclic shift, 2 byte cyclic shift in each column) is shown.

  In the linear transformation in AES128, rearrangement by two kinds of cyclic shifts is performed on a certain data string X, and the result L (P (X)) is the same as the result of performing linear transformation on the rearranged P1 (X). This is because it is possible to match the result with the result P2 (L (X)) obtained by performing the linear transformation on the data string and rearranging the result L (X) of the linear transformation by two kinds of cyclic shifts. . Note that both P1 (•) and P2 (•) are rearranged by two types of cyclic shifts, but the amounts of movement in the vertical and horizontal directions do not have to match.

  In FIG. 17, permutation units 3301 and 3302 perform two types of cyclic shifts according to the selection value R by the selection unit 3700. A possible value of the selection value R is R = {0, 1,..., 14, 15}.

  The permutation unit 3301 performs two types of cyclic shifts so that data at the same byte position as the selected value R comes to the 0th byte.

FIG. 21 shows the data position P _R (X) when the following data X is shifted by each selected value R (R = 0 to 15). FIG. 21A shows P _R (X) of R0-7, and FIG. 21B shows R = 8-15.

  Contrary to 3301, permutation section 3302 performs two types of cyclic shifts so that the 0th byte data comes to the same byte position as selected value R.

FIG. 22 shows the data position P _R (X) when X is shifted by each selected value R (R = 0 to 15).

  Each nonlinear conversion table S1 to S16 (see FIG. 18) of the nonlinear conversion unit 3400 in FIG. 17 performs processing in units of 1 byte. The mask value M on the input side and the mask value N on the output side in the nonlinear conversion unit 3400 are 16 bytes (the mask value M is the concatenation of [m1, m2, m3, m16] in FIG. 19, and the mask value N is [ n1, n2, n3, n16]), and is divided into one byte at a time and associated with each non-linear conversion table with mask.

  The selection unit 3700 in FIG. 17 receives the random number generated by the random number generation unit 3800 and sets the random number as the initial selection value R.

The selection unit 3700 updates the selection value R for each round process. As a method for updating the selection value R in the present embodiment, for example, the following method is used (however, it is not limited to the following).
-Prepare a calculation formula and enter the current selection value or the initial random number and the current round number into the calculation formula to obtain the next selection value.
Prepare a table and read the next selection value using the current selection value or the initial random number and the current round number as arguments.

  In the present embodiment, the selection value is updated by a method of reading the next selection value (R ′) from the table using the current selection value (R).

  A method for determining a table for updating the mask value M on the input side and the mask value N on the output side (see FIG. 19) in the nonlinear conversion unit 3400 and the selection value R in the selection unit 3700 will be described.

  One of the mask value M on the input side and the mask value N on the output side in the nonlinear conversion unit 3400 can be set to an arbitrary value. Here, when the mask value N is set, the selection value R and the selection value R ′ for the next round are set next.

  Then, the permutation unit 3302 rearranges the mask value N on the output side in the nonlinear conversion unit 3400 based on the rearrangement table corresponding to the selection value R.

Next, the rearranged result (P2 _R (N)) is processed by the ShiftRows calculator 3501 and the MixColumns calculator 3502 as linear processing.

The permutation unit 3301 sorts the linear processing result (L (P2 _R (N))) based on the sorting table corresponding to the selection value R ′. The result of this rearrangement is set as a mask M on the input side of the nonlinear conversion unit 3400.

  Conversely, when an arbitrary value is set in M, the reverse procedure of the rearrangement in the permutation unit 3301, the reverse calculation in the MixColumns calculation unit 3502, the reverse calculation in the ShiftRows calculation unit 3501, And N is obtained by the reverse operation of the rearrangement of the permutation unit 3302.

  Next, how to determine a table for updating the selection value R will be described.

  First, the mask value N on the output side in the non-linear transformation unit 3400 is rearranged by the selection value R in the permutation unit 3302, and the data L (P2 (N)) obtained by performing the ShiftRows computation unit 3501 and the MixColumns computation unit 3502 for linear processing. , R ′ is the byte where the 0th byte mask of M is located.

  Alternatively, a selection value necessary to make L (P2 (N)) the same as M in the permutation unit 3301 is R ′. By performing this operation for all R, R 'for R can be determined, and an update table is completed.

  The random number generation unit 3800 generates any value of R = {0, 1,..., 14, 15} at the start of encryption processing, and outputs it to the selection unit.

  The mask value (16 bytes) used in this embodiment is as follows. Numerical values are expressed in hexadecimal notation.

SBOX input side mask M = {30482444cfb7dbbba1622a0b5e9dd5f4}

SBOX output side mask N = {6afe93444801c1bbb7783e4895876cb7}

  23 and 24 show an initial mask table (1111 in FIG. 3) of the initial mask calculation unit 3101 in FIG. 17 and an unmask table (1113 in FIG. 4) of the unmask calculation unit 3102. These initial mask and unmask are stored in the initial mask table (1111 in FIG. 3) of the initial mask calculator 3101 and the unmask table (1113 in FIG. 4) of the unmask calculator 3102.

  On the other hand, M and N are reflected in advance in the SBOX (S1 to S16 in FIG. 18) of the nonlinear conversion unit 3400. When the original SBOX function is S (x), the reflected SBOX St (x) (t = 1 to 16) is given as follows.

St (x) = S (xt (XOR) mt) (XOR) nt

  Here, m and n represent mask values for one byte in M and M, respectively.

  As a mask value relationship, M is obtained by performing permutation (4-byte cyclic shift) on N after calculating with ShiftRows and Mixcolumns.

  That is, R = 0 is cyclically shifted by the permutation unit 3302 (R = 0 is not shifted), and is calculated by ShiftRows and Mixcolumns. Then, R ′ = 4 is cyclically shifted by the permutation unit 3301 It is.

  In this embodiment, a table for updating masks and selection values is set with R = 0 and R ′ = 4. However, by changing the combination of R and R ′, different masks and selection values can be updated. It is possible to build a table.

  When the initial mask is R = 0, it is equivalent to the SBOX input side mask M, and other initial masks of the selection value R are selected as the selection value R by the permutation unit 3302 with respect to the initial mask M0 of R = 0. A cyclic shift is performed.

  The unmasking is equivalent to the one obtained by performing the cyclic shift with the selection value R in the permutation unit 3302 and converting it with ShiftRows.

  FIG. 25 shows an example of a table representing the relationship between the current selection value R (0 to 15) and the next round selection value R ′.

  FIG. 26 is a flowchart for explaining the operation of the first embodiment shown in FIG. The operation of the first embodiment will be described with reference to FIGS.

  First, the plaintext and the secret key are input to the encryption processing circuit, the plaintext is input to the encryption unit 1000, and the secret key is input to the key generation unit 2000 (step B1).

  When the encryption process is started, the random number generation unit 3800 in FIG. 2 generates a random number and inputs the random number to the selection unit 3700 (step B2).

  The selection unit 3700 outputs a selection value R based on the input random number (step B3).

  In the initial mask calculation unit 3101, an initial mask is selected based on the selection value R from the initial mask table of FIG. 23, and an exclusive OR of the plaintext and the initial mask is calculated. The plaintext is masked by this exclusive OR operation (addition operation) (step B4).

  Next, the key operation unit 3601 performs an exclusive OR operation between the masked plaintext and the round key output from the key generation unit 2000, and stores the operation result in the register 3200 (step B5).

  Steps B6 to B13 are performed as round processing after the processing in the key calculation unit 3601. Since the processing contents differ only in the 10th round, the process branches to the next step at the end of the 9th round.

  First, the permutation unit 3301 rearranges the data string based on the selection value R (step B6).

  Next, the nonlinear transformation unit 3400 performs nonlinear transformation on the output value of the permutation unit 3301, and outputs a nonlinear transformation output (Y) (step B7). In the nonlinear conversion unit 3400, the output value of the permutation unit 3301 is divided into 16 pieces, and x1 to x16 are input to the nonlinear conversion tables (S1 to S16) 3411 to 1414 (see FIG. 18).

These non-linear conversion tables are non-linear conversion tables with a mask. In the non-linear conversion table (S1) 3411, as shown in FIG. 19, an exclusive OR operation unit 3431 calculates an exclusive OR of x1 and m _1, and the operation result is stored in the non-linear conversion table 3421 (S ( )) To perform non-linear transformation, take the exclusive OR of the result of non-linear transformation by the exclusive OR operation unit 3435 and n _1, and output the exclusive OR operation result to the output y 1 of the non-linear transformation table (S 1) 3411 To do.

Here, the initial mask value applied to plaintext in step B4, binding the m ₁ ~m _t (concatenate) the mask value _{M (= m 1 || m 2} || ··· || m t; however, || Indicates connection (connection). This is because the selection value R is common, and M is rearranged by the permutation unit 3202 based on the selection value R and stored in the initial mask table. Since the initial mask is rearranged by the permutation unit 3201 that performs the reverse arrangement of the permutation unit 3202, the initial mask is in the same sequence as the mask value M on the input side. The masks match.

  Since the initial mask and the mask value M on the input side in the non-linear conversion unit 3400 are canceled (when the exclusive OR of the matching values is taken, it becomes 0), the non-linear conversion tables 3421 to 3424 are the original ones. A non-linear transformation is performed on the plaintext.

Then, in the exclusive OR operation units 3435 to 3438 in FIG. 19, a mask N (= n ₁ || n ₂ ||...) Obtained by connecting n _{1 to} n ₁₆ to the result of nonlinear transformation of the original plaintext. | n ₁₆ ).

  The permutation unit 3302 in FIG. 17 rearranges the output Y of the nonlinear conversion unit 3400 based on the selection value R (step B8).

  The rearrangement performed by the permutation unit 3302 is the reverse of the rearrangement performed by the permutation unit 3301. By performing reverse sorting in the permutation unit 3302, the data order can be returned to the order before being input to the permutation unit 3301. In addition, the arrangement of the mask applied to the data is rearranged.

  Next, the ShiftRows calculation unit 3501 performs ShiftRows calculation on the rearranged nonlinear transformation results (step B9).

  Subsequently, the MixColumns calculation unit 3502 performs the MixColumns calculation on the result of the ShiftRows calculation (step B10).

  The key calculation unit 3601 calculates an exclusive OR of the output from the MixColumns calculation unit 3502 and the round key sent from the key generation unit 2000, and outputs the calculation result (step B11). The calculation result is stored in the register 3200.

  In the selection unit 3700, for example, according to the table shown in FIG. 25, the current selection value R is updated to the next selection value R ′ (step B12).

  After the processing in the key calculation unit 3601 and the selection unit 3700 in FIG. 17, it is determined whether or not the round processing has been repeated nine times (final round processing start) (step B13).

  As a result of the determination, when the round process has not been completed for the specified number of times (9 rounds) (NO branch of step B13), the process returns to step B6 and the round process is repeated again.

  On the other hand, when the round process has been completed nine times, the process proceeds to step B6, which is the YES branch destination of step B13, as the final round process.

  When repeating the round process, first, the permutation unit 3301 rearranges the results of the key calculation unit 3601 (step B6).

  Next, non-linear conversion is performed on the rearranged data string by the non-linear conversion unit 3400, and a conversion result is output (step B7).

  The permutation unit 3302 rearranges the transformation results of the nonlinear transformation unit 3400 based on the selection value R, and outputs the rearranged results (step B8).

  Next, the ShiftRows calculation unit 3501 performs ShiftRows calculation on the rearranged nonlinear transformation results (step B9).

  Subsequently, the MixColumns calculation unit 3502 performs the MixColumns calculation on the result of the ShiftRows calculation (step B10).

  The key calculation unit 3601 calculates an exclusive OR of the output from the MixColumns calculation unit 3502 and the round key sent from the key generation unit 2000, and outputs the calculation result (step B11). The calculation result is stored in the register 3200.

  In the selection unit 3700, for example, according to the table shown in FIG. 25, the current selection value R is updated to the next selection value R ′ (step B12).

  When the round process has been performed a predetermined number of times, the process proceeds from step B12 to step B13.

  In the final round (the 10th round), the steps B6 to B9 and B11 of the YES branch destination of step B13 are performed as before.

  In AES, MixColumns processing is not performed in the final round, so step B10 is not performed.

  After the processing (step B11) in the key operation unit 3601 in the final round is completed, the unmask operation unit 3302 unprocesses the processing result of the key operation unit 3601 and the unmask indicated by the selection value R from the unmask table shown in FIG. And the operation result is output as ciphertext (step B14).

  The unmask is equivalent to the output mask value N in the non-linear conversion unit 3400 that is converted by the ShiftRows calculation unit 3501 to the value obtained by performing the cyclic shift with the selection value R in the permutation unit 3302.

  Therefore, by calculating the exclusive OR of the processing result of the key calculation unit 3601 and the unmask read with the selection value R, the mask applied to the processing result of the key calculation unit 3601 can be released, and the encryption You can get a sentence.

  Finally, ciphertext C is output and the process ends (step B15).

  Data transition when this embodiment is applied is shown in FIGS.

  27 to 30 are diagrams showing transitions when the initial random number is R = 0 (FIG. 27: Round 0-2, FIG. 28: Round 3-5, FIG. 29: Round 6-8, FIG. 30). : Round 9, 10).

  FIGS. 31 to 34 are diagrams showing transitions when the initial random number is R = 7 (FIG. 31: Round 0-2, FIG. 32: Round 3-5, FIG. 33: Round 6-8, Figure 34: Round 9, 10).

  Further, data transition in AES128 of the comparative example is shown in FIGS. FIG. 39 shows a circuit configuration of the AES encryption unit of the comparative example. FIG. 40 shows the configuration of the non-linear converter 3401 of FIG. The non-linear conversion unit 3401 in FIG. 40 includes 16 non-masked non-linear conversion tables.

  27 to 38, the following data is processed.

Plaintext = {3243f6a8885a308d313198a2e0370734}

Private key = {2b7e151628aed2a6abf7158809cf4f3c}

Ciphertext = {3925841d02dc09fbdc118597196a0b32}

SBOX input side mask M = {30482444cfb7dbbba1622a0b5e9dd5f4}

SBOX output side mask N = {6afe93444801c1bbb7783e4895876cb7}

  The initial mask table is shown in FIG. 23, and the unmask table is shown in FIG.

  The selection value R in the selection unit 3700 is updated based on the table of FIG.

  Note that AfterAddInputMask, AfterSubBytes, AfterAddOutputMask, InputMask, and OutputMask from the first round to the tenth round are described to indicate data transition, but in actual processing, the value of AfterPermutationR = x next to StartofRound is When input to the nonlinear conversion unit 3400 in FIG. 17, only the value of AfterAddOutputMask is output. Therefore, the values of AfterAddInputMask, AfterSubBytes, InputMask, and OutputMask do not appear in the conversion process of the nonlinear conversion unit 3400.

  The selection value is updated at the end of the round, and the transition is shown in the form of R: x-> x ′ under AfterAddRoundKey.

(Example 2)
An encryption processing circuit when 3D encryption is used as encryption will be described as a second embodiment. First, a general configuration example of an encryption processing circuit when using 3D encryption will be described. The 3D cipher has an algorithm structure that uses AES encryption processing, and AES uses 16 bytes (128 bits) of 4x4 as the processing unit, while 3D ciphers have 3 bytes of 4x4x4 64 bytes (512 bits). A dimension block is used as a processing unit. In addition, an AES-like process and a three-dimensional round function are added to this block (Non-Patent Document 6). The data format handled by 3D encryption is shown below.

  In 3D encryption, a 4 × 4 × 4 64 byte (512 bit) three-dimensional block is one data block. The 1st to 16th bytes are the 1st slice, the 17th to 32nd bytes are the 2nd slice, the 33rd to 48th bytes are the 3rd slice, and the 49th to 64th bytes are the 4th slice.

  FIG. 41 is a diagram illustrating a configuration (reference example) of an encryption circuit for 3D encryption. The encryption circuit for 3D encryption includes a register 4200, a nonlinear conversion unit 4401, a diffusion function unit (θ) 4501, a maximum distance separation matrix unit (π) 4502, and key operation units (AddRoundKey) 4601 and 4602.

  The nonlinear conversion unit 4401 performs nonlinear conversion on the input value X and outputs the conversion result as an output value Y. FIG. 42 is a diagram illustrating a configuration of the nonlinear conversion unit 4401. The non-linear conversion unit 4401 includes 64 non-linear conversion tables (γ) 4421 to 4424. In the non-linear conversion tables (γ) 4421 to 4424, non-linear conversion similar to the AES SBOX (SubstitutionBox) is performed.

  The diffusion function unit (θ) 4501 performs diffusion processing on the output value Y of the nonlinear conversion unit 4401 and outputs the processing result to the maximum distance separation matrix unit (π) 4502. The diffusion function part (θ) 4501 performs diffusion processing according to the diffusion function θ1 or θ2. Note that diffusion is performed by θ1 in the odd-numbered round, and diffusion by θ2 is performed in the even-numbered round.

  θ1 is a process for performing ShiftRows in each slice. θ2 is a 4 × 4 matrix obtained by combining the 4 bytes of the first column of each slice, and performs ShiftRows on the matrix. An example of applying θ1 and θ2 to X is shown below.

The maximum distance separation matrix section (π) 4502 calculates the product of each slice of the processing result of the diffusion function section (θ) 4501 and the 4 × 4 maximum distance separation matrix (MDS). As an example of calculation performed in the maximum distance separation matrix part (π) 4302, calculation with the first slice X1 of X is shown.

  The elements in MDS are hexadecimal numbers. Round key calculation units (AddRoundKey) 4601 and 4602 calculate the processing result of the maximum distance separation matrix unit (π) 4502 and the exclusive OR of the plaintext and the 512-bit round key, and output the calculation result.

  FIG. 43 is a flowchart for explaining the operation of the reference example of FIG. The operation of the reference example will be described with reference to FIGS.

  First, the plaintext and the secret key are input to the encryption processing circuit, and the plaintext is input to the encryption unit 1000 and the secret key is input to the key generation unit 2000 (step C1).

  The key calculation unit 4602 calculates an exclusive OR of the plaintext and the round key Ki (step C2).

  After the exclusive OR, steps C3 to C7 are performed as round processing.

  First, the nonlinear conversion unit 4400 performs nonlinear conversion of the output result of the key calculation unit 4601 or 4602 (step C3). Inside the nonlinear conversion unit 4400, an input value to the nonlinear conversion unit 4400 is divided for each byte, and nonlinear conversion is performed using the nonlinear conversion tables (γ) 4421 to 4424.

  In the diffusion function part (θ) 4501, it is determined whether or not it is an odd-numbered round (step C4).

  In the case of an odd-numbered round, diffusion processing is performed on the output of the nonlinear conversion unit 4401 with the diffusion function θ1 (step C5-1).

  In the case of the even-numbered round, diffusion processing is performed on the output of the nonlinear conversion unit 4401 with the diffusion function θ2 (step C5-2).

  The maximum distance separation matrix part (π) 4502 calculates the output of the diffusion function part (θ) 4501 and the MDS matrix π (step C6).

  The key calculation unit 4601 calculates an exclusive OR of the calculation result of the maximum distance separation matrix unit (π) 4502 and the round key generated by the key generation unit 2000 (step C2).

  After calculation by the key calculation unit 4601, it is determined whether or not the current round is the 21st round (the next is the final round) (step C7).

  If the next round is not the final round, the process returns to step C3 and repeats the round process. If the next round is the final round, go to Step C3-1.

  In the 22nd round, the operation with the MDS matrix π is skipped. Therefore, non-linear processing (step C3-1), diffusion processing θ2 (step C5-2), and processing (step C2) in the key calculation unit 4601 are performed. The round process ends here.

  Finally, the result of the key calculation unit 4601 is output as ciphertext and the process ends (step C8).

  A second embodiment in which the present invention is applied to the above-described 3D encryption processing circuit will be described. FIG. 44 is a diagram illustrating the configuration of the encryption unit according to the second embodiment. 41 differs from the circuit configuration of the encryption unit of the 3D encryption in FIG. 41 in that an initial mask calculation unit 4101 for mask calculation, an unmask calculation unit 4102 and permutation units 4301 and 4302, a selection unit 4700, and a random number generation unit 4800. And a non-linear conversion unit 4400 including non-linear conversion tables (γ1 to γ64) 4411 to 4414 with masks instead of the non-linear conversion unit 4401 of FIG.

  The initial mask calculation unit 4101 calculates an exclusive OR of the initial mask and the input data, and the unmask calculation unit 4102 calculates the exclusive OR of the unmask and the input data.

  The permutation units 4301 and 4302 rearrange the input data based on the selection value. Note that the permutation unit 4302 performs the reverse sorting of the permutation unit 4301.

  A non-linear conversion unit 4400 performs non-linear conversion of input data. The nonlinear conversion unit 4400 includes 64 masked nonlinear conversion tables (γ1 to γ64) 4411 to 4414. The non-linear conversion unit 4400 divides the input value into 64 pieces of data byte by byte, and performs non-linear conversion processing using non-linear conversion tables with masks (γ1 to γ64) 4411 to 4414, respectively. FIG. 45 is a diagram illustrating a configuration of the nonlinear conversion unit 4400.

In the non-linear conversion table (γ1) 4411, the non-linear conversion table γ performs non-linear conversion on the value obtained by calculating an exclusive OR of the 1-byte input value and the mask m _1, and sets the mask n ₁ to the non-linear conversion result. The value obtained by exclusive OR is taken as the output value. FIG. 46 shows the configuration of the nonlinear conversion unit 4400. FIG. 46 is a diagram showing the input / output relationship of each of the nonlinear conversion tables 4411 to 4414 in FIG.

  The mask value of Example 2 will be described. In 3D encryption, the spreading process changes between odd and even rounds, so a countermeasure is required.

  The first countermeasure is a method of switching the non-linear conversion unit between odd-numbered rounds and even-numbered rounds. Two combinations of mask values are prepared, and two nonlinear conversion units are prepared accordingly. The output values of the non-linear conversion units 4400A and 4400B are selected by the selector 4450, the output value of the non-linear conversion unit 4400A is selected during the odd round, and the output value of the non-linear conversion unit 4400B is selected during the even round.

  In setting the mask value, either the input side mask or the output side mask can be set arbitrarily. The input side mask Ma of the nonlinear conversion unit 4400A and the input side mask Mb of the nonlinear conversion unit 4400B are arbitrarily set, or conversely, the output side mask Na of the nonlinear conversion unit 4400A and the output side mask Nb of the nonlinear conversion unit 4400B are arbitrarily set. Any one of the combinations can be set.

  After setting the selection value R of the previous even round and the selection value R ′ of the next odd round, the input side mask Ma of the nonlinear conversion unit 4400A is permutated 4302 with respect to Nb in the previous even round. Assume that θ2, π, and permutation 4301 have been performed.

  As a result, the Nb calculated during the even-numbered round can be canceled by the non-linear conversion unit 4400A of the next odd-numbered round.

  On the other hand, the input side mask Mb of the non-linear conversion unit 4400B sets the selection value R of the previous even-numbered round and the selection value R ′ of the next odd-numbered round, and then permutates 4302 with respect to Na in the previous even-numbered round. , Θ1, π, and permutation 4301 have been performed.

  As a result, the Mb-A that has been calculated during the odd-numbered rounds can be canceled by the next even-numbered non-linear conversion unit 420B.

  Further, in the initial mask table, since the non-linear transformation unit 4400A is selected in the first round, it is assumed that the permutation unit 4301 reverses the rearrangement for each selection value with respect to Ma.

  On the other hand, since the matrix calculation with π is not performed in the last 22nd round in the unmask table, the selection values of θ2 and permutation 4302 are rearranged for Nb. .

  In this measure, it is necessary to prepare two nonlinear conversion units, but 64 types of mask values can be set.

  The second countermeasure is to set a mask so that the result is the same regardless of which of θ1 and θ2 is performed on N. As a setting method, first, the selection value R of the current round and the selection value R ′ of the next round are set. Next, an arbitrary value is set to the output side mask N1 of the 1st to 16th bytes corresponding to the first slice.

  Assume that the output side mask N2 of the 17th to 32nd bytes of the second slice is obtained by cyclically shifting N1 by 12 bytes.

  Assume that the output side mask N3 of the 33rd to 48th bytes of the third slice is obtained by cyclically shifting N1 by 8 bytes.

  Further, assume that the output side mask N4 of the 49th to 64th bytes of the fourth slice is obtained by cyclically shifting N1 by 4 bytes.

  Subsequently, an input side mask M is obtained. M is N (= {N1 || N2 || N3 || N4}; where || indicates concatenation (concatenation)), permutation 4302, θ1, and π at selected value R, and selected value It is assumed that permutation 4301 at R ′ is performed.

  FIG. 48 shows the input side mask M set by the above method.

  By setting in this way, it is possible to repeat round processing only by providing one nonlinear processing unit (nonlinear conversion unit). In the second countermeasure, only one nonlinear processing unit is required, but only 16 types of mask values can be set.

  Next, permutation in the second embodiment will be described.

  Permutation applicable to 3D encryption includes rearrangement by three steps.

  As the first step, cyclic shift is performed for each slice. This means that the entire data is cyclically shifted by a multiple of 16 bytes.

  As a second step, a cyclic shift of multiples of 4 bytes is performed in each slice. In other words, the cyclic shift of 0, 4, 8, 12 bytes in the 1st to 16th bytes, and the cyclic shift of 0, 4, 8, 12 bytes in the 17th to 32nd bytes I will go. Similarly, the other two slices are cyclically shifted to 0, 4, 8, or 12 bytes.

  As the third step, there is a method in which 1 to 4 bytes are arranged in the first column, and the 5th to 8th bytes are arranged in units of 4 bytes and the second column, and the same cyclic shift is performed inside each column.

  FIG. 49 is a diagram showing permutation by the above three steps.

  FIG. 50 is a flowchart for explaining the operation of the second embodiment. 43 differs from the comparative example in FIG. 43 in that steps C9 to C15 and C12-1 are added, and steps C3 and C3-1 in FIG. 43 are changed to non-linear transformation with a mask (step C3-2). This is the point.

  The operation of the second embodiment will be described with reference to FIGS.

  First, the plaintext and the secret key are input to the encryption processing circuit, and the plaintext is input to the encryption unit 1000 and the secret key is input to the key generation unit 2000 (step C1).

  The random number generation unit 4800 generates a random number and outputs it to the selection unit 4700 (step C9).

  The selection unit 4700 determines a selection value from the random number and outputs the selection value (step C10).

  The initial mask calculation unit 4101 selects an initial mask based on the selection value from the initial mask table 1111 in FIG. 3, and calculates an exclusive OR of the plaintext and the initial mask. The plaintext is masked by this exclusive OR operation (addition operation) (step C11). The plain text with the mask is stored in the register 4200.

  After the mask process, steps C12 to C7 are performed as a round process. First, the permutation unit 4301 in FIG. 44 rearranges the data string based on the selection value (step C12).

Next, the nonlinear transformation unit 4400 performs nonlinear transformation on the output value of the permutation unit 4301 and outputs a nonlinear transformation output (step C3-2). In the nonlinear conversion unit 4400, the output value of the permutation unit 4301 is divided into 64 pieces, and x1 to x64 are input to the nonlinear conversion tables γ1 to γ64) 4411 to 4414. These non-linear conversion tables are non-linear conversion tables with a mask. The result of the non-linear conversion table (γ1) 4411 is obtained by calculating an exclusive OR of x1 and m ₁ , performing non-linear conversion on the operation result by non-linear conversion γ (·), and exclusive of n ₁ with the result of non-linear conversion. The result is a logical sum.

  The permutation unit 4302 rearranges the outputs of the nonlinear conversion unit 4400 based on the selected value (step C13). The rearrangement performed by the permutation unit 4302 is reverse to the permutation unit 4301. By performing the reverse rearrangement, the data order can be returned to the order before being input to the permutation unit 4301. In addition, the arrangement of the mask applied to the data is rearranged.

  In the diffusion function part (θ) 4501, it is determined whether or not it is an odd-numbered round (step C4).

  In the case of the odd-numbered round, the diffusion process is performed on the output of the nonlinear conversion unit 4400 with the diffusion function θ1 (step C5-1).

  In the case of the even-numbered round, the diffusion process is performed on the output of the nonlinear conversion unit 4400 with the diffusion function θ2 (step C5-2).

  The maximum distance separation matrix part (π) 4502 calculates the output of the diffusion function part (θ) 4501 and the MDS matrix π (step C6).

  The key calculation unit 4600 calculates an exclusive OR of the calculation result of the maximum distance separation matrix unit (π) 4502 and the round key generated by the key generation unit 2000 (step C2).

  In addition, the selection unit 4700 updates the selection value (step C14).

  After the calculation in the key calculation unit 4600 and the update of the selection value, it is determined whether or not the current round is the 21st round (the next is the final round) (step C7).

  If the next round is not the final round, the process returns to step C12 and repeats the round process. When the next is the final round, the process proceeds to Step C12-1.

  In the 22nd round, the operation with the MDS matrix π is skipped. Therefore, non-linear processing with a mask (step C3-2), diffusion processing θ2 (step C5-2), and key calculation (step C2) are performed. The round process ends here.

  Subsequently, the unmask calculation unit 4102 selects an unmask based on the selection value from the unmask table 1113 in FIG. 4, and calculates the exclusive OR of the output of the key calculation unit 4600, which is the result of the round process, and the unmask. The calculation result is output as ciphertext (step C15). This exclusive OR with the unmask removes the mask applied to the round processing result and obtains the original ciphertext.

  Finally, the result of the unmask operation unit 4102 is output as ciphertext and the process ends (step C8).

  The encryption processing circuits of the first embodiment and the first and second embodiments can be realized by hardware, software, or a combination thereof. The encryption processing method performed by the above-described encryption processing circuit and other devices can also be realized by hardware, software, or a combination thereof. Here, “realized by software” means realized by a computer reading and executing a program. The program can be stored and provided to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, semiconductor memory (for example, mask ROM, PROM (ProgrammableROM), EPROM (ErasablePROM), flash ROM, RAM (randomaccessmemory)) are included. The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

  In the above embodiments and examples, the encryption processing circuit has been described. However, by applying the present invention, the decryption processing circuit (that is, the decryption processing circuit) may have the same configuration as the encryption processing circuit. it can. The decryption process is a process for returning a ciphertext to a plaintext, contrary to the encryption process. In this case, “encryption” is replaced with “decryption”.

For example, in FIG. 1, “encryption unit 1000” is replaced with “decryption unit 5000”. In FIG. 1, when the encryption unit 1000 is a decryption unit, “ciphertext” is input and “plaintext” is output. 2 is replaced with a decryption unit (FIG. 51). FIG. 52 is a diagram showing the configuration of the decoding unit 5000. Hereinafter, the operation in the decoding unit will be described with reference to FIG. In FIG. 52, the ciphertext is input and the processing result is output as plaintext. The ciphertext encrypted in the first embodiment is input to the decryption unit, unmasked by the unmask operation unit 5102 in the decryption unit, and stored in the register 5200. Thereafter, as round processing, addition (equivalently subtraction) with the round key Ki is performed by the key calculation unit 5600, and the calculation result is linearly converted by the linear conversion unit 5500. The linear transformation unit 5500 in the decryption unit is an inverse transformation L ⁻¹ (·) with respect to the linear transformation L (·) in the encryption unit. The result of inverse transformation by the linear transformation unit 5500 is rearranged by the permutation unit 5302. The rearrangement in the permutation unit 5302 is opposite to the rearrangement in the permutation unit 1302 of the encryption unit. The rearranged result is divided into t pieces and input to the tables (S1 to St) of the nonlinear conversion unit 5400. The table (S1 to St) in the decryption unit is the input and output of the table (S1 to St) in the encryption unit are reversed (the table output in the encryption unit is the input (table index), and the table in the encryption unit) Is the output value corresponding to the table index). In the table (S1 to St) in the decryption unit, the mask N on the output side of the table in the encryption unit is used as the mask on the input side, and the mask M on the input side of the table in the encryption unit is used as the mask on the output side. The permutation unit 5301 rearranges the results converted by the nonlinear conversion unit. The rearrangement in the permutation unit 5301 is opposite to the rearrangement in the permutation unit 1301 of the encryption unit. When the decoding unit repeats the specified number of rounds, the initial mask calculation unit 5101 performs an operation with the initial mask on the processing result of the permutation unit 5301 to release the mask, and the processing result is plaintext. Is output as In addition, the selection value is updated in the opposite way to the encryption unit. When the selection value sv is updated to sv ′ in the next round in the encryption unit, the selection value sv ′ is updated in the next round in the decryption unit. Then the value is updated to sv.

  It should be noted that the disclosures of the above-mentioned patent documents and non-patent documents are incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept. Further, various combinations or selections of various disclosed elements (including each element in each supplementary note, each element in each embodiment, each element in each drawing, etc.) are possible within the scope of the claims of the present invention. . That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea.

1000 Encryption unit 1101 Initial mask operation unit 1102 Unmask operation unit 1103 MMSj + 1 addition unit 1111 Initial mask table 1112 Exclusive OR operation unit 1113 Unmask table 1114 Exclusive OR operation unit 1200 Register 1301 Permutation unit 1302 Perm Station part 1303 Barrel shift 1304 Barrel shift 1400 Nonlinear converter 1401 Nonlinear converter (without mask)
1402 Nonlinear Conversion Unit 1411 Nonlinear Conversion Table (S1)
1412 Nonlinear conversion table (S2)
1413 Nonlinear conversion table (S3)
1414 Nonlinear Conversion Table (St)
1420, 1421-1424 Nonlinear conversion table (S)
1431 to 1438 Exclusive OR operation unit 1441 Nonlinear conversion table (S1, RSM)
1442 Nonlinear conversion table (S2, RSM)
1443 Nonlinear conversion table (S3, RSM)
1444 Nonlinear conversion table (St, RSM)
1500 Linear transformation unit 1600 Key operation units 1611 to 1614 Exclusive OR operation unit 1700 Selection unit 1800 Random number generation unit 1901 Front unit 1902 Rear unit 2000 Key generation unit 3101 Initial mask operation unit 3102 Unmask operation unit 3200 Registers 3301 and 3302 Mutation unit 3400 Nonlinear transformation unit 3401 Nonlinear transformation unit (no mask)
3411 Nonlinear Conversion Table (S1)
3412 Nonlinear conversion table (S2)
3413 Nonlinear Conversion Table (S3)
3414 Nonlinear Conversion Table (S16)
3421 to 3424 Nonlinear conversion table (S)
3431 to 3438 Exclusive OR operation unit 3501 ShiftRows operation unit 3502 MixColumns operation units 3601 and 3602 Key operation unit 3700 Selection value unit 3800 Random number generation unit 4101 Initial mask operation unit 4102 Unmask operation unit 4200 Register 4301 and 4302 Permutation unit 4400 4400A, 4400B, 4401 Nonlinear conversion unit 4411 Nonlinear conversion table with mask (γ1)
4412 Nonlinear conversion table with mask (γ2)
4413 Nonlinear conversion table with mask (γ2)
4414 Nonlinear conversion table with mask (γ64)
4411A Nonlinear conversion table with mask (γ1)
4412A Nonlinear conversion table with mask (γ64)
4411B Nonlinear conversion table with mask (γ'1)
4412B Nonlinear conversion table with mask (γ'64)
4421 to 4424 Nonlinear conversion table (γ)
4450 Selector 4501 Diffusion function part (θ)
4502 Maximum distance separation matrix (π)
4601, 4602 Key calculation unit 4700 Selection unit 4800 Random number generation unit 5000 Decoding unit 5101 Initial mask calculation unit 5102 Unmask calculation unit 5200 Register 5301, 5302 Permutation unit 5400 Non-linear conversion unit 5500 Linear conversion unit 5600 Key calculation unit 5700 Selection value unit 5800 random number generator

Claims (10)

A random number generator for generating random numbers;
A selection unit that sets an initial value of a selection value using the random number as an input, and updates the next selection value every time round processing ends,
An initial mask operation unit that selects an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and performs an exclusive OR of the selected initial mask and the input plaintext;
A first permutation unit for rearranging the pattern corresponding to the selection value from the selection unit to the input data string and outputting the rearranged result;
A non-linear transformation unit including a plurality of tables each for non-linear transformation of a value obtained by dividing the output of the first permutation unit into a plurality of values;
A second reordering of the pattern opposite to the first permutation unit is performed on the data string obtained by combining a plurality of output values of the non-linear transformation unit according to the selection value from the selection unit. The permutation part of
A linear transformation unit that performs linear transformation on the output of the second permutation unit;
A key calculation unit for calculating the output of the linear conversion unit and a round key;
With
In the first round process, the output of the initial mask calculation unit is input to the first permutation unit. In the second and subsequent round processes, the first permutation unit receives the previous round. The output of the key calculation unit in the process is input,
In the non-linear conversion unit, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear conversion value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round processing by the first permutation unit, the nonlinear conversion unit, the second permutation unit, the linear conversion unit, and the key calculation unit is performed a specified number of times,
An unmask value corresponding to the selection value from the selection unit is selected from a plurality of unmask values, and the selected unmask value is exclusive of the output of the key calculation unit after completion of the specified number of round processes An encryption processing circuit comprising an unmask operation unit that takes a logical sum and outputs a ciphertext. Each permutation part of the first and second permutation parts is:
A result obtained by performing linear transformation in the linear transformation unit on values rearranged in the permutation unit,
The result obtained by rearranging the data string by the permutation unit with respect to the result of linear conversion by the linear conversion unit,
2. The encryption processing circuit according to claim 1, wherein the encryption processing circuits have rearrangement patterns such that they match each other. The mask values on the output side of the non-linear transformation unit are rearranged in the second permutation unit,
The values rearranged by the second permutation unit are linearly transformed by the linear transformation unit,
The value obtained by rearranging the result of linear transformation by the linear transformation unit in the first permutation unit is used as a mask value on the input side of the nonlinear transformation unit. Encryption processing circuit.   In the selection unit, the rearrangement pattern of the first permutation unit is selected so that the sequence of the mask values applied to the data string and the sequence of the mask values on the input side of the non-linear transformation unit match. The encryption processing circuit according to any one of claims 1 to 3, wherein When the selection value of the selection unit is the first value (sv), the rearrangement of the second permutation unit is P2sv (•), the linear transformation is L (•),
When the selection value is the second value (sv ′), the rearrangement of the first permutation unit is P1sv ′ (•), and the selection value of the selection unit has the first value (sv). Assuming that the next selection value becomes the second value (sv ′), the input side mask value M and the output side mask value of the nonlinear conversion unit for all selection values in the selection unit For N
M = P1sv '(L (P2sv (N)))
4. The encryption processing circuit according to claim 1, wherein the first and second permutation units have a rearrangement pattern that satisfies the following relationship. 5. Targeting AES (Advanced Encryption Standard) as an encryption algorithm,
The first and second permutation units perform rearrangement by a cyclic shift of multiples of 4 bytes, and further form a column every 4 bytes and perform rearrangement by the same cyclic shift in each column. The encryption processing circuit according to any one of claims 1 to 5, wherein: For 3D encryption as an encryption algorithm,
In the first and second permutation units,
In the first slice, rearrangement is performed by cyclic shift with a multiple of 4 bytes, and further, a column is formed every 4 bytes and rearrangement is performed by the same cyclic shift in each column.
In the second slice, rearrangement is performed by a cyclic shift with the same multiple of 4 bytes as in the first slice. Further, a column is formed every 4 bytes, and the first slice in each column Sort by the same cyclic shift,
In the third slice, rearrangement is performed by a cyclic shift with the same multiple of 4 bytes as in the first slice, and a column is formed every 4 bytes, and the first slice in each column Sort by the same cyclic shift,
In the fourth slice, rearrangement is performed by a cyclic shift with the same multiple of 4 bytes as in the first slice, and a column is formed every 4 bytes, and the first slice in each column 5. The encryption processing circuit according to claim 1, wherein rearrangement is performed by the same cyclic shift. An encryption processing method by a data processing device,
A random number generating step for generating a random number;
A selection step of setting an initial value of a selection value using the random number as an input, and updating a next selection value every time round processing ends,
An initial mask operation step of selecting an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and taking an exclusive OR of the selected initial mask and input;
A first permutation step of rearranging the pattern corresponding to the selected value from the selection step to the input data string and outputting the rearranged result;
A non-linear transformation step for non-linear transformation of a plurality of values obtained by dividing the output value of the first permutation step into a plurality of tables;
In accordance with a selection value from the selection step, a second rearrangement of the pattern opposite to the first permutation step is performed on a data string obtained by combining a plurality of output values of the nonlinear transformation step. The permutation process,
A linear transformation step for performing a linear transformation on the output of the second permutation step;
A key calculation step for calculating the output of the linear transformation step and a round key;
Including
In the first round process, the output of the initial mask calculation process is input to the first permutation process,
In the second and subsequent round processes, the output of the key calculation process in the previous round process is input to the first permutation process,
In the non-linear conversion step, the table performs non-linear conversion according to the table using a value obtained by performing an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round process by the first permutation step, the nonlinear transformation step, the second permutation step, the linear transformation step, and the key calculation step is performed a prescribed number of times,
An exclusive logic of selecting an unmask value corresponding to the selection value from the selection step from among a plurality of unmask values, and the output of the key operation step after the specified number of round processing ends An unmask operation step of taking the sum and outputting as ciphertext;
An encryption processing method comprising: A program for causing a data processing apparatus to execute encryption processing,
Random number generation processing for generating random numbers;
A selection process in which an initial value of a selection value is set using the random number as an input, and the next selection value is updated every round of round processing;
Selecting an initial mask value corresponding to the selection value from the selection unit from a plurality of initial mask values, and initial mask operation processing for taking an exclusive OR of the selected initial mask and input;
A first permutation process for rearranging the pattern corresponding to the selection value from the selection process to the input data string and outputting the rearranged result;
A non-linear transformation process that non-linearly transforms values obtained by dividing the output value of the first permutation process into a plurality of tables, respectively;
In accordance with a selection value from the selection process, a second rearrangement of the pattern opposite to the first permutation process is performed on a data string obtained by combining a plurality of output values of the nonlinear conversion process. Permutation processing,
A linear transformation process for performing a linear transformation on the output of the second permutation process;
A key operation process for calculating an output of the linear transformation process and a round key;
Including
In the first round process, the output of the initial mask calculation process is input to the first permutation process,
In the second and subsequent round processes, the first permutation process receives the output of the key calculation process in the previous round process,
In the non-linear conversion process, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with the mask value on the input side for the input to the table, and the non-linear converted value Output the value obtained by taking the exclusive OR with the mask value on the output side,
The round processing by the first permutation processing, the nonlinear transformation processing, the second permutation processing, the linear transformation processing, and the key calculation processing is performed a prescribed number of times,
Select an unmask value corresponding to the selection value from the selection process from among a plurality of unmask values, and exclusive logic between the selected unmask value and the output of the key operation process after the specified number of rounds have been completed Including unmasking operation that takes the sum and outputs it as ciphertext,
An encryption processing program characterized by that. A random number generator for generating random numbers;
A selection unit that sets an initial value of a selection value using the random number as an input, and updates the next selection value every time round processing ends,
In accordance with a selection value from the selection unit, an unmask value is selected from a plurality of unmask values, and the selected unmask value and an unmask operation unit that performs exclusive OR with the ciphertext;
In the first round, the output of the unmask calculation unit, and in the second and subsequent rounds, a reordering result in the second permutation unit in the previous round, and a key calculation unit that calculates the round key;
A linear conversion unit that performs linear conversion on the output of the key calculation unit;
A first permutation unit that rearranges the pattern corresponding to the selection value from the selection unit and outputs the rearranged result with respect to the output of the linear conversion unit;
A non-linear conversion unit including a plurality of tables that non-linearly convert values obtained by dividing the output value of the first permutation unit into a plurality of values,
In accordance with a selection value from the selection unit, a second reordering of the pattern opposite to the first permutation unit is performed on a data string obtained by combining a plurality of output values of the nonlinear conversion unit. The permutation section,
With
In the non-linear conversion unit, the table performs non-linear conversion according to the table using a value obtained by taking an exclusive OR with a mask value on the input side with respect to the input to the table, and the non-linear conversion value Output the value obtained by taking the exclusive OR with the mask value on the output side,
Round processing by the key calculation unit, the first permutation unit, the non-linear conversion unit, and the second permutation unit is performed a specified number of times,
An initial mask value is selected from a plurality of initial mask values according to a selection value from the selection unit, and the selected initial mask value and the second permutation unit after the prescribed number of round processes are completed A decoding processing circuit comprising an initial mask operation unit that performs an exclusive OR with the rearrangement result of

Images