JP2021141458A - Information processing device, information processing method, and program - Google Patents

Abstract

To achieve a white-box implementation of AES with memory saving.SOLUTION: An information processing device includes acquisition means for acquiring a result of an operation, containing an operation result of an operation involving multiplication of SubBytes processing and MixColumns processing in a first round of White-Box AES, corresponding to an exclusive logical OR of an expansion key obfuscated in the first round and a conversion result obtained by converting a plaintext with a second lookup table by referring to a first lookup table commonly used in intermediate rounds.SELECTED DRAWING: Figure 4

Description

The present invention relates to an information processing device, an information processing method and a program.

When performing encryption processing such as encryption or authentication using an encryption algorithm, it is a prerequisite that the key used for the encryption processing is not known to a third party. However, devices that perform encryption and authentication are often in the hands of third parties, and attackers try to obtain keys that are hard-coded in the device firmware, etc. by disassembling / analyzing the device. ..

A white-box implementation (White-Box Cryptography) is known as a method of obfuscating a hard-coded key. As a white box implementation related to AES (Advanced Encryption Standard), for example, the white box implementation described in Non-Patent Documents 1 and 2 is known.

"White-Box Cryptography and an AES Implementation." S. Chow, P. Eisen, H. Johnson, P.C. van Oorschot. In 9th Annual Workshop on Selected Areas in Cryptography (SAC 2002), Aug.15-16 2002. "A Tutorial on White-box AES." James A. Muir. Advances in Network Analysis and its Applications, Mathematics in Industry 18 (2013), 209-229.

According to Non-Patent Documents 1 and 2 described above, the total size of the look-up table required when the key length of AES is 128 bits is 508 KB, and the look-up table required when the key length is 256 bits. The total size of is 732KB.

However, in recent years, network connection of embedded systems has been promoted, and it is desired to realize AES white box implementation with a smaller memory capacity so that key obfuscation can be performed even in an embedded system with a small memory capacity. ..

The disclosed technology was made in view of the above points, and aims to realize AES white box implementation with low memory.

In order to achieve the above object, the information processing apparatus according to one embodiment includes the calculation result of the operation including the multiplication of the SubBytes process and the MixColumns process in the first round of the White-Box AES, and in the intermediate round. An operation corresponding to the exclusive OR of the conversion result obtained by converting the plain text by the second lookup table and the expanded key obfuscated in the first round with reference to the commonly used first lookup table. It is characterized by having an acquisition means for acquiring a result.

The purpose is to realize AES white box implementation with memory saving.

It is a figure which shows an example of the processing of the 1st sub-round in the 1st round of encryption. It is a figure which shows an example of the processing of the 1st sub-round in the r (2 ≦ r ≦ E) round of encryption. It is a figure which shows an example of the processing of the 1st sub-round in the E + 1th round of encryption. It is a figure which shows an example of the functional structure of the encryption system which concerns on this embodiment. It is a figure which shows an example of the hardware configuration of the encryption system which concerns on this embodiment. It is a figure which shows the flow of the process per 1 subround in the 1st round of the encryption which concerns on this embodiment. It is a figure which shows the flow of processing per one sub-round in the r (2 ≦ r ≦ E) round of encryption which concerns on this embodiment. It is a figure which shows the flow of processing per one sub-round in the E + 1th round of the encryption which concerns on this embodiment.

Hereinafter, an embodiment of the present invention will be described. In this embodiment, the encryption system 10 that realizes the white-box implementation of AES (White-Box AES) in a memory-saving manner will be described. Here, it is assumed that the encryption system 10 according to the present embodiment is an embedded system (Embedded System) equipped with a general microprocessor or the like. An embedded system is, for example, a system that is embedded in an industrial device, a home electric appliance, or the like and realizes a specific function. Specifically, for example, it is possible to incorporate the encryption system 10 according to the present embodiment into a smart meter or the like used in a HEMS (Home Energy Management System).

However, the encryption system 10 according to the present embodiment is not limited to the embedded system, and may be, for example, various terminals or devices such as a PC (Personal Computer), a smartphone, and a tablet terminal.

<Theoretical composition>
First, the theoretical configuration of encryption by White-Box AES according to this embodiment will be described. In AES, the data is encrypted by repeatedly executing the rounds corresponding to the bit length of the key (encryption key), with the processing for 16 bytes of data as one round. Further, in one round, processing for 4 bytes is regarded as one sub-round, and four sub-rounds are executed.

Hereinafter, the input data of each round is represented by v, the output data is represented by w, the index indicating the round is represented by r (however, 1 ≦ r ≦ E + 1), and the index indicating the sub round is represented by s (however, 1 ≦ s ≦ 4). .. Further, the data of the 1st to 16th bytes of the 16-byte input data v is represented by v0 to v15, respectively. Similarly, the 1st to 16th bytes of the 16-byte output data w are represented by w0 to w15, respectively. Note that E is the number of rounds corresponding to the key length. For example, when the key length is 128 bits, E = 10, when the key length is 192 bits, E = 12, and when the key length is 256 bits, E = 14.

≪1st round≫
The processing of the first round (that is, when r = 1) of the White-Box AES according to the present embodiment will be described. In the first round of encryption, the input data v is plaintext and the output data w is an intermediate value.

Hereinafter, as an example, the processing of the first sub-round (that is, when s = 1) in the first round of encryption will be described with reference to FIG. FIG. 1 is a diagram showing an example of processing in the first sub-round in the first round of encryption.

As shown in FIG. 1, in the first sub-round in the first round, for example, v0, v5, v10 and v15 are selected from the 16-byte input data v, and these selected data (that is, 4 bytes) are selected. Data) is processed. The process of selecting this 4-byte data is called the Shift Rows process. In the Shift Rows process, 4-byte data different from the 1st sub-round is selected in the 2nd sub-round, and 4-byte data different from the 1st and 2nd sub-rounds is selected in the 3rd sub-round. In the first round, 4 bytes of data different from those in the 1st to 3rd sub rounds are selected. Specifically, for example, v4, v9, v14 and v3 are selected in the second subround, v8, v13, v2 and v7 are selected in the third subround, and v12, v1, v6 and in the fourth subround. v11 is selected. Hereinafter, 1-byte data of the 4-byte data selected by the Shift Rows process is also referred to as "selected data".

At this time, in the first sub-round in the first round of the White-Box AES according to the present embodiment, the selected data is converted by the lookup table Tb, and then the obfuscated enlarged key k'1x (however, x = 0, After performing the exclusive OR operation with 5, 10, 15), the lookup tables T0 to T3 are used for conversion, and the exclusive OR operation of the MixColumns process is performed to obtain one of the output data w. Obtain byte data w0 to w3.

Here, each symbol in FIG. 1 means the following.

RIx (where x is either b or 0-4): 8-bit random number RJ: 16-bit random number representing the sort number RL: 8-bit random number used for multiplication on the Galois field (the irreducible polynomial is 30 ways). In the figure, the multiplication on the Galois field is indicated by "・". In addition, the inverse element of RL on the Galois field is indicated by ^{"RL -1".}

k1x (however, x = 0 to 15): 8-bit expansion key in the first round S (): A function that executes SubBytes processing. In the figure, it is written as "S".

Sort (RJ, d): A function that takes the parameter RJ and 8-bit data d as inputs, sorts each bit value of this data d, and outputs 8-bit data. In the figure, it is described as "Sort (RJ)".

Rvrs (RJ, d): Inverse conversion of Sort (RJ, d) with parameter RJ and 8-bit data d as inputs. In the figure, it is described as "Rvrs (RJ)".

In addition, RI4 and k'1x are defined below.

なお、ｋ'１ｘは難読化した拡大鍵である。

Note that k'1x is an obfuscated enlarged key.

Then, a lookup table Tb that converts plaintext for arbitrary 8-bit data d is configured as follows.

また、任意の８ビットデータｄに対して、SubBytes処理とMixColumns処理の乗算とを合成したルックアップテーブルＴ０〜Ｔ３を以下で構成する。

Further, the lookup tables T0 to T3 obtained by synthesizing the multiplication of the SubBytes process and the MixColumns process for the arbitrary 8-bit data d are configured as follows.

以上のルックアップテーブルＴｂ、Ｔ０〜Ｔ３及び難読化した拡大鍵ｋ'１ｘ（ただし、ｘ＝０，５，１０，１５）により、本実施形態に係るWhite-Box AESの１ラウンド目における１サブラウンド目の処理が実現される。すなわち、以下により出力データｗのうちの１バイトデータｗ０〜ｗ３が得られる。

With the above lookup tables Tb, T0 to T3 and the obfuscated enlarged key k'1x (however, x = 0, 5, 10, 15), one sub in the first round of the White-Box AES according to the present embodiment. Round processing is realized. That is, 1-byte data w0 to w3 of the output data w can be obtained by the following.

なお、出力データｗのうちの１バイトデータｗ４〜ｗ７は２サブラウンド目、ｗ８〜ｗ１１は３サブラウンド目、ｗ１２〜ｗ１５は４サブラウンド目で同様に得られる。ただし、２サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ４、ｖ９、ｖ１４、ｖ３をそれぞれ用いると共に、難読化した拡大鍵ｋ'１０、ｋ'１５、ｋ'１１０、ｋ'１１５の代わりにｋ'１４、ｋ'１９、ｋ'１１４、ｋ'１３をそれぞれ用いる。同様に、３サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ８、ｖ１３、ｖ２、ｖ７をそれぞれ用いると共に、難読化した拡大鍵ｋ'１０、ｋ'１５、ｋ'１１０、ｋ'１１５の代わりにｋ'１８、ｋ'１１３、ｋ'１２、ｋ'１７をそれぞれ用いる。同様に、４サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ１２、ｖ１、ｖ６、ｖ１１をそれぞれ用いると共に、難読化した拡大鍵ｋ'１０、ｋ'１５、ｋ'１１０、ｋ'１１５の代わりにｋ'１１２、ｋ'１１、ｋ'１６、ｋ'１１１をそれぞれ用いる。

Of the output data w, 1-byte data w4 to w7 are similarly obtained in the second subround, w8 to w11 are obtained in the third subround, and w12 to w15 are obtained in the fourth subround. However, in the second subround, v4, v9, v14, and v3 are used instead of v0, v5, v10, and v15, and the obfuscated enlarged keys k'10, k'15, k'110, and k'115 are used. Instead, k'14, k'19, k'114, and k'13 are used, respectively. Similarly, in the third subround, v8, v13, v2, and v7 are used instead of v0, v5, v10, and v15, and the obfuscated enlarged keys k'10, k'15, k'110, and k'115 are used, respectively. Instead of, k'18, k'113, k'12, and k'17 are used, respectively. Similarly, in the 4th subround, v12, v1, v6, v11 are used instead of v0, v5, v10, v15, and the obfuscated enlarged keys k'10, k'15, k'110, k'115, respectively. Instead of, k'112, k'11, k'16, and k'111 are used, respectively.

≪r (1 ≦ r ≦ E) round ≫
Next, the processing of the r (2 ≦ r ≦ E) round (that is, the intermediate round) of the White-Box AES according to the present embodiment will be described. In the r (2 ≦ r ≦ E) round of encryption, the input data v is the intermediate value output in the previous round, and the output data w is the intermediate value input in the next round.

Hereinafter, as an example, the processing of the first sub-round (that is, when s = 1) in the r (2 ≦ r ≦ E) round of encryption will be described with reference to FIG. FIG. 2 is a diagram showing an example of processing in the first sub-round in the r (2 ≦ r ≦ E) round of encryption.

As shown in FIG. 2, in the first sub-round in the r (2 ≦ r ≦ E) round, for example, v0, v5, v10 and v15 of the 16-byte input data v are selected data.

At this time, in the first sub-round in the r (2 ≦ r ≦ E) round of the White-Box AES according to the present embodiment, the selected data and the obfuscated enlarged key k'rx (however, x = 0.5) After performing the exclusive OR operation with 10 and 15), the lookup tables T0 to T3 are used for conversion, and the exclusive OR operation of the MixColumns process is performed to perform the 1-byte data of the output data w. Obtain w0 to w3.

Here, krx (where x = 0 to 15) is an 8-bit expansion key in the rth round, and k'rx is an obfuscation of the expansion key krx as follows.

以上のルックアップテーブルＴ０〜Ｔ３及び難読化した拡大鍵ｋ'ｒｘ（ただし、ｘ＝０，５，１０，１５）により、本実施形態に係るWhite-Box AESのｒ（２≦ｒ≦Ｅ）ラウンド目における１サブラウンド目の処理が実現される。すなわち、以下により出力データｗのうちの１バイトデータｗ０〜ｗ３が得られる。

With the above lookup tables T0 to T3 and the obfuscated enlarged key k'rx (however, x = 0, 5, 10, 15), r (2 ≦ r ≦ E) of the White-Box AES according to the present embodiment. The processing of the first sub-round in the first round is realized. That is, 1-byte data w0 to w3 of the output data w can be obtained by the following.

なお、出力データｗのうちの１バイトデータｗ４〜ｗ７は２サブラウンド目、ｗ８〜ｗ１１は３サブラウンド目、ｗ１２〜ｗ１５は４サブラウンド目で同様に得られる。ただし、２サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ４、ｖ９、ｖ１４、ｖ３をそれぞれ用いると共に、難読化した拡大鍵ｋ'ｒ０、ｋ'ｒ５、ｋ'ｒ１０、ｋ'ｒ１５の代わりにｋ'ｒ４、ｋ'ｒ９、ｋ'ｒ１４、ｋ'ｒ３をそれぞれ用いる。同様に、３サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ８、ｖ１３、ｖ２、ｖ７をそれぞれ用いると共に、難読化した拡大鍵ｋ'ｒ０、ｋ'ｒ５、ｋ'ｒ１０、ｋ'ｒ１５の代わりにｋ'ｒ８、ｋ'ｒ１３、ｋ'ｒ２、ｋ'ｒ７をそれぞれ用いる。同様に、４サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ１２、ｖ１、ｖ６、ｖ１１をそれぞれ用いると共に、難読化した拡大鍵ｋ'ｒ０、ｋ'ｒ５、ｋ'ｒ１０、ｋ'ｒ１５の代わりにｋ'ｒ１２、ｋ'ｒ１、ｋ'ｒ６、ｋ'ｒ１１をそれぞれ用いる。

Of the output data w, 1-byte data w4 to w7 are similarly obtained in the second subround, w8 to w11 are obtained in the third subround, and w12 to w15 are obtained in the fourth subround. However, in the second subround, v4, v9, v14, and v3 are used instead of v0, v5, v10, and v15, and the obfuscated extended keys k'r0, k'r5, k'r10, and k'r15 are used. Instead, k'r4, k'r9, k'r14, and k'r3 are used, respectively. Similarly, in the third subround, v8, v13, v2, and v7 are used instead of v0, v5, v10, and v15, and the obfuscated extended keys k'r0, k'r5, k'r10, and k'r15 are used, respectively. Instead of, k'r8, k'r13, k'r2, and k'r7 are used, respectively. Similarly, in the 4th subround, v12, v1, v6, v11 are used instead of v0, v5, v10, v15, respectively, and the obfuscated extended keys k'r0, k'r5, k'r10, k'r15 are used. Instead of, k'r12, k'r1, k'r6, and k'r11 are used, respectively.

≪E + 1 round ≫
Next, the processing of the E + 1th round (that is, the final round) of the White-Box AES according to the present embodiment will be described. In the E + 1th round of encryption, the input data v is the intermediate value output in the previous round, and the output data w is the ciphertext.

Hereinafter, as an example, the processing of the first sub-round (that is, when s = 1) in the E + 1th round of encryption will be described with reference to FIG. FIG. 3 is a diagram showing an example of processing in the first sub-round in the E + 1th round of encryption.

As shown in FIG. 3, in the first sub-round in the E + 1th round, for example, of the 16-byte input data v, v0, v5, v10 and v15 are the selection data.

At this time, in the first sub-round in the E + 1th round of the White-Box AES according to the present embodiment, the selection data and the obfuscated enlarged key k'Ex (however, x = 0, 5, 10, 15) are exclusive. An exclusive OR operation was performed, and after conversion by the lookup table T0, an exclusive OR operation was performed with the obfuscated extended key k'(E + 1) x (however, x = 0,1,2,3). By converting with the lookup table Te above, 1-byte data w0 to w3 of the output data w are obtained.

Here, k (E + 1) x (where x = 0 to 15) is an 8-bit expansion key in the E + 1th round, and k'(E + 1) x obfuscates the expansion key k (E + 1) x by the following. It is a thing.

ＲＩｅは８ビットの乱数である。

RIe is an 8-bit random number.

Further, a lookup table Te that converts arbitrary 8-bit data d into a ciphertext is configured as follows.

以上のルックアップテーブルＴ０、Ｔｅ並びに難読化した拡大鍵ｋ'Ｅｘ（ただし、ｘ＝０，５，１０，１５）及びｋ'（Ｅ＋１）ｘ（ただし、ｘ＝０，１，２，３）により、本実施形態に係るWhite-Box AESのＥ＋１ラウンド目における１サブラウンド目の処理が実現される。すなわち、以下により出力データｗのうちの１バイトデータｗ０〜ｗ３が得られる。

The above lookup tables T0, Te and the obfuscated extended keys k'Ex (where x = 0,5,10,15) and k'(E + 1) x (where x = 0,1,2,3) As a result, the processing of the first sub-round in the E + 1th round of the White-Box AES according to the present embodiment is realized. That is, 1-byte data w0 to w3 of the output data w can be obtained by the following.

なお、出力データｗのうちの１バイトデータｗ４〜ｗ７は２サブラウンド目、ｗ８〜ｗ１１は３サブラウンド目、ｗ１２〜ｗ１５は４サブラウンド目で同様に得られる。ただし、２サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ４、ｖ９、ｖ１４、ｖ３をそれぞれ用いると共に、難読化した拡大鍵ｋ'Ｅ０、ｋ'Ｅ５、ｋ'Ｅ１０、ｋ'Ｅ１５、ｋ'（Ｅ＋１）０、ｋ'（Ｅ＋１）１、ｋ'（Ｅ＋１）２、ｋ'（Ｅ＋１）３の代わりにｋ'Ｅ４、ｋ'Ｅ９、ｋ'Ｅ１４、ｋ'Ｅ３、ｋ'（Ｅ＋１）４、ｋ'（Ｅ＋１）５、ｋ'（Ｅ＋１）６、ｋ'（Ｅ＋１）７をそれぞれ用いる。同様に、３サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ８、ｖ１３、ｖ２、ｖ７をそれぞれ用いると共に、難読化した拡大鍵ｋ'Ｅ０、ｋ'Ｅ５、ｋ'Ｅ１０、ｋ'Ｅ１５、ｋ'（Ｅ＋１）０、ｋ'（Ｅ＋１）１、ｋ'（Ｅ＋１）２、ｋ'（Ｅ＋１）３の代わりにｋ'Ｅ８、ｋ'Ｅ１３、ｋ'Ｅ２、ｋ'Ｅ７、ｋ'（Ｅ＋１）８、ｋ'（Ｅ＋１）９、ｋ'（Ｅ＋１）１０、ｋ'（Ｅ＋１）１１をそれぞれ用いる。同様に、４サブラウンド目ではｖ０、ｖ５、ｖ１０、ｖ１５の代わりにｖ１２、ｖ１、ｖ６、ｖ１１をそれぞれ用いると共に、難読化した拡大鍵ｋ'Ｅ０、ｋ'Ｅ５、ｋ'Ｅ１０、ｋ'Ｅ１５、ｋ'（Ｅ＋１）０、ｋ'（Ｅ＋１）１、ｋ'（Ｅ＋１）２、ｋ'（Ｅ＋１）３の代わりにｋ'Ｅ１２、ｋ'Ｅ１、ｋ'Ｅ６、ｋ'Ｅ１１、ｋ'（Ｅ＋１）１２、ｋ'（Ｅ＋１）１３、ｋ'（Ｅ＋１）１４、ｋ'（Ｅ＋１）１５をそれぞれ用いる。

Of the output data w, 1-byte data w4 to w7 are similarly obtained in the second subround, w8 to w11 are obtained in the third subround, and w12 to w15 are obtained in the fourth subround. However, in the second subround, v4, v9, v14, and v3 are used instead of v0, v5, v10, and v15, and the obfuscated extended keys k'E0, k'E5, k'E10, and k'E15, respectively. Instead of k'(E + 1) 0, k'(E + 1) 1, k'(E + 1) 2, k'(E + 1) 3, k'E4, k'E9, k'E14, k'E3, k'(E + 1) ) 4, k'(E + 1) 5, k'(E + 1) 6, k'(E + 1) 7, respectively. Similarly, in the third subround, v8, v13, v2, and v7 are used instead of v0, v5, v10, and v15, and the obfuscated extended keys k'E0, k'E5, k'E10, and k'E15 are used. , K'(E + 1) 0, k'(E + 1) 1, k'(E + 1) 2, k'(E + 1) 3 instead of k'E8, k'E13, k'E2, k'E7, k'( E + 1) 8, k'(E + 1) 9, k'(E + 1) 10, and k'(E + 1) 11 are used, respectively. Similarly, in the 4th subround, v12, v1, v6, v11 are used instead of v0, v5, v10, v15, and the obfuscated extended keys k'E0, k'E5, k'E10, k'E15 are used. , K'(E + 1) 0, k'(E + 1) 1, k'(E + 1) 2, k'(E + 1) 3 instead of k'E12, k'E1, k'E6, k'E11, k'( E + 1) 12, k'(E + 1) 13, k'(E + 1) 14, and k'(E + 1) 15 are used, respectively.

Further, in the example shown in FIG. 3, the look-up table T0 is used, but the look-up table T1 may be used instead of the look-up table T0. By using the look-up tables T0 or T1 in this way, the number of required look-up tables can be reduced, which can contribute to memory saving.

≪Application example≫
The lookup tables Tb, T0 to T3, and Te described with reference to FIGS. 1 to 3 can be further enhanced in security by configuring the conversion component and the inverse conversion component in multiple stages. Specifically, the lookup table Tb is constructed by using N of the conversion components shown in (1) of FIG. 1 with N as an integer of 2 or more, and the inverse conversion components and (3) shown in (2) of FIG. ) May be used to form the look-up tables T0 to T3, and N of the inverse conversion components shown in FIG. 3 (4) may be used to form the look-up table Te.

<Functional configuration>
Next, the functional configuration of the encryption system 10 according to the present embodiment will be described with reference to FIG. FIG. 4 is a diagram showing an example of the functional configuration of the encryption system 10 according to the present embodiment.

As shown in FIG. 4, the encryption system 10 according to the present embodiment includes a selection unit 101, a table reference unit 102, a calculation unit 103, and a storage unit 104.

Look-up tables Tb, T0 to T3, and Te are stored in the storage unit 104. In addition, various data (for example, plaintext, intermediate value, ciphertext, etc.) used for encryption may be stored in the storage unit 104.

The selection unit 101 selects four selection data from the input data v for each sub-round. The table reference unit 102 refers to the lookup tables Tb, T0 to T3, and Te stored in the storage unit 104, and acquires the calculated value corresponding to the 8-bit data (in other words, the 8-bit data is obtained. Convert to the calculated value corresponding to the data). The calculation unit 103 performs an operation for obfuscating the enlarged key, an exclusive OR operation, and the like.

<Hardware configuration>
Next, the hardware configuration of the encryption system 10 according to the present embodiment will be described with reference to FIG. FIG. 5 is a diagram showing an example of the hardware configuration of the encryption system 10 according to the present embodiment.

As shown in FIG. 5, the encryption system 10 according to the present embodiment includes a processor 201, a memory device 202, and an I / F 203. Each of these hardware is connected so as to be able to communicate with each other via the bus 204.

The processor 201 is, for example, various arithmetic units such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit). Each functional unit (selection unit 101, table reference unit 102, and arithmetic unit 103) of the encryption system 10 according to the present embodiment is realized by a process of causing the processor 201 to execute one or more programs stored in the memory device 202. NS.

The memory device 202 is, for example, various storage devices such as a RAM (Random Access Memory), a ROM (Read Only Memory), and a flash memory. The storage unit 104 included in the encryption system 10 according to the present embodiment can be realized by using, for example, the memory device 202.

The I / F 203 is an interface for inputting data to the encryption system 10 and outputting data from the encryption system 10.

The encryption system 10 according to the present embodiment can realize various processes by having the hardware configuration shown in FIG. The hardware configuration shown in FIG. 5 is an example, and the encryption system 10 according to the present embodiment may have, for example, a plurality of processors 201 or a plurality of memory devices 202. May be good.

<Processing flow>
Hereinafter, a process of encrypting plaintext by the encryption system 10 according to the present embodiment will be described.

≪Processing per subround in the first round of encryption≫
First, the flow of processing per subround in the first round of encryption will be described with reference to FIG. FIG. 6 is a diagram showing a processing flow per subround in the first round of encryption according to the present embodiment.

The selection unit 101 selects four selection data from the input data v (that is, plain text) (step S101). As described above, each selection data is 1 byte data.

Next, the table reference unit 102 refers to the lookup table Tb stored in the storage unit 104 for each selection data selected in step S101, and acquires the calculated value corresponding to the selection data. (Step S102).

Next, the calculation unit 103 obfuscates the expansion key (expansion key in the first round) corresponding to the selection data for each selection data selected in step S101, and then obfuscates the expansion key. And the exclusive OR with the calculated value corresponding to the selected data is calculated (step S103).

Next, the table reference unit 102 refers to the lookup tables T0 to T3 for each selection data selected in step S101, and obtains a calculation value corresponding to the calculation result obtained in step S103. Acquire each (step S104).

Then, the calculation unit 103 performs an exclusive OR operation of the MixColumns process for each of the calculation values obtained in the above step S104 (step S105). As a result, 4 bytes of the output data w of the first round can be obtained.

<< Processing per sub-round in the r (2≤r≤E) round of encryption >>
Next, the flow of processing per subround in the intermediate round of encryption will be described with reference to FIG. 7. FIG. 7 is a diagram showing a processing flow per sub-round in the r (2 ≦ r ≦ E) round of encryption according to the present embodiment.

The selection unit 101 selects four selection data from the input data v (that is, the output data w output in the previous round) (step S201).

Next, the calculation unit 103 obfuscates the expansion key (r-round expansion key) corresponding to the selection data for each selection data selected in step S201, and then obfuscates the obfuscation key. And the exclusive OR with the calculated value corresponding to the selected data is calculated (step S202).

Next, the table reference unit 102 refers to the lookup tables T0 to T3 for each selection data selected in step S201, and obtains a calculation value corresponding to the calculation result obtained in step S202. Acquire each (step S203).

Then, the calculation unit 103 performs an exclusive OR operation of the MixColumns process for each of the calculation values obtained in the above step S203 (step S204). As a result, 4 bytes of data in the output data w of the rth round can be obtained.

≪Processing per sub-round in E + 1th round of encryption≫
Next, the flow of processing per subround in the final round will be described with reference to FIG. FIG. 8 is a diagram showing a processing flow per sub-round in the E + 1th round of encryption according to the present embodiment.

The selection unit 101 selects four selection data from the input data v (that is, the output data w output in the E round) (step S301).

Next, the calculation unit 103 excludes the expansion key (E-round expansion key) corresponding to the selection data and the calculation value corresponding to the selection data for each selection data selected in step S301. Calculate the exclusive OR (step S302). As the expansion key for the E-round, a key that has already been obfuscated in the E-round may be used.

Next, the table reference unit 102 refers to the lookup table T0 for each selection data selected in step S301, and acquires the calculation values corresponding to the calculation results obtained in step S302. (Step S303). As described above, the look-up table T1 may be used instead of the look-up table T0.

Next, the calculation unit 103 obfuscates the expansion key (expansion key in the E + 1th round) corresponding to the selection data for each selection data selected in step S301, and then obfuscates the obfuscated expansion key. And, among the calculated values obtained in step S303, the exclusive OR is calculated with the calculated value corresponding to the selected data (step S304).

Then, the table reference unit 102 refers to the lookup table Te for each selection data selected in step S301, and acquires a calculation value corresponding to the calculation result obtained in step S304 (step). S305). As a result, 4 bytes of data in the output data w (that is, ciphertext) of the final round can be obtained.

<Summary>
As described above, the encryption system 10 according to the present embodiment can realize the encryption by White-Box AES by using the lookup tables Tb, T0 to T3 and Te. Since the lookup tables Tb, T0 to T3, and Te are all 256 bytes, the total table size is 1.5 kilobytes and the data length of the extended key (that is, 176 bytes when the key length is 128 bits and 192 bits when the key length is 128 bits). Can realize White-Box AES in total with 208 bytes (240 bytes in the case of 256 bits). Further, in order to decipher the expansion key k1x, it is necessary to decipher the random number components included in the lookup tables Tb, T0 to T3 and Te, so that sufficient security strength is realized.

As described above, in the encryption system 10 according to the present embodiment, White-Box AES can be realized with less memory than before while realizing sufficient security strength. In particular, when a plurality of keys are held, a 1.5-kilobyte lookup table can be used in common, so that the memory saving effect is large.

In the present embodiment, the case of encrypting the plaintext has been described, but the case of decrypting the ciphertext can be realized by configuring each round so as to be the reverse conversion of the encryption. Specifically, InvShiftRows processing may be used instead of ShiftRows processing, InvSubBytes processing may be used instead of SubBytes processing, and InvMixColumns processing may be used instead of MixColumns processing.

The present invention is not limited to the above-described embodiment disclosed in detail, and various modifications and modifications, combinations with known techniques, and the like are possible without departing from the scope of claims.

10 Cryptographic system 101 Selection 102 Table reference 103 Calculation unit 104 Storage unit 201 Processor 202 Memory device 203 I / F
204 bus

Claims (7)

In the first round of White-Box AES, the operation result of the operation including the multiplication of SubBytes processing and MixColumns processing is included, and the plain text is referred to by referring to the first lookup table commonly used in the middle round. An information processing apparatus comprising: an acquisition means for acquiring an operation result corresponding to an exclusive OR of the conversion result obtained by converting the above in a second lookup table and the expanded key obfuscated in the first round. .. The acquisition means
In the intermediate round of the White-Box AES, the calculation result corresponding to the exclusive OR of the input data of the intermediate round and the expanded key obfuscated in the intermediate round with reference to the first lookup table. The information processing apparatus according to claim 1, wherein the information processing apparatus is obtained. The first lookup table includes a third lookup table and a fourth look-up table in which the operand of the multiplication in the MixColumns process is 1, and a fifth lookup table in which the operand of the multiplication is 2. It is composed of a lookup table and a sixth lookup table in which the operand of the multiplication is 3.
The acquisition means
In the final round of the White-Box AES, the input data of the final round and the previous round of the final round are obfuscated with reference to the third lookup table or the fourth lookup table. The information processing apparatus according to claim 1 or 2, wherein the calculation result corresponding to the exclusive OR with the expansion key is acquired. The acquisition means
Further, referring to the seventh lookup table for obtaining the ciphertext, the operation result corresponding to the exclusive OR of the acquired operation result and the expanded key obfuscated in the final round is used as the ciphertext. The information processing apparatus according to claim 3, wherein the information processing apparatus is to be acquired. The calculation result included in the second lookup table is a calculation result of a predetermined conversion process, a SubBytes process, a multiplication of the MixColumns process, and an inverse conversion process corresponding to the conversion process.
The expansion key obfuscated in the first round is a key obtained by subjecting the expansion key in the first round to the reverse conversion process, according to any one of claims 1 to 4. Information processing device. In the first round of White-Box AES, the operation result of the operation including the multiplication of SubBytes processing and MixColumns processing is included, and the plain text is referred to by referring to the first lookup table commonly used in the middle round. The computer executes an acquisition procedure for acquiring an operation result corresponding to the exclusive OR of the conversion result obtained by converting the above in the second lookup table and the expanded key obfuscated in the first round. Information processing method. In the first round of White-Box AES, the operation result of the operation including the multiplication of SubBytes processing and MixColumns processing is included, and the plain text is referred to by referring to the first lookup table commonly used in the middle round. Is characterized by having a computer execute an acquisition procedure for acquiring an operation result corresponding to the exclusive OR of the conversion result converted by the second lookup table and the expanded key obfuscated in the first round. program.

Images