JP4758824B2 - ENCRYPTION DEVICE, DECRYPTION DEVICE, ENCRYPTION METHOD, DECRYPTION METHOD, PROGRAM USING THE METHOD, AND RECORDING MEDIUM - Google Patents

Description

  The present invention relates to an encryption device, a decryption device, an encryption method, a decryption method, a program using these methods, and a program for performing communication (broadcast communication) between one encryption device and one or more decryption devices, and The present invention relates to a recording medium.

  In communication between one encryption device and one decryption device, forward security and authenticity with respect to the ciphertext string are important. Forward security means that if a secret key is known to an attacker at a certain point in cryptographic communication, the security of at least the previous ciphertext is protected. Authenticity is security against an attack in which an attacker temporarily saves data transmitted by a sender and alters the contents.

As a general method for ensuring forward security, a method using a stateful forward secure pseudorandom number generator G for updating a secret key is known (Non-Patent Document 1). In this method, the secret key in the initial state (stage number 0) is shared between the encryption device and the decryption device, and the timing for updating the secret key (timing for changing the stage number) is also determined in advance. . In this way, the encryption device and the decryption device can share the same stage number and a secret key corresponding to that number. The past secret key is discarded without being recorded. Therefore, the past secret key is not known.
As a general method for ensuring authenticity, there is a method of attaching a tag by a message authentication code (MAC) (Non-Patent Document 2). In this method, as long as the secret key used in the message authentication code is not leaked, tampering with the message alone is prevented.

However, when a plurality of messages are sent, even if tampering with a single message can be prevented, tampering such as message copying, reordering, deletion, insertion, etc. can occur. That is, there may be a situation where one sentence is correct but is not correct as a sequence of sentences. Therefore, there is a method of adding a tag by a message authentication code including a message number.
Further, in the broadcast communication between one encryption device and one or more decryption devices, the decryption device (recipient) changes dynamically (the decryption device list changes). In addition, when the communication is unidirectional, it is not possible to make an inquiry to the encryption device (sender) even if data loss is detected.

  FIG. 1 shows a functional configuration example of an encryption device that performs broadcast communication between one encryption device and one or more decryption devices. The functional configuration example of the encryption device in FIG. 1 is not a publicly available functional configuration example. However, this configuration can be easily conceived by those skilled in the art based on the above-described conventional technology and problems. The encryption device 900 includes a session key generation unit 910, a plaintext encryption unit 920, a message number generation unit 930, a stage number generation unit 940, a counter combination unit 950, a pseudo random number generation unit (PRNG) 960, a key encryption unit 970, an encryption key A coupling unit 980, a tag generation unit 990, and an output unit 995 are included.

The session key generation unit 910 generates a session key K. The plaintext encryption unit 920 encrypts the plaintext (message) m using the session key K and outputs the ciphertext c. The message number generation unit 930 generates message number information ctr-u for each plaintext (message) for each decryption device. Here, “−u” indicates that the information is individually given to each decoding device. The same applies to the following other symbols. The counter combining unit 950 combines the number information ctr-u corresponding to the number of generated decryption devices to the ciphertext c (simply combines the bit string and the bit string). The stage number generation unit 940 changes the stage number iu at the timing for updating the secret key for each decryption device. The pseudo-random number generation unit (PRNG) 960 updates the state s _i -u for the decryption device whose stage number i-u has been changed, and the secret key (the secret key k _E -u for encrypting the session key). A secret key k _T -u) for generating a tag is generated. The key encryption unit 970 encrypts the session key K using the secret key k _E -u for encrypting the session key, and outputs the encrypted session key hu. The encryption key combining unit 980 combines the output of the key encryption unit 970 with the output of the counter combining unit 950. The tag generation unit 990 generates a message authentication code tag-u from the output of the encryption key combining unit 980 using the secret key k _T -u for generating the tag. The output unit 995 includes a ciphertext c, number information ctr-u for each decryption device, a stage number iu for each decryption device, an encrypted session key hu for each decryption device, and a message authentication code for each decryption device. tag-u is output. With such a configuration, it is possible to ensure forward safety and authenticity, and perform broadcast communication between one encryption device and one or more decryption devices.

However, the configuration example of FIG. 1 has the following problems. (1) The key encryption unit 970 must employ a strong encryption method. Therefore, the amount of calculation in the key encryption unit 970 becomes very large. (2) The message authentication code tag-u must be calculated by the number of decryption devices using the ciphertext c. Moreover, since the ciphertext c is generally long, the amount of calculation of the tag generation unit 990 increases. (3) What is the secret key k _T -u for generating a tag when receiving a DoS (Denial-of-Service) attack that sends a message with a very large value as a stage number to a decryption device? The message cannot be authenticated unless it is updated again. That is, it cannot respond to DoS attacks. (4) Since the number information ctr-u is assigned to each decoding device, the amount of communication increases as the number of decoding devices increases. (5) Since the stage number iu is also assigned to each decoding device, the amount of communication increases as the number of decoding devices increases. (6) For each decryption device, number information ctr-u, stage number i-u, pseudo-random number generator state s _i -u, secret key k _E -u for encrypting the session key, and tag are generated. Therefore, a large recording capacity is required because the secret key k _T -u for recording must be recorded.
M. Bellare and B. Yee, “Forward-Security in Private-Key Cryptography,” Topics in Cryptology-CT-RSA 2003, Lecture Notes in Computer Science 2612 (2003), Springer-Verlag. Hiroshi Yuki “Introduction to Cryptography-Alice in the Secret Country”, Softbank Publishing Co., Ltd., 2003.

  The encryption device and the decryption device of the present invention, when performing broadcast communication between one encryption device and one or more decryption devices, while maintaining forward safety and authenticity, the calculation amount, the communication amount, and the recording The purpose is to reduce capacity and respond to DoS attacks. In reducing the amount of calculation, the amount of calculation for encrypting the session key and the amount of calculation for generating the message authentication code are particularly reduced. In reducing the amount of communication, a method is realized in which the amount of communication is less likely to increase when the number of decoding devices increases.

The encryption device and the decryption device of the present invention have a configuration in which some of the following three means are combined. (1) The pseudorandom number generator updates the stage number of each decryption device for each plaintext (message), and encrypts a session key for encrypting the plaintext (hereinafter referred to as “encryption session key”). A secret key for generating a message authentication code (hereinafter referred to as “tag secret key”) and a secret key for generating a message authentication code are generated. Further, the key encryption unit encrypts the encryption session key by exclusive OR. (2) Using a hash session key (hereinafter referred to as “hash session key”), a ciphertext and message number information are converted by a hash function in a hash part with a key. (3) The fixed tag generation unit generates a message authentication code (hereinafter referred to as “fixed message authentication code”) using a fixed secret key (hereinafter referred to as “fixed secret key”).
As combinations of the above three means, only (1), (1) and (2), (1) and (3), (1), (2), (3), and (2) only are combined. is there.

  By means of (1) above, the frequency of key secret key generation increases. However, the encryption session key can be encrypted by exclusive OR. Further, since the generation of the stage number is not necessary, it can be expected that the amount of calculation is reduced. Furthermore, since the stage number required for each decoding device is not required, it is not necessary to transmit, and the communication amount and the recording capacity can be reduced. Since the key secret key and the tag secret key are updated each time, it is not necessary to record the key secret key and the tag secret key, and the recording capacity can be further reduced.

The message authentication code can be generated by shortening the length of the ciphertext by means of (2) above. Therefore, the amount of calculation of the tag generation unit can be reduced.
Even if a DoS attack is made by means (3) above, it is possible to verify whether the message is correct using the fixed secret key. Therefore, it can cope with a DoS attack. Although the message authentication code increases, since the message number can be made common to all the decryption devices, there is almost no increase or decrease in the traffic. Only the decryption device has to record the fixed secret key, but since there is no need to record the message number for each decryption device, there is almost no increase or decrease in recording capacity.

  As described above, the encryption device and the decryption device of the present invention, when performing broadcast communication between one encryption device and one or more decryption devices, while maintaining forward safety and authenticity, The amount of communication and the recording capacity can be reduced to cope with DoS attacks.

  Below, in order to avoid duplication of description, the same number is given to the structural part which has the same function, and the process step which performs the same process, and abbreviate | omits description.

[First Embodiment]
FIG. 2 shows a functional configuration example of the encryption apparatus according to the first embodiment. FIG. 3 shows a processing flow of the encryption apparatus according to the first embodiment when one plaintext (message) is input. The encryption device 700 includes an encryption session key generation unit 110, a plaintext encryption unit 115, a message number generation unit 320, a counter combination unit 325, a pseudo random number generation unit 145, a key encryption unit 150, an encryption key combination unit 155, and a tag generation unit 160. , An output unit 730 is provided.
The encryption session key generation unit 110 generates a session key K _M (hereinafter referred to as “encryption session key”) for encrypting the plaintext m (S110). Plaintext encryption unit 115, a plaintext m input to the encryption device 700, using the encryption session key _{K M,} and outputs the ciphertext c (S115). The message number generation unit 320 generates plaintext (message) number information ctr-u for each decryption device that is a transmission destination (S320). Here, “−u” indicates that the information is individually given to each decoding device. The same applies to the following other symbols. The counter combining unit 325 combines the number information ctr-u with the number of decryption devices to the ciphertext c (S325). “Combining” means simply connecting (arranging) bit strings and bit strings. Pseudo-random number generation unit 145, for each plaintext (message) m, updates the state s _G -u for each decoder, the number of the decoding apparatus, the secret key for encrypting the encryption session key K _M k _E - u (hereinafter referred to as “key secret key”) and a secret key k _T -u (hereinafter referred to as “tag secret key”) for generating the message authentication code tag-u are generated (S145). Key encryption unit 150, a cryptographic session key K _M, for each decoder, and encrypted by the exclusive OR of the key secret key k _E -u, and outputs the encrypted encryption session key h-u (S150 ). The encryption key combining unit 155 combines the encrypted session keys hu as many as the number of decryption devices with the output c | ctr-u of the counter combining unit (S155). The tag generation unit 160 generates a message authentication code tag-u using the tag secret key k _T -u for each decryption device from the output c‖ctr-u‖h-u of the encryption key combining unit (S160). . The output unit 730 sends the ciphertext c, the number information ctr-u for each decryption device, the encrypted encryption session key hu for each decryption device, and the message authentication code tag-u for each decryption device to the decryption device. Transmit (S730).

  FIG. 4 shows a functional configuration example of the decoding device according to the first embodiment. FIG. 5 shows a processing flow of the decryption device of the first embodiment when one ciphertext is input. The decryption device 750 includes an input unit 780, a pseudo random number generation unit 245, a key decryption unit 250, a tag generation unit 260, a message number generation unit 420, a comparison unit 485, a plaintext decryption unit 215, and a state information generation unit 490. .

The input unit 780 receives the ciphertext c, the number information ctr-u for each decryption device, the encrypted encryption session key hu for each decryption device, and the message authentication code tag-u for each decryption device. The ciphertext c, the decryption device number information ctr-u, the decryption device encrypted cipher session key hu, and the decryption device message authentication code tag-u are extracted (S780). Pseudo-random number generation unit 245, every time a ciphertext is received by the input unit 780, updates the state _s G -u, secret key for encrypting the encryption session key _{K M k} E -u (hereinafter, " And a secret key k _T -u (hereinafter referred to as “tag secret key”) for generating the message authentication code tag-u (S245). Key decryption unit 250, an encrypted encryption session key h-u, and decrypted by the exclusive OR of the key secret key _k E -u, and outputs the encryption session key _{K M} (S250). The tag generation unit 260 generates a tag secret key from the received encrypted plaintext c, the number information ctr-u, and the bit string c‖ctr-u‖hu combined with the encrypted encryption session key hu. generating a message authentication code C-tag-u with k _T -u (S260). The message number generation unit 420 generates plaintext (message) number information C-ctr-u (S420). The comparison unit 485 compares the received number information ctr-u with the number information C-ctr-u generated by the message number generation unit 420, and the received message authentication code tag-u and the message generated by the tag generation unit 260. The authentication code C-tag-u is compared, and if both match, it is determined that the received information is normal (S485). If either does not match, an error handling process is performed (S299). As the error handling process, there are a method of canceling the process, a method of advancing the state s _G -u of the pseudorandom number generation unit 245 by one, and starting again from step S150. Plaintext decryption unit 215, when the comparison unit 485 determines that the normal, the ciphertext c received using the encryption session key _{K M,} and decodes to obtain the plain text (message) m (S215). Further, the state information generation unit 490 outputs the state information s _G -u of the pseudo random number generation unit 245 and the received number information ctr-u as state information (S490).

In the encryption device and the decryption device according to the first embodiment, the pseudo-random number generation unit updates the stage number of each decryption device for each plaintext (message) to generate a key secret key and a tag secret key. Also, the encryption session key was encrypted by exclusive OR in the key encryption unit.
With such a configuration and processing flow, the frequency of key secret key generation increases. However, the encryption session key can be encrypted by exclusive OR. Further, since the generation of the stage number is not necessary, it can be expected that the amount of calculation is reduced. Furthermore, since the stage number required for each decoding device is not required, it is not necessary to transmit, and the communication amount and the recording capacity can be reduced. Since the key secret key and the tag secret key are updated each time, it is not necessary to record the key secret key and the tag secret key, and the recording capacity can be further reduced.

[Second Embodiment]
FIG. 6 shows a functional configuration example of the encryption apparatus according to the second embodiment. FIG. 7 shows a processing flow of the encryption apparatus according to the second embodiment when one plaintext (message) is input. The encryption device 300 includes an encryption session key generation unit 110, a plaintext encryption unit 115, a message number generation unit 320, a counter combination unit 325, a hash session key generation unit 130, a keyed hash unit 135, a key combination unit 140, and a pseudo random number generation. Unit 145, key encryption unit 150, encryption key combination unit 155, tag generation unit 160, and output unit 380.

The difference in configuration between FIG. 6 and FIG. 2 is that a hash session key generation unit 130, a keyed hash unit 135, and a key combination unit 140 are added. Steps S110 to S325, S145, and S150 are the same as those in the first embodiment (FIGS. 2 and 3). The hash session key generation unit 130 generates a hash session key (hereinafter referred to as “hash session key”) in parallel with steps S110 to S325 (S130). Step S130 and step S325 is completed, keyed hash unit 135, an output c‖ctr-u counter coupling portion 325, using a hashing session key _{K H,} is converted by the hash function (S135). The key coupling 140, the output d of the keyed hash unit, combining the hash session key _{K H} (S140).

The processing content of the following processing is almost the same as that of the first embodiment, but the data to be handled (input data to each configuration unit) is different with the change of the configuration. The encryption key combining unit 155 combines the output hu of the key encryption unit 150 with the output d‖K _H of the key combining unit 140 by the number of decryption devices (S155). The tag generation unit 160 generates a message authentication code tag-u using the tag secret key k _T -u from the output d‖K _H ‖h-u of the encryption key combining unit 155 (S160). The output unit 380 includes a ciphertext c, number information ctr-u for each decryption device, a hash session key K _H , an encrypted cipher session key hu for each decryption device, and a message authentication code tag- for each decryption device. u is output (S380).

  FIG. 8 illustrates a functional configuration example of the decoding device according to the second embodiment. FIG. 9 shows a processing flow of the decryption device of the second embodiment when one ciphertext is input. The decryption device 400 includes an input unit 480, a keyed hash unit 235, a key combination unit 240, an encryption key combination unit 255, a pseudo random number generation unit 245, a key decryption unit 250, a tag generation unit 260, a message number generation unit 420, and a comparison unit. 485, a plaintext decryption unit 215, and a state information generation unit 490.

The difference in configuration between FIG. 8 and FIG. 4 is that a keyed hash unit 235, a key combining unit 240, and an encryption key combining unit 255 are added. The input unit 480 includes a ciphertext c, number information ctr-u for each decryption device, a hash session key K _H , an encrypted cipher session key hu for each decryption device, and a message authentication code tag- for each decryption device. When u is received, the ciphertext c, the decryption device number information ctr-u, the hash session key K _H , the decryption device's encrypted encryption session key hu, and the decryption device's message authentication code tag- u is extracted (S480). The keyed hash unit 235 converts the bit string c‖ctr-u obtained by combining the received encrypted plaintext c and the number information ctr-u with a hash function using the received hash session key K _H (S235). ). The key coupling 240, the output d of the keyed hash unit 235, couples the hash session key _{K H} (S240). The encryption key combining unit 255 combines the received encrypted encryption session key hu with the output d‖K _H of the key combining unit 240 (S255).

The contents of other processes are almost the same as those of the first embodiment (FIGS. 4 and 5), but the data to be handled (input data to each component) is different with the change of the configuration. Step S245 is the same as in the first embodiment. In step S260, the tag generation unit 260 generates a message authentication code C-tag-u using the tag secret key k _T -u from the output d‖K _H ‖h-u of the encryption key combining unit 255 (S260). ). Steps S250, S485, S215, S490, and S299 are the same as those in the first embodiment.

  In the encryption device and the decryption device of the second embodiment, the pseudo-random number generation unit updates the stage number of each decryption device for each plaintext (message) to generate a key secret key and a tag secret key. Also, the encryption session key was encrypted by exclusive OR in the key encryption unit. Further, the encryption device and the decryption device of the second embodiment convert the ciphertext and the message number information by a hash function using a hash session key in a keyed hash unit.

  With such a configuration and processing flow, the frequency of key secret key generation increases. However, the encryption session key can be encrypted by exclusive OR. Further, since the generation of the stage number is not necessary, it can be expected that the amount of calculation is reduced. Furthermore, since the stage number required for each decoding device is not required, it is not necessary to transmit, and the communication amount and the recording capacity can be reduced. Since the key secret key and the tag secret key are updated each time, it is not necessary to record the key secret key and the tag secret key, and the recording capacity can be further reduced. Further, by using a hash function, it is possible to generate a message authentication code while shortening the length of the ciphertext. Therefore, the amount of calculation of the tag generation unit can be reduced.

[Third Embodiment]
FIG. 10 shows a functional configuration example of the encryption apparatus according to the third embodiment. FIG. 11 shows a processing flow of the encryption apparatus according to the third embodiment when one plaintext (message) is input. The encryption device 500 includes an encryption session key generation unit 110, a plaintext encryption unit 115, a message number generation unit 120, a counter combination unit 125, a pseudo random number generation unit 145, a key encryption unit 150, an encryption key combination unit 155, and a tag generation unit 160. , A tag combination unit 165, a fixed secret key generation unit 170, a fixed tag generation unit 175, and an output unit 580.

The difference in configuration between FIG. 10 and FIG. 2 is that a tag combining unit 165, a fixed secret key generation unit 170, and a fixed tag generation unit 175 are added. Steps S110 and S115 are the same as those in the first embodiment (FIGS. 2 and 3). By adding the tag combination unit 165, the fixed secret key generation unit 170, and the fixed tag generation unit 175, the message number generation unit 120 generates the number information ctr of one message common to all the decryption devices (S120). ). The counter combining unit 125 combines only one number information ctr with the ciphertext c output from the plaintext encryption unit 115 (S125). Steps S145 to S160 are the same as in the first embodiment. The tag combining unit 165 combines the message authentication code tag-u with the number of decryption devices to the output c‖ctr‖h-u of the encryption key combining unit (S165). The fixed secret key generation unit 170 generates a secret key s _T -u (hereinafter referred to as “fixed secret key”) fixed for each decryption device (S170). The fixed tag generation unit 175 uses the fixed secret key s _T -u for each decryption device from the output c‖ctr‖h-u‖tag-u of the tag combination unit 165 to generate a message authentication code tag′-u (hereinafter referred to as the tag authentication code tag′-u , "Fixed message authentication code") is generated (S175). Note that the fixed tag generation unit 175 always uses the fixed secret key s _T -u that is the same secret key, but the generated data string c‖ctr‖h-u‖tag-u changes, so The fixed message authentication code tag′-u to be changed is changed. The output unit 580 includes an encrypted plaintext c, one number information ctr, an encrypted encryption session key hu for each decryption device, a message authentication code tag-u for each decryption device, and a fixed for each decryption device. The message authentication code tag′-u is output (S580).

  FIG. 12 illustrates a functional configuration example of the decoding device according to the third embodiment. FIG. 13 shows a processing flow of the decryption device of the third embodiment when one ciphertext is inputted. The decryption apparatus 600 includes an input unit 680, a pseudo random number generation unit 245, a key decryption unit 250, a tag generation unit 260, a message number generation unit 220, a tag combination unit 265, a fixed secret key generation unit 270, a fixed tag generation unit 275, a comparison Unit 285, plaintext decryption unit 215, and state information generation unit 290.

The difference in configuration between FIG. 12 and FIG. 4 is that a tag combining unit 265, a fixed secret key generation unit 270, and a fixed tag generation unit 275 are added. Due to these structural differences, the processing flow is changed as follows. The input unit 680 includes a ciphertext c, one number information ctr, an encrypted encryption session key hu for each decryption device, a message authentication code tag-u for each decryption device, and a fixed message authentication code for each decryption device When tag′-u is received, ciphertext c, number information ctr, encrypted encryption session key hu of the decryption device, message authentication code tag-u of the decryption device, and fixed message authentication of the decryption device The code tag′-u is extracted (S680). The tag combining unit 265 combines the received message authentication code tag-u with the bit string c‖ctr‖hu that combines the received ciphertext c, the number information ctr, and the encrypted encryption session key hu. (S265). The fixed secret key generation unit 270 generates a fixed secret key s _T -u (S270). The fixed tag generation unit 275 uses the fixed secret key s _T -u generated by the fixed secret key generation unit 270 from the output c‖ctr‖h-u‖tag-u of the tag combination unit 265 and uses the fixed message authentication code. C-tag′-u is generated (S275). The message number generation unit 220 generates message number information C-ctr (S220). Steps S245 to S260 are the same as those in the first embodiment (FIGS. 4 and 5). The comparison unit 285 compares the received number information ctr with the number information C-ctr generated by the message number generation unit 220, and the received message authentication code tag-u and the message authentication code C- generated by the tag generation unit 260. tag-u is compared, the received fixed message authentication code tag′-u is compared with the fixed message authentication code C-tag′-u generated by the fixed tag generation unit 275, and the information received when all match Is determined to be normal (S285). Steps S215 and S299 are the same as in the first embodiment. The state information generation unit 290 includes a bit string s _G -u ‖s _T -u obtained by combining the state s _G -u of the pseudo random number generation unit 245 and the fixed secret key s _T -u generated by the fixed secret key generation unit 270, and The received number information ctr is output as status information (S290).

  In the encryption device and the decryption device of the third embodiment, the pseudo-random number generation unit updates the stage number of each decryption device for each plaintext (message) to generate the key secret key and the tag secret key. Also, the encryption session key was encrypted by exclusive OR in the key encryption unit. In the encryption device and the decryption device of the third embodiment, the fixed message generation code is generated by the fixed tag generation unit using the fixed secret key.

With such a configuration and processing flow, the frequency of key secret key generation increases. However, the encryption session key can be encrypted by exclusive OR. Further, since the generation of the stage number is not necessary, it can be expected that the amount of calculation is reduced. Furthermore, since the stage number required for each decoding device is not required, it is not necessary to transmit, and the communication amount and the recording capacity can be reduced. Since the key secret key and the tag secret key are updated each time, it is not necessary to record the key secret key and the tag secret key, and the recording capacity can be further reduced. Further, by using the fixed message authentication code, it is possible to detect that the received number information ctr is abnormal using the fixed secret key. For example, in the case of a decryption device that does not use a fixed message authentication code, if a message with a very large number information ctr is suddenly sent, the state s _G -u of the pseudorandom number generator 145 corresponds to the number information ctr. The message cannot be authenticated unless the tag secret key k _T -u obtained in that state is used and updated. However, the decryption apparatus 600 of the present embodiment can authenticate the message using the fixed secret key s _T -u even if a message to which the very large number information ctr is suddenly sent is sent. That is, it can be identified that the message is due to a DoS attack without updating the state of the pseudorandom number generator 145. Therefore, it can cope with a DoS attack. Although the message authentication code increases, since the message number can be made common to all the decryption devices, there is almost no increase or decrease in the traffic. Only the decryption device has to record the fixed secret key, but since there is no need to record the message number for each decryption device, there is almost no increase or decrease in recording capacity.

[Fourth Embodiment]
The fourth embodiment is an embodiment including all the means of the present invention. FIG. 14 shows a functional configuration example of the encryption apparatus according to the fourth embodiment. FIG. 15 shows a processing flow of the encryption apparatus according to the fourth embodiment when one plaintext (message) is input. The encryption device 100 includes an encryption session key generation unit 110, a plaintext encryption unit 115, a message number generation unit 120, a counter combination unit 125, a hash session key generation unit 130, a keyed hash unit 135, a key combination unit 140, and a pseudo random number generation. Unit 145, key encryption unit 150, encryption key combination unit 155, tag generation unit 160, tag combination unit 165, fixed secret key generation unit 170, fixed tag generation unit 175, and output unit 180.

Below, it demonstrates, showing the difference with 2nd Embodiment. The difference in configuration between FIG. 14 and FIG. 6 is that a tag combining unit 165, a fixed secret key generating unit 170, and a fixed tag generating unit 175 are added. Steps S110 and S115 are the same as those in the second embodiment (FIGS. 6 and 7). By adding the tag combination unit 165, the fixed secret key generation unit 170, and the fixed tag generation unit 175, the message number generation unit 120 generates the number information ctr of one message common to all the decryption devices (S120). ). The counter combining unit 125 combines only one number information ctr with the ciphertext c output from the plaintext encryption unit 115 (S125). Steps S130 to S160 are the same as in the first embodiment. The tag combining unit 165 combines the message authentication code tag-u by the number of decryption devices to the output d‖K _H ‖u of the encryption key combining unit (S165). The fixed secret key generation unit 170 generates a secret key s _T -u (hereinafter referred to as “fixed secret key”) fixed for each decryption device (S170). The fixed tag generation unit 175 uses the fixed secret key s _T -u for each decryption device from the output d‖K _H ‖h-u‖tag-u of the tag combination unit 165, and uses the message authentication code tag′-u ( Hereinafter, “fixed message authentication code”) is generated (S175). The output unit 180 includes an encrypted plaintext c, one number information ctr, a hash session key K _H , an encrypted encryption session key hu for each decryption device, a message authentication code tag-u for each decryption device, Then, the fixed message authentication code tag′-u for each decryption device is output (S180).

  FIG. 16 illustrates a functional configuration example of the decoding device according to the fourth embodiment. FIG. 17 shows a processing flow of the decryption device of the fourth embodiment when one ciphertext is input. The decryption apparatus 200 includes an input unit 280, a keyed hash unit 235, a key combination unit 240, an encryption key combination unit 255, a pseudo random number generation unit 245, a key decryption unit 250, a tag generation unit 260, a message number generation unit 220, and a tag combination. Unit 265, fixed secret key generation unit 270, fixed tag generation unit 275, comparison unit 285, plaintext decryption unit 215, and state information generation unit 290.

The difference in configuration between FIG. 16 and FIG. 8 is that a tag combining unit 265, a fixed secret key generation unit 270, and a fixed tag generation unit 275 are added. Due to these structural differences, the processing flow is changed as follows. The input unit 280 includes a ciphertext c, one number information ctr, a hash session key K _H , an encrypted encryption session key hu for each decryption device, a message authentication code tag-u for each decryption device, and a decryption device When the fixed message authentication code tag′-u is received, the ciphertext c, the number information ctr, the hash session key K _H , the encrypted encryption session key hu of the decryption device, and the message authentication code of the decryption device tag-u and the fixed message authentication code tag′-u of the decryption apparatus are extracted (S280). Steps S235 to S255 are the same as those in the second embodiment (FIGS. 8 and 9). The tag combining unit 265 combines the received message authentication code tag-u with the output d‖K _H ‖hu of the encryption key combining unit 255 (S265). The fixed secret key generation unit 270 generates a fixed secret key s _T -u (S270). The fixed tag generation unit 275 uses the fixed secret key s _T -u generated by the fixed secret key generation unit 270 from the output d‖K _H ‖h-u‖tag-u of the tag combining unit 265 to perform fixed message authentication. A code C-tag′-u is generated (S275). The message number generation unit 220 generates message number information C-ctr (S220). Steps S245 to S260 are the same as those in the second embodiment (FIGS. 8 and 9). The comparison unit 285 compares the received number information ctr with the number information C-ctr generated by the message number generation unit 220, and the received message authentication code tag-u and the message authentication code C- generated by the tag generation unit 260. tag-u is compared, the received fixed message authentication code tag′-u is compared with the fixed message authentication code C-tag′-u generated by the fixed tag generation unit 275, and the information received when all match Is determined to be normal (S285). Steps S215 and S299 are the same as in the first embodiment. The state information generation unit 290 includes a bit string s _G -u ‖s _T -u obtained by combining the state s _G -u of the pseudo random number generation unit 245 and the fixed secret key s _T -u generated by the fixed secret key generation unit 270, and The received number information ctr is output as status information (S290).

  In the encryption device and the decryption device of the fourth embodiment, the pseudo-random number generation unit updates the stage number of each decryption device for each plaintext (message) to generate the key secret key and the tag secret key. Also, the encryption session key was encrypted by exclusive OR in the key encryption unit. In addition, the encryption device and the decryption device of the fourth embodiment convert the ciphertext and the message number information by a hash function using a hash session key in a keyed hash unit. Further, in the encryption device and the decryption device of the fourth embodiment, the fixed message generation code is generated by the fixed tag generation unit using the fixed secret key.

  With such a configuration and processing flow, the frequency of key secret key generation increases. However, the encryption session key can be encrypted by exclusive OR. Further, since the generation of the stage number is not necessary, it can be expected that the amount of calculation is reduced. Furthermore, since the stage number required for each decoding device is not required, it is not necessary to transmit, and the communication amount and the recording capacity can be reduced. Since the key secret key and the tag secret key are updated each time, it is not necessary to record the key secret key and the tag secret key, and the recording capacity can be further reduced. Further, by using a hash function, it is possible to generate a message authentication code while shortening the length of the ciphertext. Therefore, the amount of calculation of the tag generation unit can be reduced. Furthermore, a DoS attack can be dealt with by using a fixed message authentication code. Although the message authentication code increases, since the message number can be made common to all the decryption devices, there is almost no increase or decrease in the traffic. Only the decryption device has to record the fixed secret key, but since there is no need to record the message number for each decryption device, there is almost no increase or decrease in recording capacity.

[Fifth Embodiment]
FIG. 18 shows a functional configuration example of the encryption device according to the fifth embodiment. FIG. 19 shows a processing flow of the encryption apparatus of the fifth embodiment when one plaintext (message) is inputted. The encryption device 800 includes an encryption session key generation unit 110, a plaintext encryption unit 115, a message number generation unit 320, a counter combination unit 325, a hash session key generation unit 130, a keyed hash unit 135, a key combination unit 140, and a pseudo random number generation. A unit 845, a key encryption unit 820, an encryption key combination unit 155, a tag generation unit 160, a stage number generation unit 840, and an output unit 830.

  A difference in configuration between FIG. 18 and FIG. 6 (second embodiment) is that a stage number generation unit 840 is added. The pseudo-random number generation unit 845 does not update the state for each plaintext (message), but updates it when the stage number generation unit 840 generates the stage number iu according to a predetermined rule. Examples of the predetermined rule include a rule for generating a stage number iu for each fixed number of messages and a rule for generating a stage number iu for each predetermined time (number of days). Furthermore, since the state of the pseudo-random number generator 845 is not updated for each plaintext (message), the key encryption unit 820 cannot employ an encryption method based on exclusive OR, and must employ a strong encryption method. I must. However, any method may be used as long as it is a strong encryption method.

Steps S110 to S140 are the same as those in the second embodiment (FIGS. 6 and 7). The stage number generation unit 840 generates the stage number iu of the pseudo random number generation unit 845 according to a predetermined rule for the number of decoding devices (S840). In other words, when the stage number generation unit 840 determines that it is time to generate a new stage number iu according to a predetermined rule for each decoding device, the stage number generation unit 840 generates a new stage number iu for each decoding device. (S840). The pseudorandom number generation unit 845 updates the state s _G -u and generates the key secret key k _E -u and the tag secret key k _T -u for the decryption device for which the new stage number iu has been generated. (S845). Note that new key secret key _k E The -u tag secret key _k T -u is for not generated decoder key secret key _k E -u tag secret key _k T -u, previous plaintext (message The key secret key k _E -u and the tag secret key k _T -u used for the encryption of () are used. Therefore, it is necessary to record the key secret key k _E -u and the tag secret key k _T -u for all the decryption devices in the recording unit (not shown in FIG. 18) of the encryption device 800. is there.

Key encryption unit 820, a cryptographic session key _{K M,} each decoder is encrypted by using the key secret key _k E -u (S820). Steps S155 and S160 are the same as in the second embodiment. The output unit 830 includes a ciphertext c, number information ctr-u for each decryption device, stage number information iu for each decryption device, a hash session key K _H , and an encrypted cipher session key hu for each decryption device. And the message authentication code tag-u for each decryption device are output (S830).

  FIG. 20 illustrates a functional configuration example of the decoding device according to the fifth embodiment. FIG. 21 shows a processing flow of the decryption device of the fifth embodiment when one ciphertext is inputted. The decryption device 850 includes an input unit 880, a keyed hash unit 235, a key combination unit 240, an encryption key combination unit 255, a pseudo random number generation unit 895, a key decryption unit 865, a tag generation unit 260, a message number generation unit 420, and a stage number. A generation unit 890, a comparison unit 885, a plaintext decryption unit 215, and a state information generation unit 490 are provided.

  The difference in configuration between FIG. 20 and FIG. 8 (second embodiment) is that a stage number generation unit 890 is added. The pseudo-random number generation unit 895 does not update the state every time a message is received, but updates it when the stage number generation unit 890 generates the stage number iu according to a predetermined rule. Examples of the predetermined rule include a rule for generating a stage number iu for each fixed number of messages and a rule for generating a stage number iu for each predetermined time (number of days). Furthermore, since the state of the pseudo random number generation unit 895 is not updated for each plaintext (message), the key decryption unit 865 cannot employ a decryption method based on exclusive OR, and the key encryption unit 820 of the encryption device 800. The decryption method must be compatible with the strong encryption method employed by the company.

The input unit 880 includes a ciphertext c, number information ctr-u for each decryption device, a stage number iu for each decryption device, a hash session key K _H , an encrypted cipher session key hu for each decryption device, And the message authentication code tag-u for each decryption device, the ciphertext c, the decryption device number information ctr-u, the decryption device stage number iu, the hash session key K _H , the decryption device encryption The encrypted encryption session key hu and the message authentication code tag-u of the decryption apparatus are extracted (S880). Steps S235 to S255 and step S420 are the same as those in the second embodiment (FIGS. 8 and 9). The stage number generation unit 890 generates the stage number C-i-u of the pseudo random number generation unit 895 according to a predetermined rule (S890). In other words, if the stage number generation unit 890 determines that it is time to generate a new stage number C-i-u according to a predetermined rule, it generates a new stage number C-i-u (S890). . When a new stage number C-i-u is generated, the pseudo-random number generation unit 895 updates the state s _G -u and generates a key secret key k _E -u and a tag secret key k _T -u. (S895). If the new key secret key k _E -u and the tag secret key k _T -u are not generated, the key secret key k _E -u and the tag secret key k used for decrypting the previous plaintext (message) are used. _T- u is used. Therefore, the recording portion of the decoding device 850 (not shown in FIG. 20), it is necessary to record the key secret key k _E -u tag secret key k _T -u.

Tag generation unit 260, the output d‖K _H ‖h-u encryption key coupling unit 255, to generate a message authentication code C-tag-u with tag secret key _k T -u (S260). Key decryption unit 865, the decoding method corresponding to the encryption method of the key encryption unit 820 of the encryption device 800 decrypts the encrypted session key _{K M} (S865). The comparison unit 885 compares the received number information ctr-u with the number information C-ctr-u generated by the message number generation unit 420, and the received message authentication code tag-u and the message generated by the tag generation unit 260. The authentication code is compared, the received stage number iu is compared with the stage number C-iu generated by the stage number generation unit, and if all match, it is determined that the received information is normal ( S885). Steps S215, S490, and S299 are the same as in the second embodiment.

  In the encryption device and the decryption device of the second embodiment, a ciphertext and message number information are converted by a hash function using a hash session key in a keyed hash unit. With such a configuration and processing flow, it is possible to generate a message authentication code while shortening the length of the ciphertext. Therefore, the amount of calculation of the tag generation unit can be reduced.

  In the above five embodiments, the recording unit 1020 of the computer shown in FIG. 22 is loaded with a program that causes the steps of the above method to be executed, and the control unit 1010, the input unit 1030, the output unit 1040, and the like are operated. Can be implemented. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

The figure which shows the function structural example of the encryption apparatus which performs the broadcast communication considered that those skilled in the art can think easily from a prior art. The figure which shows the function structural example of the encryption apparatus of 1st Embodiment. The figure which shows the processing flow of the encryption apparatus of 1st Embodiment when one plaintext (message) is input. The figure which shows the function structural example of the decoding apparatus of 1st Embodiment. The figure which shows the processing flow of the decryption apparatus of 1st Embodiment when one encryption text is input. The figure which shows the function structural example of the encryption apparatus of 2nd Embodiment. The figure which shows the processing flow of the encryption apparatus of 2nd Embodiment when one plaintext (message) is input. The figure which shows the function structural example of the decoding apparatus of 2nd Embodiment. The figure which shows the processing flow of the decryption apparatus of 2nd Embodiment when one encryption text is input. The figure which shows the function structural example of the encryption apparatus of 3rd Embodiment. The figure which shows the processing flow of the encryption apparatus of 3rd Embodiment when one plaintext (message) is input. The figure which shows the function structural example of the decoding apparatus of 3rd Embodiment. The figure which shows the processing flow of the decryption apparatus of 3rd Embodiment when one encryption text is input. The figure which shows the function structural example of the encryption apparatus of 4th Embodiment. The figure which shows the processing flow of the encryption apparatus of 4th Embodiment when one plaintext (message) is input. The figure which shows the function structural example of the decoding apparatus of 4th Embodiment. The figure which shows the processing flow of the decryption apparatus of 4th Embodiment when one encryption text is input. The figure which shows the function structural example of the encryption apparatus of 5th Embodiment. The figure which shows the processing flow of the encryption apparatus of 5th Embodiment when one plaintext (message) is input. The figure which shows the function structural example of the decoding apparatus of 5th Embodiment. The figure which shows the processing flow of the decryption apparatus of 5th Embodiment when one encryption text is input. The figure which shows the function structural example of a computer.

Claims (22)

An encryption device for performing communication between one encryption device and one or more decryption devices,
An encryption session key generation unit for generating a session key for encrypting plaintext (hereinafter referred to as “encryption session key”);
A plaintext encryption unit that encrypts the input plaintext using the encryption session key;
A message number generator for generating plaintext number information for each decryption device;
A counter combining unit that combines the number information with the number of decryption devices into the encrypted plaintext;
For each plaintext, update the state for each decryption device, and generate a secret key (hereinafter referred to as “key secret key”) and a message authentication code for encrypting the encryption session key by the number of decryption devices. A pseudo-random number generator that generates a secret key (hereinafter referred to as a “tag secret key”);
A key encryption unit for encrypting the encryption session key for each decryption device by exclusive OR with the key secret key;
An encryption key combining unit that combines the output of the key encryption unit with the output of the counter combining unit by the number of decryption devices;
A tag generation unit that generates a message authentication code using the tag secret key for each decryption device from the output of the encryption key combining unit;
An encryption device comprising: an output unit that outputs encrypted plaintext, number information for each decryption device, an encrypted encryption session key for each decryption device, and a message authentication code for each decryption device. The encryption device according to claim 1,
A hash session key generation unit that generates a hash session key (hereinafter referred to as a “hash session key”);
A keyed hash unit that converts the output of the counter combining unit with a hash function using the hash session key;
A key combining unit that combines the hash session key with the output of the keyed hash unit;
The encryption key combining unit combines the output of the key encryption unit with the output of the key combining unit by the number of decryption devices. The output unit includes encrypted plaintext, number information for each decryption device, hash An encryption apparatus characterized by outputting a session key, an encrypted encryption session key for each decryption apparatus, and a message authentication code for each decryption apparatus. The encryption device according to claim 1,
A tag combining unit that combines the message authentication code to the output of the encryption key combining unit by the number of decryption devices;
A fixed secret key generation unit that generates a secret key fixed for each decryption device (hereinafter referred to as “fixed secret key”);
A fixed tag generation unit that generates a message authentication code (hereinafter referred to as “fixed message authentication code”) from the output of the tag combination unit using the fixed secret key for each decryption device,
The message number generation unit generates only one number information common to all decoding devices;
The counter combiner combines the number information with the encrypted plaintext;
The output unit outputs an encrypted plaintext, one number information, an encrypted encryption session key for each decryption device, a message authentication code for each decryption device, and a fixed message authentication code for each decryption device. Feature encryption device. The encryption device according to claim 2,
A tag combining unit that combines the message authentication code to the output of the encryption key combining unit by the number of decryption devices;
A fixed secret key generation unit that generates a secret key fixed for each decryption device (hereinafter referred to as “fixed secret key”);
A tag generation unit that generates a message authentication code (hereinafter referred to as “fixed message authentication code”) using the fixed secret key for each decryption device from the output of the tag combination unit,
The message number generation unit generates only one number information common to all decoding devices;
The counter combiner combines the number information with the encrypted plaintext;
The output unit includes an encrypted plaintext, one number information, a hash session key, an encrypted encryption session key for each decryption device, a message authentication code for each decryption device, and a fixed message authentication code for each decryption device. An encryption device characterized by outputting. An encryption device for performing communication between one encryption device and one or more decryption devices,
An encryption session key generation unit for generating a session key for encrypting plaintext (hereinafter referred to as “encryption session key”);
A plaintext encryption unit that encrypts the input plaintext using the encryption session key;
A message number generator for generating plaintext number information for each decryption device;
A counter combining unit that combines the number information with the number of decryption devices into the encrypted plaintext;
A hash session key generation unit that generates a hash session key (hereinafter referred to as a “hash session key”);
A keyed hash unit that converts the output of the counter combining unit with a hash function using the hash session key;
A key combining unit that combines the hash session key with the output of the keyed hash unit;
A stage number generation unit that generates the stage number of the pseudo-random number generation unit by the number of decoding devices;
The state for the decryption device in which the stage number is generated is updated, and a secret key for encrypting a session key (hereinafter referred to as “key secret key”) and a secret key for generating a message authentication code (hereinafter referred to as “key secret key”). A pseudo random number generator that generates a tag secret key),
A key encryption unit that encrypts the encryption session key for each decryption device using the key secret key;
An encryption key combining unit that combines the output of the key encryption unit with the output of the key combining unit by the number of decryption devices;
A tag generation unit that generates a message authentication code using the tag secret key for each decryption device from the output of the encryption key combining unit;
Output unit for outputting encrypted plaintext, number information for each decryption device, stage number information for each decryption device, hash session key, encrypted encryption session key for each decryption device, and message authentication code for each decryption device An encryption device comprising: A decryption device for performing communication between one encryption device and one or more decryption devices,
An input unit that receives an encrypted plaintext, number information, a session key that encrypts the encrypted plaintext (hereinafter referred to as an “encryption session key”), and a message authentication code;
Each time plaintext encrypted by the input unit is received, the state is updated, and a secret key (hereinafter referred to as “key secret key”) and a message authentication code for encrypting the encryption session key are generated. A pseudo-random number generator for generating a secret key (hereinafter referred to as “tag secret key”) for
A key decryption unit for decrypting an encrypted encryption session key by exclusive OR with the key secret key;
A tag generation unit that generates a message authentication code using the tag secret key from a bit string obtained by combining the received encrypted plaintext, number information, and encrypted encryption session key;
A message number generator for generating plaintext number information;
Information received when the received number information is compared with the number information generated by the message number generation unit, the received message authentication code is compared with the message authentication code generated by the tag generation unit, and both are matched. A comparison unit that determines that is normal,
A decryption device comprising: a plaintext decryption unit that decrypts received encrypted plaintext using the encryption session key when the comparison unit determines normal. The decoding device according to claim 6, wherein
A keyed hash part for converting the received encrypted plaintext and number information by a hash function using a received hash session key (hereinafter referred to as “hash session key”);
A key combining unit that combines the hash session key with the output of the keyed hash unit;
The output of the key combination unit also includes an encryption key combination unit for combining the received encrypted encryption session key,
The input unit receives an encrypted plaintext, number information, a hash session key, an encrypted encryption session key, and a message authentication code;
The tag generation unit generates a message authentication code from the output of the encryption key combination unit using the tag secret key. The decoding device according to claim 6, wherein
A tag combining unit that combines the received message authentication code with a bit string in which the received encrypted plaintext, number information, and encrypted encryption session key are combined;
A fixed secret key generation unit that generates a fixed secret key (hereinafter referred to as a “fixed secret key”);
A fixed tag generation unit that generates a message authentication code (hereinafter referred to as a “fixed message authentication code”) from the output of the tag combining unit using the generated fixed secret key;
The input unit receives an encrypted plaintext, number information, an encrypted encryption session key, a message authentication code, and a fixed message authentication code;
The comparison unit compares the received number information with the number information generated by the message number generation unit, compares the received message authentication code with the message authentication code generated by the tag generation unit, and receives the fixed message A decoding device, wherein an authentication code and a fixed message authentication code generated by the fixed tag generation unit are compared, and if all match, the received information is determined to be normal. The decoding device according to claim 7, wherein
A tag combining unit that combines the received message authentication code with the output of the encryption key combining unit;
A fixed secret key generation unit that generates a fixed secret key (hereinafter referred to as a “fixed secret key”);
A fixed tag generation unit that generates a fixed message authentication code (hereinafter referred to as “fixed message authentication code”) from the output of the tag combination unit using the generated fixed secret key;
The input unit receives an encrypted plaintext, number information, a hash session key, an encrypted encryption session key, a message authentication code, and a fixed message authentication code;
The comparison unit compares the received number information with the number information generated by the message number generation unit, compares the received message authentication code with the message authentication code generated by the tag generation unit, and receives the fixed message A decoding device, wherein an authentication code and a fixed message authentication code generated by the fixed tag generation unit are compared, and if all match, the received information is determined to be normal. A decryption device for performing communication between one encryption device and one or more decryption devices,
Encrypted plaintext, number information, stage number information, session key for hash (hereinafter referred to as “hash session key”), session key obtained by encrypting encrypted plaintext (hereinafter referred to as “encryption session key”) ), And an input unit for receiving the message authentication code;
A keyed hash part for converting the received encrypted plaintext and the bit string obtained by combining the number information with a hash function using the received hash session key;
A key combining unit that combines the hash session key with the output of the keyed hash unit;
A stage number generator for generating a stage number;
When the stage number generation unit generates the stage number, the state is updated, and a secret key (hereinafter referred to as “key secret key”) for encrypting the session key and a secret key (hereinafter referred to as “key authentication key”) are generated. , Referred to as “tag secret key”)
A key decryption unit for decrypting an encrypted encryption session key using the key secret key;
An encryption key combining unit that combines the received encrypted session key with the output of the key combining unit;
A tag generation unit that generates a message authentication code from the output of the encryption key combining unit using the tag secret key;
A message number generator for generating plaintext number information;
The received number information is compared with the number information generated by the message number generation unit, the received stage number is compared with the stage number generated by the stage number generation unit, and the received message authentication code and the tag generation unit A comparison unit that compares the message authentication code generated in step 1 and determines that the received information is normal if all match,
A decryption device comprising: a plaintext decryption unit that decrypts received plaintext using the encryption session key when the comparison unit determines normal. An encryption method for performing communication between one encryption device and one or more decryption devices,
An encryption session key generation step of generating a session key for encrypting plaintext (hereinafter referred to as “encryption session key”) in an encryption session key generation unit;
A plaintext encryption step of encrypting the input plaintext using the encryption session key in the plaintext encryption unit;
In the message number generation unit, for each decryption device, a message number generation step for generating plaintext number information;
A counter combining step of combining the number information with the number of decryption devices into the encrypted plaintext by the counter combining unit;
The pseudo-random number generation unit updates the state for each decryption device for each plaintext, and encrypts the encryption session key by the number of decryption devices (hereinafter referred to as “key secret key”) and message authentication. A pseudo-random number generation step for generating a secret key for generating a code (hereinafter referred to as a “tag secret key”);
A key encryption unit that encrypts the encryption session key by exclusive OR with the key secret key for each decryption device in a key encryption unit;
An encryption key combining unit that combines the output of the counter encryption step with the output of the key encryption step by the number of decryption devices, at the encryption key combining unit;
A tag generation unit for generating a message authentication code using the tag secret key for each decryption device from the output of the encryption key combining step in the tag generation unit;
An encryption method comprising: an output step of outputting an encrypted plaintext, number information for each decryption device, an encrypted encryption session key for each decryption device, and a message authentication code for each decryption device at an output unit. The encryption method according to claim 11, comprising:
A hash session key generation unit for generating a session key for hash (hereinafter referred to as “hash session key”) in a hash session key generation unit;
A keyed hash step, wherein the output of the counter combining step is converted by a hash function using the hash session key in a keyed hash unit;
A key combining unit that includes a key combining step of combining the hash session key with an output of the keyed hash step;
The encryption key combining step combines the output of the key encryption step with the output of the key combining step by the number of decryption devices. The output step includes encrypted plaintext, number information for each decryption device, hash An encryption method comprising: outputting a session key, an encrypted encryption session key for each decryption device, and a message authentication code for each decryption device. The encryption method according to claim 11, comprising:
In a tag combining unit, a tag combining step for combining the message authentication code by the number of decryption devices to the output of the encryption key combining step;
A fixed secret key generation unit for generating a secret key (hereinafter, referred to as “fixed secret key”) fixed for each decryption device by a fixed secret key generation unit;
There is also a fixed tag generation step in which a fixed tag generation unit generates a message authentication code (hereinafter referred to as “fixed message authentication code”) using the fixed secret key for each decryption device from the output of the tag combination step. And
The message number generation step generates only one number information common to all decoding devices;
The counter combining step combines the number information with the encrypted plaintext;
The output step outputs an encrypted plaintext, one number information, an encrypted encryption session key for each decryption device, a message authentication code for each decryption device, and a fixed message authentication code for each decryption device. A characteristic encryption method. The encryption method according to claim 12, comprising:
In a tag combining unit, a tag combining step for combining the message authentication code by the number of decryption devices to the output of the encryption key combining step;
A fixed secret key generation unit for generating a secret key (hereinafter, referred to as “fixed secret key”) fixed for each decryption device by a fixed secret key generation unit;
The tag generation unit also includes a tag generation step of generating a message authentication code (hereinafter referred to as “fixed message authentication code”) using the fixed secret key for each decryption device from the output of the tag combining step.
The message number generation step generates only one number information common to all decoding devices;
The counter combining step combines the number information with the encrypted plaintext;
The output step includes an encrypted plaintext, one number information, a hash session key, an encrypted encryption session key for each decryption device, a message authentication code for each decryption device, and a fixed message authentication code for each decryption device. An encryption method characterized by outputting. An encryption method for performing communication between one encryption device and one or more decryption devices,
An encryption session key generation step of generating a session key for encrypting plaintext (hereinafter referred to as “encryption session key”) in an encryption session key generation unit;
A plaintext encryption unit that encrypts the input plaintext using the encryption session key;
In the message number generation unit, for each decryption device, a message number generation step for generating plaintext number information;
A counter combining step of combining the number information with the number of decryption devices into the encrypted plaintext by the counter combining unit;
A hash session key generation unit for generating a session key for hash (hereinafter referred to as “hash session key”) in a hash session key generation unit;
A keyed hash step, wherein the output of the counter combining step is converted by a hash function using the hash session key in a keyed hash unit;
A key combining step of combining the hash session key with an output of the keyed hash step in a key combining unit;
In the stage number generation unit, a stage number generation step for generating the stage number of the pseudo random number generation unit as many as the number of decoding devices,
In order to generate a secret key (hereinafter referred to as “key secret key”) and a message authentication code for encrypting a session key by updating a state of the decryption apparatus in which the stage number is generated in a pseudo random number generation unit A pseudo-random number generation step of generating a secret key (hereinafter referred to as a “tag secret key”),
A key encryption step of encrypting the encryption session key for each decryption device using the key secret key in a key encryption unit;
An encryption key combining unit for combining the output of the key encryption step with the output of the key combining step by the number of decryption devices in the encryption key combining unit;
A tag generation unit for generating a message authentication code using the tag secret key for each decryption device from the output of the encryption key combining step in the tag generation unit;
In the output unit, the encrypted plaintext, the number information for each decryption device, the stage number information for each decryption device, the hash session key, the encrypted encryption session key for each decryption device, and the message authentication code for each decryption device An encryption method having an output step of outputting. A decryption method for performing communication between one encryption device and one or more decryption devices,
An input step of receiving an encrypted plaintext, number information, a session key obtained by encrypting the encrypted plaintext (hereinafter referred to as “encryption session key”), and a message authentication code at an input unit;
Each time the plaintext encrypted by the input unit is received by the pseudo random number generation unit, the state is updated, and a secret key for encrypting the encryption session key (hereinafter referred to as “key secret key”). A pseudo-random number generation step for generating a secret key (hereinafter referred to as a “tag secret key”) for generating a message authentication code;
A key decryption step of decrypting an encrypted encryption session key by exclusive OR with the key secret key in a key decryption unit;
A tag generation step of generating a message authentication code using the tag secret key from a bit string obtained by combining the received encrypted plaintext, number information, and the encrypted encryption session key in the tag generation unit;
A message number generation step for generating plaintext number information in the message number generation unit;
The comparison unit compares the received number information with the number information generated at the message number generation step, compares the received message authentication code with the message authentication code generated at the tag generation step, and if both match A comparison step for determining that the received information is normal;
A decryption method comprising: a plaintext decryption step of decrypting received encrypted plaintext using the encryption session key when the plaintext decryption unit determines that the comparison step is normal. The decoding method according to claim 16, comprising:
A key that is converted by a hash function using a received hash session key (hereinafter referred to as a “hash session key”) in a hash part with a key, by using the received session key for hash (hereinafter referred to as “hash session key”). Hash step with
A key combining step of combining the hash session key with an output of the keyed hash step in a key combining unit;
An encryption key combining unit that combines the received encrypted encryption session key with the output of the key combining step in the encryption key combining unit;
Receiving the encrypted plaintext, number information, hash session key, encrypted cryptographic session key, and message authentication code;
The tag generation step generates a message authentication code from the output of the encryption key combination step by using the tag secret key. The decoding method according to claim 16, comprising:
A tag combining step of combining the received message authentication code with a bit string in which the received encrypted plaintext, the number information, and the encrypted encryption session key are combined in the tag combining unit;
A fixed secret key generation unit for generating a fixed secret key (hereinafter referred to as “fixed secret key”) in a fixed secret key generation unit;
The fixed tag generation unit also has a fixed tag generation step of generating a message authentication code (hereinafter referred to as “fixed message authentication code”) using the generated fixed secret key from the output of the tag combining step.
Receiving the encrypted plaintext, number information, encrypted cryptographic session key, message authentication code, and fixed message authentication code;
The comparison step compares the received number information with the number information generated at the message number generation step, compares the received message authentication code with the message authentication code generated at the tag generation step, and receives the fixed message A decoding method, wherein an authentication code and the fixed message authentication code generated in the fixed tag generation step are compared, and if all match, the received information is determined to be normal. The decoding method according to claim 17,
In a tag combining unit, a tag combining step for combining the received message authentication code with the output of the encryption key combining step;
A fixed secret key generation unit for generating a fixed secret key (hereinafter referred to as “fixed secret key”) in a fixed secret key generation unit;
The fixed tag generation unit also includes a fixed tag generation step of generating a fixed message authentication code (hereinafter referred to as “fixed message authentication code”) using the generated fixed secret key from the output of the tag combining step.
Receiving the encrypted plaintext, number information, hash session key, encrypted cryptographic session key, message authentication code, and fixed message authentication code;
The comparison step compares the received number information with the number information generated at the message number generation step, compares the received message authentication code with the message authentication code generated at the tag generation step, and receives the fixed message A decoding method, wherein an authentication code and the fixed message authentication code generated in the fixed tag generation step are compared, and if all match, the received information is determined to be normal. A decryption method for performing communication between one encryption device and one or more decryption devices,
In the input unit, encrypted plaintext, number information, stage number information, session key for hash (hereinafter referred to as “hash session key”), session key obtained by encrypting the encrypted plaintext (hereinafter referred to as “encryption”). A session key "), and an input step for receiving the message authentication code;
A keyed hash step of converting a bit string in which the received encrypted plaintext and the number information are combined with a hash function using the received hash session key in a keyed hash part;
A key combining step of combining the hash session key with an output of the keyed hash step in a key combining unit;
In the stage number generation unit, a stage number generation step for generating a stage number;
When the stage number generation step generates the stage number, the pseudo random number generation unit generates a secret key (hereinafter referred to as “key secret key”) and a message authentication code for updating the state and encrypting the session key. A pseudo-random number generation step for generating a secret key (hereinafter referred to as a “tag secret key”) for
A key decryption step of decrypting an encrypted encryption session key using the key secret key by a key decryption unit;
An encryption key combining unit that combines the received encrypted encryption session key with the output of the key combining step by an encryption key combining unit;
A tag generation step for generating a message authentication code using the tag secret key from the output of the encryption key combining step in the tag generation unit;
A message number generation step for generating plaintext number information in the message number generation unit;
In the comparison unit, the received number information is compared with the number information generated in the message number generation step, the received stage number is compared with the stage number generated in the stage number generation step, and the received message authentication code and A comparison step of comparing the message authentication code generated in the tag generation step and determining that the received information is normal when all match;
A decryption method comprising: a plaintext decryption step of decrypting received plaintext using the encryption session key when the plaintext decryption unit determines that the comparison step is normal.   A program for causing a computer to execute each step of the method according to claim 11.   A computer-readable recording medium on which the program according to claim 21 is recorded.

Images