JP4914329B2 - Message authenticator generation device, message authenticator verification device, message authenticator generation method, message authenticator verification method, program, and recording medium - Google Patents

Description

  The present invention relates to a message authenticator generation device, a message authenticator verification device, a message authenticator generation method, and message authentication for enabling authentication of a sender or a data creator for data on a communication path or a recording medium. The present invention relates to a child verification method, a program, and a recording medium.

In message authentication, the message authentication code MAC generates a message authenticator tag from a k-bit key K and data M having an arbitrary bit length (tag ← MAC _K (M)). By sharing the message authentication code MAC and the key K, the sender and the receiver or the data creator and the data user can perform authentication and verification of the data contents as follows.

  The sender or the data creator generates a message authenticator tag from the key K (usually one key but may be two or more) and the data M at the message authenticator generating device. Then, the data M and the message authenticator are transmitted or stored. The receiver or the data user generates a message authenticator tag ′ from the key K and the data M by the message authenticator verification device. Then, tag and tag ′ are compared. If tag = tag ′, it is assumed that the authentication of the sender or the data creator and the consistency of the data contents are verified. If tag ≠ tag ′, it is determined that the sender or the data creator is misrepresented or the data has been tampered with.

The conventional message authentication code, is applied twice a hash function H _MD using Merkle Dangado repeat that improve safety (non-patent document 1), and the like. The message authentication code MAC _K (M) of Non-Patent Document 1 calculates a message authentication code tag as shown in the following equation.

ただし、“‖”はビット列の結合を意味する記号、“０^ｃ−ｋ”は“０”がｃ−ｋ個並んだビット列を示す記号、ＩＰＡＤとＯＰＡＤはｃビットのあらかじめ定められた定数である。このメッセージ認証コードは、圧縮関数の擬似乱数性に基づく耐偽造安全性証明が可能である（非特許文献２）。図１は、式（１）の処理を行うメッセージ認証子生成装置の機能構成例を示す図である。メッセージ認証子生成装置９００は、鍵パディング手段９１０とハッシュ手段９２０とを備える。鍵パディング手段９１０は、式（１）の１行目を実行し、ｋビットの鍵をｄビットにする。ハッシュ手段９２０は、式（１）の２行目と３行目を実行し、メッセージ認証子τを出力する。図２は、ハッシュ手段９２０の機能構成例である。ハッシュ手段９２０は、パディング部９２１、メッセージブロック生成部９２２、初期設定部９２３、中間変数計算部９２４から構成されている。パディング部９２１は、ハッシュ関数Ｆ_ＭＤへ入力されたビット列Ｄを、パディングによりＮ×ｂビットのビット列Ｍ^＊に変換する（ただし、Ｎとｂは正の整数）。メッセージブロック生成部９２２は、ビット列Ｍ^＊をＮ個のｂビットのメッセージブロックｍ_ｎに分割する（ただし、ｎは１以上Ｎ以下の整数）。初期設定部９２３は、最初の中間変数ｖ_０をあらかじめ定めた定数に設定する。中間変数計算部９２４は、
ｖ_ｎ←ｆ（ｖ_ｎ−１‖ｍ_ｎ） （２）
をｎ＝１からｎ＝Ｎまで繰り返し、ｖ_Ｎを求め、出力する。中間変数ｖ_ｎはｃビットのビット列であり、ｆは（ｃ＋ｂ）ビットのビット列をｃビットのビット列に圧縮する圧縮関数である。なお、このメッセージ認証コードに用いる圧縮関数ｆの場合、ｃとｂの値に対する制約はなく、ｃ＞ｂでもｃ＜ｂでもかまわない。また、このメッセージ認証コードは、圧縮関数の擬似乱数性に基づく耐偽造安全性証明が可能である（非特許文献２、非特許文献３）。
M. Bellare, R. Canetti, H. Krawczyk, “Keying hash functions for message authentication,” CRYPTO 1996, LNCS vol.1109, pp.1-15, Springer, Heidelberg (1996). M. Bellare, “New proofs for NMAC and HMAC: Security without collision-resistance,” CRYPTO 2006, LNCS vol.4117, pp.602-619, Springer, Heidelberg (2006). M. Bellare, R. Canetti, H. Krawczyk, “Pseudorandom functions revisited: The cascade construction and its concrete security,” IEEE Symposium on Foundations of Computer Science, pp.514-523 (1996).

However, “‖” is a symbol indicating a combination of bit strings, “0 ^ck ” is a symbol indicating a bit string in which “ ^k ” is arranged “0”, and IPAD and OPAD are predetermined constants of c bits. . This message authentication code can be forged security-proof based on the pseudo randomness of the compression function (Non-Patent Document 2). FIG. 1 is a diagram illustrating a functional configuration example of a message authenticator generation device that performs the processing of Expression (1). The message authenticator generation device 900 includes key padding means 910 and hash means 920. The key padding means 910 executes the first line of the equation (1) and changes the k-bit key to d bits. The hash unit 920 executes the second and third lines of the formula (1) and outputs a message authenticator τ. FIG. 2 is a functional configuration example of the hash unit 920. The hash means 920 includes a padding unit 921, a message block generation unit 922, an initial setting unit 923, and an intermediate variable calculation unit 924. The padding unit 921 converts the bit string D input to the hash function _FMD into a bit string M ^* of N × b bits by padding (where N and b are positive integers). The message block generation unit 922 divides the bit string M ^* into N b-bit message blocks _mn (where n is an integer from 1 to N). The initial setting unit 923 sets the first intermediate variable v ₀ to a predetermined constant. The intermediate variable calculation unit 924
v _n <-f (v _n−1 ‖m _n ) (2)
Are repeated from n = 1 to n = _N to obtain vN and output. Intermediate variable v _n is the bit string c bits, f is a compression function that compresses the bit string of (c + b) bits in the bit string of c bits. In the case of the compression function f used for this message authentication code, there are no restrictions on the values of c and b, and c> b or c <b may be used. Further, this message authentication code can be forged security-proof based on the pseudo-random property of the compression function (Non-Patent Document 2, Non-Patent Document 3).
M. Bellare, R. Canetti, H. Krawczyk, “Keying hash functions for message authentication,” CRYPTO 1996, LNCS vol.1109, pp.1-15, Springer, Heidelberg (1996). M. Bellare, “New proofs for NMAC and HMAC: Security without collision-resistance,” CRYPTO 2006, LNCS vol.4117, pp.602-619, Springer, Heidelberg (2006). M. Bellare, R. Canetti, H. Krawczyk, “Pseudorandom functions revisited: The cascade construction and its concrete security,” IEEE Symposium on Foundations of Computer Science, pp.514-523 (1996).

The security of the message authentication code MAC _K (M) of Non-Patent Document 1 is only guaranteed to a level called a birthday limit, and is actually vulnerable to birthday attacks. Therefore, an object of the present invention is to provide a message authentication code having safety exceeding the birthday limit.

The message authenticator generation device of the present invention includes key padding means, DIL means, cAU means, and pseudo-random number means. The key padding means outputs L + 1 c bits (where c is a predetermined integer) keys K ₁ ,..., K _L , K ′. L + 1 keys K ₁ ,..., K _L , K ′ may be recorded in advance, or L + 1 keys may be generated from one key K. The DIL means uses the DIL function Φ to obtain data D ₁ ,..., An integer multiple of L bits (where L is an integer of 2 or more) b bits (where b is a predetermined integer) from the data M. to generate a D _L. The cAU means obtains a c-bit intermediate variable y _i using the cAU function and the key K _i for each data D _i (where i is an integer of 1 to L). The pseudo random number means obtains a message authenticator tag from the _L intermediate variables y ₁ ,..., Y _L using a pseudo random function family.
Note that the DIL function Φ is obtained when L is an integer of 2 or more.
Φ = {φ _i } _{1 ≦ i ≦ L}
(Where φ _i : M → D _i ), and if M ≠ M ′, “φ _i (M) ≠ φ _i (M ′) and φ _j (M) ≠ φ _j (M This is a function that satisfies the condition that 1 ≦ i <j ≦ L exists.

For example, the DIL means may set all the data D ₁ ,..., _DL as a bit string obtained by performing predetermined padding on the data M to an integer multiple of b bits (in this case, D ₁ = D ₂ = ... = D _L ). Alternatively, the DIL means may be as follows. The DIL unit includes a padding unit, a message block generation unit, and a data generation unit. Then, the padding unit obtains data M ^* which is an integer multiple of b bits by performing predetermined padding on the data M. If the data M input to the DIL means is limited to an integer multiple of b bits, a padding unit is not necessary. The message block generator divides the data M ^*, which is an integer multiple of b bits, into N b-bit message blocks m _n (where n is an integer from 1 to N). In the data generation unit, the data D _i from i = 1 to i = L−1 is _converted to the message block m _{i + (j−1) (L−1)} (where j is an integer of 1 or more), and j = 1.

の範囲で連結したビット列とし、データＤ_Ｌを、ｉ＝１からｉ＝Ｌ−１のメッセージブロックｍ_{ｉ＋（ｊ−１）（Ｌ−１）}の排他的論理和を、ｊは１以上の整数）を、ｊ＝１から

And a bit string obtained by connecting in the range of the data _{D L,} i = message block from the first _{i = L-1 m i +} (j-1) the exclusive OR of _(L-1), j is an integer of 1 or more ) From j = 1

の範囲で連結したビット列とする。
本発明のメッセージ認証子検証装置は、本発明のメッセージ認証子生成装置と比較部とを備え、データＭとメッセージ認証子τとを入力とし、データＭの検証を行う。メッセージ認証子生成装置は、データＭからメッセージ認証子ｔａｇ’を生成する。比較部は、メッセージ認証子ｔａｇとメッセージ認証子ｔａｇ’とを比較してデータＭの検証結果を出力する。

A bit string concatenated in the range of.
The message authenticator verification device according to the present invention includes the message authenticator generation device according to the present invention and a comparison unit, and receives data M and a message authenticator τ as input, and verifies the data M. The message authenticator generation device generates a message authenticator tag ′ from the data M. The comparison unit compares the message authenticator tag and the message authenticator tag ′ and outputs a verification result of the data M.

  In the message authenticator generation device of the present invention, if the message is different, the DIL means outputs data for L columns which are different by at least two columns, and each data is processed in parallel by the cAU means, and L pieces of data are processed. All outputs are processed simultaneously by the pseudorandom means. Therefore, the security level is doubled as compared with the conventional method using one column of cAU means and pseudo random number means, and security exceeding the birthday limit can be ensured.

Furthermore, in DIL means, for example by adopting an exclusive using logical sum method, the data D ₁ by dividing the data _M, ..., it can generate D _L, since the processing amount of cAU means for each column is reduced The processing amount can be made close to the case where parallel processing is not performed. Therefore, a security level exceeding the birthday limit can be secured while suppressing an increase in the processing amount.

  Below, in order to avoid duplication of description, the same number is given to the structural part which has the same function, and the process step which performs the same process, and description is abbreviate | omitted.

[First Embodiment]
FIG. 3 shows a functional configuration example of the message authenticator generation device of the present invention. FIG. 4 shows a processing flow of the message authenticator generation device of the present invention. Further, FIG. 5 shows processing in the DIL means, cAU means, and pseudo-random number means of this embodiment when L = 2. The message authenticator generating apparatus 100 includes key padding means 110, DIL means 120, cAU means 130, and pseudorandom number means 140.

In addition, the definition of the cAU function and the pseudo random number function family used in the following description is shown in Non-Patent Document 1, and follows this definition. When the DIL function Φ is an integer of 2 or more,
Φ = {φ _i } _{1 ≦ i ≦ L}
(Where φ _i : M → D _i ), and if M ≠ M ′, “φ _i (M) ≠ φ _i (M ′) and φ _j (M) ≠ φ _j (M This is a function that satisfies the condition that 1 ≦ i <j ≦ L exists. In other words, “M = M ′ holds if φ _i (M) = φ _i (M ′) is satisfied for at least L−1 values i∈ {1, 2,..., L}”. A function that satisfies the condition.

The key padding means 110 outputs L + 1 keys K ₁ ,..., K _L , K ′ of c bits (where c is a predetermined integer) (S110). Note that L + 1 keys K ₁ ,..., K _L , K ′ can also be generated from one key. Therefore, how many keys are recorded and how L + 1 keys K ₁ ,..., K _L , K ′ are generated may be appropriately designed.

The DIL means 120 uses the DIL function Φ to obtain data D ₁ ,... Which is an integer multiple of L bits (where L is an integer of 2 or more) b bits (where b is a predetermined integer) from the data M. , D _L = m ₁ ‖m ₂ ‖... ‖M _N ( _{where mn} is a bit string of b bits, where n is an integer of 1 to N) (S120). Data D ₁ ,..., D _L is a bit string that is an integer multiple of b bits by performing predetermined padding on the data M (in this case, D ₁ = D ₂ =... = D _L ). . Alternatively, the bit string M ^* obtained by making the data M an integer multiple of b bits by padding or the like may be input to the DIL unit 120 and the DIL unit 120 may not perform padding.

The cAU unit 130 obtains a c-bit intermediate variable y _i by using the cAU function and the key K _i for each data D _i (where i is an integer between 1 and L) (S130-1,..., S130). -L). Specifically, the b-bit bit string m ₁ and the c-bit key _Ki are compressed to c bits by the compression function f. Then, compressed into c bits a bit string m ₂ results and b bits for the compression in the compression function f. In this way, the intermediate variable y _i is obtained by repeatedly calling the compression function f. The processing of L cAU functions (S130-1,..., S130-L) may be executed by L cAU means (130-1,..., 130-L) or one cAU. It may be executed by means 130. Typical compression functions include sha1 of c = 160, b = 512, sha = 256 of b = 512, and sha256 of b = 512 (NIST, “Secure hash standard.” FIPS PUB 180-2 (2002)). .

The pseudo random number means 140 obtains a message authenticator tag from the _L intermediate variables y ₁ ,..., Y _L using the pseudo random function family and the key K ′ (S140). For example, a b-bit bit string y ₁ ‖... ‖Y _L ‖0 ^b-Lc and a c-bit key K ′ may be input to the compression function f to obtain a message authenticator tag. However, in this example, Lc ≦ b must be satisfied.

  Since the message authenticator generation device of this embodiment performs parallel processing of L columns by the cAU means, the security level can be increased. For example, by setting L to 2, the security level is doubled, and security exceeding the birthday limit can be secured. However, even if L is increased too much, the security level is only increased unnecessarily. On the other hand, when L is increased, there is a disadvantage that the processing amount increases.

[Second Embodiment]
In the first embodiment, the amount of processing increases when L is increased. In the present embodiment, a method of reducing the processing amount by increasing L by designing the DIL function will be described.

  A functional configuration example of the message authenticator generation device of this embodiment is also shown in FIG. The processing flow of the message authenticator generation device of the present invention is also shown in FIG. FIG. 6 shows a functional configuration of the DIL unit of the present embodiment, and FIG. 7 shows a processing flow of the DIL unit of the present embodiment. Further, FIG. 8 shows processing in the DIL means, cAU means, and pseudo-random number means of this embodiment when L = 3.

The message authenticator generating apparatus 200 includes key padding means 110, DIL means 220, cAU means 130, and pseudorandom number means 140.
As in the first embodiment, the definition of the cAU function and the pseudorandom function family used in the following description is shown in Non-Patent Document 1, and follows this definition. When the DIL function Φ is an integer of 2 or more,
Φ = {φ _i } _{1 ≦ i ≦ L}
(Where φ _i : M → D _i ), and if M ≠ M ′, “φ _i (M) ≠ φ _i (M ′) and φ _j (M) ≠ φ _j (M This is a function that satisfies the condition that 1 ≦ i <j ≦ L exists. In other words, “M = M ′ holds if φ _i (M) = φ _i (M ′) is satisfied for at least L−1 values i∈ {1, 2,..., L}”. A function that satisfies the condition.

The key padding means 110 is the same as that in the first embodiment, and outputs L + 1 keys K ₁ ,..., K _L , K ′ (S110). As shown in FIG. 6, the DIL unit 220 includes a padding unit 221, a message block generation unit 222, and a data generation unit 223. The padding unit 221 obtains data M ^* that is an integer multiple of b bits by performing predetermined padding on the data M (S221). If the data M input to the DIL unit 220 is limited to an integer multiple of b bits, the padding unit 221 is not necessary. The message block generator 222 divides the data M ^* into N b-bit message blocks m _n (where n is an integer between 1 and N) (S222). The data generation unit 223 converts the data D _i from i = 1 to i = L−1 into the message block m _{i + (j−1) (L−1)} (where j is an integer equal to or greater than 1), j = 1. From

の範囲で連結したビット列とする。例えば、Ｌ＝３、Ｎが偶数の場合は、Ｄ_１＝ｍ_１‖ｍ_３‖…‖ｍ_Ｎ−１、Ｄ_２＝ｍ_２‖ｍ_４‖…‖ｍ_Ｎとなる（図８）。また、データＤ_Ｌを、ｉ＝１からｉ＝Ｌ−１のメッセージブロックｍ_{ｉ＋（ｊ−１）（Ｌ−１）}の排他的論理和を、ｊは１以上の整数）を、ｊ＝１から

A bit string concatenated in the range of. For example, when L = 3 and N is an even number, D ₁ = m ₁ ‖m ₃ ‖... ‖M _N−1 and D ₂ = m ₂ ‖m ₄ ‖... ‖M _N (FIG. 8). Further, the data _{D L,} i = 1 from i = L-1 of the message block _{m i + (j-1)} to the exclusive OR of _(L-1), j is an integer of 1 or more), j = 1 From

の範囲で連結したビット列とする（Ｓ２２３）。例えば、Ｌ＝３、Ｎが偶数の場合は、

The bit string is concatenated within the range (S223). For example, if L = 3 and N is an even number,

となる（図８）。

(FIG. 8).

As in the first embodiment, the cAU unit 130 uses the cAU function and the key K _i to set the c-bit intermediate variable y _i for each data D _i (where i is an integer of 1 to L). (S130-1, ..., S130-L).

As in the first embodiment, the pseudo random number means 140 obtains the message authenticator tag from the _L intermediate variables y ₁ ,..., Y _L using the pseudo random function family and the key K ′ (S140). ).

The DIL means of the present embodiment, the data ^{M *} data _D 1, _..., so partitioned _{D L-1,} the number of bits of the _{D i} becomes the data ^{M *} of the number of bits L-1 min 1. Therefore, the number of times of calling the compression function f by the cAU means is 1 + 1 / (L−1) times the number of times of calling the compression function f by the method of Non-Patent Document 1. That is, it is doubled when L = 2, 1.5 times when L = 3, and 1.33 times when L = 4. By increasing L in this way, the amount of processing can be reduced. However, increasing L increases the number of keys required. Therefore, the value of L may be appropriately designed in consideration of the processing amount, the recording capacity, and the like.

  Since the message authenticator generation device of this embodiment performs parallel processing of L columns by the cAU means, it is possible to ensure security exceeding the birthday limit as in the first embodiment. In addition, security that exceeds the birthday limit can be secured while reducing the amount of processing (high efficiency).

[Third Embodiment]
FIG. 9 shows a functional configuration example of the message authenticator verification device of the present invention. FIG. 10 shows a processing flow example of the message authenticator verification device of the present invention. The message authenticator verification device 500 includes the message authenticator generation device 100 or 200 shown in the first embodiment or the second embodiment, the comparison unit 510, and the recording unit 590, and the data M and the message authenticator tag are the same. Input and verification results are output.

  The message authenticator generation device 100 (200) in the message authenticator verification device 500 generates a message authenticator tag 'from the data M (S100 or S200). The comparison unit 510 compares the message authenticator tag with the message authenticator tag ′. If tag = tag ′, it is assumed that the authentication of the sender or the data creator and the consistency of the data contents are verified. If tag ≠ tag ′, it is determined that the sender or the data creator is misrepresented or the data has been tampered with. Then, the verification result is output (S510). The recording unit 590 may not be provided, and these pieces of information may be recorded by other components.

  With this configuration, the message authenticator verification device 500 can achieve the same effects as the message authenticator generation device 100 (200).

  FIG. 11 shows a functional configuration example of a computer. Note that the message authenticator generation device and the message authenticator verification device of the present invention cause the recording unit 2020 of the computer 2000 to read a program that causes the computer 2000 to operate as each component of the present invention, and the processing unit 2010 and the input unit 2030. This can be realized by operating the output unit 2040 or the like. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

The figure which shows the function structural example of the conventional message authenticator production | generation apparatus. The figure which shows the function structural example of the conventional hash means. The figure which shows the function structural example of the message authenticator production | generation apparatus of this invention. The figure which shows the processing flow of the message authenticator production | generation apparatus of this invention. The figure which shows the process in the DIL means, cAU means, and pseudorandom means of 1st Embodiment in the case of L = 2. The figure which shows the function structural example of the DIL means of 2nd Embodiment. The figure which shows the processing flow of the DIL means of 2nd Embodiment. The figure which shows the process in the DIL means, cAU means, and pseudorandom means of 2nd Embodiment in the case of L = 3. The figure which shows the function structural example of the message authenticator verification apparatus of this invention. The figure which shows the example of a processing flow of the message authenticator verification apparatus of this invention. The figure which shows the function structural example of a computer.

Explanation of symbols

100, 200, 900 Message authenticator generation device 110, 910 Key padding means 120, 220 DIL means 130 cAU means 140 Pseudorandom number means 221, 921 Padding unit 222, 922 Message block generation unit 223 Data generation unit 500 Message authenticator verification device 510 comparison unit 590 recording unit 920 hash means 923 initial value setting unit 924 intermediate variable calculation unit

Claims (10)

A message authenticator generation device that outputs a message authenticator tag for data M,
Key padding means for outputting L + 1 c bits (where c is a predetermined integer) K ₁ ,..., K _L , K ′;
Φ = {φ _i } _{1 ≦ i ≦ L} (where L is an integer of 2 or more, φ _i : M → D _i ), and if M ≠ M ′, “φ _i (M) ≠ φ _i ( M ′) and φ _j (M) ≠ φ _j (M ′), and using the DIL function Φ that satisfies the condition that 1 ≦ i <j ≦ L exists, L b bits from the data M DIL means for generating data D ₁ ,..., D _L that is an integer multiple of (where b is a predetermined integer);
CAU means for obtaining a c-bit intermediate variable y _i using a cAU function and a key K _i for each data D _i (where i is an integer of 1 to L);
A message authenticator generation device comprising: pseudo random number means for obtaining a message authenticator tag from the _L intermediate variables y ₁ ,..., Y _L using a pseudo random function family and a key K ′. The message authenticator generation device according to claim 1,
Wherein any of the data D _i, the relative data M, the message authentication code generation device, characterized in that a bit string that is an integer multiple of b bits by performing padding a predetermined. The message authenticator generation device according to claim 1,
L is an integer greater than or equal to 3,
The DIL means includes
a message block generator that divides the data M ^*, which is an integer multiple of b bits, into N b-bit message blocks m _n (where n is an integer between 1 and N);
The data D _i from i = 1 to i = L−1 is _converted from the message block m _{i + (j−1) (L−1)} (where j is an integer of 1 or more) from j = 1.

And a bit string obtained by connecting in the range of the data _{D L,} the exclusive OR of i = 1 from i = L-1 of the message block _{m i + (j-1)} (L-1), j is 1 or more Integer) from j = 1

A message authenticator generation device comprising: a data generation unit configured to generate a bit string concatenated in a range of A message authenticator verification device that receives data M and a message authenticator tag and performs verification of the data M,
The message authenticator generation device according to any one of claims 1 to 3, which generates a message authenticator tag 'from the data M;
A message authenticator verification device comprising: a comparison unit that compares the message authenticator tag and the message authenticator tag ′ and outputs a verification result of data M. A message authenticator generation method for outputting a message authenticator tag for data M,
A key padding step for outputting L + 1 c bits (where c is a predetermined integer) K ₁ ,..., K _L , K ′ by key padding means;
In the DIL means, φ = {φ _i } _{1 ≦ i ≦ L} (where L is an integer of 2 or more, φ _i : M → D _i ), and if M ≠ M ′, “φ _i (M) Using the DIL function Φ satisfying the condition that 1 ≦ i <j ≦ L exists such that ≠ φ _i (M ′) and φ _j (M) ≠ φ _j (M ′), L A DIL step for generating data D ₁ ,..., D _L that is an integer multiple of b bits (where b is a predetermined integer);
cAU step for obtaining c-bit intermediate variable y _i by cAU means using cAU function and key K _i for each data D _i (where i is an integer of 1 or more and L or less);
A pseudo-random number means, comprising: a pseudo-random number step for obtaining a message authenticator tag from the _L intermediate variables y ₁ ,..., Y _L using a pseudo-random function family and a key K ′. The message authenticator generation method according to claim 5, comprising:
Wherein any of the data D _i, the relative data M, the message authentication code generation method which is a bit string that is an integer multiple of b bits by performing padding a predetermined. The message authenticator generation method according to claim 5, comprising:
L is an integer greater than or equal to 3,
The DIL step includes
a message block generation sub-step for dividing the data M ^*, which is an integer multiple of b bits, into N b-bit message blocks m _n (where n is an integer between 1 and N);
The data D _i from i = 1 to i = L−1 is _converted from the message block m _{i + (j−1) (L−1)} (where j is an integer of 1 or more) from j = 1.

And a bit string obtained by connecting in the range of the data _{D L,} the exclusive OR of i = 1 from i = L-1 of the message block _{m i + (j-1)} (L-1), j is 1 or more Integer) from j = 1

And a data generation sub-step for generating a bit string concatenated in a range of. A message authenticator verification method in which data M and a message authenticator tag are input, and data M is verified.
Each step of the message authenticator generation method according to claim 5, wherein a message authenticator tag ′ is generated from the data M;
A comparison step of comparing the message authenticator tag with the message authenticator tag ′ and outputting a verification result of the data M in a comparison unit;   A program for operating a computer as the apparatus according to claim 1.   A computer-readable recording medium on which the program according to claim 9 is recorded.

Images