JP5223245B2 - Cryptographic processing apparatus, cryptographic processing method, and computer program - Google Patents

Description

  The present invention relates to a cryptographic processing apparatus, a cryptographic processing method, and a computer program. More specifically, the present invention relates to a cryptographic processing apparatus, a cryptographic processing method, and a computer program that execute a common key block cryptographic process.

  Ensuring security is an important issue in network communications, electronic commerce, and other data processing fields. One method for ensuring security is encryption technology, and encryption processing is used in various fields. For example, an encryption processing module is embedded in a small device such as an IC card, and data is transmitted / received between the IC card and a reader / writer as a data reading / writing device, and authentication processing or encryption / decryption of transmitted / received data is performed. The system has been put into practical use.

  There are various cryptographic processing algorithms, but broadly classified, the encryption key and the decryption key are different keys, for example, the public key cryptosystem that sets the public key and the private key, and the encryption key and the decryption key are common. It is classified into a common key encryption method set as a key.

  There are various algorithms in the common key cryptosystem, one of which generates a plurality of keys based on the common key, and a block unit (64 bits, 128, 256 bits, etc.) using the generated plurality of keys. There is a method of repeatedly executing the data conversion process. A typical algorithm applying such a key generation method and data conversion processing is a common key block encryption method.

  As a typical common key block cipher algorithm, for example, a DES (Data Encryption Standard) algorithm which has been a US standard cipher in the past, an AES (Advanced Encryption Standard) algorithm which is a current US standard, and the like are known.

  The common key block encryption process will be described with reference to FIG. The common key block cipher algorithm mainly includes a data encryption unit 114 having a round function execution unit that repeatedly executes conversion of input data, and a key schedule unit 112 that generates a round key to be applied in each round of the round function unit. Consists of. The key schedule unit 112 expands the secret key (K) 111 of several hundred bits to the extended key 113 of about several thousand bits and supplies it to the data encryption unit 114. Of the extended key 113, a part of the extended key input by the round function 115 of the data encryption unit 114 is referred to as a round key.

For example, in a block cipher configured to perform an r-stage round function, {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } round keys are input to the 1 to r round functions. The In addition, IK is exclusively ORed as an initial key and FK as a final key.

  A typical structure of the data encryption unit 114 is a Feistel structure. The Feistel structure has a structure for converting plaintext into ciphertext by simple repetition of a round function as a data conversion function. In the round function, linear transformation processing and nonlinear transformation processing are executed. Note that there are Non-Patent Document 1 and Non-Patent Document 2, for example, as documents describing encryption processing using the Feistel structure.

  FIG. 2 shows a specific configuration example of the data encryption unit 114. The block length is n, the round function 115 is a Feistel structure, the size of the round key is n / 2 bits, and the round number r is r = 4t + 2 (t is a natural number). At this time, the initial key IK and the final key FK are also n / 2 bits, and are exclusive ORed only on one side of the data line divided by the Feistel structure.

The n-bit plaintext P input to the data encryption unit 114 shown in FIG. 2 is divided into halves, with the upper n / 2 bits being P ₀ and the lower n / 2 bits being P ₁ . Similarly, the ciphertext C is also divided into halves, with the upper n / 2 bits being C ₀ and the lower n / 2 bits being C ₁ .

In the data encryption unit 114 shown in FIG. 2, after the initial key IK is exclusive ORed with the lower n / 2 bits P ₁ of the input plaintext P, round keys: RK ₁ , RK ₂ ,..., RK _r−1 , The round function to which RK _r is input is processed r times, and the final key FK is exclusive-ORed with the lower n / 2 bits output from the last round function, and the lower n / 2 bits C _{1 of the} ciphertext C Is generated.

  The round function 115 includes an F function and data exchange (right-left series exchange). There are various types of internal structures of the F function. For example, as in the F function 116 shown in FIG. 2, an exclusive OR operation with a round key, a non-linear operation called S-box, and linear transformation A configuration for performing processing is known.

FIG. 3 shows a configuration example of the data encryption unit 114 having a configuration different from that in FIG. In the data encryption unit 114 shown in FIG. 3, the configuration of each round function is the same as the configuration shown in FIG. 2, but the input configuration of the initial key IK and the final key FK is different from the configuration shown in FIG. Yes. That is, in the configuration shown in FIG. 2, the initial key IK is exclusively ORed with the lower n / 2 bits P ₁ of the input plaintext P. However, in the configuration shown in FIG. after XOR initial key IK to 2 bit _{P 0, RK 1, RK 2} , ..., r times the process round function consisting of F function and swapping function _{which RK r-1, RK r} are input The final key FK is exclusively ORed with the upper n / 2 bits output from the last round function to generate the upper n / 2 bits C _{0 of the} ciphertext C.

  The configuration of the data encryption unit shown in FIG. 2 and FIG. 3 is a configuration in which the n-bit input plaintext P is divided into two series of upper and lower n / 2 bits and processed. There is also a configuration in which the process is divided into four series of n / 4 bits.

A configuration example (four-sequence Type-2 generalized Feistel structure) of a data encryption unit having a four-sequence configuration will be described with reference to FIGS. 4 and 5. As shown in FIGS. 4 and 5, n / 4-bit data obtained by dividing the n-bit plaintext P into ¼ is P ₀ , P ₁ , P ₂ , P ₃ and the n-bit ciphertext C is ¼. The divided n / 4-bit data is assumed to be C ₀ , C ₁ , C ₂ , and C ₃ , respectively.

In this configuration, as shown in FIGS. 4 and 5, two round functions are executed in each round. The two round functions in each round generate n / 4-bit round keys RK ₁ [0] and RK ₁ [1] by dividing the n / 2-bit round key RK ₁ into ½, and each round function To enter. Similarly, for the n / 2-bit initial key IK, n / 4-bit IK [0] and IK [1] divided into ½ are input to two of the four sequences, and the n / 2-bit initial key IK is Also for the final key FK, n / 4-bit FK [0] and FK [1] divided into ½ are input to two of the four sequences.

In FIG. 4, the divided input plaintext P to 1/4 n / 4-bit data in _{P 0,} P _1, P 2, _{P 3,} initial key IK [0] to _{P 1} and _{P 3} and IK [ 1] is subjected to an exclusive OR, and then a round function is input to which n / 4-bit divided round keys RK ₁ [0] and RK ₁ [1] are input.

Hereinafter, in each round, a round key {RK ₂ [0], RK ₂ [1]}, ..., {RK _r-1 [0], RK _r-1 [1]}, { RK _r [0], RK _r [1]} are input and a total of r round functions are executed.

Finally, the last key n-bit ciphertext C as each _{C 0,} C _1, C 2, output preceding processing of _{C 1} and _{C 3} constitute a _{C 3} the divided n / 4-bit data to 1/4 FK Is exclusively ORed with FK [0] and FK [1] divided into n / 4 bits.

In FIG. 5, n / 4-bit data obtained by dividing the input plaintext P into ¼ is P ₀ , P ₁ , P ₂ , P ₃ , P ₀ and P ₂ , which are different from the configuration of FIG. After the exclusive OR of the initial keys IK [0] and IK [1], the same round function is repeated r times, and finally the processing before the output of C ₀ and C ₂ which are different from FIG. FK [0] and FK [1] obtained by dividing the final key FK into n / 4 bits are exclusive ORed.

As described above with reference to FIG. 1, the round key is generated in the key schedule unit 112. The key schedule unit 112 expands the secret key (K) 111 of several hundred bits to the extended key 113 of about several thousand bits and supplies it to the data encryption unit 114. In a block cipher configured to perform an r-stage round function, round keys of {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are respectively assigned to the round functions from 1 to r stages. ) 111 is generated. Note that the initial key IK and the final key FK are also generated based on the secret key (K) 111.

A general generation process example of a round key, an initial key IK, and a final key FK, which are keys applied in the data encryption unit, will be described. For example, the round key is configured as follows. First, nonlinear conversion is performed on the k-bit secret key K to generate a k-bit first intermediate key KA. Next, n / 2 bits are extracted from the first intermediate key KA to form {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }.

Next, another k-bit data is created from the secret key K, and this is used as the second intermediate key KB. Regarding the second intermediate key KB,
1) Data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K,
2) Data obtained by applying linear transformation to the secret key K,
3) The secret key K itself can be set.
N / 2 bits are extracted from the second intermediate key KB every two rounds to form {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }.

The round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are the following data generated from the secret key K by the above-described processing:
First intermediate key KA-based n / 2-bit key {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }
Second intermediate key KB-based n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }
Based on these data, the round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are set as follows, for example.
RK ₁ = KA ₁
RK ₂ = KA ₂
RK ₃ = KA ₃ (EXOR) KB ₃
RK ₄ = KA ₄ (EXOR) KB ₄
RK ₅ = KA ₅
...
RK _r-4 = KA _r-4
RK _r-3 = KA _r-3 (EXOR) KB _r-3
RK _r-2 = KA _r-2 (EXOR) KB _r-2
RK _r-1 = KA _r-1
RK _r = KA _r
And In the above equation, [A (EXOR) B] is an exclusive OR operation of A and B.

Also, regarding the initial key IK and the final key FK, n / 2 bits are extracted from the second intermediate key KB to form KB ₀ and KB _{r + 1} ,
IK = KB ₀
FK = KB _{r + 1}
And

With such a key generation configuration, it is said that the difficulty of key analysis can be increased. The n / 2-bit key KA _n generated only from the first intermediate key KA is used only in two consecutive rounds and does not continue three rounds. For example, in the above setting, the n / 2-bit key KA _n generated only from the first intermediate key KA is used for the first round and the second round, but the third intermediate and the fourth round are the first intermediate Data generated as an exclusive OR operation result of the n / 2-bit key KA _n generated from the key KA and the n / 2-bit key KB _n generated from the second intermediate key KB is set as the round key. . As described above, it is known that by combining data having different original data, it is possible to increase the difficulty of key analysis and to realize highly secure cryptographic processing.

  FIG. 6 shows an input configuration of key data when the data encryption unit having the Feistel structure of FIG. 2 described above uses a round key, an initial key, and a final key generated by the above method. The exclusive OR operation units 121 to 123 illustrated in FIG. 6 are exclusive OR operation units added for the above-described key generation processing.

  FIG. 7 shows an input configuration of key data when the data encryption unit having the Feistel structure shown in FIG. 3 is configured to use the round key, the initial key, and the final key generated by the above method. The exclusive OR operation units 131 to 133 illustrated in FIG. 7 are exclusive OR operation units added for the above-described key generation processing.

  Key data input configuration when the round key, the initial key, and the final key generated by the above method are used in the data encryption unit having the 4-series Type-2 generalized Feistel structure of FIG. 4 described above Is shown in FIG. The exclusive OR operation units 141 to 146 shown in FIG. 8 are exclusive OR operation units added for the above-described key generation processing.

  Key data input configuration when the round key, the initial key, and the final key generated by the above method are used in the data encryption unit having the 4-series Type-2 generalized Feistel structure shown in FIG. Is shown in FIG. Exclusive OR operation units 151 to 156 shown in FIG. 9 are exclusive OR operation units added for the above-described key generation processing.

  When the data encryption unit shown in FIG. 6 to FIG. 9 is configured by specific hardware, each round function is the same arithmetic circuit, so one round function circuit is set and the one round function circuit is set. Generally, the configuration is used repeatedly. That is, one round function circuit and a circuit for sequentially changing data and key data input to the round function circuit are required.

FIG. 10 shows a configuration example of a cryptographic processing circuit as a hardware configuration example of the data encryption unit having the two series Feistel structure shown in FIG. The cryptographic processing circuit shown in FIG. 10 includes, from one round function circuit 201 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, an n / 2-bit key {based on the first intermediate key KA { First key generation unit (KA _i generation circuit) 202 that generates KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }, and a second intermediate generated based on, for example, a different nonlinear transformation based on the secret key K A second key generation unit (KB _i generation circuit) 203 that generates an n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 } based on the second intermediate key KB from the key KB. And selectors 1 to 3, 211 to 213, an n-bit data register 214, and exclusive OR operation units 215 and 216.

First, at the start of encryption, the second key generation unit (KB _i generation circuit) 203 generates KB ₀ , the selectors 1 and 211 select plain text input, and the selectors 3 and 213 select KB ₀ . The n bits of the plaintext input selected by the selectors 1 and 211 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive of KB ₀ selected by the selectors 3 and 213. After being subjected to exclusive OR in the OR operation unit 216, it is stored in the data register 214.

In the first round, the first key generation unit (KA _i generation circuit) 202 generates KA ₁ , the selectors ₁ and 211 select the output of the round function circuit 201, and the selectors 2 and 212 select 0. The selectors 3 and 213 are set to select 0. As the round key, the round function circuit 201 receives KA ₁ and the exclusive OR of 0 selected by the selectors 2 212, that is, KA ₁ . In this first round, round function processing using KA ₁ is performed. This corresponds to the first round process of the configuration shown in FIG.

In the first round, the round key [KA ₁ ] is input to the round function circuit 201 and the result data obtained by executing the round function is output from the selectors 1 and 211. The n bits output from the selectors 1 and 211 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 3 and 213 in the exclusive OR operation unit 216. Although logical OR is performed, since the outputs of the selectors 3 and 213 are 0, they are stored in the data register 214 as they are.

In the second round, KA ₂ is generated in the first key generation unit (KA _i generation circuit) 202, the selectors 1 and 211 select the output of the round function circuit 201, and the selectors 2 and 212 select 0. The selectors 3 and 213 are set to select 0.

The round function circuit 201 exclusive of 0 selected by KA ₂ and the selector 2,212 as round keys, i.e. KA ₂ is input. In the second round, the round key [KA ₂ ] is input to the round function circuit 201 and the result data obtained by executing the round function is output from the selectors 1 and 211. The n bits output from the selectors 1 and 211 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 3 and 213 in the exclusive OR operation unit 216. Although logical OR is performed, since the outputs of the selectors 3 and 213 are 0, they are stored in the data register 214 as they are.

In the third round, KA ₃ is generated in the first key generation unit (KA _i generation circuit) 202, and KB ₃ is generated in the second key generation unit (KB _i generation circuit) 203. 211 is set to select the output of the round function circuit, selectors 2 and 212 are set to select KB ₃ , and selectors ₃ and 213 are set to select 0.

With this setting, the round function circuit 201 uses KA ₃ as the round key and the exclusive OR result [KA ₃ (EXOR) KB ₃ ] in the exclusive OR operation unit 215 of KB ₃ selected by the selectors 2 and 212. Is entered as a round key.

Thus, in the third round, the round key [KA ₃ (EXOR) KB ₃ ] is input to the round function circuit 201 and the result data obtained by executing the round function is output from the selectors 1 and 211. The n bits output from the selectors 1 and 211 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 3 and 213 in the exclusive OR operation unit 216. Although logical OR is performed, since the outputs of the selectors 3 and 213 are 0, they are stored in the data register 214 as they are.
The above process is repeated according to the number of rounds.

In the r-th round, the first key generation unit (KA _i generation circuit) 202 generates KA _r and the second key generation unit (KB _i generation circuit) 203 generates KB _{r + 1. The} selectors ₁ and 211 are round function circuits. 201 output is selected, selectors 2 212 select 0, and selectors 3 213 select KB _{r + 1} .

Exclusive of 0 to round function circuit 201 selected by KA _r selector 2,212 as round keys, i.e. KA _r is input. In the r-th round, the round key [KA _r ] is input to the round function circuit 201 and the result data obtained by executing the round function is output from the selectors 1 and 211. The n bits output from the selectors 1 and 211 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 3 and 213 in the exclusive OR operation unit 216. ORed. The output of the selectors 3 and 213 is KB _{r + 1} , and the exclusive OR result of the lower n / 2 bits of the output of the round function circuit 201 and KB _{r + 1} is stored in the data register 214. This process corresponds to a configuration for performing an exclusive OR process between the output of the r-th round and KB _{r + 1} shown in FIG.

Through these processes, the ciphertext C = C ₀ | C ₁ is stored in the data register 214.

  FIG. 11 shows an example of a cryptographic processing circuit configuration as a hardware configuration example of the data encryption unit having the two series Feistel structure shown in FIG. The cryptographic processing circuit shown in FIG. 11 also has a configuration substantially similar to the configuration shown in FIG.

From one round function circuit 201 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, an n / 2-bit key {KA ₁ , KA ₂ ,..., KA based on the first intermediate key KA _From the first key generation unit (KA _i generation circuit) 202 that generates _r−1 , KA _r }, and the second intermediate key KB generated by, for example, different non-linear transformation based on the secret key K, the second intermediate key KB A second key generation unit (KB _i generation circuit) 203 for generating a base n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }; 212, the n-bit data register 214, the exclusive OR operation unit 215, and the configuration thereof are the same as those shown in FIG.

The exclusive OR operation unit 221 and the selectors 3 and 222 in the output units of the selectors 1 and 211 are different from the settings shown in FIG. 10, and the exclusive OR operation unit 221 outputs the outputs of the selectors 1 and 211. And the output of the selectors 3 and 222 that selectively input KB _i generated by the second key generation unit (KB _i generation circuit) 203. Yes. The process flow is the same as the process described with reference to FIG.

  FIG. 12 shows an example of a cryptographic processing circuit configuration as a hardware configuration example of the data encryption unit having the 4-series Type-2 generalized Feistel structure of FIG. 8 described above. The cryptographic processing circuit shown in FIG. 12 has almost the same configuration as that shown in FIG.

That is, from one round function circuit 201 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, an n / 2-bit key {KA ₁ , KA ₂ ,. the first key generation unit for generating a _{KA r-1, KA r}} and (KA _i generation circuit) 202, a second intermediate key KB that is generated by, for example, different nonlinear transformation based on the secret key K, the second intermediate A second key generation unit (KB _i generation circuit) 203 for generating a key KB-based n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }, and selectors 1-2 211, 212, n-bit data register 214, exclusive OR operation unit 215, and the configuration thereof are the same as those shown in FIG.

The output units of the selectors 1 and 211 are configured to be divided into n / 4-bit series. That is, the n bits output from the selectors 1 and 211 are divided into four data of n / 4 bits from the top. This corresponds to P ₀ , P ₁ , P ₂ , and P ₃ which are n / 4-bit data input sequences shown in FIG.

Furthermore, exclusive OR operation units 252 and 253 for performing exclusive OR on P ₁ and P ₃ in the input series P ₀ , P ₁ , P ₂ and P _{3 of} these n / 4-bit data. Is set, and an exclusive OR operation is performed with the outputs of selectors 3 and 251 that selectively input KB _i generated by the second key generation unit (KB _i generation circuit) 203. The process flow is substantially the same as the process described with reference to FIG.

  FIG. 13 shows a configuration example of a cryptographic processing circuit as a hardware configuration example of the data encryption unit having the 4-series Type-2 generalized Feistel structure of FIG. 9 described above. The cryptographic processing circuit shown in FIG. 13 has almost the same configuration as that shown in FIG.

That is, from one round function circuit 201 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, an n / 2-bit key {KA ₁ , KA ₂ ,. the first key generation unit for generating a _{KA r-1, KA r}} and (KA _i generation circuit) 202, a second intermediate key KB that is generated by, for example, different nonlinear transformation based on the secret key K, the second intermediate A second key generation unit (KB _i generation circuit) 203 for generating a key KB-based n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }, and selectors 1-2 211, 212, n-bit data register 214, exclusive OR operation unit 215, and the configuration thereof are the same as those shown in FIG.

The output units of the selectors 1 and 211 are divided into four pieces of n / 4-bit data from the top as in the configuration shown in FIG. This corresponds to P ₀ , P ₁ , P ₂ , and P ₃ which are n / 4-bit data input sequences shown in FIG.

Furthermore, exclusive OR operation units 272 and 273 for performing exclusive OR on P ₀ and P ₂ in the input series P ₀ , P ₁ , P ₂ and P _{3 of} these n / 4-bit data. Is set, and an exclusive OR operation with the output of the selectors 3 and 271 that selectively input the KB _i generated by the second key generation unit (KB _i generation circuit) 203 is performed. The process flow is substantially the same as the process described with reference to FIG.

As described with reference to FIGS. 10 to 13, a circuit that generates a round key for each round using a plurality of intermediate keys KA and KB and performs encryption processing includes many selectors (three). In addition, an exclusive OR operation circuit of the first intermediate key KA-based key KA _i and the second intermediate key KB-based key KB _i is required, which increases the circuit scale and the manufacturing cost. There's a problem.
K. Nyberg, "Generalized Feistel networks", ASIACRYPT'96, SpringerVerlag, 1996, pp.91--104. Yuliang Zheng, Tsutomu Matsumoto, Hideki Imai: On the Construction of Block Ciphers Provably Secure and Not Relying on Any Unproved Hypotheses.CRYPTO 1989: 461-480

  The present invention has been made in view of the above problems, and in a configuration in which a common key block cipher process is performed using a plurality of intermediate keys KA and KB, the circuit scale is reduced and the size and cost are reduced. It is an object of the present invention to provide a cryptographic processing device, a cryptographic processing method, and a computer program.

The first aspect of the present invention is:
A cryptographic processing device that executes a common key block cryptographic process;
Data encryption in which a first intermediate key KA and a second intermediate key KB having different data configurations generated based on a secret key K are applied, and a plurality of round functions are repeatedly executed to perform data conversion processing of input data Part
The data encryption unit
A round function execution unit that executes a round function of the number of rounds r, and uses only a round key KA _i (where i is an integer from 1 to r) generated based on the first intermediate key KA, A round function execution unit to be executed;
Exclusive logic with key KB _i (where i is an integer from 0 to r + 1) generated based on the second intermediate key KB for the input data or the constituent data of the output data from the round function execution unit An exclusive OR operation unit for performing a sum operation;
The cryptographic processing device is characterized by having a configuration including:

Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the data encryption unit includes a first key generation unit that executes a generation process of a round key KA _i based on the first intermediate key KA, and the first key generation unit A round function execution unit that executes a round function using only the round key KA _i generated by the key generation unit as an input key; and a first selector that selectively outputs either the input data or the output data from the round function execution unit , A second key generation unit for generating a key KB _i based on the second intermediate key KB, a key KB _i generated by the second key generation unit, and a selection output of a plurality of data including a value 0. A second selector to be executed; and a configuration data of output data of the first selector and an exclusive OR operation unit that executes an exclusive OR operation of the output data of the second selector. And features.

Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the data encryption unit has a replacement processing unit that inputs a key KB _i generated by the second key generation unit and executes a bit position replacement process. The second selector is configured to selectively output any one of the key KB _i generated by the second key generation unit, the value 0, and the generation data of the replacement processing unit.

Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the first key generation unit is configured to input r round keys KA to be input to each of round functions 1 to r based on the first intermediate key KA. _{1 to} KA _r are generated, and the round function execution unit sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of round functions _{1 to r.} The second key generation unit executes the round function based on the second intermediate key KB and the initial key KB ₀ applied before the start of the round function and the start of the final round function of the r round. and final key _{KB r + 1} to be applied in the key _KB 3 corresponding to consecutive two rounds every _round, KB 4, generates _{··· KB r-3, KB r} -2, the exclusive-OR operation unit, The input device Data or the configuration data of the output data from the round-function executing part, the second intermediate key key _KB that is generated based on _{KB 0, KB 3, KB 4} , ··· KB r-3, KB, r- ₂ , and an exclusive OR operation with a key KB _i selected from KB _{r + 1} is characterized.

Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the exclusive OR operation unit is configured to generate keys KB ₃ , KB ₄ ,... KB _r-3 , which are generated based on the second intermediate key KB. It is characterized in that an exclusive OR operation using the same key selected from KB _r-2 repeatedly using the output data from the round function execution units of different rounds is executed.

Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the exclusive OR operation unit performs four consecutive OR operations using the same key selected from the key KB _i twice. For the setting equivalent to the case where the input round key for the round function is set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
The configuration is such that an exclusive OR operation process using the same key selected from the key KB _{i is} repeated twice so as to be equivalent to the round key input process of (a) to (d) above. It is characterized by that.

Furthermore, in one embodiment of the cryptographic processing apparatus of the present invention, the exclusive OR operation unit is a part of divided data obtained by dividing the input data or the output data from the round function execution unit into a plurality of pieces. On the other hand, the configuration is such that an exclusive OR operation with a key KB _i generated based on the second intermediate key KB or a split key of the key KB _i is executed.

Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the round function execution unit is configured to input divided data in units of n / k bits (where k ≧ 2) when the input data is n bits. , An exclusive OR operation of the input data to the round function execution unit and the round key KA _i is executed, and further, nonlinear transformation and linear transformation are executed to generate output data.

  Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the data encryption unit is configured to execute an encryption process according to a Feistel structure.

Furthermore, in an embodiment of the cryptographic processing apparatus of the present invention, the first intermediate key KA is key data generated by a nonlinear conversion process for the secret key K, and the second intermediate key KB is
(A) data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K;
(B) data obtained by applying linear transformation to the secret key K;
(C) Secret key K itself It is the data comprised by either of said (a)-(c), It is characterized by the above-mentioned.

Furthermore, the second aspect of the present invention provides
An encryption processing method for executing a common key block encryption process in an encryption processing apparatus,
A data encryption unit applies a first intermediate key KA and a second intermediate key KB having different data configurations generated based on a secret key K, and repeatedly executes a plurality of round functions to perform data conversion processing of input data A data encryption step for performing
The data encryption step includes
A round function execution step in which a round function execution unit executes a round function of round number r using only a round key KA _i (where i is an integer from 1 to r) generated based on the first intermediate key KA When,
An exclusive OR operation unit generates a key KB _i generated based on the second intermediate key KB for the input data or the configuration data of the output data from the round function execution unit (where i is 0 to r + 1). An exclusive OR operation step of performing an exclusive OR operation with the integer),
There is an encryption processing method characterized by comprising:

Furthermore, in an embodiment of the encryption processing method of the present invention, the data encryption step includes a first key for generating a round key KA _i based on the first intermediate key KA by the first key generation unit. A generating step, a round function executing unit for executing a round function using only the round key KA _i generated by the first key generating unit as an input key, and a first selector for the input data or the round A first data selection step of selecting and outputting any of the output data from the function execution unit; and a second key generation in which the second key generation unit executes a key KB _i generation process based on the second intermediate key KB And a second data selection step in which the second selector executes selection output of a plurality of data including the key KB _i generated by the second key generation unit and the value 0, and an exclusive OR operation The arithmetic unit includes an exclusive OR operation step for performing an exclusive OR operation on the configuration data of the output data of the first selector and the output data of the second selector.

Furthermore, in an embodiment of the encryption processing method of the present invention, in the data encryption step, the replacement processing unit further inputs a key KB _i generated by the second key generation unit, and executes a bit position replacement process. The second data selection step is a step of selecting and outputting one of the key KB _i generated by the second key generation unit, the value 0, and the generated data of the replacement processing unit. It is characterized by being.

Furthermore, in one embodiment of the cryptographic processing method of the present invention, the first key generation step includes r round keys KA input to each of round functions 1 to r based on the first intermediate key KA. _{1 to} KA _r are generated, and the round function execution step sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of the round functions of rounds _{1 to r.} The round key is then executed, and the second key generation step is based on the second intermediate key KB, the initial key KB ₀ applied before the start of the round function, and the start of the final round function of r round generates a final key _{KB r + 1} to be applied, the key _{KB 3,} KB 4 corresponding to consecutive two rounds every round, the _{··· KB r-3, KB r} -2 in the exclusive Kazu演Step, the input data or the round and configuration data of the output data from the function execution unit, a key _KB 0 generated based on the second intermediate key _{KB, KB 3, KB 4,} , ··· KB r- ₃ , a step of performing an exclusive OR operation with a key KB _i selected from KB _r−2 and KB _{r + 1} .

Furthermore, in one embodiment of the cryptographic processing method of the present invention, the exclusive OR operation step includes keys KB ₃ , KB ₄ ,... KB _r-3 , generated based on the second intermediate key KB. It is a step of executing an exclusive OR operation using the same key selected from KB _r-2 repeatedly using the output data from the round function execution units of different rounds twice.

Furthermore, in an embodiment of the cryptographic processing method of the present invention, the exclusive OR operation step includes four consecutive OR operations in which the same key selected from the key KB _i is used twice. For the setting equivalent to the case where the input round key for the round function is set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
A step of executing an exclusive OR operation process using the same key selected from the key KB _i twice so as to be equivalent to the round key input process of (a) to (d) above. It is characterized by that.

Furthermore, in an embodiment of the cryptographic processing method of the present invention, the exclusive OR operation step includes a part of divided data obtained by dividing the input data or the output data from the round function execution unit into a plurality of pieces. On the other hand, it is a step of performing an exclusive OR operation with a key KB _i generated based on the second intermediate key KB or a split key of the key KB _i .

Furthermore, in one embodiment of the cryptographic processing method of the present invention, the round function execution step inputs the divided data in units of n / k bits (where k ≧ 2) when the input data is n bits, and the round function This is a step of performing an exclusive OR operation between the input data to the execution unit and the round key KA _i, and further performing nonlinear transformation and linear transformation to generate output data.

Furthermore, in one embodiment of the cryptographic processing method of the present invention, the first intermediate key KA is key data generated by nonlinear conversion processing on the secret key K, and the second intermediate key KB is
(A) data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K;
(B) data obtained by applying linear transformation to the secret key K;
(C) Secret key K itself It is the data comprised by either of said (a)-(c), It is characterized by the above-mentioned.

Furthermore, the third aspect of the present invention provides
In a cryptographic processing device, a computer program for executing a common key block cryptographic process,
Applying the first intermediate key KA and the second intermediate key KB having different data configurations generated based on the secret key K to the data encryption unit and repeatedly executing a plurality of round functions to convert the input data Having a data encryption step to perform
The data encryption step includes
A round function execution step for causing a round function execution unit to execute a round function using only a round key KA _i (where i is an integer from 1 to r) generated based on the first intermediate key KA;
A key KB _i generated based on the second intermediate key KB with respect to the input data or the configuration data of the output data from the round function execution unit in the exclusive OR operation unit (where i is 0 to r + 1) An exclusive OR operation step for performing an exclusive OR operation with the integer),
A computer program characterized by including:

  The computer program of the present invention is, for example, a computer program that can be provided by a storage medium or a communication medium provided in a computer-readable format to a general-purpose computer system that can execute various program codes. . By providing such a program in a computer-readable format, processing corresponding to the program is realized on the computer system.

  Other objects, features, and advantages of the present invention will become apparent from a more detailed description based on embodiments of the present invention described later and the accompanying drawings. In this specification, the system is a logical set configuration of a plurality of devices, and is not limited to one in which the devices of each configuration are in the same casing.

According to the configuration of one embodiment of the present invention, a plurality of round functions are repeatedly executed by applying a first intermediate key KA and a second intermediate key KB having a plurality of different data configurations generated based on a secret key K. In the common key block cipher processing configuration for performing data conversion processing of input data, only the round key KA _i generated based on the first intermediate key KA is input to the round function execution unit to execute the round function, The key KB _i generated based on the intermediate key KB performs an exclusive OR operation with the input data to be encrypted or the output data from the round function without being input to the F function in the round function section. It was set as the structure made to do. With this configuration, it is possible to simplify the cryptographic processing circuit and reduce the size and cost of the apparatus.

  Details of the cryptographic processing apparatus, cryptographic processing method, and computer program of the present invention will be described below. The cryptographic processing apparatus of the present invention is a cryptographic processing apparatus that executes a common key block cryptographic process, and has the same processing configuration as that described above with reference to FIG. However, the configuration of the data encryption unit that executes the round function or the like is a simplified configuration as compared with the circuit configurations described above with reference to FIGS.

  As described above with reference to FIG. 1, the common key block cipher algorithm mainly includes a data encryption unit 114 having a round function execution unit that repeatedly executes conversion of input data, and rounds of each round function unit. And a key schedule unit 112 for generating a round key to be applied. The key schedule unit 112 expands the secret key (K) 111 of several hundred bits to the extended key 113 of about several thousand bits and supplies it to the data encryption unit 114.

In the data encryption unit 114, round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are input to the round functions from 1 to r stages, respectively. In addition, IK is exclusively ORed as an initial key and FK as a final key.

  The round key, the initial key IK, and the final key FK, which are keys applied in the data encryption unit in the cryptographic processing apparatus according to the embodiment of the present invention, are also generated by the same process as described above.

That is, nonlinear conversion is performed on the k-bit secret key K to create a k-bit first intermediate key KA. Next, n / 2 bits are extracted from the first intermediate key KA to form {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }. Next, another k-bit data is created from the secret key K, and this is used as the second intermediate key KB. Regarding the second intermediate key KB,
1) Data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K,
2) Data obtained by applying linear transformation to the secret key K,
3) Any of the settings such as the secret key K itself.
N / 2 bits are extracted from the second intermediate key KB every two rounds to form {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }.

The round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are the following data generated from the secret key K by the above-described processing:
First intermediate key KA-based n / 2-bit key {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }
Second intermediate key KB-based n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }
Based on these data, the round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } are set as follows, for example.
RK ₁ = KA ₁
RK ₂ = KA ₂
RK ₃ = KA ₃ (EXOR) KB ₃
RK ₄ = KA ₄ (EXOR) KB ₄
RK ₅ = KA ₅
...
RK _r-4 = KA _r-4
RK _r-3 = KA _r-3 (EXOR) KB _r-3
RK _r-2 = KA _r-2 (EXOR) KB _r-2
RK _r-1 = KA _r-1
RK _r = KA _r
And In the above equation, [A (EXOR) B] is an exclusive OR operation of A and B. Also for the initial key IK and the final key FK, n / 2 bits are extracted from the second intermediate key KB to form KB ₀ and KB _{r + 1} ,
IK = KB ₀
FK = KB _{r + 1}
And

  As described above, with such a key generation configuration, it is possible to realize a highly secure cryptographic process that increases the difficulty of key analysis.

  A cryptographic processing device according to an embodiment of the present invention mixes a plurality of keys (in the above example, a first intermediate key and a second intermediate key) as described above to obtain a round key, an initial key, and a final key. This simplifies the circuit configuration of the data encryption unit that generates and performs data encryption processing.

In one embodiment of the present invention, in order to realize a simplified circuit configuration, the input configuration of the second intermediate key-based key KB _i that is input in the round selected when generating the round key RK _i is described first. The configuration is different from the conventional configuration (FIGS. 10 to 13). Specifically, using equivalent deformation, an exclusive OR operation of the second intermediate key-based key KB _i is performed on data different from the conventional configuration described above (FIGS. 10 to 13), and the result As a result, it is possible to execute the same cryptographic processing algorithm as in the prior art.

Embodiments of the simplified circuit configuration of the data encryption unit in the cryptographic processing apparatus according to the present invention will be described below. The explanation,
(1) Example 1: First application example in 2 series Feistel structure (2) Example 2: Second application example in 2 series Feistel structure (3) Example 3: First application example in 4 series Feistel structure (4) Example 4) Second application example in a 4-series Feistel structure

(1) Example 1: First Application Example in Two-Series Feistel Structure First, as Example 1, a first application example in a two-sequence Feistel structure will be described. In other words, the n-bit input plaintext P described above with reference to FIG. 6 is simplified to correspond to a 2-line Feistel-structure data encryption unit that performs processing by dividing the upper-order n / 2 bits into two series. Circuit configuration. The conventional circuit configuration of the two series type shown in FIG. 6 is the circuit configuration shown in FIG.

  The circuit configuration of the data encryption unit that executes the round function according to the present embodiment is the circuit configuration illustrated in FIG. 17. Before the description of the circuit configuration illustrated in FIG. 17, refer to FIGS. 14 to 16. A theoretical explanation for realizing simplification of the circuit will be given.

The round keys {RK ₁ , RK ₂ ,..., RK _r−1 , RK _r } input to the round function of the data encryption unit having the two series of Feistel structures shown in FIG. In addition,
First intermediate key KA-based n / 2-bit key {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }
Second intermediate key KB-based n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 }
Based on these data,
1st round: RK ₁ = KA ₁
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃ (EXOR) KB ₃
4th round: RK ₄ = KA ₄ (EXOR) KB ₄
5th round: RK ₅ = KA ₅
...
This is the setting.

For example, the round key input in the third round, that is,
RK ₃ = KA ₃ (EXOR) KB ₃
For this key generation, an exclusive OR operation unit 215 shown in FIG. 10 is used.

  The circuit according to the present invention (see FIG. 17) implements a configuration in which the exclusive OR operation unit 215 for key generation shown in FIG. 10 is omitted. This theory will be described with reference to FIGS.

FIG. 14 is a diagram illustrating the second to fifth round processes to which the circuit described above with reference to FIG. 10 is applied. The following round keys are input to the F functions 302 to 305 of the second to fifth round functions.
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃ (EXOR) KB ₃
4th round: RK ₄ = KA ₄ (EXOR) KB ₄
5th round: RK ₅ = KA ₅
In the circuit configuration shown in FIG. 10, in order to input these round keys to the round function circuit in each round, each round key is generated using the selectors 2, 212 and the exclusive OR operation unit 215. .

For example, the exclusive OR operation units 307 and 308 shown in the third and fourth rounds in the configuration shown in FIG. 14 correspond to the exclusive OR operation unit 215 shown in FIG. In rounds where the second intermediate key base key KB _i is not used as in the second and fifth rounds, the outputs of the selectors 2 and 212 in FIG. 10 are set to 0, and the exclusive OR operation unit shown in FIG. 215 outputs the first intermediate key-based key KA _i without being changed.

FIG. 15 is a diagram for explaining the second to fifth round processes to which the circuit shown in FIG. 17 according to the present invention is applied. The following round keys are input to the F functions 312 to 315 of the second to fifth round functions.
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃
4th round: RK ₄ = KA ₄
5th round: RK ₅ = KA ₅

Further, in the configuration shown in FIG. 15, n / 2 bits (data P shown in the figure) on the side not input to the F function of the second round among the n bits input in the second round, and the second intermediate key KB base Exclusive-OR operation with the n / 2-bit key KB ₃ in the exclusive-OR operation unit 321, and then the output (data Q) of the second round F function 312 and the exclusive-OR operation unit At 322, an exclusive OR operation is performed, and the resulting n / 2-bit data is used as an input of the third round F function 313, and this input and the round key KA ₃ input to the third round F function; The exclusive OR operation unit 323 in the F function 313 performs this exclusive OR operation, and the result data (data T ′) is input to the nonlinear conversion unit (S box) in the F function 313.

  The input data (T ′) for the nonlinear transformation unit (S box) in the third round F function 313 in the configuration of FIG. 15 and the nonlinear transformation unit (S box) in the third round F function 303 in FIG. Compare the input data (T) for.

The input data [T] to the nonlinear calculation in the F function in the third round shown in FIG. 14 can be expressed as the following calculation result using the data P, Q, KA ₃ , KB ₃ shown in FIG.
T = P (EXOR) Q (EXOR) KA ₃ (EXOR) KB ₃

Further, the input data (T ′) to the non-linear transformation unit (S box) in the F function 313 in the third round in the configuration of FIG. 15 is the following calculation using the data P, Q, KA ₃ , KB ₃ shown in FIG. Can be expressed as a result. Data P, Q, KA ₃ and KB ₃ are the same as the data shown in FIG.
T ′ = P (EXOR) KB ₃ (EXOR) Q (EXOR) KA ₃
The formula for calculating T ′ is equivalent to the formula for calculating T. That is,
T '= T
Thus, the input to the non-linear transformation unit of the third round F function in the configuration of FIG. 15 is the same as the input to the non-linear transformation unit of the third round F function in the configuration of FIG.

Thus, the round key input to the F function in the third round is
In the configuration of FIG. 14, RK ₃ = KA ₃ (EXOR) KB ₃
But
As shown in FIG. 15, the round key input to the F function in the third round is
RK ₃ = KA ₃
As a result, if the exclusive OR operation of KB ₃ is executed at the generation stage of the input data for the F function of the third round and the data is input to the F function of the third round, the same cryptographic processing is obtained as a result. Will be done.

The same applies to the fourth round. In the configuration of FIG. 14, the round key input to the F function 304 in the fourth round is processed by the exclusive OR operation unit 308.
RK ₄ = KA ₄ (EXOR) KB ₄
Is entered as
As shown in FIG. 15, the round key input to the F function 314 in the third round is
RK ₄ = KA ₄
In the generation stage of input data for the F function 314 in the fourth round, the exclusive OR operation of KB ₄ is executed in the exclusive OR operation unit 324, and the data is input to the F function in the fourth round. As a result, the same encryption processing is performed as data.

Next, the fifth round processing in the configurations of FIGS. 14 and 15 will be compared.
FIG. 14 illustrates the processing of the second to fifth rounds to which the circuit described above with reference to FIG. 10 is applied. The F functions 302 to 305 of the round functions of the second to fifth rounds are described. The following round key is input.
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃ (EXOR) KB ₃
4th round: RK ₄ = KA ₄ (EXOR) KB ₄
5th round: RK ₅ = KA ₅
That is, the second intermediate key KB-based key data KB _i is not used in the fifth round.

The non-linear conversion section of the F-function 305 in the fifth round of FIG. 14 the input data [U] to (S boxes), the data P shown in FIG. 14, Q, R, can be expressed as the calculation result of the following by KA ₅ it can.
U = P (EXOR) Q (EXOR) R (EXOR) KA ₅

Furthermore, the nonlinear conversion unit in the F-function 315 in the fifth round in the configuration of FIG. 15 the input data for the (S Box) (U '), the following by data _{P, Q, R, KB 3} , KA 5 shown in FIG. 15 It can be expressed as the operation result of Data P, Q, R, KB ₃ and KA ₅ are the same as the data shown in FIG.
U ′ = P (EXOR) KB ₃ (EXOR) Q (EXOR) KB ₃ (EXOR) R (EXOR) KA ₅
In the calculation formula of U ′, the exclusive OR operation is executed twice for the key KB ₃ that is the same data. The process of performing the exclusive OR operation by repeating the same data twice is the same as not performing the exclusive OR operation.

Therefore, the above formula is obtained by omitting two exclusive OR operations for the key KB ₃ from the above formula, that is,
U ′ = P (EXOR) Q (EXOR) R (EXOR) KA ₅
Gives the same result.
The above formula is a formula for calculating the input data [U] to the nonlinear calculation of the F function 305 in the fifth round shown in FIG. 14 described with reference to FIG.
U = P (EXOR) Q (EXOR) R (EXOR) KA ₅
This is the same as the above calculation formula. That is,
U '= U
Thus, the input to the non-linear conversion unit of the fifth round F function in the configuration of FIG. 15 is the same as the input to the non-linear conversion unit of the F function of the fifth round in the configuration of FIG.

In this way, even in a round in which the second intermediate key KB-based key data KB _i in the conventional configuration shown in FIG. 14 is not used, the round key input to the round is a key based on the first intermediate key KA. The result is obtained by setting KA _i as it is, and setting the same key KB _i of the second intermediate key base KB to be repeated an even number of times on the non-input data side with respect to the F function to perform the exclusive OR operation. As a result, the same cryptographic processing is performed.

Such a setting can be realized in all rounds. As shown in FIG. 15, a configuration in which the exclusive OR operation of the second intermediate key KB-based key KB _i is performed on the input data for the round function, the round key applied in each round is the first intermediate key. Only the KA-based key KA _i can be used. Specifically, an encryption processing configuration as shown in FIG. 16 is realized. The cryptographic processing configuration shown in FIG. 16 has a configuration equivalent to the cryptographic processing configuration shown in FIG. 6 described above. That is, the ciphertext C obtained by inputting the plaintext P by applying the cryptographic processing configuration shown in FIG. 6 and the ciphertext C obtained by inputting the same plaintext P by applying the cryptographic processing configuration shown in FIG. The same encryption processing is performed.

In this way, the round key for the round function is only the first intermediate key KA-based key KA _i, and the exclusive OR operation of the second intermediate key KB-based key KB _i is performed on the input data for the round function. Thus, encryption processing using the simplified circuit configuration shown in FIG. 17 is possible.

  That is, FIG. 17 shows the hardware configuration of the data encryption unit having the two series Feistel structure shown in FIG. In this configuration, the number of selectors is reduced and the exclusive OR is compared with the hardware configuration of the data encryption unit having the conventional 2-series Feistel structure shown in FIG. 6 described above with reference to FIG. It has a simplified circuit configuration with fewer arithmetic units.

The cryptographic processing circuit shown in FIG. 17 as a hardware configuration example of the data encryption unit having the two series Feistel structure shown in FIG. 16 is generated by, for example, non-linear transformation based on one round function circuit 351 and the secret key K Key generation unit (KA _i generation) that generates an n / 2-bit key {KA ₁ , KA ₂ ,..., KA _r−1 , KA _r } based on the first intermediate key KA. Circuit) 352 and a second intermediate key KB generated by, for example, different non-linear transformation based on the secret key K, an n / 2 bit key {KB ₃ , KB ₄ ,..., KB _r− based on the second intermediate key KB a _3, a second key generation unit for generating a _{KB r-2}} and (KB _i generation circuit) 353, and n-bit data register 354, a selector 1～2,355～356, an exclusive OR operation section 357

First, at the start of encryption, the second key generation unit (KB _i generation circuit) 353 generates KB ₀ , the selectors 1 and 355 select plain text input, and the selectors 2 and 356 select KB ₀ . The n bits of the plaintext input selected by the selectors 1 and 355 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive of KB ₀ selected by the selectors 2 and 356. After being subjected to exclusive OR in the OR operation unit 357, it is stored in the data register 354. The exclusive OR operation in the exclusive OR operation unit 357 is an exclusive OR operation between the lower n / 2 bits (P ₁ ) of the input data before the first round and the KB _{0 in the} configuration shown in FIG. It corresponds to processing.

In the first round, KA ₁ is generated in the first key generation unit (KA _i generation circuit) 352, KB ₃ is generated in the second key generation unit (KB _i generation circuit) 353, and the selectors 1 and 355 The output of the round function circuit 351 is selected, and the selectors 2 and 356 are set to select KB ₃ . The round function circuit 351 receives KA ₁ from the first key generation unit (KA _i generation circuit) 352 as a round key. In this first round, round function processing using KA ₁ is performed. This corresponds to the first round processing of the configuration shown in FIG.

In the first round, the round key [KA ₁ ] is input to the round function circuit 351 and the result data obtained by executing the round function is output from the selectors 1 and 355. The n bits output from the selectors 1 and 355 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 2 and 356 in the exclusive OR operation unit 357. ORed. Exclusive OR of the output of the selector 2,356 is KB ₃ generated in the second key generation unit (KB _i generation circuit) 353, a lower n / 2 output from the selector 1,355, and KB ₃ The operation result is the lower n / 2 bits of the n-bit data stored in the data register 354. The upper n / 2 bits of the n-bit data stored in the data register 354 are upper n / 2 bits output from the round function circuit 351 via the selectors 1 and 355.

In the second round, the first key generation unit (KA _i generation circuit) 352 generates KA ₂ , the second key generation unit (KB _i generation circuit) 353 generates KB ₄ , and the selectors 1 and 355 The output of the round function circuit 351 is selected, and the selectors 2 and 356 are set to select the KB ₄ generated by the second key generation unit (KB _i generation circuit) 353.

The round function circuit 351 receives KA ₂ generated by the first key generation unit (KA _i generation circuit) 352 as a round key. In the second round, the round key [KA ₂ ] is input to the round function circuit 351 and the result data obtained by executing the round function is output from the selectors 1 and 355. The n bits output from the selectors 1 and 355 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 2 and 356 in the exclusive OR operation unit 357. ORed. Since the outputs of the selectors 2 and 356 are KB ₄ generated by the second key generation unit (KB _i generation circuit) 353, the exclusive logic between the low-order n / 2 output from the selectors 1 and 355 and the KB ₄ The result of the sum operation is the lower n / 2 bits of the n-bit data stored in the data register 354. The upper n / 2 bits of the n-bit data stored in the data register 354 are upper n / 2 bits output from the round function circuit 351 via the selectors 1 and 355.

These processes are repeated according to the number of rounds.
In the (r−1) -th round, the first key generation unit (KA _i generation circuit) 352 generates KA _r−1 , the selectors ₁ and 355 select the output of the round function circuit 351, and the selectors 2 and 2 356 is set to select 0.

KA _r-1 is input to the round function circuit 351 as a round key. In the (r−1) -th round, the round key [KA _r−1 ] is input to the round function circuit 351 and the result data obtained by executing the round function is output from the selectors 1 and 355. The n bits output from the selectors 1 and 355 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 2 and 356 in the exclusive OR operation unit 357. ORed. The outputs of the selectors 2 and 356 are 0, and n bits output from the selectors 1 and 355 are stored in the data register 354 as they are. This process corresponds to the (r-1) round process shown in FIG. As shown in FIG. 16, the low-order n / 2 bits input in the r-th round of the final round are configured not to perform exclusive OR with the key KB _i .

In the final r-th round, the first key generation unit (KA _i generation circuit) 352 generates KA _r , the second key generation unit (KB _i generation circuit) 353 generates KB _{r + 1} , and the selector 1, 355 selects the output of the round function circuit 351, and the selectors 2 and 356 are set to select KB _{r + 1} generated by the second key generation unit (KB _i generation circuit) 353.

KA _r is input to the round function circuit 351 as a round key generated by the first key generation unit (KA _i generation circuit) 352. In the r-th round, the round key [KA _r ] is input to the round function circuit 351 and the result data obtained by executing the round function is output from the selectors 1 and 355. The n bits output from the selectors 1 and 355 are divided into upper n / 2 bits and lower n / 2 bits, and the lower n / 2 bits are exclusive with the outputs of the selectors 2 and 356 in the exclusive OR operation unit 357. ORed. The output of the selectors 2 and 356 is KB _{r + 1} , and the exclusive OR result of the lower n / 2 bits of the output of the round function circuit 351 and KB _{r + 1} is stored in the data register 354. The upper n / 2 bits of the n-bit data stored in the data register 354 are upper n / 2 bits output from the round function circuit 351 via the selectors 1 and 355. This process corresponds to a configuration for performing an exclusive OR process between the output of the r-th round and KB _{r + 1} shown in FIG.

With the above processing, the data register 354 has
The ciphertext C = C ₀ | C ₁ is stored.
The circuit configuration shown in FIG. 17 configured as a circuit for executing the processing of the encryption configuration shown in FIG. 16 is simplified compared to the circuit configuration shown in FIG. 10 corresponding to the encryption configuration shown in FIG. In other words, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

The processing executed by each component of the cryptographic processing circuit shown in FIG. 17 is summarized as follows.
Based on the first intermediate key KA, the first key generation unit (KA _i generation circuit) 352 generates r round keys KA _{1 to} KA r that are input to the respective round functions of rounds _{1 to r} .
A round function circuit 351 as a round function execution unit sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of round functions 1 to r. Execute.
The second key generation unit (KB _i generation circuit) 353, based on the second intermediate key KB, the initial key KB ₀ applied before the start of the round function and the final key applied after the start of the final round function of the r round A key KB _{r + 1} and keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 corresponding to every two consecutive rounds are generated.
The exclusive OR operation unit 357 includes input data or configuration data of output data from the round function circuit 351 as a round function execution unit, and keys KB ₀ , KB ₃ , generated based on the second intermediate key KB. An exclusive OR operation with the key KB _i selected from KB ₄ ,..., KB _r−3 , KB _r−2 , KB _{r + 1} is executed.
Such a processing configuration is obtained.

The exclusive OR operation unit 357 applies different keys to the same key selected from the keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 generated based on the second intermediate key KB. The exclusive OR operation that is used twice is executed on the output data from the round function execution unit. Specifically, for the setting equivalent to the case where the input round keys for four consecutive round functions are set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
An exclusive OR operation process using the same key selected from the key KB _i twice is executed so as to be equivalent to the round key input process of (a) to (d) above. As in the even p + 4 rounds since the above p~p + 3 rounds, consecutive KA _i 2 _rounds, the exclusive OR operation processing so as to be set equivalent to enter the KA _i (EXOR) KB i on two consecutive rounds Run.

  Thus, the circuit configuration shown in FIG. 17 for executing the processing of the encryption configuration shown in FIG. 16 is simplified compared to the circuit configuration shown in FIG. 10 corresponding to the encryption configuration shown in FIG. The configuration, that is, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

(2) Example 2: Second Application Example in Two-Series Feistel Structure Next, as Example 2, a second application example in the two-series Feistel structure will be described. In other words, the n-bit input plaintext P described with reference to FIG. 7 is divided into two series of upper and lower n / 2 bits, and the simplified processing corresponding to the data encryption unit having the two series Feistel structure. Circuit configuration. Note that the conventional circuit configuration of the two-line type shown in FIG. 7 is that shown in FIG.

  The circuit configuration of the data encryption unit that executes the round function according to the present embodiment is the circuit configuration illustrated in FIG. 20, but before the description of the circuit configuration illustrated in FIG. 20, refer to FIGS. 18 to 19. A theoretical explanation for realizing simplification of the circuit will be given.

FIG. 18 is a diagram for explaining the second to fifth round processes to which the circuit shown in FIG. 20 according to the present invention is applied. The following round keys are input to the F functions 412 to 415 of the second to fifth round functions.
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃
4th round: RK ₄ = KA ₄
5th round: RK ₅ = KA ₅

Furthermore, in the configuration shown in FIG. 18, among n bits input in the third round, n / 2 bits input to the F function of the third round and an n / 2 bit key KB ₃ based on the second intermediate key KB The exclusive OR operation is executed in the exclusive OR operation unit 421, and the resultant n / 2-bit data is input to this input and the third round F function as the input of the third round F function 413. The exclusive OR operation with the round key KA ₃ is performed in the exclusive OR operation unit 422 in the F function 413, and the result data (data T ′) is input to the nonlinear conversion unit (S box) in the F function 413. It is said.

  The Feistel structure shown in FIG. 7 and the Feistel structure shown in FIG. 6 differ only in the input positions of the initial key and the final key, and the processing configuration of round operations of 1 to r rounds is the same. The input to the F function in each round in the configuration of 18 is compared with the input to the F function in the cryptographic processing configuration shown in FIG. 14 corresponding to the Feistel structure in FIGS. The encryption processing configuration shown in FIG. 14 corresponds to the encryption processing configuration by the circuit of FIG. 11 described above as the circuit configuration corresponding to FIG.

  The input data (T ′) for the nonlinear transformation unit (S box) in the third round F function 413 and the nonlinear transformation unit (S box) in the third round F function 303 in FIG. Compare the input data (T).

As described above, the input data [T] to the nonlinear calculation in the third round F function shown in FIG. 14 is the following calculation result based on the data P, Q, KA ₃ , KB ₃ shown in FIG. Can be represented.
T = P (EXOR) Q (EXOR) KA ₃ (EXOR) KB ₃

The third non-linear conversion section in the F function 413 rounds in the configuration of FIG. 18 the input data for the (S Box) (T '), the calculation by the data P, _Q, KA 3, KB ₃ shown in FIG. 18 below Can be expressed as a result. Data P, Q, KA ₃ and KB ₃ are the same as the data shown in FIG.
T ′ = P (EXOR) Q (EXOR) KB ₃ (EXOR) KA ₃
The formula for calculating T ′ is equivalent to the formula for calculating T. That is,
T '= T
Thus, the input to the non-linear transformation unit of the third round F function in the configuration of FIG. 18 is the same as the input to the non-linear transformation unit of the F function of the third round in the configuration of FIG.

Thus, the round key input to the F function in the third round is
In the configuration of FIG. 14, RK ₃ = KA ₃ (EXOR) KB ₃
But
As shown in FIG. 18, the round key input to the F function in the third round is
RK ₃ = KA ₃
As a result, if the exclusive OR operation of KB ₃ is executed at the generation stage of the input data for the F function of the third round and the data is input to the F function of the third round, the same cryptographic processing is obtained as a result. Will be done.

The same applies to the fourth round. In the configuration of FIG. 14, the round key input to the F function 304 in the fourth round is processed by the exclusive OR operation unit 308.
RK ₄ = KA ₄ (EXOR) KB ₄
Is entered as
As in the configuration of FIG. 18, the round key input to the F function 414 in the third round is
RK ₄ = KA ₄
In the generation stage of input data for the F function 414 in the fourth round, the exclusive OR operation of KB ₄ is executed in the exclusive OR operation unit 423, and the data is input to the F function in the fourth round. As a result, the same encryption processing is performed as data.

Next, the fifth round processing in the configurations of FIGS. 14 and 18 will be compared.
FIG. 14 illustrates the processing from the second round to the fifth round to which the circuit described above with reference to FIG. 11 is applied. The following round key is input.
2nd round: RK ₂ = KA ₂
3rd round: RK ₃ = KA ₃ (EXOR) KB ₃
4th round: RK ₄ = KA ₄ (EXOR) KB ₄
5th round: RK ₅ = KA ₅
That is, the second intermediate key KB-based key data KB _i is not used in the fifth round.

The non-linear conversion section of the F-function 305 in the fifth round of FIG. 14 the input data [U] to (S boxes), the data P shown in FIG. 14, Q, R, can be expressed as the calculation result of the following by KA ₅ it can.
U = P (EXOR) Q (EXOR) R (EXOR) KA ₅

Also, the input data (U ′) to the nonlinear transformation unit (S box) in the F function 415 of the fifth round in the configuration of FIG. 18 is the following by the data P, Q, R, KA ₅ , KB ₃ shown in FIG. It can be expressed as the operation result of The data P, Q, R, KA ₅ , KB ₃ are the same as the data shown in FIG.
U ′ = P (EXOR) Q (EXOR) KB ₃ (EXOR) R (EXOR) KB ₃ (EXOR) KA ₅
In the calculation formula of U ′, the exclusive OR operation is executed twice for the key KB ₃ that is the same data. The process of performing the exclusive OR operation by repeating the same data twice is the same as not performing the exclusive OR operation.

Therefore, the above formula is obtained by omitting two exclusive OR operations for the key KB ₃ from the above formula, that is,
U ′ = P (EXOR) Q (EXOR) R (EXOR) KA ₅
Gives the same result.
The above formula is a formula for calculating the input data [U] to the nonlinear calculation of the F function 305 in the fifth round shown in FIG. 14 described with reference to FIG.
U = P (EXOR) Q (EXOR) R (EXOR) KA ₅
This is the same as the above calculation formula. That is,
U '= U
Thus, the input to the non-linear conversion unit of the fifth round F function in the configuration of FIG. 18 is the same as the input to the non-linear conversion unit of the F function of the fifth round in the configuration of FIG.

In this way, even in a round in which the second intermediate key KB-based key data KB _i in the conventional configuration shown in FIG. 14 is not used, the round key input to the round is a key based on the first intermediate key KA. By setting KA _i as it is and setting the same key KB _i of the second intermediate key base KB to be repeated an even number of times on the input data side for the F function, as a result, Are subject to the same cryptographic processing.

Such a setting can be realized in all rounds. As shown in FIG. 18, the round key to be applied in each round is set as the first intermediate key by performing an exclusive OR operation of the key KB _i based on the second intermediate key KB with respect to the input data for the round function. Only the KA-based key KA _i can be used. Specifically, an encryption processing configuration as shown in FIG. 19 is realized. The cryptographic processing configuration shown in FIG. 19 has a configuration equivalent to the cryptographic processing configuration shown in FIG. 7 described above. That is, the ciphertext C obtained by inputting the plaintext P by applying the cryptographic processing configuration shown in FIG. 7 and the ciphertext C obtained by inputting the same plaintext P by applying the cryptographic processing configuration shown in FIG. The same encryption processing is performed.

In this way, the round key for the round function is only the first intermediate key KA-based key KA _i and the exclusive OR operation of the second intermediate key KB-based key KB _i is performed on the input data for the round function. By doing so, encryption processing using the simplified circuit configuration shown in FIG. 20 becomes possible.

  That is, FIG. 20 shows the hardware configuration of the data encryption unit having the two series Feistel structure shown in FIG. In this configuration, the number of selectors is reduced compared to the hardware configuration of the data encryption unit having the conventional two-series Feistel structure shown in FIG. 7 described above with reference to FIG. It has a simplified circuit configuration with fewer arithmetic units.

The cryptographic processing circuit shown in FIG. 20 includes, from one round function circuit 451 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, a first intermediate key KA-based n / 2-bit key { KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }, and a second intermediate generated by, for example, different non-linear transformation based on the secret key K, and a first key generation unit (KA _i generation circuit) 452. Second key generation unit (KB _i generation circuit) 453 that generates an n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 } based on the second intermediate key KB. An n-bit data register 454, selectors 1 to 2, 455 to 456, and an exclusive OR operation unit 457.

First, at the start of encryption, the second key generation unit (KB _i generation circuit) 453 generates KB ₀ , the selectors 1 and 455 select plain text input, and the selectors 2 and 456 select KB ₀ . The n bits of the plaintext input selected by the selectors 1 and 455 are divided into upper n / 2 bits and lower n / 2 bits, and the upper n / 2 bits are exclusive of KB ₀ selected by the selectors 2 and 456. An exclusive OR is performed in the OR operation unit 457 and then stored in the data register 454. Exclusive OR process in this exclusive OR operation unit 457, XORed with the upper n / 2 bits (P ₀₎ and KB ₀ of the input data before the first round of the configuration shown in FIG. 19 It corresponds to processing.

In the first round, KA ₁ is generated in the first key generation unit (KA _i generation circuit) 452, selectors ₁ and 455 select the output of the round function circuit 451, and selectors 2 and 456 select 0. Set. KA ₁ is input from the first key generation unit (KA _i generation circuit) 452 to the round function circuit 451 as a round key. In this first round, round function processing using KA ₁ is performed. This corresponds to the first round processing of the configuration shown in FIG.

In the first round, the round key [KA ₁ ] is input to the round function circuit 451 and the result data obtained by executing the round function is output from the selectors 1 and 455. The n bits output from the selectors 1 and 455 are divided into upper n / 2 bits and lower n / 2 bits, and the upper n / 2 bits are exclusive from the outputs of the selectors 2 and 456 in the exclusive OR operation unit 457. ORed. The outputs of the selectors 2 and 456 are 0, and the data output from the selectors 1 and 455 is stored in the data register 454 as it is.

In the second round, the first key generation unit (KA _i generation circuit) 452 generates KA ₂ , the selectors ₁ and 455 select the output of the round function circuit 451, and the selectors 2 and 456 generate the second key. It is assumed that KB ₃ generated in the unit (KB _i generation circuit) 453 is selected.

The round function circuit 451 receives KA ₂ generated in the first key generation unit (KA _i generation circuit) 452 as a round key. In the second round, the round key [KA ₂ ] is input to the round function circuit 451 and the result data obtained by executing the round function is output from the selectors 1 and 455. The n bits output from the selectors 1 and 455 are divided into upper n / 2 bits and lower n / 2 bits, and the upper n / 2 bits are exclusive from the outputs of the selectors 2 and 456 in the exclusive OR operation unit 457. ORed. Since the outputs of the selectors 2 and 456 are KB ₃ generated by the second key generation unit (KB _i generation circuit) 453, the exclusive logic between the upper n / 2 output from the selectors 1 and 455 and the KB ₃ The result of the sum operation is the upper n / 2 bits of the n-bit data stored in the data register 454. The lower n / 2 bits of the n-bit data stored in the data register 454 are lower n / 2 bits output from the round function circuit 451 via the selectors 1 and 455.

These processes are repeated according to the number of rounds.
In the (r-1) -th round, KA _r-1 is generated in the first key generation unit (KA _i generation circuit) 452, and KB _r-2 is generated in the second key generation unit (KB _i generation circuit) 453. Generate. The selectors 1 and 455 select the output of the round function circuit 451, and the selectors 2 and 456 are set to select the KB _r-2 generated by the second key generation unit (KB _i generation circuit) 453.

KA _r-1 is input to the round function circuit 451 as a round key. In the (r−1) -th round, the round key [KA _r−1 ] is input to the round function circuit 451 and the result data obtained by executing the round function is output from the selectors 1 and 455. The n bits output from the selectors 1 and 455 are divided into upper n / 2 bits and lower n / 2 bits, and the upper n / 2 bits are exclusive from the outputs of the selectors 2 and 456 in the exclusive OR operation unit 457. ORed. The output of the selectors ₂ and 456 is KB _r-2 generated by the second key generation unit (KB _i generation circuit) 453, and the upper n / 2 output from the selectors 1 and 455 and the KB _r-2 The result of the exclusive OR operation is the upper n / 2 bits of the n-bit data stored in the data register 454. The lower n / 2 bits of the n-bit data stored in the data register 454 are lower n / 2 bits output from the round function circuit 451 via the selectors 1 and 455. This process corresponds to the (r-1) round process shown in FIG.

In the final r-th round, KA _r is generated in the first key generation unit (KA _i generation circuit) 452, and KB _{r + 1} is generated in the second key generation unit (KB _i generation circuit) 453. The selectors 1 and 455 select the output of the round function circuit 451, and the selectors 2 and 456 are set to select the KB _{r + 1} generated by the second key generation unit (KB _i generation circuit) 453.

KA _r is input to the round function circuit 451 as the round key generated by the first key generation unit (KA _i generation circuit) 452. In the r-th round, the round key [KA _r ] is input to the round function circuit 451 and the result data obtained by executing the round function is output from the selectors 1 and 455. The n bits output from the selectors 1 and 455 are divided into upper n / 2 bits and lower n / 2 bits, and the upper n / 2 bits are exclusive from the outputs of the selectors 2 and 456 in the exclusive OR operation unit 457. ORed. The output of the selectors 2 and 456 is KB _{r + 1} , and the exclusive OR result of the upper n / 2 bits of the output of the round function circuit 451 and KB _{r + 1} is stored in the data register 454. The lower n / 2 bits of the n-bit data stored in the data register 454 are lower n / 2 bits output from the round function circuit 451 via the selectors 1 and 455. This process corresponds to a configuration for performing an exclusive OR process between the output of the r-th round and KB _{r + 1} shown in FIG.

Through the above processing, the data register 454 is stored in the data register 454.
The ciphertext C = C ₀ | C ₁ is stored.
The circuit configuration shown in FIG. 20 configured as a circuit for executing the processing of the encryption configuration shown in FIG. 19 is simplified compared with the circuit configuration shown in FIG. 11 corresponding to the encryption configuration shown in FIG. In other words, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

The processing executed by each component of the cryptographic processing circuit shown in FIG. 20 is summarized as follows.
Based on the first intermediate key KA, the first key generation unit (KA _i generation circuit) 452 generates r round keys KA _{1 to} KA r to be input to the respective round functions of rounds _{1 to r} .
A round function circuit 451 as a round function execution unit sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of round functions 1 to r. Execute.
The second key generation unit (KB _i generation circuit) 453, based on the second intermediate key KB, the initial key KB ₀ applied before the start of the round function and the final key applied after the start of the final round function of the r round A key KB _{r + 1} and keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 corresponding to every two consecutive rounds are generated.
The exclusive OR operation unit 457 includes input data or configuration data of output data from the round function circuit 451 as a round function execution unit, and keys KB ₀ , KB ₃ , generated based on the second intermediate key KB. An exclusive OR operation with the key KB _i selected from KB ₄ ,..., KB _r−3 , KB _r−2 , KB _{r + 1} is executed.
Such a processing configuration is obtained.

The exclusive OR operation unit 457 generates different rounds for the same key selected from the keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 generated based on the second intermediate key KB. The exclusive OR operation that is used twice is executed on the output data from the round function execution unit. Specifically, for the setting equivalent to the case where the input round keys for four consecutive round functions are set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
An exclusive OR operation process using the same key selected from the key KB _i twice is executed so as to be equivalent to the round key input process of (a) to (d) above. As in the even p + 4 rounds since the above p~p + 3 rounds, consecutive KA _i 2 _rounds, the exclusive OR operation processing so as to be set equivalent to enter the KA _i (EXOR) KB i on two consecutive rounds Run.

  In this way, the circuit configuration shown in FIG. 20 for executing the processing of the encryption configuration shown in FIG. 19 is simplified compared to the circuit configuration shown in FIG. 11 corresponding to the encryption configuration shown in FIG. The configuration, that is, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

(3) Example 3: First Application Example in Four-Series Feistel Structure Next, as Example 3, a first application example in the four-series Feistel structure will be described. That is, it corresponds to a data encryption unit having a 4-series Feistel structure that performs processing by dividing the n-bit input plaintext P described above with reference to FIG. 8 into 4 series of upper to lower n / 4 bits. This is a simplified circuit configuration. The conventional circuit configuration of the 4-series type shown in FIG. 8 is the circuit configuration shown in FIG.

  The circuit configuration of the data encryption unit that executes the round function according to the present embodiment is the circuit configuration illustrated in FIG. 24. Before the description of the circuit configuration illustrated in FIG. 24, refer to FIGS. A theoretical explanation for realizing simplification of the circuit will be given.

FIG. 21 is a diagram illustrating the second to fifth round processes to which the circuit described above with reference to FIG. 12 is applied. As described above, in the data encryption unit having the four series Feistel structure, two round functions are executed in each round. The two round functions in each round generate n / 4-bit round keys RK ₁ [0] and RK ₁ [1] by dividing the n / 2-bit round key RK ₁ into ½, and each round function To enter. Similarly, for the n / 2-bit initial key IK, n / 4-bit IK [0] and IK [1] divided into ½ are input to two of the four sequences, and the n / 2-bit initial key IK is Also for the final key FK, n / 4-bit FK [0] and FK [1] divided into ½ are input to two of the four sequences.

As shown in FIG. 21, in the F functions 502 to 505 and 512 to 515 of the round functions from the second round to the fifth round, the following round keys are input.
Second round: RK ₂ = KA ₂ [0] | KA ₂ [1]
Third round: RK ₃ = KA ₃ [0] (EXOR) KB ₃ [0] | KA ₃ [1] (EXOR) KB ₃ [1]
Round 4: RK ₄ = KA ₄ [0] (EXOR) KB ₄ [0] | KA ₄ [1] (EXOR) KB ₄ [1]
Round 5: RK ₅ = KA ₅ [0] | KA ₅ [1]

  In the circuit configuration shown in FIG. 12, in order to input these round keys to the round function circuit in each round, each round key is generated using the selectors 2, 212 and the exclusive OR operation unit 215. .

For example, the exclusive OR operation units 521 to 524 shown in the third and fourth rounds in the configuration shown in FIG. 21 correspond to the exclusive OR operation unit 215 shown in FIG. In rounds where the second intermediate key base key KB _i is not used as in the second and fifth rounds, the outputs of the selectors 2 and 212 in FIG. 12 are set to 0, and the exclusive OR operation unit shown in FIG. 215 outputs the first intermediate key-based key KA _i without being changed.

FIG. 22 is a diagram for explaining the second to fifth round processes to which the circuit shown in FIG. 24 according to the present invention is applied. The following round keys are input to the F functions 552 to 555 and 562 to 565 of the round functions of the second to fifth rounds.
Second round: RK ₂ = KA ₂ [0] | KA ₂ [1]
3rd round: RK ₃ = KA ₃ [0] | KA ₃ [1]
4th round: RK ₄ = KA ₄ [0] | KA ₄ [1]
Round 5: RK ₅ = KA ₅ [0] | KA ₅ [1]

Furthermore, in the configuration shown in FIG. 22, the exclusive OR units 572 to 575 and 582 to 585 are arranged in the preceding stage of the exclusive OR operation unit on the F function output side of each round in n bits of data input to each round. It is configured to execute an exclusive OR operation between each n / 4 bit and the second intermediate key KB-based n / 4-bit key KB _i [0], KB _i [1].

In the second round,
In the exclusive OR unit 572 before the exclusive OR operation process on the output of the F function 552, exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₃ [0],
In the exclusive OR unit 582 before the exclusive OR operation process for the output of the F function 562, the exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₃ [1] is performed. It is configured to execute.

In the third round,
In the exclusive OR unit 573 before the exclusive OR operation processing on the output of the F function 553, exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₄ [0],
In the exclusive OR unit 583 before the exclusive OR operation process on the output of the F function 563, the exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₄ [1] is performed. It is configured to execute.

In the fourth round,
In the exclusive OR unit 574 before the exclusive OR operation process on the output of the F function 554, exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₃ [1],
In the exclusive OR unit 584 before the exclusive OR operation process for the output of the F function 564, the exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₃ [0] is performed. It is configured to execute.

In the fifth round,
In the exclusive OR unit 575 before the exclusive OR operation process on the output of the F function 555, exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₄ [1],
In the exclusive OR unit 585 before the exclusive OR operation process for the output of the F function 565, the exclusive OR operation of the n / 4 bit data from the previous round and the n / 4 bit key KB ₄ [0] is performed. It is configured to execute.

That is, before the start of the second round, KB ₃ [0] is exclusively ORed with the (n / 4 + 1) -th bit to the n / 2-th bit of the output data of the round function of the first round. Exclusively OR's KB ₃ [1] from the (3n / 4 + 1) -th bit to the n-th bit of the output data of the round function of the round.
Also, before the start of the third round, KB ₄ [0] is exclusive ORed with the (n / 4 + 1) -th bit to the n / 2-th bit of the output data of the round function of the second round, and similarly 2 Exclusively OR's KB ₄ [1] from the (3n / 4 + 1) -th bit to the n-th bit of the output data of the round function of the round.

Also, before the start of the fourth round, KB ₃ [1] is exclusively ORed with the (n / 4 + 1) -th bit to the n / 2-th bit of the output data of the round function of the third round, and similarly 3 Exclusively OR's KB ₃ [0] from the (3n / 4 + 1) -th bit to the n-th bit of the output data of the round function of the round.
Further, before the start of the fifth round, KB ₄ [1] is exclusively ORed with the (n / 4 + 1) -th bit to the n / 2-th bit of the output data of the round function of the fourth round, and similarly 4 Exclusively OR's KB ₄ [0] from the (3n / 4 + 1) -th bit to the n-th bit of the output data of the round function of the round.

In the third round in the configuration of FIG.
Input data (T ′ [0]) for the nonlinear transformation unit (S box) in the F function 553,
Input data (T ′ [1]) for the nonlinear transformation unit (S box) in the F function 563,
When,
Input data (T [0]) for the nonlinear transformation unit (S box) in the F function 503 of the third round in FIG.
Input data (T [1]) for the nonlinear transformation unit (S box) in the F function 513,
Let's compare.

Input data: T [0], T [1] to the nonlinear transformation units (S boxes) of the F functions 503, 513 in the third round in FIG. 21 are the data P [0], P [1], Q [0], Q [1], KA ₃ [0], KA ₃ [1], KB ₃ [0], and KB ₃ [1] can be expressed as the following calculation results.
T [0] = P [0] (EXOR) Q [0] (EXOR) KA ₃ [0] (EXOR) KB ₃ [0]
T [1] = P [1] (EXOR) Q [1] (EXOR) KA ₃ [1] (EXOR) KB ₃ [1]

Also, the input data T ′ [0], T ′ [1] for the non-linear transformation part (S box) of the F functions 553, 563 in the third round in FIG. 22 are the data P [0], P shown in FIG. [1], Q [0], Q [1], KA ₃ [0], KA ₃ [1], KB ₃ [0], KB ₃ [1] can be expressed as the following calculation results. Note data _{P [0], P [1} ], Q [0], Q [1], KA 3 [0], KA 3 [1], KB 3 [0], KB 3 [1] is 21 It is the same as the data shown.
T ′ [0] = P [0] (EXOR) KB ₃ [0] (EXOR) Q [0] (EXOR) KA ₃ [0]
T ′ [1] = P [1] (EXOR) KB ₃ [1] (EXOR) Q [1] (EXOR) KA ₃ [1]
These T ′ [0] and T ′ [1] calculation formulas are equivalent to the above T [0] and T [1] calculation formulas. That is,
T ′ [0] = T [0]
T ′ [1] = T [1]
Thus, the input to the non-linear transformation unit of the third round F function in the configuration of FIG. 22 is the same as the input to the non-linear transformation unit of the third round F function in the configuration of FIG.

In this way, the round key input to the two F functions in the third round is
In the configuration of FIG.
KA ₃ [0] (EXOR) KB ₃ [0], and KA ₃ [1] (EXOR) KB ₃ [1]
But
As shown in FIG. 22, the round key input to the F function in the third round is
KA ₃ [0] and KA ₃ [1],
As a result, an exclusive OR operation using KB ₃ [0] and KB ₃ [1] is executed in the generation stage of input data for the third round F function, and the data is input to the third round F function. As a result, the same encryption processing is performed as the data to be processed. The same applies to the fourth round.

Next, the fifth round processing in the configurations of FIGS. 21 and 22 will be compared.
In FIG. 21, F functions 505 and 515 of the round function of the fifth round include
Round 5: KA ₅ [0], KA ₅ [1],
The key data KA _i based on the first intermediate key KA is input. That is, the second intermediate key KB-based key data KB _i is not used in the fifth round.

The input data U [0], U [1] to the nonlinear transformation units (S boxes) of the two F functions 505, 515 in the fifth round shown in FIG. 21 are the data P [0], P [ 1], Q [0], Q [1], R [0], R [1], KA ₅ [0], and KA ₅ [1].
U [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]

Also, the input data U ′ [0], U ′ [1] to the nonlinear transformation unit (S box) of the F functions 555, 565 in the fifth round in FIG. 22 are the data P [0], P shown in FIG. [1], Q [0], Q [1], R [0], R [1], KA ₅ [0], KA ₅ [1], KB ₃ [0], KB ₃ [1] It can be expressed as a calculation result. These data are the same as the data shown in FIG.
U ′ [0] = P [1] (EXOR) KB ₃ [1] (EXOR) Q [1] (EXOR) KB ₃ [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U ′ [1] = P [0] (EXOR) KB ₃ [0] (EXOR) Q [0] (EXOR) KB ₃ [0] (EXOR) R [1] (EXOR) KA ₅ [1]
In the calculation formulas of U ′ [0] and U ′ [1], the exclusive OR operation is performed twice for the same key KB ₃ [1] or KB ₃ [0]. The process of performing the exclusive OR operation by repeating the same data twice is the same as not performing the exclusive OR operation.

Therefore, the above formula is obtained by omitting two exclusive OR operations for the key KB ₃ [1] or KB ₃ [0] from the above formula, ie,
U ′ [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U ′ [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]
Gives the same result.

The above formula is a formula for calculating the input data U [0], U [1] to the nonlinear calculation of the F functions 505 and 515 of the fifth round shown in FIG. 21 described with reference to FIG.
U [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]
This is the same as the above calculation formula. That is,
U ′ [0] = U [0]
U ′ [1] = U [1]
Thus, the input to the non-linear conversion unit of the fifth round F function in the configuration of FIG. 22 is the same as the input to the non-linear conversion unit of the F function of the fifth round in the configuration of FIG.

As described above, even in the round in which the second intermediate key KB-based key data KB _i in the conventional configuration shown in FIG. 21 is not used, the round key input to the round is the first intermediate key KA-based key. The result is obtained by setting KA _i as it is, and setting the same key KB _i of the second intermediate key base KB to be repeated an even number of times on the non-input data side with respect to the F function to perform the exclusive OR operation. As a result, the same cryptographic processing is performed.

Such a setting can be realized in all rounds. As shown in FIG. 22, a configuration in which exclusive OR operation of the second intermediate key KB-based key KB _i is performed on the input data for the round function, the round key applied in each round is the first intermediate key. Only the KA-based key KA _i can be used. Specifically, an encryption processing configuration as shown in FIG. 23 is realized. The cryptographic processing configuration shown in FIG. 23 has a configuration equivalent to the cryptographic processing configuration shown in FIG. 8 described above. That is, the ciphertext C obtained by inputting the plaintext P by applying the cryptographic processing configuration shown in FIG. 8 and the ciphertext C obtained by inputting the same plaintext P by applying the cryptographic processing configuration shown in FIG. The same encryption processing is performed.

In this way, the round key for the round function is defined as KA _i [0], KA _i [1] composed only of the first intermediate key KA-based key KA _i , and the second intermediate key for the input data for the round function. The encryption process using the simplified circuit configuration shown in FIG. 24 is performed by performing the exclusive OR operation of KB _i [0] and KB _i [1] configured by the KB-based key KB _i . It becomes possible.

  That is, FIG. 24 shows the hardware configuration of the data encryption unit having the four-series Feistel structure shown in FIG. In this configuration, the number of selectors is reduced compared to the hardware configuration of the data encryption unit having the conventional 4-series Feistel structure shown in FIG. 8 described with reference to FIG. It has a simplified circuit configuration with fewer arithmetic units.

The cryptographic processing circuit shown in FIG. 24 includes a round function circuit 601 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, and an n / 2 bit key { First key generation unit (KA _i generation circuit) 602 that generates KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }, and a second intermediate generated based on the secret key K, for example, by different non-linear transformations Second key generation unit (KB _i generation circuit) 603 that generates an n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 } based on the second intermediate key KB. And an exchange circuit 604, an n-bit data register 605, selectors 1 to 2, 611 to 612, and exclusive OR operation units 621 and 622. The exchange circuit 604 is a circuit for exchanging the upper n / 4 bits and the lower n / 4 bits of the n / 2 bit input. This is used to replace the keys KB _i [0] and KB _i [1] generated by the second key generation unit (KB _i generation circuit) 603.

First, at the start of encryption, the second key generation unit (KB _i generation circuit) 603 generates KB ₀ , the selectors 1 and 611 select plain text input, and the selectors 2 and 612 select KB ₀ . The n bits of plaintext input selected by the selectors 1 and 611 are divided into four in units of upper to lower n / 4 bits.

Exclusively OR operation with KB ₀ [0], which is the upper n / 4 bits of KB ₀ selected by selectors 2, 612 from the (n / 4 + 1) -th bit to the n / 2-th bit of n-bit plaintext data In the unit 621, the exclusive OR is performed, and KB ₀ [1], which is the lower n / 4 bits of KB ₀ selected by the selectors 2,612 from the (3n / 4 + 1) -th bit to the n-th bit, and the exclusive logic The OR operation unit 622 performs exclusive OR, and the other plaintext data is stored in the data register 605 as it is. The exclusive OR processing in the exclusive OR operation units 621 and 622 at this time is the exclusive OR operation processing of the input data P ₁ and KB ₀ [0] before the first round having the configuration shown in FIG. , And P ₃ and KB ₀ [1].

In the first round, the first key generation unit (KA _i generation circuit) 602 generates KA ₁ , the second key generation unit (KA _i generation circuit) 603 generates KB ₃ , and the selectors 1 and 611 The output of the round function circuit 601 is selected, and the selectors 2 and 612 are set to select KB ₃ . The round function circuit 601 receives KA ₁ from the first key generation unit (KA _i generation circuit) 602 as a round key. In this first round, round function processing using KA ₁ is performed. This corresponds to the first round process of the configuration shown in FIG. Note that the round function circuit 601 executes processing of two F functions, that is, an F function to which KA ₁ [0] and KA ₁ [1] are applied, as shown in FIG. The processing of these F functions may be either parallel processing or sequential processing. In the following description, the processing of the round function that receives the round key [KA _i ] includes processing for executing the F function to which KA _i [0] and KA _i [1] are applied.

In the first round, the round key [KA ₁ ] is input to the round function circuit 601 and the result data obtained by executing the round function is output from the selectors 1 and 611. The n bits output from the selectors 1 and 611 are divided into n / 4-bit units, and the (n / 4 + 1) -th bit to the n / 2-th bit of the KB ₃ selected by the output of the selector 2 612 KB ₃ [0], which is the upper n / 4 bit, is exclusively ORed with the exclusive OR operation unit 621, and the (3n / 4 + 1) th bit to the nth bit are selected by the outputs of the selectors 2 and 612. KB ₃ [1], which is the lower n / 4 bit of KB ₃ , is exclusive-ORed by the exclusive OR operation unit 622, and the output data from the other selectors 1 and 611 is stored in the data register 605 as it is. Is done. The exclusive OR processing in the exclusive OR operation units 621 and 622 at this time is the exclusive OR between the output data of the first round having the configuration shown in FIG. 23 and KB ₃ [0] and KB ₃ [1]. Corresponds to arithmetic processing.

In the second round, KA ₂ is generated in the first key generation unit (KA _i generation circuit) 602, KB ₄ is generated in the second key generation unit (KB _i generation circuit) 603, and the selectors 1 and 611 are The output of the round function circuit 601 is selected, and the selectors 2 and 612 are set to select the KB ₄ generated in the second key generation unit (KB _i generation circuit) 603.

The round function circuit 601 receives KA ₂ generated in the first key generation unit (KA _i generation circuit) 602 as a round key. In the second round, the round key [KA ₂ ] is input to the round function circuit 601 and the result data obtained by executing the round function is output from the selectors 1 and 611. The n bits output from the selectors 1 and 611 are divided into n / 4-bit units, and the (n / 4 + 1) -th bit to the n / 2-th bit of the KB ₄ selected by the output of the selector 2 612 KB ₄ [0], which is the upper n / 4 bit, is exclusively ORed with the exclusive OR operation unit 621, and the (3n / 4 + 1) th bit to the nth bit are selected by the outputs of the selectors 2 and 612. KB ₄ [1], which is the lower n / 4 bits of KB ₄ , is exclusive-ORed by the exclusive OR operation unit 622, and the output data from the other selectors 1 and 611 is stored in the data register 605 as it is. Is done. The exclusive OR processing in the exclusive OR operation units 621 and 622 at this time is the exclusive OR of the output data of the second round having the configuration shown in FIG. 23 and KB ₄ [0] and KB ₄ [1]. Corresponds to arithmetic processing.

In the third round, the first key generation unit (KA _i generation circuit) 602 generates KA ₃ , the second key generation unit (KB _i generation circuit) 603 generates KB ₃ , and the selectors 1 and 611 The output of the round function circuit 601 is selected, and the selectors 2 and 612 are set to select the output of the switching circuit 604. The exchange circuit 604 exchanges the upper n / 4 bits and the lower n / 4 bits of the n / 2 bit key KB ₃ generated in the second key generation unit (KB _i generation circuit) 603. That is, KB ₃ [0] and KB ₃ [1] are exchanged and output from selectors 2 612 as KB ₃ [1] and KB ₃ [0].

The round function circuit 601 receives KA ₃ generated by the first key generation unit (KA _i generation circuit) 602 as a round key. In the third round, the round key [KA ₃ ] is input to the round function circuit 601 and the result data obtained by executing the round function is output from the selectors 1 and 611. The n bits output from the selectors 1 and 611 are divided into n / 4-bit units, and the (n / 4 + 1) -th bit to the n / 2-th bit of the KB ₃ selected by the output of the selector 2 612 KB ₃ [1], which is the upper n / 4 bits of the replacement data, is exclusive ORed with the exclusive OR operation unit 621, and the (3n / 4 + 1) -th bit to the n-th bit are output by the selectors 2, 612. The selected KB ₃ [0] is exclusive-ORed with the exclusive-OR operation unit 622, and the output data from the other selectors 1 and 611 is stored in the data register 605 as it is. The exclusive OR processing in the exclusive OR operation units 621 and 622 at this time is the exclusive OR of the output data of the third round having the configuration shown in FIG. 23 and KB ₃ [1] and KB ₃ [0]. Corresponds to arithmetic processing.

These processes are repeated according to the number of rounds.
In the (r−1) -th round, the first key generation unit (KA _i generation circuit) 602 generates KA _r−1 , the selectors ₁ and 611 select the output of the round function circuit 601, and the selectors 2 and 2 612 is set to select 0.

KA _r-1 is input to the round function circuit 601 as a round key. In the (r−1) -th round, the round key [KA _r−1 ] is input to the round function circuit 601 and the result data obtained by executing the round function is output from the selectors 1 and 611. The n bits output from the selectors 1 and 611 are divided into n / 4-bit units, and the (n / 4 + 1) -th bit to the n / 2-th bit are selected by the output of the selector 2 612 [0]. [0] selected by the outputs of the selectors 2 and 612 from the (3n / 4 + 1) -th bit to the n-th bit in the exclusive OR operation unit 622 Exclusive ORed. As a result, the output data from the selectors 1 and 611 is stored in the data register 605 as it is. This process corresponds to the (r−1) -th round output process having the configuration shown in FIG.

In the final r-th round, the first key generation unit (KA _i generation circuit) 602 generates KA _r , the second key generation unit (KB _i generation circuit) 603 generates KB _{r + 1} , and the selector 1, 611 selects the output of the round function circuit 601, and the selectors 2 and 612 are set to select KB _{r + 1} generated by the second key generation unit (KB _i generation circuit) 603.

KA _r is input to the round function circuit 601 as the round key generated by the first key generation unit (KA _i generation circuit) 602. In the r-th round, the round key [KA _r ] is input to the round function circuit 601 and the result data obtained by executing the round function is output from the selectors 1 and 611. The n bits output from the selectors 1 and 611 are divided into n / 4-bit units, and from the (n / 4 + 1) -th bit to the n / 2-th bit, the KB _{r + 1} selected by the output of the selector 2 612 The exclusive OR operation unit 621 performs exclusive OR operation with KB _{r + 1} [0], which is the upper n / 4 bit, and the (3n / 4 + 1) -th bit to the n-th bit are selected by the outputs of the selectors 2 and 612. KB _{r + 1} [1], which is the lower n / 4 bits of KB _{r + 1} , is exclusive ORed with the exclusive OR operation unit 622, and the output data from the other selectors 1 and 611 is stored in the data register 605 as it is. Is done. The exclusive OR processing in the exclusive OR operation units 621 and 622 at this time is performed by exclusive OR of the output data of the r-th round configured as shown in FIG. 23 and KB _{r + 1} [0] and KB _{r + 1} [1]. Corresponds to arithmetic processing.

With the above processing, the data register 605 is stored in the data register 605.
The ciphertext C = C ₀ | C ₁ | C ₂ | C ₃ is stored.
The circuit configuration shown in FIG. 24 configured as a circuit for executing the processing of the encryption configuration shown in FIG. 23 is simplified compared to the circuit configuration shown in FIG. 12 corresponding to the encryption configuration shown in FIG. In other words, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

The processing executed by each component of the cryptographic processing circuit shown in FIG. 24 is summarized as follows.
Based on the first intermediate key KA, the first key generation unit (KA _i generation circuit) 602 generates r round keys KA _{1 to} KA r that are respectively input to the round functions _{1 to r} .
A round function circuit 601 as a round function execution unit sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of round functions 1 to r. Execute. In each round, an F function to which KA _i [0] and KA _i [1] are applied is executed.
The second key generation unit (KB _i generation circuit) 603, based on the second intermediate key KB, the initial key KB ₀ applied before the start of the round function and the final key applied after the start of the r-round final round function A key KB _{r + 1} and keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 corresponding to every two consecutive rounds are generated.
The replacement circuit 604 replaces the upper and lower n / 4 bits KB _i [0] and KB _i [1] of the n / 2 bit key KB _i generated by the second key generation unit (KB _i generation circuit) 603.
The exclusive OR operation units 621 and 622 are keys KB ₀ and KB generated based on the input data or the configuration data of the output data from the round function circuit 601 as the round function execution unit and the second intermediate key KB. ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 , KB _{r + 1} , the exclusive data OR of the configuration data KB _i [0] and KB _i [1] of the key KB _i selected .
Such a processing configuration is obtained.

The exclusive OR operation units 621 and 622 are the same key selected from the keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 generated based on the second intermediate key KB. Specifically, an exclusive OR operation using the configuration data KB _i [0] and KB _i [1] of the key KB _i by repeatedly using the output data from the round function execution units of different rounds is executed. Specifically, for the setting equivalent to the case where the input round keys for four consecutive round functions are set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
An exclusive OR operation process using the same key selected from the key KB _i twice is executed so as to be equivalent to the round key input process of (a) to (d) above. As in the even p + 4 rounds since the above p~p + 3 rounds, consecutive KA _i 2 _rounds, the exclusive OR operation processing so as to be set equivalent to enter the KA _i (EXOR) KB i on two consecutive rounds Run.

As a key to input for each F function,
(A) Input the keys KA _p [0] and KA _p [1] into the p-round F function,
(B) Enter the round keys KA _{p + 1} [0] and KA _{p + 1} [1] in the p + 1 round,
(C) The round keys [KA _{p + 2} [0] (EXOR) KB _{p + 2} [0]] and [KA _{p + 2} [1] (EXOR) KB _{p + 2} [1]] are input to the p + 2 round.
(D) Enter the round keys [KA _{p + 3} [0] (EXOR) KB _{p + 3} [0]] and [KA _{p + 3} [1] (EXOR) KB _{p + 3} [1]] in the p + 3 round,
The exclusive OR operation units 621 and 622 apply exclusive keys KB _i [0] and KB _i [1] generated based on the second intermediate key KB so as to be equivalent to such input settings. Performs a logical OR operation.

  Thus, the circuit configuration shown in FIG. 24 for executing the processing of the encryption configuration shown in FIG. 23 is simplified as compared with the circuit configuration shown in FIG. 12 corresponding to the encryption configuration shown in FIG. The configuration, that is, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

(4) Example 4: Second Application Example in 4-Series Feistel Structure Next, as Example 4, a second application example in the 4-series Feistel structure will be described. That is, it corresponds to a data encryption unit having a 4-series Feistel structure that performs processing by dividing the n-bit input plaintext P described above with reference to FIG. 9 into 4 series of upper to lower n / 4 bits. This is a simplified circuit configuration. Note that the conventional circuit configuration of the 4-series type shown in FIG. 9 is the circuit configuration shown in FIG.

  The circuit configuration of the data encryption unit that executes the round function according to the present embodiment is the circuit configuration illustrated in FIG. 27. Before the description of the circuit configuration illustrated in FIG. 27, refer to FIGS. 25 to 26. A theoretical explanation for realizing simplification of the circuit will be given.

FIG. 25 is a diagram for explaining the second to fifth round processes to which the circuit shown in FIG. 27 according to the present invention is applied. The following round keys are input to the F functions 752 to 755 and 762 to 765 of the round functions of the second to fifth rounds.
Second round: RK ₂ = KA ₂ [0] | KA ₂ [1]
3rd round: RK ₃ = KA ₃ [0] | KA ₃ [1]
4th round: RK ₄ = KA ₄ [0] | KA ₄ [1]
Round 5: RK ₅ = KA ₅ [0] | KA ₅ [1]

Further, in the configuration shown in FIG. 25, the exclusive OR parts 773 to 775 and 782 are arranged in the preceding stage of the input data part on the F function input side of each round in n bits of the data inputted to each round except the second round. 785 is set, and an exclusive OR operation of each n / 4 bit and the second intermediate key KB-based n / 4-bit key KB _i [0], KB _i [1] is executed. .

In the third round,
An exclusive OR operation between the n / 4-bit data from the previous round input to the F function 753 and the n / 4-bit key KB ₃ [0],
The exclusive-OR operation of the n / 4-bit data from the previous round input to the F function 763 and the n / 4-bit key KB ₃ [1] is executed.

In the fourth round,
An exclusive OR operation of the n / 4-bit data from the previous round input to the F function 754 and the n / 4-bit key KB ₄ [0],
The exclusive-OR operation of the n / 4-bit data from the previous round input to the F function 764 and the n / 4-bit key KB ₄ [1] is executed.

In the fifth round,
Exclusive OR operation of the n / 4-bit data from the previous round input to the F function 755 and the n / 4-bit key KB ₃ [1],
The exclusive-OR operation of the n / 4-bit data from the previous round input to the F function 765 and the n / 4-bit key KB ₃ [0] is executed.

That is, before the start of the third round, exclusive OR of the output data of the round function of the second round from the first bit to the n / 4 bit and KB ₃ [0] is performed, and similarly the second round Exclusively OR's KB ₃ [1] from the (n / 2 + 1) th bit to the 3n / 4th bit of the output data of the function.

Furthermore, before the start of the fourth round, exclusive OR of the output data of the round function of the third round from the first bit to the n / 4 bit and KB ₄ [0] is performed, and similarly the third round Exclusively OR's KB ₄ [1] from the (n / 2 + 1) th bit to the 3n / 4th bit of the output data of the function.

Furthermore, before the start of the fifth round, exclusive OR of the output data of the round function of the fourth round from the first bit to the n / 4th bit and KB ₃ [1] is performed, and similarly the fourth round Exclusively OR's KB ₃ [0] with the (n / 2 + 1) -th bit to 3n / 4-th bit of the output data of the function.

  The Feistel structure shown in FIG. 9 and the Feistel structure shown in FIG. 8 differ only in the input positions of the initial key and the final key, and the processing configuration of round operations of 1 to r rounds is the same. The input to the F function in each round in the configuration of 25 is compared with the input to the F function in the encryption processing configuration shown in FIG. 21 described above corresponding to the Feistel structure of FIGS. The encryption processing configuration shown in FIG. 21 corresponds to the encryption processing configuration by the circuit of FIG. 13 described above as the circuit configuration corresponding to FIG.

In the third round in the configuration of FIG.
Input data (T ′ [0]) for the nonlinear transformation unit (S box) in the F function 753,
Input data (T ′ [1]) for the nonlinear transformation unit (S box) in the F function 763,
When,
Input data (T [0]) for the nonlinear transformation unit (S box) in the F function 503 of the third round in FIG.
Input data (T [1]) for the nonlinear transformation unit (S box) in the F function 513,
Let's compare.

The input data T [0] and T [1] to the non-linear transformation unit (S box) of the third round F functions 503 and 513 in FIG. 21 are the data P [0] shown in FIG. _{], P [1], Q} [0], Q [1], KA 3 [0], KA 3 [1], KB 3 [0], can be expressed as the operation result of the following by _KB 3 [1] .
T [0] = P [0] (EXOR) Q [0] (EXOR) KA ₃ [0] (EXOR) KB ₃ [0]
T [1] = P [1] (EXOR) Q [1] (EXOR) KA ₃ [1] (EXOR) KB ₃ [1]

Also, input data: T ′ [0], T ′ [1] to the nonlinear transformation part (S box) of the F functions 753, 763 in the third round in FIG. 25 are the data P [0], P shown in FIG. [1], Q [0], Q [1], KA ₃ [0], KA ₃ [1], KB ₃ [0], KB ₃ [1] can be expressed as the following calculation results. Note data _{P [0], P [1} ], Q [0], Q [1], KA 3 [0], KA 3 [1], KB 3 [0], KB 3 [1] is 21 It is the same as the data shown.
T ′ [0] = P [0] (EXOR) Q [0] (EXOR) KB ₃ [0] (EXOR) KA ₃ [0]
T ′ [1] = P [1] (EXOR) Q [1] (EXOR) KB ₃ [1] (EXOR) KA ₃ [1]
These T ′ [0] and T ′ [1] calculation formulas are equivalent to the above T [0] and T [1] calculation formulas. That is,
T ′ [0] = T [0]
T ′ [1] = T [1]
Thus, the input to the non-linear transformation unit of the third round F function in the configuration of FIG. 25 is the same as the input to the non-linear transformation unit of the third round F function in the configuration of FIG.

In this way, the round key input to the two F functions in the third round is
In the configuration of FIG.
KA ₃ [0] (EXOR) KB ₃ [0], and KA ₃ [1] (EXOR) KB ₃ [1]
But
As shown in FIG. 25, the round key input to the F function in the third round is
KA ₃ [0] and KA ₃ [1],
As a result, an exclusive OR operation using KB ₃ [0] and KB ₃ [1] is executed in the generation stage of input data for the third round F function, and the data is input to the third round F function. As a result, the same encryption processing is performed as the data to be processed. The same applies to the fourth round.

Next, the fifth round processing in the configurations of FIGS. 21 and 25 will be compared.
In FIG. 21, F functions 505 and 515 of the round function of the fifth round include
Round 5: KA ₅ [0], KA ₅ [1],
The key data KA _i based on the first intermediate key KA is input. That is, the second intermediate key KB-based key data KB _i is not used in the fifth round.

As described above, the input data U [0], U [1] to the nonlinear transformation units (S boxes) of the two F functions 505 and 515 in the fifth round shown in FIG. 21 are the data shown in FIG. It can be expressed as the following calculation result by P [0], P [1], Q [0], Q [1], R [0], R [1], KA ₅ [0], KA ₅ [1]. it can.
U [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]

Also, the input data U ′ [0], U ′ [1] to the nonlinear transformation unit (S box) of the F functions 755, 765 in the fifth round in FIG. 25 are the data P [0], P shown in FIG. [1], Q [0], Q [1], R [0], R [1], KA ₅ [0], KA ₅ [1], KB ₃ [0], KB ₃ [1] It can be expressed as a calculation result. These data are the same as the data shown in FIG.
U ′ [0] = P [1] (EXOR) Q [1] (EXOR) KB ₃ [1] (EXOR) R [0] (EXOR) KB ₃ [1] (EXOR) KA ₅ [0]
U ′ [1] = P [0] (EXOR) Q [0] (EXOR) KB ₃ [0] (EXOR) R [1] (EXOR) KB ₃ [0] (EXOR) KA ₅ [1]
In the calculation formulas of U ′ [0] and U ′ [1], the exclusive OR operation is performed twice for the same key KB ₃ [1] or KB ₃ [0]. The process of performing the exclusive OR operation by repeating the same data twice is the same as not performing the exclusive OR operation.

Therefore, the above formula is obtained by omitting two exclusive OR operations for the key KB ₃ [1] or KB ₃ [0] from the above formula, ie,
U ′ [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U ′ [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]
Gives the same result.

The above formula is a formula for calculating the input data U [0], U [1] to the nonlinear calculation of the F functions 505 and 515 of the fifth round shown in FIG. 21 described with reference to FIG.
U [0] = P [1] (EXOR) Q [1] (EXOR) R [0] (EXOR) KA ₅ [0]
U [1] = P [0] (EXOR) Q [0] (EXOR) R [1] (EXOR) KA ₅ [1]
This is the same as the above calculation formula. That is,
U ′ [0] = U [0]
U ′ [1] = U [1]
Thus, the input to the non-linear transformation unit of the fifth round F function in the configuration of FIG. 25 is the same as the input to the non-linear transformation unit of the F function of the fifth round in the configuration of FIG.

As described above, even in the round in which the second intermediate key KB-based key data KB _i in the conventional configuration shown in FIG. 21 is not used, the round key input to the round is the first intermediate key KA-based key. By setting KA _i as it is and setting the same key KB _i of the second intermediate key base KB to be repeated an even number of times on the input data side for the F function, as a result, Are subject to the same cryptographic processing.

Such a setting can be realized in all rounds. As shown in FIG. 25, a configuration in which exclusive OR operation of the second intermediate key KB-based key KB _i is performed on the input data for the round function, the round key applied in each round is the first intermediate key. Only the KA-based key KA _i can be used. Specifically, an encryption processing configuration as shown in FIG. 26 is realized. The cryptographic processing configuration shown in FIG. 26 has a configuration equivalent to the cryptographic processing configuration shown in FIG. 9 described above. That is, the ciphertext C obtained by inputting the plaintext P by applying the cryptographic processing configuration shown in FIG. 9 and the ciphertext C obtained by inputting the same plaintext P by applying the cryptographic processing configuration shown in FIG. The same encryption processing is performed.

In this way, the round key for the round function is defined as KA _i [0], KA _i [1] composed only of the first intermediate key KA-based key KA _i , and the second intermediate key for the input data for the round function. By adopting a configuration that performs an exclusive OR operation of KB _i [0] and KB _i [1] configured by the KB-based key KB _i , cryptographic processing using the simplified circuit configuration shown in FIG. It becomes possible.

  In other words, FIG. 27 shows a hardware configuration of the data encryption unit having the four series Feistel structure shown in FIG. In this configuration, the number of selectors is reduced compared to the hardware configuration of the data encryption unit having the conventional 4-series Feistel structure shown in FIG. 9 described above with reference to FIG. It has a simplified circuit configuration with fewer arithmetic units.

The cryptographic processing circuit shown in FIG. 27 includes one round function circuit 801 and a first intermediate key KA generated by, for example, non-linear transformation based on the secret key K, and a first intermediate key KA-based n / 2-bit key { First key generation unit (KA _i generation circuit) 802 that generates KA ₁ , KA ₂ ,..., KA _r−1 , KA _r }, and a second intermediate generated based on, for example, a different nonlinear transformation based on the secret key K A second key generation unit (KB _i generation circuit) 803 that generates an n / 2-bit key {KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 } based on the second intermediate key KB from the key KB. And an exchange circuit 804, an n-bit data register 805, selectors 1 to 2, 811 to 812, and exclusive OR operation units 821 and 822. The exchange circuit 804 is a circuit for exchanging the upper n / 4 bits and the lower n / 4 bits of the input of n / 2 bits. This is used to replace the keys KB _i [0] and KB _i [1] generated by the second key generation unit (KB _i generation circuit) 803.

First, at the start of encryption, the second key generation unit (KB _i generation circuit) 803 generates KB ₀ , the selectors 1 811 select plain text input, and the selectors 2 812 select KB ₀ . The n bits of plaintext input selected by the selectors 1 and 811 are divided into four in units of upper to lower n / 4 bits.

The exclusive OR operation unit 821 excludes KB ₀ [0], which is the upper n / 4 bits of KB ₀ selected by the selectors 2 and 812, from the first bit to the n / 4 bit of the n-bit plaintext data. Exclusive OR operation with KB ₀ [1], which is the lower n / 4 bits of KB ₀ selected by selector 2 812 from the (n / 2 + 1) th bit to the 3n / 4th bit. In the part 822, exclusive OR is performed, and other plaintext data is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is the exclusive OR operation processing of the input data P ₀ and KB ₀ [0] before the first round having the configuration shown in FIG. , And P ₂ and KB ₀ [1].

In the first round, the first key generation unit (KA _i generation circuit) 802 generates KA ₁ , the selectors ₁ 811 select the output of the round function circuit 801, and the selectors 2 812 select [0]. Set to select. The round function circuit 801 receives KA ₁ from the first key generation unit (KA _i generation circuit) 802 as a round key. In this first round, round function processing using KA ₁ is performed. This corresponds to the first round processing of the configuration shown in FIG. In the round function circuit 801, as shown in FIG. 26, processing of two F functions, that is, an F function to which KA ₁ [0] and KA ₁ [1] are applied is executed. The processing of these F functions may be either parallel processing or sequential processing. In the following description, the processing of the round function that receives the round key [KA _i ] includes processing for executing the F function to which KA _i [0] and KA _i [1] are applied.

In the first round, the round key [KA ₁ ] is input to the round function circuit 801 and the result data obtained by executing the round function is output from the selectors 1 811. The n bits output from the selectors 1 and 811 are divided into n / 4 bit units. The first bit to the n / 4 bit and the (n / 2 + 1) th bit to the 3n / 4 bit are the selector 2 bits. , 812 and the exclusive OR operation unit 821 and the exclusive OR operation unit 822 are exclusively ORed, but the output of the selectors 2 and 812 is [0], and the output data from the selectors 1 and 811 Is stored in the data register 805 as it is. The process at this point corresponds to the first round process having the configuration shown in FIG.

In the second round, the first key generation unit (KA _i generation circuit) 802 generates KA ₂ , the second key generation unit (KB _i generation circuit) 803 generates KB ₃ , and selectors 1 811 It selects the output of the round function circuit 801, the selector 2,812 shall be set to select a KB _3. The n bits of the output of the round function circuit 801 selected by the selectors 1 and 811 are divided into four in units of upper to lower n / 4 bits.

Exclusively ORed with KB ₃ [0], which is the upper n / 4 bits of KB ₃ selected by selector 2 812 from the first bit to the n / 4 bit of the output n-bit data of round function circuit 801 is exclusive in operation 821, and (n / 2 + 1) _KB from bit to 3n / 4 bit are the lower n / 4 bits of KB ₃ selected by the selector 2,812 3 [1], The exclusive OR operation unit 822 performs exclusive OR, and the other plaintext data is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is performed by exclusive OR between the output data of the second round having the configuration shown in FIG. 26 and KB ₃ [0] and KB ₃ [1]. Corresponds to arithmetic processing.

In the third round, the first key generation unit (KA _i generation circuit) 802 generates KA ₃ , the second key generation unit (KB _i generation circuit) 803 generates KB ₄ , and selectors 1811 It selects the output of the round function circuit 801, the selector 2,812 shall be set to select a KB _4. The n bits of the output of the round function circuit 801 selected by the selectors 1 and 811 are divided into four in units of upper to lower n / 4 bits.

Exclusively ORed with KB ₄ [0], which is the upper n / 4 bits of KB ₄ selected by selectors 2 812 from the first bit to the n / 4 bit of the output n-bit data of the round function circuit 801 is exclusive in operation 821, the _KB 4 [1] which is a lower n / 4 bits of the (n / 2 + 1) KB from bit to 3n / 4 bit has been selected by the selector 2,812 _4, The exclusive OR operation unit 822 performs exclusive OR, and the other plaintext data is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR calculation units 821 and 822 at this time is performed by exclusive OR of the third round output data having the configuration shown in FIG. 26 and KB ₄ [0] and KB ₄ [1]. Corresponds to arithmetic processing.

In the fourth round, the first key generation unit (KA _i generation circuit) 802 generates KA ₄ , the second key generation unit (KB _i generation circuit) 803 generates KB ₃ , and selectors 1811 Selects the output of the round function circuit 801, and the selectors 2 and 812 are set to select the output of the switching circuit 804. The exchange circuit 804 exchanges the upper n / 4 bits and the lower n / 4 bits of the n / 2 bit key KB ₃ generated in the second key generation unit (KB _i generation circuit) 803. That is, KB ₃ [0] and KB ₃ [1] are exchanged and output from selector 2 812 as KB ₃ [1] and KB ₃ [0].

The round function circuit 801 receives KA ₄ generated by the first key generation unit (KA _i generation circuit) 802 as a round key. In the fourth round, the round key [KA ₄ ] is input to the round function circuit 801 and the result data obtained by executing the round function is output from the selectors 1 811. The n bits output from the selectors 1 and 811 are divided into n / 4-bit units, and the first bit to the n / 4-th bit is the higher order of the replacement data of KB ₃ selected by the output of the selectors 2 and 812. The exclusive OR operation unit 821 performs exclusive OR operation on KB ₃ [1], which is n / 4 bits, and the (n / 2 + 1) th bit to the 3n / 4th bit are selected by the outputs of the selectors 2 and 812. KB ₃ [0] is exclusive ORed with the exclusive OR operation unit 822, and the output data from the other selectors 1 and 811 is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is the exclusive OR of the fourth round output data having the configuration shown in FIG. 26 and KB ₃ [1] and KB ₃ [0]. Corresponds to arithmetic processing.

In the fifth round, the first key generation unit (KA _i generation circuit) 802 generates KA ₅ , the second key generation unit (KB _i generation circuit) 803 generates KB ₄ , and selectors 1 811 Selects the output of the round function circuit 801, and the selectors 2 and 812 are set to select the output of the switching circuit 804. The exchange circuit 804 exchanges the upper n / 4 bits and the lower n / 4 bits of the n / 2 bit key KB ₄ generated in the second key generation unit (KB _i generation circuit) 803. That is, KB ₄ [0] and KB ₄ [1] are exchanged and output from selector 2 812 as KB ₄ [1] and KB ₄ [0].

The round function circuit 801 receives KA ₅ generated by the first key generation unit (KA _i generation circuit) 802 as a round key. In the fifth round, the round key [KA ₅ ] is input to the round function circuit 801 and the result data obtained by executing the round function is output from the selectors 1 811. The n bits output from the selectors 1 and 811 are divided into n / 4-bit units, and the first bit to the n / 4-th bit is the higher order of the replacement data of KB ₄ selected by the output of the selectors 2 and 812. The exclusive OR operation unit 821 performs exclusive OR operation with KB ₄ [1], which is n / 4 bits, and the (n / 2 + 1) th bit to the 3n / 4th bit are selected by the outputs of the selectors 2 and 812. KB ₄ [0] is exclusive-ORed with the exclusive-OR operation unit 822, and output data from the other selectors 1 and 811 is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is performed by exclusive OR of the fifth round output data having the configuration shown in FIG. 26 and KB ₄ [1] and KB ₄ [0]. Corresponds to arithmetic processing.

Repeat the above according to the number of rounds.
In the (r−1) -th round, the first key generation unit (KA _i generation circuit) 802 generates KA _r−1 and the second key generation unit (KB _i generation circuit) 803 generates KB _r-2. The selectors 1 and 811 select the output of the round function circuit 801, and the selectors 2 and 812 are set to select the output of the switching circuit 804. In the replacement circuit 804, the n / 2-bit key: KB _r-2 generated in the second key generation unit (KB _i generation circuit) 803 is input, and the upper n / 4 bits and the lower n / 4 bits of KB _r-2. Are switched, and the selector 2 812 outputs a key whose upper n / 4 bit is KB _r-2 [1] and whose lower n / 4 bit is KB _r-2 [0].

The round function circuit 801 receives KA _r-1 generated in the first key generation unit (KA _i generation circuit) 802 as a round key. In the (r−1) -th round, the round key [KA _r−1 ] is input to the round function circuit 801 and the result data obtained by executing the round function is output from the selectors 1 811. The n bits output from the selectors 1 and 811 are divided into n / 4-bit units, and the KB _r-2 replacement data in which the first to n / 4th bits are selected by the output of the selectors ₂ and 812. KB _r-2 [1], which is the higher-order n / 4 bits, is exclusive-ORed in the exclusive OR operation unit 821, and the (n / 2 + 1) th bit to the 3n / 4th bit are the selectors 2 812. KB _r-2 [0] selected by the output is exclusive ORed by the exclusive OR operation unit 822, and the output data from the other selectors 1 and 811 is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is performed by the (r−1) -th round output data having the configuration shown in FIG. 26 and KB _r-2 [1], KB _r-2 [ [0].

In the r-th round, the first key generation unit (KA _i generation circuit) 802 generates KA _r , the second key generation unit (KB _i generation circuit) 803 generates KB _{r + 1} , and selectors 1811 Selects the output of the round function circuit 801, and the selectors 2 and 812 are set to select KB _{r + 1} generated in the second key generation unit (KB _i generation circuit) 803.

The round function circuit 801 receives KA _r generated by the first key generation unit (KA _i generation circuit) 802 as a round key. In the r-round, it results in the round function circuit 801 round key [KA _r] has performed is input round function data is output from the selector 1,811. The n bits output from the selectors 1 and 811 are divided into n / 4-bit units, and the first bit to the n / 4th bit are the upper n / 4 of KB _{r + 1} selected by the output of the selectors 2 and 812. is exclusive in exclusive OR operation section 821 _{KB r +} 1 [0] and a bit, (n / 2 + 1) KB r + 1 from bit to 3n / 4 bit is selected by the output of the selector 2,812 [1] is exclusive-ORed with the exclusive-OR operation unit 822, and output data from the other selectors 1 and 811 is stored in the data register 805 as it is. The exclusive OR processing in the exclusive OR operation units 821 and 822 at this time is performed by exclusive OR between the r-th round output data having the configuration shown in FIG. 26 and KB _{r + 1} [0] and KB _{r + 1} [1]. Corresponds to arithmetic processing.

With the above processing, the data register 805 is stored in the data register 805.
The ciphertext C = C ₀ | C ₁ | C ₂ | C ₃ is stored.
The circuit configuration shown in FIG. 27 configured as a circuit for executing the processing of the encryption configuration shown in FIG. 26 is simplified compared to the circuit configuration shown in FIG. 13 corresponding to the encryption configuration shown in FIG. In other words, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

The processing executed by each component of the cryptographic processing circuit shown in FIG. 27 is summarized as follows.
Based on the first intermediate key KA, the first key generation unit (KA _i generation circuit) 802 generates r round keys KA _{1 to} KA r that are respectively input to the round functions _{1 to r} .
A round function circuit 801 as a round function execution unit sequentially inputs _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of round functions 1 to r. Execute. In each round, an F function to which KA _i [0] and KA _i [1] are applied is executed.
The second key generation unit (KB _i generation circuit) 803, based on the second intermediate key KB, the initial key KB ₀ applied before the start of the round function and the final key applied after the start of the final round function of the r round A key KB _{r + 1} and keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 corresponding to every two consecutive rounds are generated.
The replacement circuit 804 replaces the upper / lower n / 4 bits KB _i [0] and KB _i [1] of the n / 2 bit key KB _i generated by the second key generation unit (KB _i generation circuit) 803.
The exclusive OR operation units 821 and 822 are keys KB ₀ and KB generated based on the input data or the configuration data of the output data from the round function circuit 801 serving as the round function execution unit and the second intermediate key KB. ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 , KB _{r + 1} , the exclusive data OR of the configuration data KB _i [0] and KB _i [1] of the key KB _i selected .
Such a processing configuration is obtained.

The exclusive OR operation units 821 and 822 are the same key selected from the keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 generated based on the second intermediate key KB. Specifically, an exclusive OR operation using the configuration data KB _i [0] and KB _i [1] of the key KB _i by repeatedly using the output data from the round function execution units of different rounds is executed. Specifically, for the setting equivalent to the case where the input round keys for four consecutive round functions are set as follows, that is, for four consecutive rounds p to p + 3,
(A) Enter the round key KA _p in the p round,
(B) Enter the round key KA _{p + 1} in _{p + 1} round,
(C) Enter the round key [KA _{p + 2} (EXOR) KB _{p + 2} ] in the p + 2 round,
(D) Enter the round key [KA _{p + 3} (EXOR) KB _{p + 3} ] in the p + 3 round,
An exclusive OR operation process using the same key selected from the key KB _i twice is executed so as to be equivalent to the round key input process of (a) to (d) above. As in the even p + 4 rounds since the above p~p + 3 rounds, consecutive KA _i 2 _rounds, the exclusive OR operation processing so as to be set equivalent to enter the KA _i (EXOR) KB i on two consecutive rounds Run.

As a key to input for each F function,
(A) Input the keys KA _p [0] and KA _p [1] into the p-round F function,
(B) Enter the round keys KA _{p + 1} [0] and KA _{p + 1} [1] in the p + 1 round,
(C) The round keys [KA _{p + 2} [0] (EXOR) KB _{p + 2} [0]] and [KA _{p + 2} [1] (EXOR) KB _{p + 2} [1]] are input to the p + 2 round.
(D) Enter the round keys [KA _{p + 3} [0] (EXOR) KB _{p + 3} [0]] and [KA _{p + 3} [1] (EXOR) KB _{p + 3} [1]] in the p + 3 round,
In the exclusive OR operation units 821 and 822 so as to be equivalent to such an input setting, an exclusive to which the keys KB _i [0] and KB _i [1] generated based on the second intermediate key KB are applied. Performs a logical OR operation.

  The circuit configuration shown in FIG. 27 for executing the processing of the encryption configuration shown in FIG. 26 is simplified as compared with the circuit configuration shown in FIG. 13 corresponding to the encryption configuration shown in FIG. The configuration, that is, the selector circuit and the exclusive OR circuit are reduced one by one, and the circuit can be reduced in size and cost.

[IC module configuration example as a cryptographic processing apparatus]
Finally, FIG. 28 shows a configuration example of an IC module 900 as a cryptographic processing apparatus that executes cryptographic processing according to the above-described embodiment. The above-described processing can be executed by, for example, various information processing apparatuses such as a PC, an IC card, a reader / writer, and the IC module 900 shown in FIG. 28 can be configured in these various devices.

  A CPU (Central processing Unit) 901 shown in FIG. 28 is a processor that executes the start and end of cryptographic processing, control of data transmission / reception, data transfer control between components, and other various programs. The memory 902 includes a ROM (Read-Only-Memory) that stores programs executed by the CPU 901 or fixed data such as calculation parameters, a program executed in the processing of the CPU 901, and a parameter storage area that changes as appropriate in the program processing, It consists of RAM (Random Access Memory) used as a work area. The memory 902 can be used as a storage area for key data necessary for encryption processing, data to be applied to a conversion table (substitution table) or conversion matrix applied in the encryption processing, and the like. The data storage area is preferably configured as a memory having a tamper resistant structure. The cryptographic processing unit 903 executes, for example, the above-described various cryptographic processing configurations, for example, a common key block cryptographic processing algorithm according to the Feistel structure.

Further, as described in the above embodiments, the cryptographic processing unit 903 generates the first intermediate key KA and the second intermediate key KB based on the secret key K, and executes the round function. The first intermediate key KA is key data generated by a non-linear conversion process for the secret key K, and the second intermediate key KB is
(A) data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K;
(B) data obtained by applying linear transformation to the secret key K;
(C) The secret key K itself is data configured by any one of the above (a) to (c).

The encryption processing unit 903 generates keys KA _i and KB _i based on the first intermediate key KA and the second intermediate key KB. Only the intermediate key base key KA _i is applied as the round function key in the round function, and the intermediate key base key KB _i is used for exclusive OR operation with the input / output data of the round function.

  Here, an example is shown in which the cryptographic processing means is an individual module, but such an independent cryptographic processing module is not provided, for example, a cryptographic processing program is stored in the ROM, and the CPU 901 reads and executes the ROM stored program. You may comprise.

  The random number generator 904 executes random number generation processing necessary for generating a key necessary for cryptographic processing.

  The transmission / reception unit 905 is a data communication processing unit that performs data communication with the outside. For example, the data transmission / reception unit 905 performs data communication with an IC module such as a reader / writer and outputs ciphertext generated in the IC module or an external reader. Data input from devices such as writers is executed.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiments without departing from the gist of the present invention. In other words, the present invention has been disclosed in the form of exemplification, and should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims should be taken into consideration.

  The series of processing described in the specification can be executed by hardware, software, or a combined configuration of both. When executing processing by software, the program recording the processing sequence is installed in a memory in a computer incorporated in dedicated hardware and executed, or the program is executed on a general-purpose computer capable of executing various processing. It can be installed and run. For example, the program can be recorded in advance on a recording medium. In addition to being installed on a computer from a recording medium, the program can be received via a network such as a LAN (Local Area Network) or the Internet and can be installed on a recording medium such as a built-in hard disk.

  Note that the various processes described in the specification are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Further, in this specification, the system is a logical set configuration of a plurality of devices, and the devices of each configuration are not limited to being in the same casing.

As described above, according to the configuration of the embodiment of the present invention, the first intermediate key KA and the second intermediate key KB having a plurality of different data configurations generated based on the secret key K are applied to In a common key block cipher processing configuration in which a round function is repeatedly executed to perform data conversion processing of input data, only the round key KA _i generated based on the first intermediate key KA is input to the round function execution unit to obtain the round function. The key KB _{i that} is executed and generated based on the second intermediate key KB is exclusive of the input data to be encrypted or the output data from the round function without being input to the F function in the round function section. The configuration is such that an OR operation is executed. With this configuration, it is possible to simplify the cryptographic processing circuit and reduce the size and cost of the apparatus.

It is a figure which shows the basic composition of a common key block encryption algorithm. It is a figure explaining the structural example of the data encryption part in a common key block cipher. It is a figure explaining the structural example of the data encryption part in a common key block cipher. It is a figure explaining the structural example of the data encryption part which has a 4 series structure in a common key block cipher. It is a figure explaining the structural example of the data encryption part which has a 4 series structure in a common key block cipher. FIG. 3 is a diagram illustrating an example in which a data encryption unit having a Feistel structure in FIG. 2 is configured to use a round key, an initial key, and a final key generated based on a plurality of different keys. FIG. 4 is a diagram illustrating an example in which a data encryption unit having a Feistel structure in FIG. 3 uses a round key generated based on a plurality of different keys, an initial key, and a final key. FIG. 5 is a diagram illustrating an example in which a data encryption unit having a Feistel structure in FIG. 4 uses a round key, an initial key, and a final key generated based on a plurality of different keys. FIG. 6 is a diagram for explaining an example in which a data encryption unit having a Feistel structure in FIG. 5 uses a round key, an initial key, and a final key generated based on a plurality of different keys. FIG. 7 is a diagram illustrating a configuration example of an encryption processing circuit of a data encryption unit having a two-series Feistel structure illustrated in FIG. 6. It is a figure which shows the example of a encryption processing circuit structure of the data encryption part which has the 2 series Feistel structure shown in FIG. It is a figure which shows the example of a encryption processing circuit structure of the data encryption part which has the 4 series Feistel structure shown in FIG. It is a figure which shows the example of a encryption processing circuit structure of the data encryption part which has the 4 series Feistel structure shown in FIG. It is a figure explaining the process of 2nd round-5th to which the circuit demonstrated with reference to FIG. 10 is applied. It is a figure explaining the process of 2nd round-5th to which the circuit shown in FIG. 17 according to one Example of this invention is applied. It is a figure explaining the encryption processing structure at the time of applying the circuit shown in FIG. 17 according to one Example of this invention. It is a figure explaining the structural example of the encryption processing circuit according to one Example of this invention. It is a figure explaining the process of 2nd round-5th round to which the circuit shown in FIG. 20 according to this invention is applied. It is a figure explaining the encryption processing structure at the time of applying the circuit shown in FIG. 20 according to one Example of this invention. It is a figure explaining the structural example of the encryption processing circuit according to one Example of this invention. It is a figure explaining the process of 2nd round-5th to which the circuit demonstrated with reference to FIG. 12 is applied. It is a figure explaining the process of 2nd round-5th round to which the circuit shown in FIG. 24 according to this invention is applied. FIG. 25 is a diagram illustrating an encryption processing configuration when the circuit shown in FIG. 24 according to an embodiment of the present invention is applied. It is a figure explaining the structural example of the encryption processing circuit according to one Example of this invention. It is a figure explaining the process of 2nd round-5th round to which the circuit shown in FIG. 27 according to this invention is applied. FIG. 28 is a diagram illustrating an encryption processing configuration when the circuit shown in FIG. 27 according to an embodiment of the present invention is applied. It is a figure explaining the structural example of the encryption processing circuit according to one Example of this invention. It is a figure which shows the structural example of IC module as a cryptographic processing apparatus which performs the cryptographic processing which concerns on this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 111 Secret key 112 Encryption key schedule part 113 Extended key 114 Data encryption part 115 Round function 116 F function 121-123 Exclusive OR operation part 131-133 Exclusive OR operation part 151-156 Exclusive OR operation part 201 round function circuit 202 first key generation unit (KA _i generation circuit)
203 Second key generation unit (KB _i generation circuit)
211 to 213 Selector 214 Data register 215 to 216 Exclusive OR operation unit 221 Exclusive OR operation unit 222 Selector 251 Selector 252 to 253 Exclusive OR operation unit 271 Selector 272 to 273 Exclusive OR operation unit 302 to 305 F function 307 to 308 Exclusive OR operation unit 312 to 315 F function 321 to 324 Exclusive OR operation unit 351 Round function circuit 352 First key generation unit (KA _i generation circuit)
353 Second key generation unit (KB _i generation circuit)
354 Data register 355 to 356 Selector 357 Exclusive OR operation unit 412 to 415 F function 421 to 423 Exclusive OR operation unit 451 Round function circuit 452 First key generation unit (KA _i generation circuit)
453 Second key generation unit (KB _i generation circuit)
454 Data register 455 to 456 Selector 457 Exclusive OR operation unit 502 to 505 F function 512 to 515 F function 521 to 524 Exclusive OR operation unit 552 to 555 F function 562 to 565 F function 521 to 524 Exclusive OR Calculation unit 572 to 575 Exclusive OR operation unit 581 to 585 Exclusive OR operation unit 601 Round function circuit 602 First key generation unit (KA _i generation circuit)
603 Second key generation unit (KB _i generation circuit)
604 Replacement circuit 605 Data register 611 to 612 Selector 621 to 622 Exclusive OR operation unit 752 to 755 F function 762 to 765 F function 773 to 775 Exclusive OR operation unit 782 to 785 Exclusive OR operation unit 581 to 585 Exclusive OR operation unit 801 Round function circuit 802 First key generation unit (KA _i generation circuit)
803 Second key generation unit (KB _i generation circuit)
804 Replacement circuit 805 Data register 811-812 Selector 821-822 Exclusive OR operation unit 900 IC module 901 CPU (Central processing Unit)
902 Memory 903 Encryption processing unit 904 Random number generator 905 Transmission / reception unit

Claims (21)

A cryptographic processing device that executes a common key block cryptographic process;
Data encryption in which a first intermediate key KA and a second intermediate key KB having different data configurations generated based on a secret key K are applied, and a plurality of round functions are repeatedly executed to perform data conversion processing of input data Part
The data encryption unit
A round-function executing part for executing round functions round number r, the round function _(the proviso i integer from 1 to r) round key KA i generated based on the first intermediate key KA as an input key to A round function execution unit to be executed;
Of the input data or the output data of each round output by the round function execution unit, the key KB _i (based on the second intermediate key KB) is generated for the constituent data of the output data of at least three rounds. Where i is an integer of 0 to r + 1) and an exclusive OR operation unit for executing an exclusive OR operation with
A cryptographic processing device characterized by comprising: The data encryption unit
A first key generation unit that executes a generation process of the round key KA _i based on the first intermediate key KA;
A round-function executing part for executing round functions as an input key round keys KA _i for generating the first key generation unit,
A first selector that selectively outputs either the input data or the output data from the round function execution unit;
A second key generation unit that executes a process of generating a key KB _i based on the second intermediate key KB;
A second selector that executes selection output of a plurality of data including a key KB _i generated by the second key generation unit and a value of 0;
An exclusive OR operation unit that performs an exclusive OR operation between the configuration data of the output data of the first selector and the output data of the second selector;
The cryptographic processing apparatus according to claim 1, wherein the cryptographic processing apparatus has a configuration. The data encryption unit
A replacement processing unit that inputs a key KB _i generated by the second key generation unit and executes a bit position replacement process;
The second selector
3. The cryptographic processing apparatus according to claim 2, wherein the encryption processing apparatus is configured to selectively output any one of a key KB _i generated by the second key generation unit, a value of 0, and data generated by the replacement processing unit. The first key generation unit
Based on the first intermediate key KA, r round keys KA _{1 to} KA r to be input to the respective round functions of rounds _{1 to r} are generated,
The round function execution unit
The round functions are executed by sequentially inputting _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of the round functions of rounds _{1 to r} .
The second key generator is
Based on the second intermediate key KB, an initial key KB ₀ applied before the start of the round function, a final key KB _{r + 1} applied after the start of the final round function of _r rounds, and every two consecutive rounds Generate corresponding keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 ,
The exclusive OR operation unit is
Among the input data or the output data of each round output by the round function execution unit, the configuration data of the output data of at least three rounds and the keys KB ₀ and KB generated based on the second intermediate key KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 , KB _{r + 1} , and a key KB _i selected from the key KB _i . Cryptographic processing device. The exclusive OR operation unit is
The same key selected from the keys KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 generated based on the second intermediate key KB is used as output data from the round function execution units in different rounds. 5. The cryptographic processing apparatus according to claim 4, wherein the encryption processing apparatus is configured to execute an exclusive OR operation that is repeatedly used twice. The exclusive OR operation unit is
In the exclusive OR operation processing using the same key selected from the key KB _i repeatedly twice,
Input round keys for four consecutive round functions are four consecutive rounds 4p + 1 to 4p + 4 (including rounds to which keys selected from the keys KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 are applied. Where p is an integer greater than or equal to 0)
(A) enter the round key KA _{4p + 1} to 4p + 1 round,
(B) enter the round key KA _{4p + 2} to 4p + 2 round,
(C) Enter the round key [ KA _{4p + 3} (EXOR) KB _{4p + 3} ] in the 4p + 3 round,
(D) Enter the round key [ KA _{4p + 4} (EXOR) KB _{4p + 4} ] in 4p + 4 rounds,
The configuration is such that an exclusive OR operation process using the same key selected from the key KB _i twice is performed so as to be the round key input process of (a) to (d) above. The cryptographic processing device according to claim 5. The exclusive OR operation unit is
Key KB _i or key KB _i generated based on the second intermediate key KB for the input data or a part of the divided data obtained by dividing the output data from the round function execution unit into a plurality of pieces The cryptographic processing apparatus according to claim 1, wherein an exclusive OR operation with the split key is executed. The round function execution unit
When the input data is n-bit (where n is an integer of 2 or more), n / k bits (where k is a factor of 2 or more integer and n) is configured to input the divided data of the round function is executed The output data is generated by performing an exclusive OR operation between the input data to the unit and the round key KA _i, and further performing nonlinear transformation and linear transformation to generate output data. The cryptographic processing device according to claim 1.   The encryption processing apparatus according to claim 1, wherein the data encryption unit is configured to execute an encryption process according to a Feistel structure. The first intermediate key KA is key data generated by a non-linear transformation process for the secret key K,
The second intermediate key KB is
(A) data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K;
(B) data obtained by applying linear transformation to the secret key K;
(C) Secret key K itself It is the data comprised by either of said (a)-(c), The encryption processing apparatus in any one of Claims 1-9 characterized by the above-mentioned. An encryption processing method for executing a common key block encryption process in an encryption processing apparatus,
A data encryption unit applies a first intermediate key KA and a second intermediate key KB having different data configurations generated based on a secret key K, and repeatedly executes a plurality of round functions to perform data conversion processing of input data A data encryption step for performing
The data encryption step includes
Round-function executing part, the round-function executing step round key KA i _(where i is the integer of 1 to r) execute the round function rounds number r as an input key to be generated based on the first intermediate key KA When,
The exclusive OR operation unit is based on the second intermediate key KB for the configuration data of the output data of at least three rounds in the input data or the output data of each round output by the round function execution unit. An exclusive OR operation step of performing an exclusive OR operation with the key KB _i (where i is an integer from 0 to r + 1) generated by
A cryptographic processing method comprising: The data encryption step includes
A first key generation step in which a first key generation unit executes a generation process of a round key KA _i based on the first intermediate key KA;
Round-function executing part, and the round-function executing step of executing round functions round keys KA _i for generating the first key generating section as an input key,
A first data selection step in which the first selector selects and outputs either the input data or the output data from the round function execution unit;
A second key generation step in which a second key generation unit executes a key KB _i generation process based on the second intermediate key KB;
A second data selection step in which the second selector executes a selection output of a plurality of data including the key KB _i generated by the second key generation unit and the value 0;
An exclusive OR operation unit that performs an exclusive OR operation on the configuration data of the output data of the first selector and the output data of the second selector; and
The cryptographic processing method according to claim 11, comprising: The data encryption step further comprises:
The replacement processing unit has a replacement processing step of inputting a key KB _i generated by the second key generation unit and executing a bit position replacement process,
The second data selection step includes
13. The encryption processing method according to claim 12, wherein the encryption processing method is a step of selectively outputting any one of a key KB _i generated by the second key generation unit, a value 0, and generation data of the replacement processing unit. The first key generation step includes:
Based on the first intermediate key KA, r round keys KA _{1 to} KA r to be input to the respective round functions of rounds _{1 to r} are generated,
The round function execution step includes:
The round functions are executed by sequentially inputting _r round keys KA _{1 to} KA r generated based on the first intermediate key KA to each of the round functions of rounds _{1 to r} .
The second key generation step includes
Based on the second intermediate key KB, an initial key KB ₀ applied before the start of the round function, a final key KB _{r + 1} applied after the start of the final round function of _r rounds, and every two consecutive rounds Generate corresponding keys KB ₃ , KB ₄ ,... KB _r-3 , KB _r-2 ,
The exclusive OR operation step includes:
Among the input data or the output data of each round output by the round function execution unit, the configuration data of the output data of at least three rounds and the keys KB ₀ and KB generated based on the second intermediate key KB 13. The step of performing an exclusive OR operation with a key KB _i selected from ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 , KB _{r + 1} . Cryptographic processing method. The exclusive OR operation step includes:
The same key selected from the keys KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 generated based on the second intermediate key KB is used as output data from the round function execution units in different rounds. The encryption processing method according to claim 14, wherein the encryption processing method is a step of executing an exclusive OR operation that is repeatedly used twice. The exclusive OR operation step includes:
In the exclusive OR operation processing using the same key selected from the key KB _i repeatedly twice,
Input round keys for four consecutive round functions are four consecutive rounds 4p + 1 to 4p + 4 (including rounds to which keys selected from the keys KB ₃ , KB ₄ ,..., KB _r-3 , KB _r-2 are applied. Where p is an integer greater than or equal to 0)
(A) enter the round key KA _{4p + 1} to 4p + 1 round,
(B) enter the round key KA _{4p + 2} to 4p + 2 round,
(C) Enter the round key [ KA _{4p + 3} (EXOR) KB _{4p + 3} ] in the 4p + 3 round,
(D) Enter the round key [ KA _{4p + 4} (EXOR) KB _{4p + 4} ] in 4p + 4 rounds,
It is a step of executing exclusive OR operation processing using the same key selected from the key KB _i twice so as to be the round key input processing of (a) to (d) above. The encryption processing method according to claim 15. The exclusive OR operation step includes:
Key KB _i or key KB _i generated based on the second intermediate key KB for the input data or a part of the divided data obtained by dividing the output data from the round function execution unit into a plurality of pieces The encryption processing method according to claim 11, wherein the encryption processing method is a step of executing an exclusive OR operation with the split key. The round function execution step includes:
When the input data is n-bit (where n is an integer of 2 or more), n / k bits (where k is a factor of 2 or more integer and n) enter the divided data of the input to the round-function executing parts 18. The step of performing an exclusive OR operation between data and the round key KA _i, and further performing nonlinear transformation and linear transformation to generate output data. Encryption processing method.   19. The encryption processing method according to claim 11, wherein the data encryption step is a step of executing an encryption process according to a Feistel structure. The first intermediate key KA is key data generated by a non-linear transformation process for the secret key K,
The second intermediate key KB is
(A) data obtained by applying a non-linear transformation different from the first intermediate key KA to the secret key K;
(B) data obtained by applying linear transformation to the secret key K;
(C) Secret key K itself It is the data comprised by either of said (a)-(c), The encryption processing method in any one of Claims 11-19 characterized by the above-mentioned. In a cryptographic processing device, a computer program for executing a common key block cryptographic process,
Applying the first intermediate key KA and the second intermediate key KB having different data configurations generated based on the secret key K to the data encryption unit and repeatedly executing a plurality of round functions to convert the input data Having a data encryption step to perform
The data encryption step includes
The round-function executing part, the round key KA i _(where i is an integer of 1 to r) that is generated based on the first intermediate key KA and the round-function executing step of executing the round function as input keys, and
Based on the second intermediate key KB for the configuration data of the output data of at least three rounds in the input data or the output data of each round output by the round function execution unit to the exclusive OR operation unit An exclusive OR operation step for executing an exclusive OR operation with the key KB _i (where i is an integer of 0 to r + 1) generated by
A computer program comprising:

Images