JP6273224B2 - ENCRYPTION SYSTEM, ENCRYPTION DEVICE, DECRYPTION DEVICE, ENCRYPTION METHOD - Google Patents

Description

  The present invention relates to an encryption system, an encryption device, a decryption device, and an encryption method for executing authentication encryption with additional authentication data.

  The authentication encryption with additional authentication data is a common key encryption primitive that performs concealment of the message M and authentication (falsification detection) of M and the additional authentication data A at the same time. It consists of two functions, an encryption function and a decryption function. In the additional authentication data authentication encryption, the receiver and the sender share a secret key K in advance. In addition to the message M and the additional authentication data A, the sender selects a value N (called nonce) that changes every time the encryption function is called. The encryption function generates a ciphertext C and a tag T corresponding to M, A, and N, and sends a set of (C, T, A, N) to the receiver. The recipient receives (C, T, A, N), but at this point there is no guarantee that these values have not been tampered with by a malicious third party. The receiver calculates the decryption function using the received (C, T, A, N) and K held by the receiver. The decryption function calculates a message M ′ and a tag T ′. If the calculated T ′ and the received T are the same value, it is determined that the received (C, T, A, N) is a correct value, and M ′ is output as a decoded message. If T ≠ T ′, a result indicating that decoding has failed (data has been altered) is output.

  SPONGEWRAP described in Non-Patent Document 1 is a configuration method of an encryption function and a decryption function of an authentication encryption. The encryption function and the decryption function are configured using a relatively large size replacement (bijective map) compared to the security level (number of bits) to be guaranteed.

<SPONGEWRAP>
The encryption function of SPONGEWRAP uses b-bit data called a state, b-bit replacement f: {0, 1} ^b → {0, 1} ^b , input data (N, A, M), and key K. Then, C and T are calculated while repeatedly updating. The b-bit state is divided into r bits called rate and c (= b−r) bits called capacity. When calculating the encryption function, the value of the state is initialized to a predetermined b-bit value called an initial value IV (for example, IV = 0), the b-bit is replaced by f, and the state is updated. The The specific calculation procedure of the encryption function is as described in the following procedure 1 to procedure 4. Fig. 1 shows the calculation structure of SPONGEWRAP encryption.

<Procedure 1>
The key K is divided every r−1 bits. In the final block, a padding process called 10 * padding is performed. Specifically, when the bit length of the last block is shorter than r−1 bits, a 1-bit value “1” is given, and then a bit “0” is given until r−1 bits. When the bit length of the final block is exactly r−1 bits, a 1-bit value “1” is given as the first bit of the next block, and then a bit “0” is given until r−1 bits. .

  A 1-bit value called a frame bit is concatenated with each value obtained by dividing K by r−1 bits to make r bits. Specifically, the frame bit is set to “0” from the first block to the block immediately before the final block, and the frame bit is set to “1” only for the final block. For the r bits in the rate portion of the b-bit state, the exclusive OR of K and the r-bit value obtained by concatenating the frame bits is calculated, and the substitution f is calculated. The output of f is a new state value. This operation is continued until the last block of K is exclusive ORed. Since this process can be performed in advance, the procedure up to step 1 may be called initialization.

<Procedure 2>
The nonce N and the additional authentication data A are concatenated and divided every r−1 bits. 10 * padding is applied to the final block. A frame bit of 1 bit is concatenated to each value obtained by dividing the concatenation of N and A every r−1 bits to make r bits. Specifically, the frame bit is set to “0” from the first block to the block immediately before the final block, and the frame bit is set to “1” only for the final block. In the b-bit state, the exclusive OR of N or A and the r-bit value obtained by concatenating the frame bits is calculated for the r bit of the rate part, and the permutation f is calculated. The output of f is a new state value. This operation is continued until the final blocks of N and A are exclusive ORed.

<Procedure 3>
The message M is divided every r-1 bits. 10 * padding is applied to the final block. A frame bit of 1 bit is concatenated to each value obtained by dividing the concatenation of M every r−1 bits to make r bits. Specifically, the frame bit is set to “1” from the first block to the block immediately before the final block, and the frame bit is set to “0” only for the final block.

  For the r bits in the rate portion of the b-bit state, an exclusive OR of M and the r-bit value obtained by concatenating the frame bits is calculated. The calculated r bits are output as the r bits of the ciphertext. The permutation f is calculated for the state, and the output of f is set as a new state value. This operation is continued until the final block of M is exclusive ORed. If the size of M is not a multiple of r, the last block outputs only the fractional part as ciphertext and performs an exclusive OR with the state.

<Procedure 4>
Among the b bit states, the r bit of the rate part is output as the r bit of the tag. The permutation f is calculated for the state, and the output of f is set as a new state value. This operation is continued until the number of bits of the tag is reached. If the tag length is not a multiple of r, the output of the last r bits is rounded down to the required fraction and used as the tag output.

<Decryption>
SPONGEWRAP's decryption function performs almost the same calculation as the encryption function. FIG. 2 shows a calculation structure in the decoding of SPONGEWRAP. The state is initialized to IV, and the same processing as the procedure 1 and 2 of the encryption function is performed. The procedure 3 is different from the encryption function. In the b-bit state, the exclusive OR of the r bits of the rate part and the r bits of C is obtained, and the value obtained through the reverse procedure of padding and frame bit assignment is expressed as M. The r-1 bit of '. Of the b-bit states, replace the r bits of the rate part with the r bits of C, and calculate the permutation f. The output of f is a new state value. This operation is continued until the final block of C is exclusive ORed. When the size of the final block of C is not a multiple of r, only the fraction is used for generating M ′ and replacing the state. After the procedure 3 is completed, the same processing as the procedure 4 of the encryption function is performed to obtain a tag T ′. The calculated T ′ is compared with the received T, and if it is the same value, M ′ is output as a decoded message. If they do not match, a result indicating that decoding has failed is output.

<DonkeySponge>
The donkeySponge shown in Non-Patent Document 2 is a method for calculating a message authentication code using the additional authentication data processing part of SPONGEWRAP. Fig. 3 shows the calculation structure of donkeySponge. For the purpose of generating the message authentication code, even if the key K and the input A are exclusively ORed with all the bits of the b bit state, the input data can be processed efficiently without impairing the security.

<MonkeyDuplex>
The monkeyDuplex shown in Non-Patent Document 2 is a method that allows more efficient calculation by adding ingenuity to the K and N processing methods of SPONGEWRAP. The capacity part of c bits of IV is made up to c bits of K. Alternatively, an exclusive OR of up to K c bits and a separately defined c bit constant is used as a capacity portion of IV c bits. In any method, the calculation function of f can be reduced in the procedure 1 (K processing) with the encryption function and the decryption function, so that the calculation efficiency increases. If K is less than c bits, all c bits of IV are defined by appropriate padding.

  Further, the rate part of IV r bits is defined up to N r bits. Alternatively, the exclusive OR of up to N r bits and a separately defined r bit constant is used as the rate portion of IV r bits. Since the calculation function of f in the procedure 2 can be reduced, the calculation efficiency increases. If N is less than r bits, all r bits of IV are defined by appropriate padding. Figure 4 shows the state initialization and K and N processing by monkeyDuplex.

Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche, “Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications”, SAC 2011, (eds.) Ali Miri and Serge Vaudenay, LNCS, Vol. 7118, pages 320- 337, Springer, 2012. Guido Bertoni, Joan Daemen, Michael Peeters and Gilles Van Assche, “Permutation-based encryption, authentication and authenticated encryption”, Workshop Records of DIAC 2012.

  However, in SPONGEWRAP, the additional authentication data A is processed for every r−1 bits, so the number of replacement operations f increases and is inefficient. Accordingly, an object of the present invention is to reduce the number of operations of the replacement operation f.

The encryption system of the present invention has an encryption device and a decryption device. First, K is a secret key shared by both the encryption device and the decryption device, A is additional authentication data, M is a message, C is ciphertext, T is a tag, K, A, and M are bit strings, and N is all bits Is a bit string excluding a bit string of “0”, r, c, b, P, Q, U are integers of 1 or more, b = r + c, p is an integer of 1 to P, q is an integer of 1 to Q, u Is an integer of 1 to U, S is an integer of 1 or more, s is an integer of 1 to S, f is a b-bit permutation operation, g is an integer of 0 to 2 ^c −1 It is assumed that the element is multiplied by a predetermined constant other than 0 and 1 on a finite field. Further, the state is a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part.

The first encryption device according to the present invention includes an encryption initial value setting unit, an encryption additional authentication data header division unit, a message division unit, an encryption additional authentication data trailer division unit, and an encryption additional authentication data header. A calculation unit, an encryption unit, an encryption additional authentication data trailer calculation unit, an encryption tag calculation unit, and an output unit are provided. The encryption initial value setting unit selects N, generates a b-bit encryption initial value using N and K, and sets the result of replacing the encryption initial value with f as a state. Encryption for additional authentication data header dividing portion, 'the additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., is divided into a Q _'. The message dividing unit divides the message M into message blocks m ₁ ,..., M _P every r bits using padding. If there is a trailer A ″ of additional authentication data A, the additional authentication data trailer for encryption uses the trailer A ″ of additional authentication data A as an additional authentication data block a ₁ ″ for each b bits using padding. ,..., A _U ”. The encryption additional authentication data header calculation unit calculates the exclusive OR of the additional authentication data block a _q ′ with respect to the state, and further sets q = 1 as the result obtained by replacing with f. To q = Q. The encryption unit executes the following processes (1) to (3).

(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result of replacement by f is used as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) The ciphertext C is obtained using the combination processing of the cipher blocks d ₁ ,..., D _P.
When there is a trailer A ″ of additional authentication data A, the encryption additional authentication data trailer calculation unit calculates an exclusive OR with the additional authentication data block a _u ″ for the state, and further replaces it with f The process of setting the result as a new state is repeated from u = 1 to u = U.

The tag calculation unit for encryption obtains the tag T from the rate portion of the state when S = 1, and when S ≧ 2, sets the rate portion of the state as the tag block t ₁ and further replaces the state with f. the results the process of the tag block t _s the rate portion as a new state repeatedly from s = 2 to s = S, tag block t _1, ..., determine the tag T using t _S. The output unit outputs a set of C, T, A, and N.

The first decryption device of the present invention includes an input unit, a decryption initial value setting unit, a decryption additional authentication data header splitting unit, a ciphertext splitting unit, a decryption additional authentication data trailer splitting unit, and a decryption additional authentication data header calculation. A decryption unit, a decryption additional authentication data trailer calculation unit, a decryption tag calculation unit, and a verification unit. The input unit acquires a set of C, T, A, and N. The initial value setting unit for decoding generates a b-bit initial value for decoding using N and K, and sets the result obtained by replacing the initial value for decoding with f as a state. Additional authentication data header dividing portion for decoding, 'the additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., is divided into a Q _'. The ciphertext dividing unit divides the ciphertext C into r-bit cipher blocks d ₁ ,..., D _P. When the trailer A ″ of the additional authentication data A exists, the decryption additional authentication data trailer dividing unit converts the additional authentication data A trailer A ″ to the additional authentication data block a ₁ ″ for each b bits using padding. ..., a _U ". The additional authentication data header calculation unit for decryption calculates an exclusive OR with the additional authentication data block a _q ′ for the state, and further changes the result replaced with f to a new state from q = 1. Repeat until q = Q. The decoding unit executes the following processes (1) to (3).

(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit in the capacity portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) A message M ′ is formed by combining the message blocks m ₁ ′,..., M _P ′ by removing the bits added by padding.
When there is a trailer A ″ of additional authentication data A, the decryption additional authentication data trailer calculation unit calculates an exclusive OR with the additional authentication data block a _u ″ for the state, and further replaces it with f The process of setting the result as a new state is repeated from u = 1 to u = U. The decoding tag calculation unit obtains the tag T ′ from the rate portion of the state when S = 1, and sets the rate portion of the state as the tag block t ₁ ′ when S ≧ 2, and further replaces the state with f. as a result of the tag block t _s the rate portion as a new state _'a process to be repeated from s = 2 to s = S, tag block t _1', ..., determine the _'tag T using a' t S. The verification unit compares the tag T and the tag T ′.

The second encryption apparatus of the present invention includes an encryption initial value setting unit, an encryption additional authentication data division unit, a message division unit, an encryption additional authentication data calculation unit, an encryption unit, and an encryption tag calculation. And an output unit. The difference from the first encryption device is whether or not the additional authentication data is processed separately for the header and trailer. Additional authentication data header division for encryption, additional authentication data trailer division for encryption, additional authentication data header calculation unit for encryption, additional authentication data trailer calculation unit for encryption And an additional authentication data calculation unit for encryption. The additional authentication data division unit for encryption divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q for each b bits using padding. The additional authentication data calculation unit for encryption calculates an exclusive OR with the additional authentication data block a _q for the state, and further changes the result of replacement with f to a new state from q = 1 to q Repeat until = Q. Other configurations are the same as those of the first encryption device.

The second decryption device of the present invention includes an input unit, an initial value setting unit for decryption, an additional authentication data division unit for decryption, a ciphertext division unit, an additional authentication data calculation unit for decryption, a decryption unit, a tag calculation unit for decryption, A verification unit is provided. The difference from the first decryption apparatus is whether or not the additional authentication data is processed by being divided into a header and a trailer. Decryption additional authentication data header division unit, Decryption additional authentication data trailer division unit, Decryption additional authentication data header calculation unit, Decryption additional authentication data trailer calculation unit, Decryption additional authentication data header division unit, Decoding additional addition An authentication data calculation unit is provided. The additional authentication data division unit for decryption divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q for every b bits using padding. The additional authentication data calculation unit for decryption calculates the exclusive OR with the additional authentication data block a _q for the state, and further changes the result of replacement with f to a new state from q = 1 to q = Repeat until Q. Other configurations are the same as those of the first decoding device.

  In SPONGEWRAP, the additional authentication data A is processed every r−1 bits. On the other hand, according to the encryption system of the present invention, even if an exclusive OR operation is performed on the capacity portion, the result cannot be understood, so that safe encryption can be realized. Therefore, in the process of the additional authentication data A, an exclusive OR for every b bits (exclusive OR with the entire trailer) can be performed. Therefore, since the operation of the exclusive OR between the additional authentication data and the state can be processed at least every b−1 bits, the number of replacement operations f can be reduced.

The figure which shows the calculation structure in the encryption of SPONGEWRAP. The figure which shows the calculation structure in the decoding of SPONGEWRAP. The figure which shows the calculation structure of donkeySponge. The figure which shows the initialization of the state by monkeyDuplex, and the process of K and N. FIG. 3 is a diagram illustrating a functional configuration example of the encryption system according to the first embodiment. FIG. 3 is a diagram illustrating an example of a calculation structure in encryption according to the first embodiment. FIG. 6 is a diagram illustrating an example of a calculation structure in decoding according to the first embodiment. FIG. 3 is a diagram illustrating a processing flow of the encryption apparatus according to the first embodiment. FIG. 3 is a diagram illustrating a processing flow of the decoding apparatus according to the first embodiment. FIG. 10 is a diagram illustrating a functional configuration example of an encryption system according to a first modification. FIG. 10 is a diagram illustrating an example of a calculation structure in encryption according to the first modification. The figure which shows the example of the calculation structure in the decoding of Example 1 modification 1. FIG. FIG. 10 is a diagram illustrating a processing flow of the encryption device according to the first modification. FIG. 10 is a diagram illustrating a processing flow of the decoding device according to the first modification.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

FIG. 5 shows a functional configuration example of the encryption system according to the first embodiment. FIG. 6 is a diagram illustrating an example of a calculation structure in encryption according to the first embodiment, and FIG. 7 is a diagram illustrating an example of a calculation structure in decryption according to the first embodiment. FIG. 8 is a processing flow of the encryption apparatus according to the first embodiment, and FIG. 9 is a diagram illustrating a processing flow of the decryption apparatus according to the first embodiment. The encryption system according to the first embodiment includes an encryption device 100 and a decryption device 200 connected via a network 800. First, a secret key, an additional authentication data A, message M, ciphertext C, tag number of bits T L _T, K, A, M a bit sequence that shares K for both encryption device and the decryption device, N is a bit string excluding a bit string in which all bits are “0”, r, c, b, P, Q, U are integers of 1 or more, b = r + c, p is an integer of 1 to P, q is 1 to Q The following integers, u is an integer of 1 to U, S is an integer of 1 or more, s is an integer of 1 to S, f is a b-bit permutation operation, g is an integer of 0 to 2 ^c −1 Multiplication on a finite field between a finite field element consisting of and a predetermined constant other than 0 and 1. Further, the state is a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part.

<Encryption device>
The encryption device 100 includes an initial value setting unit 110, an additional authentication data header division unit 120, a message division unit 130, an additional authentication data trailer division unit 140, an additional authentication data header calculation unit 150, an encryption unit 160, and an additional authentication data trailer. A calculation unit 170, a tag calculation unit 180, and an output unit 190 are provided. The initial value setting unit 110 selects N, generates a b-bit initial value using N and K, and sets the result obtained by replacing the initial value with f as a state (S110). For example, the initial value setting unit 110 may embed N in the rate portion and embed K in the capacity portion as the initial value. “Embedding” means, for example, that when the number of bits of N is smaller than r, it is converted to r bits by padding and made into a rate portion. When the number of bits of N is larger than r, r bits may be cut out from N, or converted into r bits using a hash function or the like to be a rate part. f is the same as the replacement described in SPONGEWRAP, and is determined in advance between the encryption device 100 and the decryption device 200. In FIG. 6, a portion surrounded by a dotted line with 110 corresponds to the initial value setting unit.

The additional authentication data header dividing unit 120 divides the header A ′ of the additional authentication data A into additional authentication data blocks a ₁ ′,..., A _Q ′ for every b bits using padding (S120). When 10 * padding is used as the padding, the header A ′ is padded so as to be an integral multiple of b−1, b−1 bits are cut out, frame bits are added, and the additional authentication data block a _q ′ What is necessary is just to divide into. In addition, when 10 * 1 padding (padding for adding a bit string in which the first and last bits are “1” and the remaining bits are “0”) is used as the padding, the header A ′ has an integer multiple of b. Padding is performed, and b bits are cut out and divided into additional authentication data blocks a _q ′. In FIG. 6, a portion surrounded by a dotted line with 120 corresponds to a message dividing unit.

The message dividing unit 130 divides the message M into message blocks m ₁ ,..., M _P every r bits using padding (S130). For the padding of the message dividing unit 130, 10 * padding may be used. In FIG. 6, a part surrounded by a dotted line marked with 130 corresponds to a message dividing part. When the additional authentication data header dividing unit 120 and the additional authentication data trailer dividing unit 140 use 10 * padding, r-1 bits may be extracted from the message M, and frame bits may be added to make r bits. When the additional authentication data header dividing unit 120 and the additional authentication data trailer dividing unit 140 use 10 * 1 padding, it is possible to determine whether each replacement operation f is processing for the additional authentication data A or processing for the message M. M may be divided into r bits (frame bits can be omitted).

When there is a trailer A ″ of additional authentication data A, the additional authentication data trailer division unit 140 uses the padding to add the additional authentication data block a ₁ ″,. , A _U ″ (S140). When 10 * padding is used as the padding, padding is performed so that the header A ′ is an integral multiple of b−1, b−1 bits are cut out, frame bits are added, and the additional authentication data block a _q ′ What is necessary is just to divide into. When 10 * 1 padding is used as padding, padding is performed so that the header A ′ is an integer multiple of b, and b bits are cut out and divided into additional authentication data blocks a _q ′. If the trailer A ″ of the additional authentication data A does not exist, the additional authentication data trailer dividing unit 140 does not perform any processing. In FIG. 6, the portion surrounded by the dotted line marked with 140 is the additional authentication data trailer division. It corresponds to the part.

The additional authentication data header calculation unit 150 calculates the exclusive OR of the additional authentication data block a _q ′ with respect to the state and changes the result of replacement with f to a new state from q = 1 to q Repeat until = Q (S150). “Exclusive OR” is an exclusive OR of each bit, and is an operation for performing an exclusive OR of bits at the same position. For example, the result of the exclusive OR of the bit string “10100” and the bit string “00110” is “10010”. In FIG. 6, a portion surrounded by a dotted line with 150 corresponds to an additional authentication data header calculation unit.

  The encryption unit 160 executes the following processes (1) to (3) (S160). In FIG. 6, a portion surrounded by a dotted line with 160 corresponds to the encryption unit.

(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result of replacement by f is used as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) The ciphertext C is obtained using the combination processing of the cipher blocks d ₁ ,..., D _P. “Determining ciphertext C using concatenation processing” means simply combining cipher blocks d ₁ ,..., D _P into ciphertext C, and combining after removing frame bits from each cipher block d _p. The ciphertext C, and the combined ciphertext C after removing the padding portion.

The additional authentication data trailer calculation unit 170 calculates the exclusive OR of the additional authentication data block a _u ″ for the state when the trailer A ″ of the additional authentication data A exists, and further replaces it with f Is repeated from u = 1 to u = U (S170). In FIG. 6, a portion surrounded by a dotted line with 170 corresponds to the additional authentication data trailer calculation unit. When the trailer A ″ of the additional authentication data A does not exist, the additional authentication data trailer calculation unit 170 performs no processing.

Tag calculation section 180 obtains tag T from the rate portion of the state when S = 1. If S ≧ 2, the rate portion of the state is the tag block t ₁ . Further in the case of S ≧ 2, and repeats the processing of the rate portion results state was replaced by f as a new state with the tag block t _s from s = 2 to s = S. The tag block _t 1, ..., determine the tag T using _{t S} (S180). For S = 1, to the rate portion may be directly tag T, may be a tag T by only the cut-out number of bits L _T from the rate portion. For S ≧ 2, for example, tag block t _1, ..., may be set as the tag T a result of coupling the t _S, tag block t _1, ..., than the number of bits L _T from the result obtained by combining the t _S truncated more bits (cut out the number of bits L _T min) or as a tag T. Further, after cutting out a predetermined bit from each tag block t _s, or as a tag T attached to them. Note, S is, it is sufficient to set in advance so as r × S is equal to or greater than the number of bits L _T of the tag T. In FIG. 6, a portion surrounded by a dotted line with 180 corresponds to a tag calculation unit. The output unit 190 outputs a set of C, T, A, and N (S190). The set of C, T, A, and N output is transmitted to the decoding device 200.

<Decoding device>
The decryption apparatus 200 includes an input unit 290, an initial value setting unit 210, an additional authentication data header division unit 220, a ciphertext division unit 230, an additional authentication data trailer division unit 240, an additional authentication data header calculation unit 250, a decryption unit 260, and an addition An authentication data trailer calculation unit 270, a tag calculation unit 280, and a verification unit 285 are provided. The input unit 290 acquires a set of C, T, A, and N (S290).

  The initial value setting unit 210 generates a b-bit initial value using N and K, and sets the result obtained by replacing the initial value with f as a state (S210). For example, the initial value setting unit 210 may embed N in the rate part and K in the capacity part as the initial value. In FIG. 7, a portion surrounded by a dotted line marked with 210 corresponds to an initial value setting unit.

The additional authentication data header dividing unit 220 divides the header A ′ of the additional authentication data A into additional authentication data blocks a ₁ ′,..., A _Q ′ for every b bits using padding (S220). When 10 * padding is used as the padding, padding is performed so that the header A ′ is an integral multiple of b−1, b−1 bits are cut out, frame bits are added, and the additional authentication data block a _q ′ What is necessary is just to divide into. Also, when using 10 * 1 padding (padding where the first and last bits are “1” and the remaining bits are “0”), padding is performed so that the header A ′ is an integral multiple of b. And b bits are cut out and divided into additional authentication data blocks a _q ′. In FIG. 7, a portion surrounded by a dotted line with 220 corresponds to a message dividing unit.

The ciphertext dividing unit 230 divides the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits (S230). In FIG. 7, a portion surrounded by a dotted line with 230 corresponds to a message dividing unit. Note that additional authentication data header dividing portion 220 and additional authentication data trailer dividing unit 240, when using a 10 * padding, excised r-1 bits from the ciphertext C, by the cipher block d _p by adding a frame bit That's fine. When the additional authentication data header dividing unit 220 and the additional authentication data trailer dividing unit 240 use 10 * 1 padding, it is possible to determine whether each replacement operation f is processing for the additional authentication data A or processing for the message M. What is necessary is just to cut out r bits from the sentence C to make a cipher block d _p .

If there is a trailer A ″ of the additional authentication data A, the additional authentication data trailer dividing unit 240 uses the padding to add the additional authentication data block a ₁ ″,. , A _U ″ (S240). When 10 * padding is used as the padding, padding is performed so that the header A ′ is an integral multiple of b−1, b−1 bits are cut out, frame bits are added, and the additional authentication data block a _q ′ What is necessary is just to divide into. When 10 * 1 padding is used as padding, padding is performed so that the header A ′ is an integer multiple of b, and b bits are cut out and divided into additional authentication data blocks a _q ′. When the trailer A ″ of the additional authentication data A does not exist, the additional authentication data trailer dividing unit 240 performs no processing. In FIG. 7, the portion surrounded by the dotted line denoted by 240 is the additional authentication data trailer division. It corresponds to the part.

The additional authentication data header calculation unit 250 calculates an exclusive OR with the additional authentication data block a _q ′ for the state, and further changes the result of replacement with f to a new state from q = 1 to q. Repeat until = Q (S250). In FIG. 7, a portion surrounded by a dotted line with 250 corresponds to the additional authentication data header calculation unit.

  The decoding unit 260 executes the following processes (1) to (3) (S260). In FIG. 7, a portion surrounded by a dotted line denoted by 260 corresponds to a decoding unit.

(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit in the capacity portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) A message M ′ is formed by combining the message blocks m ₁ ′,..., M _P ′ by removing bits added by padding.

The additional authentication data trailer calculation unit 270 calculates the exclusive OR of the additional authentication data block a _u ″ with respect to the state when the trailer A ″ of the additional authentication data A exists, and the result of replacement with f Is set to a new state from u = 1 to u = U (S270). In FIG. 7, a portion surrounded by a dotted line with 270 corresponds to the additional authentication data trailer calculation unit.

Tag calculation unit 280 obtains tag T ′ from the rate portion of the state when S = 1. When S ≧ 2, the rate portion of the state is the tag block t ₁ ′. In the case of S ≧ 2, the process of replacing the state with f as a new state and setting the rate portion as the tag block t _s ′ is repeated from s = 2 to s = S. The tag block _{t 1 ', ..., t S} ' Request tag T 'using (S280). In FIG. 7, a portion surrounded by a dotted line with 280 corresponds to a tag calculation unit. The verification unit 285 compares the tag T and the tag T ′ (S285). The decoding device 200 sets the message M ′ as a decoded message when T = T ′. When T ≠ T ′, a result indicating that decoding has failed is output.

<Effect>
In the encryption system according to the first embodiment, attention is paid to the fact that even if the exclusive OR operation is performed on the capacity portion, the security of the encryption can be secured if the result is not understood. Then, g is calculated in the process (2) of the encryption unit 160 and the decryption unit 260 so that the result is not known. Therefore, in the process of the additional authentication data A, an exclusive OR for every b bits (exclusive OR with the entire trailer) can be performed. Even when the frame bit cannot be omitted, the exclusive OR operation between the additional authentication data A and the state can be processed for every b−1 bits, so that the number of replacement operations f can be reduced. Further, in the padding of the additional authentication data header dividing units 120 and 220 and the additional authentication data trailer dividing units 140 and 240, if 10 * 1 padding is used, a frame bit can be made unnecessary. The sum operation can be processed every b bits, and the exclusive OR operation between the message and the rate portion of the state can be processed every r bits. Therefore, the number of replacement operations f can be reduced.

[Modification 1]
FIG. 10 shows an example of the functional configuration of the encryption system according to this modification. FIG. 11 is a diagram showing an example of a calculation structure in the encryption of this modification, and FIG. 12 is a diagram showing an example of a calculation structure in the decryption of this modification. FIG. 13 is a process flow of the encryption apparatus according to the present modification, and FIG. 14 is a diagram illustrating a process flow of the decryption apparatus according to the modification. The encryption system according to the present modification includes an encryption device 300 and a decryption device 400 connected via a network 800.

<Encryption device>
The encryption device 300 includes an initial value setting unit 110, an additional authentication data division unit 320, a message division unit 130, an additional authentication data calculation unit 350, an encryption unit 160, a tag calculation unit 180, and an output unit 190. The initial value setting unit 110 selects N, generates a b-bit initial value using N and K, and sets the result obtained by replacing the initial value with f as a state (S110). In FIG. 11, a portion surrounded by a dotted line with 110 corresponds to an initial value setting unit.

The additional authentication data division unit 320 divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q for each b bits using padding (S320). When 10 * padding is used as padding, the additional authentication data A is padded so as to be an integer multiple of b−1, b−1 bits are cut out, frame bits are added, and additional authentication data block a _{q is} added. What is necessary is just to divide into. When 10 * 1 padding is used as padding, additional authentication data A may be padded so as to be an integral multiple of b, and b bits may be cut out and divided into additional authentication data blocks _aq . In FIG. 11, a portion surrounded by a dotted line with 320 corresponds to a message dividing unit.

The message dividing unit 130 divides the message M into message blocks m ₁ ,..., M _P every r bits using padding (S130). For the padding of the message dividing unit 130, 10 * padding may be used. In FIG. 11, a part surrounded by a dotted line with 130 corresponds to a message dividing part. When the additional authentication data division unit 320 uses 10 * padding, r-1 bits may be extracted from the message M, and frame bits may be added to make r bits. When the additional authentication data dividing unit 320 uses 10 * 1 padding, it can be determined whether each replacement operation f is processing for the additional authentication data A or processing for the message M. Therefore, if the message M is divided into r bits, Good (can omit frame bits).

The additional authentication data calculation unit 350 calculates an exclusive OR with the additional authentication data block a _q for the state, and further changes the result replaced with f to a new state from q = 1 to q = Q. Repeat until step S350. In FIG. 11, a portion surrounded by a dotted line with 350 corresponds to the additional authentication data header calculation unit.

  The encryption unit 160 executes the following processes (1) to (3) (S160). In FIG. 11, a portion surrounded by a dotted line with 160 corresponds to the encryption unit.

(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result of replacement by f is used as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) The ciphertext C is obtained using the combination processing of the cipher blocks d ₁ ,..., D _P. “Determining ciphertext C using concatenation processing” means simply combining cipher blocks d ₁ ,..., D _P into ciphertext C, and combining after removing frame bits from each cipher block d _p. Meaning ciphertext C, and combining and removing the padding part to make ciphertext C.

Tag calculation section 180 obtains tag T from the rate portion of the state when S = 1. If S ≧ 2, the rate portion of the state is the tag block t ₁ . Further in the case of S ≧ 2, and repeats the processing of the rate portion results state was replaced by f as a new state with the tag block t _s from s = 2 to s = S. The tag block _t 1, ..., determine the tag T using _{t S} (S180). In FIG. 11, a portion surrounded by a dotted line with 180 corresponds to a tag calculation unit. The output unit 190 outputs a set of C, T, A, and N (S190). The set of C, T, A, and N output is transmitted to the decoding device 200.

<Decoding device>
The decryption device 400 includes an input unit 290, an initial value setting unit 210, an additional authentication data division unit 420, a ciphertext division unit 230, an additional authentication data calculation unit 450, a decryption unit 260, a tag calculation unit 280, and a verification unit 285. The input unit 290 acquires a set of C, T, A, and N (S290).

  The initial value setting unit 210 generates a b-bit initial value using N and K, and sets the result obtained by replacing the initial value with f as a state (S210). In FIG. 12, a portion surrounded by a dotted line marked with 210 corresponds to an initial value setting unit.

The additional authentication data division unit 420 divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q for each b bits using padding (S420). When 10 * padding is used as padding, the additional authentication data A is padded so as to be an integer multiple of b−1, b−1 bits are cut out, frame bits are added, and additional authentication data block a _{q is} added. What is necessary is just to divide into. When 10 * 1 padding is used as padding, additional authentication data A may be padded so as to be an integral multiple of b, and b bits may be cut out and divided into additional authentication data blocks _aq . In FIG. 12, a portion surrounded by a dotted line with 420 corresponds to a message dividing unit.

The ciphertext dividing unit 230 divides the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits (S230). In FIG. 12, a portion surrounded by a dotted line with 230 corresponds to a message dividing unit. In the case where the additional authentication data dividing unit 420 using 10 * padding excised r-1 bits from the ciphertext C, it is sufficient to cipher block d _p by adding a frame bit. When the additional authentication data dividing unit 420 uses 10 * 1 padding, it is possible to determine whether each replacement operation f is processing for the additional authentication data A or processing for the message M. d _p may be used.

The additional authentication data calculation unit 450 calculates the exclusive OR with the additional authentication data block a _q for the state, and further changes the result of replacement with f to a new state from q = 1 to q = Q. Repeat until step S450. In FIG. 12, a portion surrounded by a dotted line denoted by 450 corresponds to an additional authentication data calculation unit.

  The decoding unit 260 executes the following processes (1) to (3) (S260). In FIG. 12, a portion surrounded by a dotted line denoted by 260 corresponds to a decoding unit.

(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P-1.

(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit in the capacity portion is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.

(3) A message M ′ is formed by combining the message blocks m ₁ ′,..., M _P ′ by removing the bits added by padding.

Tag calculation unit 280 obtains tag T ′ from the rate portion of the state when S = 1. When S ≧ 2, the rate portion of the state is the tag block t ₁ ′. In the case of S ≧ 2, the process of replacing the state with f as a new state and setting the rate portion as the tag block t _s ′ is repeated from s = 2 to s = S. The tag block _{t 1 ', ..., t S} ' Request tag T 'using (S280). In FIG. 12, a portion surrounded by a dotted line with 280 corresponds to a tag calculation unit. The verification unit 285 compares the tag T and the tag T ′ (S285). The decoding device 400 sets the message M ′ as a decoded message when T = T ′. When T ≠ T ′, a result indicating that decoding has failed is output.

<Effect>
The encryption system of this modification is also realized by paying attention to the fact that even if the exclusive OR operation is performed on the capacity part, the security of the encryption can be secured if the result is not understood. Yes. Therefore, the same effect as Example 1 is acquired.

[Program, recording medium]
The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

100, 300 Encryption device 110, 210, 310, 410 Initial value setting unit 120, 220 Additional authentication data header division unit 130 Message division unit 140, 240 Additional authentication data trailer division unit 150, 250 Additional authentication data header calculation unit 160 Encryption 170, 270 Additional authentication data trailer calculation unit 180, 280 Tag calculation unit 190 Output unit 200, 400 Decryption device 230 Ciphertext division unit 260 Decryption unit 285 Verification unit 290 Input unit 320, 420 Additional authentication data division unit 350, 450 Additional authentication data calculation unit 800 network

Claims (8)

An encryption system having an encryption device and a decryption device,
K is a secret key shared by both the encryption device and the decryption device, A is additional authentication data, M is a message, C is a ciphertext, T is a tag, K, A, and M are bit strings, and N is all bits Is a bit string excluding a bit string of “0”, r, c, b, P, Q, U are integers of 1 or more, b = r + c, p is an integer of 1 to P, q is an integer of 1 to Q, u Is an integer of 1 to U, S is an integer of 1 or more, s is an integer of 1 to S, f is a b-bit permutation operation, g is an integer of 0 to 2 ^c −1 Multiplying a finite field between the element and a predetermined constant other than 0 and 1,
The state is defined as a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part,
The encryption device is:
Selecting N, generating an initial value for b-bit encryption using N and K, and setting an initial value setting unit for encryption in which a result obtained by replacing the initial value for encryption with f is a state;
'The additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., and add for encryption authentication data header dividing portion for dividing into a Q _',
A message dividing unit that divides the message M into r-bit message blocks m ₁ ,..., M _P using padding;
If there is a trailer A ″ of additional authentication data A, encryption is performed to divide the trailer A ″ of additional authentication data A into additional authentication data blocks a ₁ ″,..., A _U ″ every b bits using padding. Additional authentication data trailer divider for
The additional authentication for encryption is repeated from q = 1 to q = Q by calculating the exclusive OR with the additional authentication data block a _q ′ for the state and further changing the result of replacement with f to a new state. A data header calculator,
(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result replaced with f is set as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city part is treated as a finite field consisting of integers of 0 to 2 ^c −1 and multiplied by g, and the result of replacement with f is set as a new state.
(3) an encryption unit that obtains ciphertext C using a combination process of cipher blocks d ₁ ,..., D _P ;
When the trailer A ″ of the additional authentication data A exists, a process of calculating an exclusive OR with the additional authentication data block a _u ″ with respect to the state and setting the result replaced with f as a new state, an additional authentication data trailer calculation unit for encryption that repeats from u = 1 to u = U;
For S = 1 obtains the tag T from the rate portion of the state, in the case of S ≧ 2, and the rate portion of the state and tag block t _1, further rate portion of the result of replacing the state by f as a new state repeating the process of the tag block t _s from s = 2 to s = S, tag block t _1, ..., a tag calculation unit for encryption of obtaining a tag T using t _S,
An output unit that outputs a set of C, T, A, and N;
With
The decoding device
An input unit for acquiring a set of C, T, A, and N;
A decoding initial value setting unit that generates a b-bit decoding initial value using N and K, and uses the result obtained by replacing the decoding initial value with f;
'The additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., and decoding the additional authentication data header dividing portion for dividing into a Q _',
A ciphertext dividing unit that divides the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits;
When the trailer A ″ of the additional authentication data A exists, the trailer A ″ of the additional authentication data A is used for decoding to divide the additional authentication data block a ₁ ″,..., A _U ″ into b bits using padding. An additional authentication data trailer divider,
Additional authentication data for decryption that repeats the process of calculating the exclusive OR with the additional authentication data block a _q ′ for the state and further changing the result replaced by f to a new state from q = 1 to q = Q A header calculator,
(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit of the capacity part is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.
(3) a decoding unit that forms a message M ′ by combining the message blocks m ₁ ′,..., M _P ′ by removing the bits added by padding;
When the trailer A ″ of the additional authentication data A exists, a process of calculating an exclusive OR with the additional authentication data block a _u ″ with respect to the state and setting the result replaced with f as a new state, an additional authentication data trailer calculation unit for decryption that repeats from u = 1 to u = U;
When S = 1, the tag T ′ is obtained from the rate portion of the state. When S ≧ 2, the rate portion of the state is set as a tag block t ₁ ′, and the result of replacing the state with f is set as a new state. A tag calculation unit for decoding for obtaining a tag T ′ using the tag blocks t ₁ ′,..., T _S ′ by repeating the process of setting the rate part as the tag block t _s ′ from s = 2 to s = S;
An encryption system comprising: a verification unit that compares the tag T and the tag T ′. An encryption system having an encryption device and a decryption device,
K is a secret key shared by both the encryption device and the decryption device, A is additional authentication data, M is a message, C is a ciphertext, T is a tag, K, A, and M are bit strings, and N is all bits Is a bit string excluding a bit string of “0”, r, c, b, P, Q, b = r + c, p is an integer of 1 to P, q is an integer of 1 to Q, and S is a predetermined value of 1 or more An integer, s is an integer from 1 to S, f is a b-bit permutation operation, g is a finite field element consisting of integers from 0 to 2 ^c −1, and a predetermined constant other than 0 and 1 is on a finite field And multiply by
The state is defined as a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part,
The encryption device is:
Selecting N, generating an initial value for b-bit encryption using N and K, and setting an initial value setting unit for encryption in which a result obtained by replacing the initial value for encryption with f is a state;
An additional authentication data dividing unit for encryption that divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q every b bits by using padding;
A message dividing unit that divides the message M into r-bit message blocks m ₁ ,..., M _P using padding;
Additional authentication data for encryption that repeats the process of calculating an exclusive OR with the additional authentication data block a _q for the state and further changing the result of replacement with f to a new state from q = 1 to q = Q A calculation unit;
(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result replaced with f is set as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city part is treated as a finite field consisting of integers of 0 to 2 ^c −1 and multiplied by g, and the result of replacement with f is set as a new state.
(3) an encryption unit that obtains ciphertext C using a combination process of cipher blocks d ₁ ,..., D _P ;
For S = 1 obtains the tag T from the rate portion of the state, in the case of S ≧ 2, and the rate portion of the state and tag block t _1, further rate portion of the result of replacing the state by f as a new state repeating the process of the tag block t _s from s = 2 to s = S, tag block t _1, ..., a tag calculation unit for encryption of obtaining a tag T using t _S,
An output unit that outputs a set of C, T, A, and N;
With
The decoding device
An input unit for acquiring a set of C, T, A, and N;
A decoding initial value setting unit that generates a b-bit decoding initial value using N and K, and uses the result obtained by replacing the decoding initial value with f;
A decryption additional authentication data dividing unit that divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q every b bits using padding;
A ciphertext dividing unit that divides the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits;
Additional authentication data calculation for decryption is repeated from q = 1 to q = Q by calculating an exclusive OR with the additional authentication data block a _q for the state and further changing the result of replacement with f to a new state. And
(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit of the capacity part is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.
(3) a decoding unit that forms a message M ′ by combining the message blocks m ₁ ′,..., M _P ′ by removing the bits added by padding;
When S = 1, the tag T ′ is obtained from the rate portion of the state. When S ≧ 2, the rate portion of the state is set as a tag block t ₁ ′, and the result of replacing the state with f is set as a new state. A tag calculation unit for decoding for obtaining a tag T ′ using the tag blocks t ₁ ′,..., T _S ′ by repeating the process of setting the rate part as the tag block t _s ′ from s = 2 to s = S;
An encryption system comprising: a verification unit that compares the tag T and the tag T ′. The encryption system according to claim 1,
The padding of additional authentication data A with respect to header A ′ and trailer A ″ is 10 * 1 padding. The encryption system according to claim 2, wherein
A padding for additional authentication data A is 10 * 1 padding.   The encryption apparatus which the encryption system in any one of Claim 1 to 4 has.   The decryption apparatus which the encryption system in any one of Claim 1 to 4 has. An encryption method using an encryption device and a decryption device,
K is a secret key shared by both the encryption device and the decryption device, A is additional authentication data, M is a message, C is a ciphertext, T is a tag, K, A, and M are bit strings, and N is all bits Is a bit string excluding a bit string of “0”, r, c, b, P, Q, U are integers of 1 or more, b = r + c, p is an integer of 1 to P, q is an integer of 1 to Q, u Is an integer of 1 to U, S is an integer of 1 or more, s is an integer of 1 to S, f is a b-bit permutation operation, g is an integer of 0 to 2 ^c −1 Multiplying a finite field between the element and a predetermined constant other than 0 and 1,
The state is defined as a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part,
The encryption device is
Selecting N, generating an initial value for b-bit encryption using N and K, and setting the initial value for encryption with the result obtained by replacing the initial value for encryption with f as a state;
'The additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., and encryption for additional authentication data header dividing step of dividing the a Q _',
A message division step of dividing the message M into message blocks m ₁ ,..., M _P every r bits using padding;
If there is a trailer A ″ of additional authentication data A, encryption is performed to divide the trailer A ″ of additional authentication data A into additional authentication data blocks a ₁ ″,..., A _U ″ every b bits using padding. Additional authentication data trailer splitting step,
The additional authentication for encryption is repeated from q = 1 to q = Q by calculating the exclusive OR with the additional authentication data block a _q ′ for the state and further changing the result of replacement with f to a new state. A data header calculation step;
(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result replaced with f is set as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city part is treated as a finite field consisting of integers of 0 to 2 ^c −1 and multiplied by g, and the result of replacement with f is set as a new state.
(3) an encryption step for obtaining a ciphertext C using a combination process of cipher blocks d ₁ ,..., D _P ;
When the trailer A ″ of the additional authentication data A exists, a process of calculating an exclusive OR with the additional authentication data block a _u ″ with respect to the state and setting the result replaced with f as a new state, an additional authentication data trailer calculation step for encryption that repeats from u = 1 to u = U;
For S = 1 obtains the tag T from the rate portion of the state, in the case of S ≧ 2, and the rate portion of the state and tag block t _1, further rate portion of the result of replacing the state by f as a new state The tag block t _s is repeated from s = 2 to s = S, and the encryption tag calculation step for obtaining the tag T using the tag blocks t ₁ ,..., T _S ,
An output step for outputting a set of C, T, A, and N;
Run
The decoding device is
An input step for obtaining a set of C, T, A, and N;
A decoding initial value setting step of generating a b-bit decoding initial value using N and K, and setting the result obtained by replacing the decoding initial value by f as a state;
'The additional authentication data blocks a ₁ per b bits using padding' header A of additional authentication data A, ..., and additional decryption authentication data header dividing step of dividing the a Q _',
A ciphertext dividing step of dividing the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits;
When the trailer A ″ of the additional authentication data A exists, the trailer A ″ of the additional authentication data A is used for decoding to divide the additional authentication data block a ₁ ″,..., A _U ″ into b bits using padding. Additional authentication data trailer splitting step;
Additional authentication data for decryption that repeats the process of calculating the exclusive OR with the additional authentication data block a _q ′ for the state and further changing the result replaced by f to a new state from q = 1 to q = Q A header calculation step;
(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit of the capacity part is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.
(3) a decoding step of combining the message block m ₁ ′,..., M _P ′ by removing the bits added by padding into a message M ′;
When the trailer A ″ of the additional authentication data A exists, a process of calculating an exclusive OR with the additional authentication data block a _u ″ with respect to the state and setting the result replaced with f as a new state, a decryption additional authentication data trailer calculation step that repeats from u = 1 to u = U;
When S = 1, the tag T ′ is obtained from the rate portion of the state. When S ≧ 2, the rate portion of the state is set as a tag block t ₁ ′, and the result of replacing the state with f is set as a new state. A decoding tag calculation step for determining the tag T ′ using the tag blocks t ₁ ′,..., T _S ′ by repeating the process of setting the rate portion as the tag block t _s ′ from s = 2 to s = S;
A verification method for comparing the tag T and the tag T ′. An encryption method using an encryption device and a decryption device,
K is a secret key shared by both the encryption device and the decryption device, A is additional authentication data, M is a message, C is a ciphertext, T is a tag, K, A, and M are bit strings, and N is all bits Is a bit string excluding a bit string of “0”, r, c, b, P, Q, b = r + c, p is an integer of 1 to P, q is an integer of 1 to Q, and S is a predetermined value of 1 or more An integer, s is an integer from 1 to S, f is a b-bit permutation operation, g is a finite field element consisting of integers from 0 to 2 ^c −1, and a predetermined constant other than 0 and 1 is on a finite field And multiply by
The state is defined as a bit string of b bits in which a predetermined r bit is a rate part and c bit is a capacity part,
The encryption device is
Selecting N, generating an initial value for b-bit encryption using N and K, and setting the initial value for encryption with the result obtained by replacing the initial value for encryption with f as a state;
An additional authentication data division step for encryption that divides the additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q every b bits using padding;
A message division step of dividing the message M into message blocks m ₁ ,..., M _P every r bits using padding;
Additional authentication data for encryption that repeats the process of calculating an exclusive OR with the additional authentication data block a _q for the state and further changing the result of replacement with f to a new state from q = 1 to q = Q A calculation step;
(1) the exclusive OR of the message block m _p calculated for rate portion of the state, the calculation result with a cipher block d _p of r bits, on the rate portion of the state is replaced with the calculated results The process in which the result replaced with f is set as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the message block m _P is calculated for the rate part of the state, the calculation result is an r-bit cipher block d _P, and the rate part of the state is replaced with the calculation result. The c bit of the city part is treated as a finite field consisting of integers of 0 to 2 ^c −1 and multiplied by g, and the result of replacement with f is set as a new state.
(3) an encryption step for obtaining a ciphertext C using a combination process of cipher blocks d ₁ ,..., D _P ;
For S = 1 obtains the tag T from the rate portion of the state, in the case of S ≧ 2, and the rate portion of the state and tag block t _1, further rate portion of the result of replacing the state by f as a new state The tag block t _s is repeated from s = 2 to s = S, and the encryption tag calculation step for obtaining the tag T using the tag blocks t ₁ ,..., T _S ,
An output step for outputting a set of C, T, A, and N;
Run
The decoding device is
An input step for obtaining a set of C, T, A, and N;
A decoding initial value setting step of generating a b-bit decoding initial value using N and K, and setting the result obtained by replacing the decoding initial value by f as a state;
Decryption additional authentication data division step for dividing additional authentication data A into additional authentication data blocks a ₁ ,..., A _Q for each b bits using padding;
A ciphertext dividing step of dividing the ciphertext C into cipher blocks d ₁ ,..., D _P every r bits;
Additional authentication data calculation for decryption is repeated from q = 1 to q = Q by calculating an exclusive OR with the additional authentication data block a _q for the state and further changing the result of replacement with f to a new state. Steps,
(1) An exclusive OR with the cipher block d _p is calculated for the rate part of the state, the calculation result is an r-bit message block m _p ′, and the rate part of the state is replaced with the cipher block d _p In addition, the process of setting the result replaced with f as a new state is repeated from p = 1 to p = P−1.
(2) An exclusive OR with the cipher block d _P is calculated for the rate part of the state, and the calculation result is an r-bit message block m _P ′, and the rate part of the state is replaced with the cipher block d _P Then, the c bit of the capacity part is treated as a finite field consisting of integers of 0 to 2 ^c −1, multiplication by g is performed, and the result of replacement by f is set as a new state.
(3) a decoding step of combining the message block m ₁ ′,..., M _P ′ by removing the bits added by padding into a message M ′;
When S = 1, the tag T ′ is obtained from the rate portion of the state. When S ≧ 2, the rate portion of the state is set as a tag block t ₁ ′, and the result of replacing the state with f is set as a new state. A decoding tag calculation step for determining the tag T ′ using the tag blocks t ₁ ′,..., T _S ′ by repeating the process of setting the rate portion as the tag block t _s ′ from s = 2 to s = S;
A verification method for comparing the tag T and the tag T ′.

Images