JP6729119B2 - Encryption device, decryption device, encryption method, computer program, data structure, and storage medium - Google Patents

Description

The present invention relates to block cipher technology.

Conventionally, block cipher technology has been widespread. This technique divides plaintext data into blocks of a predetermined size (plaintext blocks) and encrypts each block (Non-Patent Document 1). The following modes have been proposed as block cipher modes (cipher use modes).

The ECB (Electronic Codebook) mode is a mode in which each plaintext block is encrypted without being associated with any other plaintext block. That is, this is a mode in which each plaintext block is independently encrypted.

However, according to the ECB mode, if encryption is performed using a common encryption key for all plaintext blocks, the following drawbacks occur.

When the plaintext corresponding to a specific cipher block among a plurality of encrypted blocks (cipher blocks) is known in the ECB mode, it means that another cipher block matching this cipher block has also been decrypted. The method of deciphering the cipher using this property is called "ciphertext match attack".

Moreover, the decryption can be performed even if the order of the cipher blocks is changed. Therefore, for example, even if the cryptographic block of the account number of the remittance destination and the cryptographic block of the account number of the remittance source in the encrypted data of the remittance process of the bank are replaced, the remittance process can be performed in the bank. Then, a process contrary to the original purpose is performed. A method of making a fraud using this property is called a “ciphertext alteration attack”.

Further, if the encryption is performed in the ECB mode, some pattern may remain in the data. For example, when a bitmap image is encrypted, a plurality of plaintext blocks representing the same pattern become the same cipher block. Therefore, even if encrypted, the contour of the image remains.

A CBC (Cipher Block Chaining) mode has been proposed and widely used as a cipher use mode for solving the drawbacks of the ECB mode.

In the CBC mode, an exclusive OR of the plaintext block and the immediately preceding cipher block is calculated, and the cipher block of the plaintext block is generated by encrypting the exclusive OR. However, since there is no previous cipher block in the first plaintext block, the initialization vector is used instead. The initialization vector is a random value.

http://www.techscore.com/tech/Java/JavaSE/JCE/5/

According to the CBC mode, the drawbacks of the ECB mode can be solved. However, an initialization vector must be added to the encrypted data. Therefore, the size of the data becomes larger than that in the case of encryption in the ECB mode.

In view of such problems, an object of the present invention is to eliminate the drawbacks of the ECB mode and to encrypt plaintext without adding an initialization vector.

An encryption device according to an aspect of the present invention is an encryption device that encrypts each of n plaintext blocks that are plaintext blocks of a predetermined size, and is the first of the n plaintext blocks. To hash value calculation means for calculating a hash value by a predetermined method using all or part of the (n-1)th plaintext block, and the nth plaintext block of the n plaintext blocks. a first encryption unit that generates an n-th cipher block using the hash value and one of a pair of first key and second key of the public key cryptosystem; The 1st cipher block corresponding to the 1st plaintext block of the nth to (n-1)th plaintext blocks is set to the nth cipher block , the first key, and the second key. The p-th cipher block corresponding to the p (where 2≦p≦(n−1)) plaintext block is generated by using the key used by the first encryption means and is (p−1 ) th generated using a key which the the first encryption means using one of the encryption block first key and the second key, the second encryption means, said first From the cipher block, generate the first plaintext block using the n-th cipher block and one of the first key and the second key that is not used by the first encryption means. Then, from the p-th cipher block, the (p-1)-th cipher block and a key of the first key and the second key that is not used by the first encryption means are extracted. Using the first decoding means for generating the p-th plaintext block using all or part of the first to (n-1)th plaintext block obtained by the first decoding means Second hash value calculating means for calculating the hash value by the predetermined method, the hash value generated by the second hash value calculating means from the nth cipher block, and the first key, and Second decryption means for generating the n-th plaintext block using a key of the second keys that is not used by the first encryption means .

Preferably, the first encryption means calculates an exclusive OR of the nth plaintext block and the hash value, and encrypts the exclusive OR to obtain the nth cipher block. And the second encryption means calculates an exclusive OR of the first plaintext block and the nth cipher block, and encrypts the exclusive OR to obtain the 1 Generating the th cipher block, calculating the exclusive OR of the p th plaintext block and the (p−1) th cipher block, and encrypting each of the exclusive OR, Generate the pth cipher block.

Alternatively, the first decryption means generates the first plaintext block by decrypting the first cipher block and calculating the exclusive OR with the nth cipher block, and the p The p-th plaintext block is generated by decrypting the th cipher block and calculating the exclusive OR with each of the (p-1) th cipher blocks, and the second decryption means is configured to generate the n-th plaintext block. The nth plaintext block is generated by decrypting the th cipher block and calculating the exclusive OR with the hash value.

According to the present invention, the plaintext can be encrypted without adding an initialization vector while eliminating the drawbacks of the ECB mode.

It is a figure which shows the example of the whole structure of the system containing a confidential data processing apparatus. It is a figure which shows the example of the hardware constitutions of a confidential data processing apparatus. It is a figure which shows the example of a functional structure of a confidential data processing apparatus. It is a figure for explaining an example of division of plaintext data and calculation of a hash value. It is a figure for explaining an example of processing of encryption of plaintext data. It is a figure for explaining an example of processing which decodes encryption data. It is a flow chart explaining an example of the flow of the whole processing by an encryption-and-decryption program. It is a flow chart explaining an example of a flow of encryption processing. It is a flow chart explaining an example of a flow of decoding processing. It is a figure for demonstrating the example of the encryption process which modified the PCBC mode. It is a figure for demonstrating the example of the decoding process which modified the PCBC mode. It is a figure for demonstrating the example of the process of the encryption which deform|transformed CFB mode. It is a figure for demonstrating the example of the decoding process which deform|transformed CFB mode. It is a figure for demonstrating the example of the process of the encryption which deform|transformed the OFB mode. It is a figure for demonstrating the example of the decoding process which deform|transformed the OFB mode. It is a figure for demonstrating the example of the process of the encryption which deform|transformed the CTR mode. It is a figure for demonstrating the example of the decoding process which deform|transformed CTR mode.

FIG. 1 is a diagram showing an example of the overall configuration of a system including the confidential data processing device 1. FIG. 2 is a diagram showing an example of the hardware configuration of the confidential data processing device 1. FIG. 3 is a diagram showing an example of a functional configuration of the confidential data processing device 1.

The confidential data processing device 1 encrypts and outputs data to be kept confidential. Also, the encrypted data is decrypted.

As shown in FIG. 1, the confidential data processing device 1 is connected to the multifunction peripheral 2 and the like via a communication line 3.

As the confidential data processing device 1, a personal computer or a so-called server machine is used. Hereinafter, a case where a personal computer is used as the confidential data processing device 1 will be described as an example.

As shown in FIG. 2, the confidential data processing device 1 includes a CPU (Central Processing Unit) 10a, a RAM (Random Access Memory) 10b, a ROM (Read Only Memory) 10c, an auxiliary storage device 10d, a liquid crystal display 10e, and a NIC (Network). Interface card) 10f, a keyboard 10g, a pointing device 10h, and the like.

The liquid crystal display 10e displays a screen showing a message to the user, a screen for the user to input a command or information, a screen showing the result of processing executed by the CPU 10a, and the like.

The NIC 10f communicates with the multifunction peripheral 2 and the like via the communication line 3 by a protocol such as TCP/IP.

The keyboard 10g and the pointing device 10h are used by the user to input commands or information.

The ROM 10c or the auxiliary storage device 10d stores an encryption/decryption program 10P in addition to the operating system. These programs are loaded into the RAM 10b and executed by the CPU 10a. A hard disk, SSD (Solid State Drive), or the like is used as the auxiliary storage device 10d.

The multi-function peripheral 2 is a device in which functions such as copy, network print, fax, and scan are integrated. It may be called “MFP (Multi Function Peripherals)” or “image forming apparatus”.

According to the encryption/decryption program 10P, it is possible to encrypt data or decrypt encrypted data. In particular, it is possible to realize encryption with higher confidentiality than the ECB (Electronic Codebook) mode without adding an initialization vector. Hereinafter, this mechanism will be described. The initialization vector is sometimes called "IV (initialization vector)".

According to the encryption/decryption program 10P, the plaintext data division unit 101, the first hash value calculation unit 102, the first exclusive OR calculation unit 103, the first encryption processing unit 104, and the second encryption processing unit 104 shown in FIG. Exclusive OR operation unit 105, second encryption processing unit 106, cipher block combining unit 107, print processing unit 108, encrypted data division unit 121, first decryption processing unit 122, third exclusive OR operation Functions of the unit 123, the second hash value calculation unit 124, the second decryption processing unit 125, the fourth exclusive OR calculation unit 126, the plaintext block combination unit 127, and the like are realized. Hereinafter, the processes of the respective units shown in FIG. 3 will be roughly divided into an encryption process and a decryption process.

〔encryption〕
FIG. 4 is a diagram for explaining an example of dividing the plaintext data 5A and calculating the hash value Ha. FIG. 5 is a diagram for explaining an example of a process of encrypting the plaintext data 5A.

The user prepares the data to be encrypted in the confidential data processing device 1. This data is plaintext data. Hereinafter, this data will be referred to as “plain text data 5A”.

For example, as the plaintext data 5A, data of a hash value of a document such as a contract and an image of the signature of the contractor is prepared.

Then, the user activates the encryption/decryption program 10P in the confidential data processing device 1 and specifies the plaintext data 5A.

Then, the plaintext data dividing unit 101 to the cipher block combining unit 107 execute the processing in the procedure shown in FIGS. 4 and 5.

The plaintext data dividing unit 101 stores the plaintext data 5A in a predetermined size (for example, 256 bytes).
Is divided into plaintext blocks La (#701 in FIG. 4). The plaintext block La is handled as bit string data.

Hereinafter, a case where the plaintext data dividing unit 101 divides the plaintext data 5A into n plaintext blocks La will be described as an example. The first plaintext block La, the second plaintext block La,..., The nth plaintext block La may be described separately from “plaintext block La_1”, “plaintext block La_2”,..., “Plaintext block La_n”, respectively. is there.

The first hash value calculation unit 102 uses the exclusive OR of the first to (n-1)th plaintext blocks La_ as the hash value Ha of the plaintext data 5A excluding the plaintext block La_n. It is calculated (#702). That is, the hash value Ha is calculated by the following equation (1). The size of the hash value Ha is equal to the size of the plaintext block La.
Ha=La_1 xor La_2 xor... xor La_(n-1) (1)
The first exclusive OR calculator 103 calculates an exclusive OR Lb_n between the nth plaintext block La and the hash value Ha (#703 in FIG. 5).

The first encryption processing unit 104 generates the nth cipher block Lc by encrypting the exclusive OR Lb_n calculated by the first exclusive OR operation unit 103 by the public key cryptosystem. (#704). The size of the cipher block Lc is equal to the size of the plaintext block La. At this time, one of the pair of public key 5P and secret key 5Q is used as the encryption key. Hereinafter, a case where the public key 5P is used will be described as an example.

The second exclusive OR operation unit 105 and the second encryption processing unit 106 generate the respective cipher blocks Lc from the 1st to the (n-1)th (#705, #706,... ).

Here, the processing of the second exclusive OR calculation unit 105 and the second encryption processing unit 106 when the kth cipher block Lc is generated will be described.

The second exclusive OR calculation unit 105 calculates the kth plaintext block La and the (k-1)th cipher block Lc as the kth exclusive OR Lb (that is, the exclusive OR Lb_k). Calculate exclusive OR. However, when k=1, the exclusive OR of the first plaintext block La and the nth cipher block Lc is calculated.

The second encryption processing unit 106 encrypts the kth exclusive OR (that is, exclusive OR Lb_k) calculated by the second exclusive OR operation unit 105 by the public key cryptosystem. To generate the kth cipher block Lc. At this time, the encryption key used in the first encryption processing unit 104 is used. That is, in this embodiment, the public key 5P is used.

Through the above processing, each of the first to nth cipher blocks Lc is obtained. Hereinafter, the first, second,..., Nth cipher blocks Lc may be described separately as “cipher block Lc_1”, “cipher block Lc_2”,..., “Cipher block Lc_n”.

Specifically, the second exclusive OR calculator 105 calculates the exclusive OR Lb_1 by calculating the exclusive OR of the plaintext block La_1 and the cipher block Lc_n (#705). Then, the second encryption processing unit 106 generates the cipher block Lc_1 by encrypting the exclusive OR Lb_1 by the public key cryptosystem (#706).

Similarly, the exclusive OR Lb_2 is calculated from the plaintext block La_2 and the cipher block Lc_1 (#707), and the cipher block Lc_2 is generated by encrypting the exclusive OR Lb_2 by the public key cryptosystem (#708). ). The exclusive OR Lb_3 is calculated from the plaintext block La_3 and the cipher block Lc_2 (#709), and the exclusive OR Lb_3 is encrypted by the public key cryptosystem to generate the cipher block Lc_3 (#710). Thereafter, the same processing is performed.

Then, finally, the exclusive OR Lb_(n-1) is calculated from the plaintext block La_(n-1) and the cipher block Lc(n-2) (#71x), and the exclusive OR Lb_(n-1). ) Is encrypted by the public key cryptosystem to generate a cipher block Lc_(n-1) (#71y).

The cipher block combination unit 107 generates cipher data 5B by combining the first to nth cipher blocks Lc (Lc_1, Lc_2,..., Lc_n) into one piece of data.

The encrypted data 5B is stored in a recording medium or a folder designated by the user or transmitted to a device designated by the user. It is used by the print processing unit 108 as follows.

The print processing unit 108 generates a two-dimensional barcode representing the encrypted data 5B, and generates print data 5D for printing the two-dimensional barcode. Then, the MFP 2 is instructed to print the two-dimensional barcode. At this time, the print data 5D is transmitted to the multifunction device 2. The print data 5D may be described in PDL (Page Description Language) compatible with the multifunction device 2.

When the multifunction device 2 receives the command and the print data 5D from the confidential data processing device 1, the multifunction device 2 prints the two-dimensional bar code on the paper based on the command and the print data 5D.

[Decryption]
FIG. 6 is a diagram for explaining an example of a process of decrypting the encrypted data 5B.

Next, the process of each unit of the confidential data processing device 1 and the operation of the user when decrypting the encrypted data 5B will be described with reference to FIG.

The user activates the encryption/decryption program 10P in advance. Then, the encrypted data 5B is designated as the data to be decrypted.

Alternatively, the user sets the paper on which the two-dimensional barcode is printed on the multifunction device 2 and causes the multifunction device 2 to read the two-dimensional barcode. Image data of a two-dimensional barcode is transmitted from the multifunction device 2 to the confidential data processing device 1. Then, the encrypted data 5B is prepared in the confidential data processing device 1 by causing the confidential data processing device 1 to analyze the two-dimensional barcode. The analysis of the two-dimensional barcode may be performed by the multifunction device 2.

Then, the encrypted data dividing unit 121 divides the encrypted data 5B into a predetermined size (for example, 256 bytes). As a result, the cipher data 5B is divided into a plurality of cipher blocks Ld.

The cipher block Ld is treated as bit string data, like the plaintext block La, the exclusive OR Lb, and the cipher block Lc.

If the encrypted data 5B has not been tampered with, the encrypted data 5B is divided to obtain n encrypted blocks Ld. Hereinafter, the first, second,..., Nth cipher blocks Ld may be described separately as “cipher block Ld_1”, “cipher block Ld_2”,..., “Cipher block Ld_n”.

If the cipher data 5B has not been tampered with, the cipher blocks Ld_1, Ld_2,..., Ld_n match the cipher blocks Lc_1, Lc_2,..., Lc_n, respectively.

The first decryption processing unit 122 and the third exclusive OR calculation unit 123 generate the plaintext blocks Lf from the first to (n-1)th as follows.

Here, the processing of the first decryption processing unit 122 and the third exclusive OR calculation unit 123 when the j-th plaintext block Lf is generated will be described.

The first decryption processing unit 122 decrypts the j-th cipher block Ld by the public key cryptosystem. At this time, one of the public key 5P and the secret key 5Q different from the key used as the encryption key by the first encryption processing unit 104 is used as the decryption key. Therefore, in this embodiment, the secret key 5Q is used to decrypt the cipher block Ld.

Hereinafter, a plaintext block obtained by decrypting the cipher block Ld is referred to as a “plaintext block Le”. Also, the first, second,..., Nth plaintext block Le may be described separately as “plaintext block Le_1”, “plaintext block Le_2”,..., “Plaintext block Le_n”.

The third exclusive OR calculator 123 calculates the jth plaintext block Le (that is, the plaintext block Le_j) and the (j−1)th cipher block Ld (that is, the cipher block Ld_(j−1)). Calculate exclusive OR. This exclusive OR is the jth plaintext block Lf. However, when j=1, the exclusive OR of the first plaintext block Le and the nth cipher block Ld is calculated.

Hereinafter, the first, second,..., Nth plaintext block Lf may be referred to as “plaintext block Lf_1”, “plaintext block Lf_2”,..., “Plaintext block Lf_n”, respectively.

Specifically, first, the first decryption processing unit 122 decrypts the cipher block Ld_2 (#721 in FIG. 6). As a result, the plaintext block Le_2 is generated. The third exclusive OR calculation unit 123 calculates the exclusive OR of the plaintext block Le_1 and the cipher block Ld_n as the plaintext block Lf_1 (#722).

Further, the first decryption processing unit 122 decrypts the cipher block Ld_2 to generate the plaintext block Le_2 (#723). The third exclusive OR calculation unit 123 calculates the exclusive OR of the plaintext block Le_2 and the cipher block Ld_1 as the plaintext block Lf_2 (#724).

Similarly, the cipher block Ld_j is decrypted to generate the plaintext block Le_j while shifting each block by one, and the exclusive OR of the plaintext block Le_j and the cipher block Ld_(j−1) is performed. It is calculated as a plaintext block Lf_j.

Finally, the cipher block Ld_n is decrypted to generate the plaintext block Le_(n-1) (#72x), and the exclusive logic of the plaintext block Le_(n-1) and the cipher block Ld_(n-2) is obtained. The sum is calculated as a plaintext block Lf_(n-1) (#72y).

If the encrypted data 5B has not been tampered with, the plaintext blocks Lf_1, Lf_2,..., Lf_(n-1) are the plaintext blocks La_1, La_2,..., La_(n-1) shown in FIG. 5, respectively. Match.

The second hash value calculation unit 124 calculates the plaintext blocks Lf (Lf_1, Lf_2,..., Lf_(n) from the first to (n−1)th plaintext blocks calculated by the third exclusive OR calculation unit 123. The exclusive OR of (-1)) is calculated as the hash value Hb (#731).

If the encrypted data 5B has not been tampered with, the hash value Hb matches the hash value Ha.

The second decryption processing unit 125 publishes using the decryption key (the private key 5Q in this embodiment) used in the first decryption processing unit 122, in parallel with or before or after the process of step #731. The cipher block Ld_n is decrypted by the key cryptosystem (#732). As a result, the plaintext block Le_n is generated.

The fourth exclusive OR calculator 126 calculates an exclusive OR of the hash value Hb obtained by the second hash value calculator 124 and the plaintext block Le_n obtained by the second decryption processor 125. It is calculated as a plaintext block Lf_n (#733).

If the encrypted data 5B has not been tampered with, the plaintext block Lf_n matches the plaintext block La_n.

Then, the plaintext block combination unit 127 generates the plaintext data 5C by combining the first to nth plaintext blocks Lf (Lf_1, Lf_2,..., Lf_n) into one data.

By the above processing, the encrypted data 5B is decrypted. If the encrypted data 5B has not been tampered with, the plaintext data 5C matches the plaintext data 5A.

The plaintext data 5C is stored in a folder designated by the user or transmitted to the device designated by the user.

FIG. 7 is a flowchart illustrating an example of the overall processing flow of the encryption/decryption program 10P. FIG. 8 is a flowchart illustrating an example of the flow of encryption processing. FIG. 9 is a flowchart illustrating an example of the flow of decoding processing.

Next, an overall processing flow of the confidential data processing device 1 will be described with reference to the flowcharts of FIGS.

The confidential data processing device 1 executes the processing shown in FIG. 7 based on the encryption/decryption program 10P.

When the plaintext data 5A is designated as the data to be encrypted (#11 in FIG. 7), the confidential data processing device 1 acquires the plaintext data 5A (#12) and executes the process of encrypting the plaintext data 5A. Execute (#13). The procedure of the encryption process is as shown in FIG.

In FIG. 8, the confidential data processing device 1 divides the plaintext data 5A into a plurality of plaintext blocks La having a predetermined size (#741). Hereinafter, a case where the plaintext block La is divided into n plaintext blocks La (La_1, La_2,..., La_n) will be described as an example. The hash value Ha of the plaintext block La (that is, the plaintext blocks La_1 to La_(n-1)) excluding the last plaintext block La is generated (#742).

The confidential data processing device 1 calculates the exclusive logical sum Lb_n of the hash value Ha and the plaintext block La_n (#743), and generates the cipher block Lc_n by encrypting the exclusive logical sum Lb_n with the public key 5P. (#744).

Further, the confidential data processing device 1 generates the respective cipher blocks Lc (Lc_1 to Lc_(n-1)) from the first to the (n-1)th as follows (#746 to #749).

The confidential data processing device 1 calculates the exclusive logical sum Lc_k of the plaintext block La_k and the cipher block Lc_(k-1) (#746). However, when k=1, the cipher block Lc_n is used. Then, the exclusive OR Lc_k is encrypted with the public key 5P to generate a cipher block Ld_k (#747). k is incremented by 1, such as 2, 3,..., (n−1).

When the cipher blocks Lc_1 to Lc_n are generated, the confidential data processing device 1 combines them to generate the cipher data 5B (#750).

In this way, the plaintext data 5A is encrypted and the encrypted data 5B is obtained by the processes of #741 to #750.

Returning to FIG. 7, the confidential data processing device 1 saves the encrypted data 5B in a folder designated by the user, transmits it to the device designated by the user, or generates a two-dimensional bar code representing the encrypted data 5B. , And causes the multifunction device 2 to print (#14).

Alternatively, when the encrypted data 5B is designated as the decryption target (Yes in #15), the confidential data processing device 1 acquires the encrypted data 5B (#16) and executes the process of decrypting the encrypted data 5B ( #17). The procedure of the decoding process is as shown in FIG.

In FIG. 9, the confidential data processing device 1 divides the encrypted data 5B into a plurality of encrypted blocks Ld of a predetermined size (#761). Hereinafter, a case where the cipher block is divided into n cipher blocks Ld (Ld_1 to Ld_n) will be described as an example.

The confidential data processing device 1 generates the first to (n-1)th plaintext blocks Lf (Lf_1 to Lf_(n-1)) as follows (#762 to #766).

The confidential data processing device 1 generates a plaintext block Le_j by decrypting the cipher block Ld_j with the secret key 5Q (#763), and obtains the exclusive OR of the plaintext block Le_j and the cipher block Ld_(j-1) with the plaintext. It is calculated as a block Lf_j (#764). However, when j=1, the cipher block Ld_n is used. j is incremented by 1, such as 1, 2,..., (n−1).

Further, the confidential data processing device 1 calculates the hash value Hb of the plaintext blocks Lf_1 to Lf_(n-1) (#767) and also generates the plaintext block Le_n by decrypting the cipher block Ld_n with the secret key 5Q. (#768).

Then, the confidential data processing device 1 calculates the exclusive OR of the hash value Hb and the cipher block Le_n as the plaintext block Lf_n (#769).

When the plaintext blocks Lf_1 to Lf_n are generated, the confidential data processing device 1 combines them to generate the plaintext data 5C (#770).

Returning to FIG. 7, the confidential data processing device 1 saves the plaintext data 5C in the folder designated by the user or transmits it to the device designated by the user (#18).

According to the present embodiment, the plaintext data 5A can be encrypted without adding the initialization vector while eliminating the drawbacks of the ECB mode. As a result, the size of the encrypted data 5B can be made smaller than that of the conventional encryption use mode which eliminates the drawbacks of the ECB mode.

Therefore, the size of the two-dimensional bar code representing the encrypted data 5B can be made smaller than that of the conventional encryption use mode.

FIG. 10 is a diagram for explaining an example of encryption processing in which the PCBC mode is modified. FIG. 11 is a diagram for explaining an example of a decoding process in which the PCBC mode is modified. FIG. 12 is a diagram for explaining an example of encryption processing in which the CFB mode is modified. FIG. 13 is a diagram for explaining an example of decoding processing in which the CFB mode is modified. FIG. 14 is a diagram for explaining an example of encryption processing in which the OFB mode is modified. FIG. 15 is a diagram for explaining an example of a decoding process in which the OFB mode is modified. FIG. 16 is a diagram for explaining an example of encryption processing in which the CTR mode is modified. FIG. 17 is a diagram for explaining an example of a decoding process in which the CTR mode is modified.

In the present embodiment, the confidential data processing device 1 generates the hash value Ha and the hash value Hb by calculating the exclusive OR of (n-1) blocks, but it may be generated by another method. Good. For example, it may be calculated by SHAKE256 of SHA-3 (Secure Hashing Algorithm 3). Alternatively, it may be generated by calculating the exclusive OR of less than (n-1) specific blocks. Alternatively, a specific block (plaintext block La) may be used as the hash value Ha, and a specific block (plaintext block Lf corresponding to the plaintext block La) may be used as the hash value Hb.

In the present embodiment, the confidential data processing device 1 transforms the CBC (Cipher Block Chaining) mode as follows to perform encryption and decryption.

(A1) At the time of encryption, in the CBC mode, the exclusive OR of the plaintext block La_n and the cipher block Lc_(n-1)) is calculated. However, in the present embodiment, as shown in steps #703 to #704 of FIG. 5, the hash value Ha is used instead of the cipher block Lc_(n−1) to calculate the exclusive OR.

(A2) At the time of encryption, in the CBC mode, an initialization vector is prepared and the exclusive OR of the plaintext block La_1 and the initialization vector is calculated. However, in the present embodiment, as shown in step #705, the exclusive OR is calculated using the cipher block Lc_n instead of the initialization vector.

(A3) At the time of decryption, in the CBC mode, the exclusive OR of the cipher block Ld_1 and the initialization vector included in the cipher data is calculated. However, in the present embodiment, the exclusive OR is calculated using the cipher block Ld_n instead of the initialization vector.

(A4) At the time of decryption, in the CBC mode, the exclusive OR of the decrypted cipher block Ld_n (that is, the plaintext block Le_n) and the cipher block Ld_(n-1) is calculated. However, in the present embodiment, the exclusive OR is calculated using the hash value Hb instead of the cipher block Ld_(n-1).

The above (A1) to (A4) can also be applied when transforming the encryption use mode other than the CBC mode.

For example, the PCB (Propagating Cipher Block Chaining) mode may be modified to perform encryption as shown in FIG. 10 and decryption as shown in FIG.

That is, instead of the first exclusive-OR operation unit 103 and the first encryption processing unit 104, the first encryption processing unit, as illustrated in FIG. 10, includes a plaintext block La_n and a hash value Ha. The exclusive OR is calculated and the exclusive OR is encrypted to generate the cipher block Lc′_n.

Further, instead of the second exclusive OR calculation unit 105 and the second encryption processing unit 106, the second encryption processing unit performs an exclusive OR of the plaintext block La_1 and the cipher block Lc′_n. The first cipher block Lc′_1 is generated by calculating and encrypting this exclusive OR. The first exclusive logic between the plaintext block La_(p-1) and the cipher block Lc'_(p-1) is calculated, and the first exclusive OR is calculated with the second exclusive logic between the plaintext block La_p. The cipher block Lc′_p is generated by calculating the logical sum and encrypting the second exclusive logical sum. However, 2≦p≦(n−1). The same applies below.

Then, cipher data is generated by combining the cipher blocks Lc′_1, Lc′_2,..., Lc′_n. The same applies to FIGS. 12, 14, and 16.

Instead of the first decryption processing unit 122 and the third exclusive OR calculation unit 123, the first decryption processing unit decrypts the cipher block Ld′_1 to obtain the cipher block Ld′, as illustrated in FIG. 11. The plaintext block Lf_1 is generated by calculating the exclusive OR with _n. The one obtained by calculating the first exclusive OR of the cipher block Ld'_(p-1) and the plaintext block Lf_(p-1), and decrypting the first exclusive OR and the cipher block Ld'_p The plaintext block Lf_p is generated by calculating the second exclusive OR of

Further, instead of the second decryption processing unit 125 and the fourth exclusive OR calculation unit 126, the second decryption processing unit decrypts the cipher block Ld′_n and calculates the exclusive OR with the hash value Hb. By doing so, a plaintext block Lf_n is generated.

If the encrypted data has not been tampered with, the cipher blocks Ld'_1, Ld'_2,..., Ld'_n match the cipher blocks Lc'_1, Lc'_2,..., Lc'_n, respectively. The plaintext blocks La_1, La_2,..., La_n match the plaintext blocks Lf_1, Lf_2,..., Lf_n, respectively. The same applies to FIGS. 12 to 17.

Alternatively, the CFB (Cipher Feedback) mode may be modified, encryption may be performed as shown in FIG. 12, and decryption may be performed as shown in FIG.

As shown in FIG. 12, the first encryption processing unit encrypts the hash value Ha and calculates the exclusive OR with the plaintext block La_n to generate the cipher block Lc'_n.

The second encryption processing unit encrypts the cipher block Lc'_n and calculates the exclusive OR with the plaintext block La_1 to generate the cipher block Lc'_1, and the cipher block Lc'_(p-1 ) Is encrypted and the exclusive OR with the plaintext block La_p is calculated to generate the cipher block Lc′_p.

As shown in FIG. 13, the first decryption processing unit decrypts the cipher block Ld′_n and calculates the exclusive OR with the cipher block Ld′_1 to generate the plaintext block Lf_1, thereby generating the plaintext block Lf_1. The plaintext block Lf_p is generated by decrypting Ld′_(p−1) and calculating the exclusive OR with the cipher block Ld′_p.

The second decryption processing unit decrypts the hash value Hb and calculates the exclusive OR with the cipher block Ld′_n to generate the plaintext block Lf_n,
Alternatively, the OFB (Output Feedback) mode may be modified, encryption may be performed as shown in FIG. 14, and decryption may be performed as shown in FIG.

As shown in FIG. 14, the first encryption processing unit encrypts the hash value Ha and calculates the exclusive OR with the plaintext block La_n to generate the cipher block Lc'_n.

The second encryption processing unit encrypts the cipher block Lc′_n and calculates the exclusive OR with the plaintext block La_1 to generate the cipher block Lc′_1, and encrypts the cipher block Lc′_n p times. The cipher block Lc′_p is generated by calculating the exclusive OR of the encrypted one and the plaintext block La_p.

As shown in FIG. 15, the first decryption processing unit decrypts the cipher block Ld'_n and calculates the exclusive OR with the cipher block Ld'_1 to generate the plaintext block Lf_1. The plaintext block Lf_p is generated by calculating the exclusive OR of the cipher block Ld'_n decrypted p times and the cipher block Ld'_p.

The second decryption processing unit produces the plaintext block Lf_n by decrypting the hash value Hb and calculating the exclusive OR with the cipher block Ld'_n.

Alternatively, the CTR (Counter) mode may be modified as follows so that encryption and decryption can be performed without using Nonce.

(B1) At the time of encryption, in the CTR mode, the Nonce and the counter Cr_n corresponding to the plaintext block La_n are combined to generate the counter block Ck_n. Hereinafter, a case where the two are combined by calculating the exclusive OR will be described as an example. However, as shown in FIG. 16, the confidential data processing device 1 uses the hash value Ha instead of NONCE to generate the counter block Ck_n.

(B2) At the time of encryption, in the CTR mode, the 1st to (n-1)th counter blocks Ck (that is, the counter blocks Ck_1 to Ck_(n-1)) are set to Nonce and 1 to (n-1). It is generated by combining each of the second counters Cr (that is, the counters Cr_1 to Cr_(n-1)). However, the confidential data processing device 1 uses the cipher block Lc'_n instead of Nonce as shown in FIG.

(B3) At the time of decoding, similarly to B2, in the CTR mode, counter blocks Ck_1 to Ck_(n-1) are generated by combining Nonce and counters Cr_1 to Cr_(n-1). However, as shown in FIG. 17, the confidential data processing device 1 uses the cipher block Ld'_n instead of Nonce to generate the cipher block Ld'_n.

(B4) At the time of decryption, in the CTR mode, the counter block Ck_n is generated by combining Nonce and the counter Cr_n corresponding to the plaintext block Lf_n. However, the confidential data processing device 1 generates by combining the hash value Hb instead of Nonce.

That is, as shown in FIG. 16, the first encryption processing unit generates the counter block Ck_n by calculating the exclusive OR of the counter Cr_n and the hash value Ha. The cipher block Lc'_n is generated by encrypting the counter block Ck_n and calculating the exclusive OR with the plaintext block La_n.

The second encryption processing unit generates a counter block Ck_m by calculating the exclusive OR of the counter Cr_m and the cipher block Lc′_n, encrypts the counter block Ck_m, and performs exclusive exclusion with the plaintext block La_m. The cipher block Lc′_m is generated by calculating the logical sum. However, 1≦m≦(n−1).

As shown in FIG. 17, the first decryption processing unit generates a counter block Ck_m by calculating the exclusive OR of the counter Cr_m and the cipher block Ld′_m, and decrypts the counter block Ck_m to decrypt the cipher block. A plaintext block Lf_m is generated by calculating an exclusive OR with Ld′_m.

The second decryption processing unit generates a counter block Ck_n by calculating the exclusive OR of the counter Cr_n and the hash value Hb, decrypts the counter block Ck_n, and the exclusive OR of the cipher block Ld′_n. To calculate a plaintext block Lf_n.

In the present embodiment, the encryption process and the decryption process are realized by executing the encryption/decryption program 10P by the CPU 10a, but a circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array) is used. May be realized.

In this embodiment, the public key cryptosystem is used for encryption and decryption, but the common key cryptosystem may be used for encryption and decryption.

In the present embodiment, as the plaintext data 5A, the hash value of the document such as the contract and the image of the image of the signature of the contractor are used, but other data may be used. For example, the hash value of a document such as a contract and the data of the seal (imprint) of the contractor may be used. Alternatively, data of confidential material may be used.

In addition, the configuration of the entire confidential data processing device 1 or each unit, the content of processing, the order of processing, and the like can be appropriately changed in accordance with the spirit of the present invention.

1 Confidential data processing device (encryption device, decryption device)
101 plaintext data dividing unit (dividing means)
102 First hash value calculation unit (hash value calculation means)
103 First Exclusive-OR Operation Unit (First Encryption Means)
104 First encryption processing unit (first encryption means)
105 Second Exclusive-OR Operation Unit (Second Encryption Means)
106 second encryption processing unit (second encryption means)
108 print processing unit (print processing means)
121 Encrypted data dividing unit (dividing means)
122 First Decoding Processing Unit (First Decoding Means)
123 Third Exclusive-OR Operation Unit (First Decoding Means)
124 Second Hash Value Calculation Unit (Second Hash Value Calculation Means)
125 Second Decoding Processing Unit (Second Decoding Means)
126 Fourth Exclusive-Or Operation Unit (Second Decoding Means)
2 Multi-function machine (printing device)
5A plaintext data 5C plaintext data 5P public key (first key)
5Q private key (second key)
La plaintext block Lb exclusive OR Lc cipher block Ld cipher block Lf plaintext block Ha hash value Hb hash value

Claims (28)

An encryption device for encrypting each of n plaintext blocks, which are plaintext blocks of a predetermined size,
Hash value calculation means for calculating a hash value by a predetermined method using all or part of the first to (n-1)th plaintext blocks of the n plaintext blocks;
The n-th cipher block corresponding to the n-th plaintext block of the n plaintext blocks is defined as one of the hash value and the pair of first key and second key of the public key cryptosystem. A first encryption means generated by using
The 1st cipher block corresponding to the 1st plaintext block among the 1st to (n-1)th plaintext blocks is converted into the nth cipher block , the 1st key and the 2nd key. Of the keys used by the first encryption means among them, and the p-th cipher block corresponding to the p (where 2≦p≦(n−1))-th plaintext block is (p -1) second encryption means generated using the first cipher block and the key used by the first encryption means of the first key and the second key ;
From the first cipher block, the n-th cipher block and the first key and the second key, which are not used by the first encryption means, are used for the first cipher block. A plaintext block is generated and used from the p-th cipher block by the first encryption means of the (p-1)-th cipher block and the first key and the second key. First decryption means for generating the p-th plaintext block using a non-key
Second hash value calculation means for calculating the hash value by the predetermined method using all or part of the first to (n-1)th plaintext blocks obtained by the first decryption means; ,
The hash value generated by the second hash value calculation means from the nth cipher block and the first encryption means of the first key and the second key are not used. Second decryption means for generating the n-th plaintext block using a key;
An encryption device comprising: The first encryption unit calculates the exclusive OR of the nth plaintext block and the hash value, and encrypts the exclusive OR to generate the nth encrypted block. ,
The second encryption means calculates an exclusive OR of the first plaintext block and the nth cipher block, and encrypts the exclusive OR to obtain the first cipher block. To calculate the exclusive OR of the p-th plaintext block and the (p-1)-th cipher block, and encrypt each of the exclusive ORs to obtain the p-th cipher Generate blocks,
The encryption device according to claim 1 . The first decryption unit generates the first plaintext block by decrypting the first cipher block and calculating an exclusive OR with the nth cipher block, and the first plaintext block is generated. Generate the p-th plaintext block by decrypting the cipher block and calculating the exclusive OR with each of the (p-1)-th cipher block
The second decryption unit decrypts the nth cipher block and calculates an exclusive OR with the hash value to generate the nth plaintext block.
The encryption device according to claim 2 . The first encryption unit calculates the exclusive OR of the nth plaintext block and the hash value, and encrypts the exclusive OR to generate the nth encrypted block. ,
The second encryption means calculates an exclusive OR of the first plaintext block and the nth cipher block, and encrypts the exclusive OR to obtain the first cipher block. To calculate an exclusive logic between the (p-1)th plaintext block and the (p-1)th ciphertext block, and calculate an exclusive OR between the exclusive OR and the pth plaintext block. Generating the p-th cipher block by calculating the logical sum and encrypting
The encryption device according to claim 1 . The first decryption unit decrypts the first cipher block and calculates an exclusive OR with the nth cipher block to generate the first plaintext block, and the (p- 1) The first exclusive OR of the cipher block and the (p-1)th plaintext block is calculated, and the first exclusive OR and the pth cipher block are decrypted. Generate the p-th plaintext block by computing the second exclusive OR of
The second decryption unit decrypts the nth cipher block and calculates an exclusive OR with the hash value to generate the nth plaintext block.
The encryption device according to claim 4 . The first encryption means generates the n-th cipher block by encrypting the hash value and calculating an exclusive OR with the n-th plaintext block,
The second encryption means generates the first cipher block by encrypting the n-th cipher block and calculating an exclusive OR with the first plaintext block, and the (p- 1) The p-th cipher block is generated by encrypting the p-th cipher block and calculating the exclusive OR with the p-th plaintext block,
The encryption device according to claim 1 . The first decryption unit generates the first plaintext block by decrypting the n-th cipher block and calculating an exclusive OR with the first cipher block, and the (p- 1) generate the p-th plaintext block by decrypting the 1st-th cipher block and calculating the exclusive OR with the p-th cipher block
The second decryption unit decrypts the hash value and calculates an exclusive OR with the nth cipher block to generate the nth plaintext block.
The encryption device according to claim 6 . The first encryption means generates the n-th cipher block by encrypting the hash value and calculating an exclusive OR with the n-th plaintext block,
The second encryption means generates the first cipher block by encrypting the n-th cipher block and calculating the exclusive OR with the first plaintext block, and the n-th cipher block is generated. The p-th cipher block is generated by calculating the exclusive OR of the cipher block encrypted p times and the p-th plaintext block.
The encryption device according to claim 1 . The first decryption unit generates the first plaintext block by decrypting the n-th cipher block and calculating the exclusive OR with the first cipher block, and the n-th cipher block is generated. Generating the p-th plaintext block by calculating the exclusive OR of the block decrypted p times and the p-th cipher block,
The second decryption unit decrypts the hash value and calculates an exclusive OR with the nth cipher block to generate the nth plaintext block.
The encryption device according to claim 8 . The first encryption means generates an n-th counter block using the n-th counter and the hash value, encrypts the n-th counter block, and performs exclusive access to the n-th plaintext block. Generate the nth cipher block by calculating the logical sum,
The second encryption means generates an m-th counter block using the m-th (where 1≦m≦(n−1))-th counter and the n-th cipher block, and the m-th counter block is generated. The m-th cipher block is generated by encrypting the counter block and calculating the exclusive OR with the m-th plaintext block.
The encryption device according to claim 1 . The first decryption unit generates the m-th counter block using the m-th counter and the n-th cipher block, decrypts the m-th counter block, and then the m-th cipher block. Generate an m-th plaintext block by calculating an exclusive OR with
The second decryption means generates the n-th counter block using the n-th counter and the hash value, decrypts the n-th counter block, and excludes the n-th cipher block. Generate the n-th plaintext block by calculating the logical OR
The encryption device according to claim 10 . The hash value calculation means calculates the hash value by calculating an exclusive OR of the first to (n-1)th plaintext blocks.
The encryption device according to any one of claims 1 to 11 . The second hash value calculation means calculates the hash value by calculating an exclusive OR of the first to (n-1)th plaintext blocks.
Encryption device according to claims 1 to 12. A printing device is provided with a process for printing a two-dimensional code representing the n-th cipher block generated by the first encryption means and the p-th cipher block generated by the second encryption means on a sheet. Print processing means to be executed,
Has,
The encryption device according to any one of claims 1 to 13 . The n plaintext blocks are obtained by dividing the hash value of the document and the plaintext data indicating the information indicating the identity of the person.
The encryption device according to any one of claims 1 to 14 . The information is an image of a signature,
The encryption device according to claim 15 . The hash value calculation means, the first encryption means, and the second encryption means are realized by executing a computer program loaded in a RAM (Random Access Memory) by a CPU (Central Processing Unit). The
The encryption device according to any one of claims 1 to 16 . The first decryption unit, the second hash value calculation unit, and the second decryption unit are realized by executing the computer program loaded in the RAM by the CPU.
Encryption device according to any one of claims 1 to 17. An encryption device for encrypting each of n plaintext blocks, which are plaintext blocks of a predetermined size,
Hash value calculation means for calculating a hash value by a predetermined method using all or part of the first to (n-1)th plaintext blocks of the n plaintext blocks;
The n-th cipher block corresponding to the n-th plaintext block of the n plaintext blocks is defined as one of the hash value and the pair of first key and second key of the public key cryptosystem. A first encryption means generated by using
The 1st cipher block corresponding to the 1st plaintext block among the 1st to (n-1)th plaintext blocks is the nth cipher block and a pair of first keys of the public key cryptosystem and A p-th cipher block corresponding to a p (where 2≦p≦(n−1)) plaintext block is generated by using one of the second keys and (p−1) Second encryption means generated using a second cipher block and a key used by the first encryption means of the first key and the second key ;
Output means for outputting the first to nth cipher blocks generated by the first encryption means or the second encryption means;
An encryption device comprising: A decryption device for decrypting the first to nth cipher blocks generated by the encryption device according to claim 19 .
Before Symbol first cipher block, using the n-th cipher block to generates the first plaintext block, from the p-th cipher block, the said (p-1) th cipher block the generating the p-th plaintext block using a key one key and the second first encryption means of the encryption device of the key is not used, the first decoding means,
The hash by the predetermined method used by the hash value calculation means of the encryption device by using all or part of the first to (n-1)th plaintext blocks obtained by the first decryption means A second hash value calculating means for calculating a value,
The hash value generated by the second hash value calculation means from the nth cipher block and the first encryption means of the first key and the second key are not used. generating the n th plaintext block using a key, a second decoding means,
Decoding device comprising a Turkey which have a. The first decryption unit, the hash value calculation unit, and the second decryption unit are realized by executing a computer program loaded in a RAM with a CPU.
The decoding device according to claim 20 . An encryption method for encrypting each of n plaintext blocks which are plaintext blocks of a predetermined size,
The encryption device
A hash value calculation process for calculating a hash value by a predetermined method using all or part of the first to (n-1)th plaintext blocks of the n plaintext blocks,
The n-th cipher block corresponding to the n-th plaintext block of the n plaintext blocks is defined as one of the hash value and the pair of first key and second key of the public key cryptosystem. run the first encryption process for generating with bets,
The 1st cipher block corresponding to the 1st plaintext block among the 1st to (n-1)th plaintext blocks is converted into the nth cipher block , the 1st key and the 2nd key. Generated using the key used in the first encryption process, and the p-th cipher block corresponding to the p (where 2≦p≦(n−1))-th plaintext block is (p -1) performing a second encryption process that is generated using the first cipher block and the key used in the first encryption process among the first key and the second key ,
The decryption device
From the first cipher block, the n-th cipher block and the first key and the second key, which are not used in the first encryption process, are used for the first cipher block. A plaintext block is generated and used from the p-th cipher block in the (p-1)-th cipher block and the first encryption process of the first key and the second key. Performing a first decryption process for generating the p-th plaintext block using a non-key
A second hash value calculation process for calculating the hash value by the predetermined method using all or part of the first to (n-1)th plaintext blocks obtained by the first decryption process. Run and
The hash value generated by the second hash value calculation process from the nth cipher block and the first key and the second key that are not used in the first encryption process Performing a second decryption process for generating the n-th plaintext block using the key,
An encryption method characterized by the following. A computer program used in a computer for encrypting each of n plaintext blocks, which are plaintext blocks of a predetermined size, comprising:
On the computer,
Executing a first process of calculating a hash value by a predetermined method using all or part of the first to (n-1)th plaintext blocks of the n plaintext blocks;
The n-th cipher block corresponding to the n-th plaintext block of the n plaintext blocks is defined as one of the hash value and the pair of first key and second key of the public key cryptosystem. preparative to execute the second process of generating with,
The 1st cipher block corresponding to the 1st plaintext block among the 1st to (n-1)th plaintext blocks is converted into the nth cipher block , the 1st key and the 2nd key. Of the keys used in the second process, and the p-th cipher block corresponding to the p (where 2≦p≦(n−1))-th plaintext block is (p−1 ) A third cipher block and the third key to be generated using the first key and the key used in the second process of the second key ,
From the first cipher block, the n-th cipher block and the first plaintext block using the first key and the second key that are not used in the second processing. From the p-th cipher block, the (p-1)-th cipher block and the key not used in the second process among the first key and the second key are generated. And executing a fourth process for generating the p-th plaintext block using
Executing a fifth process of calculating the hash value by the predetermined method using all or part of the first to (n-1)th plaintext blocks obtained by the fourth process,
From the n-th cipher block, using the hash value generated by the fifth process and a key of the first key and the second key that is not used in the second process. Execute a sixth process of generating the n-th plaintext block,
A computer program characterized by the above. Causing the computer to execute a seventh process of storing the first to n-th cipher blocks generated by the third process as one file in a recording medium,
The computer program according to claim 23 . A computer program used in a computer for encrypting each of n plaintext blocks, which are plaintext blocks of a predetermined size, comprising:
On the computer,
Executing a first process of calculating a hash value by a predetermined method using all or part of the first to (n-1)th plaintext blocks of the n plaintext blocks;
The n-th cipher block corresponding to the n-th plaintext block of the n plaintext blocks is defined as one of the hash value and the pair of first key and second key of the public key cryptosystem. preparative to execute the second process of generating with,
The 1st cipher block corresponding to the 1st plaintext block among the 1st to (n-1)th plaintext blocks is converted into the nth cipher block , the 1st key and the 2nd key. Of the keys used in the second process, and the p-th cipher block corresponding to the p (where 2≦p≦(n−1))-th plaintext block is (p−1 ) A third cipher block and a key used in the second process of the first key and the second key to perform a third process to generate ,
Executing a fourth process for outputting the first to n-th cipher blocks generated by the second process or the third process,
A computer program characterized by the above. A computer program used in a computer for decrypting the first to n-th cipher blocks generated by the encryption device according to claim 19.
On the computer,
The first plaintext block is generated from the first cipher block using the nth cipher block, and the (p-1)th cipher block and the first cipher block are generated from the pth cipher block. Executing a first decryption process for generating the p-th plaintext block using a key and a key of the second keys that is not used by the first encryption means of the encryption device,
The hash by the predetermined method used by the hash value calculation means of the encryption device by using all or part of the first to (n-1)th plaintext blocks obtained by the first decryption process. Execute the hash value calculation process to calculate the value,
From the n-th cipher block, the hash value generated by the hash value calculation process and the key of the first key and the second key that is not used by the first encryption means are obtained. Generate the n-th plaintext block by using the second decryption process,
A computer program characterized by the above. First through (n-1) -th hash value generated in a predetermined way, all or part have based Dzu plaintext block and n-th plaintext block of the n plaintext blocks of a predetermined size of the plaintext And an n-th cipher block generated by a pair of first and second keys of the public key cryptosystem ,
A first plaintext block of the n plaintext blocks, a first cipher block generated by the nth cipher block, and the first key ;
Of the n plaintext blocks, the p (where 2≦p≦(n−1)) plaintext block, the (p−1)th cipher block, and the pth generated by the first key. Cipher block of
It is constituted by,
The decryption device
The first plaintext block is generated from the first cipher block using the nth cipher block and the second key, and the (p−1)th cipher block is generated from the pth cipher block. A first decryption process for generating the p-th plaintext block using a cipher block and the second key;
A hash value calculation process for calculating the hash value by the predetermined method using all or part of the first to (n-1)th plaintext blocks obtained by the first decryption process;
A second decryption process for generating the nth plaintext block from the nth cipher block using the hash value generated by the hash value calculation process and the second key;
A data structure that is used to implement . Data of the data structure according to 請 Motomeko 27 is stored,
A storage medium characterized by the above.

Images