JPH0244391A - Enciphering processing method and ic card device using such method - Google Patents

Abstract

PURPOSE:To execute the concealment and the certification of a message at high speed by a small number of parts, while keeping the security of a high level by using the same mechanism utilizing a CBC (Cipher Block Chaining) mode for the concealment and the certification of the message. CONSTITUTION:A first apparatus 1 is provided with a first enciphering means 4 for inputting a plain sentence of (n) bits and outputting an enciphered sentence of (n) bits, a first register 5 and a first exclusive OR arithmetic means 6. Also, a second apparatus 2 is provided with a decoding means 7 for forming a pair with a first enciphering means 4, a second register 8, a second exclusive OR arithmetic means, a second enciphering means 11 for performing the same operation as that of a first enciphering means 4, a third register 12, a third exclusive OR arithmetic means 13 and a comparing means 14. In such a way, the same mechanism can be used for the concealment and the certification of a message, the number of parts can be curtailed, and also, on the transmitting side, high speed operation can be realized by executing simultaneously the concealment of the message and the generation of a certifier.

Description

DETAILED DESCRIPTION OF THE INVENTION Field of Industrial Application The present invention relates to an encrypted communication between devices that requires data confidentiality and authentication.

BACKGROUND OF THE INVENTION Conventionally, this type of encryption processing method has had a configuration as shown in FIG. In FIG. 3, 41 is a first device that transmits data, 42 is a second device that receives data, 43 is a plaintext block storage means, and 44 is a device that detects whether the transmitted data has been illegally tampered with by a third party. 46 is an encryption means; 46 is a decryption means for performing an inverse operation of the encryption means 46; , 47 is the first
48 is a restored block storage means, and 49 is a comparison means. Here, a block refers to a block of data that is overstated - times.

The operation of the encryption processing method configured as above will be described below. First, the first device 41 uses the first authentication code generation means 44 to generate the plaintext block storage means 4.
A first authenticator is generated from the plaintext block stored in 3. This first authenticator is used by the second device 42 (receiving side) to check whether the transmitted data has been illegally tampered with by a third party (generally called message authentication). The authenticator generation means 44 performs a reduction type operation (the bit length of the output is shorter than the bit length of the input) using all bits of the data of the plaintext block as input. The generated first authenticator is connected to a plaintext block and output to the encryption means 45, as shown in FIG. Here, 51 is a plaintext block, which is a data string M1 . M2. M3
Consists of. 62 is the first authenticator 1 having a length of m bits
person). The encrypting means 46 encrypts the plaintext block 61 and the first authenticator 62 and transmits them to the second device 42 . On the other hand, the second device 42 decodes the sent data using the decoding means 46, and converts the obtained data into a restoration program (M1', M2',
M3') e Comparison data with length of 1 and m bits (
A') Divide into 62 parts. The decoding means ae is a restoration file a.
The data (M1', M2', M3') 61 are stored in the restored block storage means 48, and the comparison data Cm') 62
is output to the comparing means 49. The comparison means 49 takes this as the first input. Next, the second device 42 uses the second authentication code generation means 47 to generate a second authentication code from the restored block stored in the restored block storage means 48,
It is output to the comparison means 49. The comparison means 49 compares this with the second
The received data is compared with the first input, and depending on whether they match, it is determined whether the received data is valid or has been tampered with by a third party. Furthermore, since the data on the communication line between the first device 41 and the second device 42 is encrypted, even if a third party eavesdrops on it,
It is difficult to decipher. In this way, message concealment and message authentication are possible.

Problems to be Solved by the Invention In such a conventional configuration, first. Second equipment 41.4
2, in addition to the encryption means 45 or the decryption means 46,
Since it is necessary to provide the authentication code generation means 44 or 47, there are problems in terms of the number of parts (or program size when realized by software) and processing speed. Particularly, when these devices 41, 42 are devices with limited internal resources, such as IC cards, the number of parts (or program size) becomes a major obstacle.

One possible solution to this problem is to use a simple calculation such as a generally known transmission error detection code (for example, horizontal parity) in the authentication code generating means 44, 47. Even if the authenticator is generated by a generally known calculation, it is output over the communication line in encrypted form, so it is safe from simple attacks by third parties. However, such a method has the following drawbacks. Plaintext block (Ml, M2゜M3)
Assume that the cryptogram for 61 is C1, C2, G:3, and the authenticator is person. Here, it is assumed that the authentication code A is generated by Mizuko Nokriti. A third party with malicious intent swaps 02 and 03 in the code on the communication line, resulting in 01. CI3. C.I.
If it is tampered with 2, the result restored by the receiving side will be Ml
, M3. It becomes M2.

However, since the horizontal parity for this tampered received block is also human, such tampering by a third party cannot be detected. This falsification is an effective attack method because the authentication is generated using horizontal parity. The encryption means 46 contains CBC (C1ph
Even if the encryption process is complicated using the ar Block Chaining mode, the above-mentioned tampering cannot be detected. In this way, the authenticator generating means 4
4.47, if a generally known simple calculation is used, specific attacks related to the calculation are possible, so the authenticator generation means 44.47 must be secret and disturb the input data. High-level operations must be used. Therefore, when concealing and authenticating messages, the number of parts inevitably increases and processing speed tends to slow down.

In view of these problems, an object of the present invention is to provide an encryption processing method that can conceal and authenticate messages at high speed with a small number of parts (or program size) while maintaining a high level of security. That is.

Means for Solving the Problem In order to solve this problem, the present invention includes at least a first device that transmits data, a second device that receives data from the first device, and a second device that receives data from the first device. The device includes a first encryption means for inputting n-bit plaintext and outputting n-bit cryptogram, a first register, and a first exclusive OR operation means; The device comprises: a decryption means paired with the first encryption means; a second register; a second exclusive OR operation means; 2 encryption means, a third register, and a third encryption means;
and a comparing means, and the first exclusive OR operation means selects one of a plurality of n-bit data obtained by dividing a plaintext block into n bits and the first exclusive OR operation means. The contents of the first register are subjected to an exclusive OR operation and outputted to the first encryption means, and the first encryption means secretly processes the output from the first exclusive OR operation means. The decryption means performs a secret operation on the m1 output from the first encryption means and outputs it to the second exclusive OR operation means. The second exclusive OR operation means performs an exclusive OR operation on the output from the decoding means and the contents of the second register to obtain n-bit restored data, and 3, the exclusive OR operation means performs an exclusive OR operation on the n-bit restored data and the contents of the third register, and outputs the result to the second encryption means; performs an operation on the output from the third exclusive OR operation means, and further calculates the output of the first encryption means, the input to the decryption means, and the second encryption means. The outputs are the first . Second. The information is stored in a third register, and the comparing means compares the contents of the second register with the contents of the third register.

Effect: This configuration allows the same mechanism to be used for message concealment and authentication, reducing the number of parts (or program size). Furthermore, on the sending side, by concealing the message and generating the authentication code at the same time, it is possible to achieve faster processing speed.

Embodiment FIG. 1 is a block diagram of an authentication method according to an embodiment of the present invention. In FIG. 1, 1 is the first node that transmits data.
device, 2 is the second device that receives data, Z
In the C card device, the first device 1 is a terminal and the second device 2 is an IC card, but from now on, the first device 1 is a terminal, and the second device 2 is an IC card. Continue the explanation with the second device.

3 is a plaintext block storage means, 4 is a first encryption means for inputting n-bit data and outputting n-bit data, 6 is a first register, 6 is a first exclusive OR operation means, 7
is the decryption means corresponding to the first encryption means 4, and 8 is the second decryption means.
9 is a second exclusive OR operation means, 10 is a reconstructed block storage means, 11 is a second encryption means that performs the same operation as the first encryption means 4, 12 is a third register, 13 is a third exclusive OR operation means, 14 is a comparison means, and 15.16 is an n-bit fixed pattern (P) that the first device 1 and the second device 2 have in common.

The present embodiment will be explained below with reference to FIG. First, as an initial state, 1. Second. Third register 5,8
．． 12 stores the same value. The first device 1 divides the plaintext block stored in the plaintext block storage means 3 into n bits, which are the units of encryption. The plurality of n-bit data strings obtained in this way are Ml, M2 .
M3 (fixed pattern (P) 1es will be described later).

The first n-bit data M1 is outputted to the first exclusive OR calculation means 6. The first exclusive OR operation means 6 calculates the exclusive OR of the n-bit data M1 and the data (initial value) in the first register, and outputs it to the encryption means 4. The encryption means 4 performs encryption processing on the input from the first exclusive OR calculation means 6, and encrypts the input from the first exclusive OR calculation means 6.
Send to. If the disturbance of the encryption means 4 is sufficient, it is extremely difficult for a third party who does not have the decryption means 7 to obtain the plaintext M1 from the communication data (ciphertext).

In this way, the message can be kept secret.

On the other hand, the second device 2 receives the received data (
The plaintext M1 is restored from the cryptogram. The second device 2 uses the decoding means 7 to decode the sent data, and outputs the result to the second exclusive OR operation means 9. A second exclusive OR operation means 9 combines the input from the decoding means 7 and the data in the second register (
The exclusive OR of the initial value M1' is calculated and the result M1' is stored in the restored block storage means 1o. Thereafter, the first device 1 stores the output (ie, the transmission data) of the first encryption means 4 in the first register 5 instead of the initial value. Similarly, the second device 2 replaces the initial value with
The received data from the first device 1 is transferred to the second register 8.
Store in. Therefore, unless the transmitted data is subject to accidental or intentional changes, the first register 5 and the second register 5
The same value will always be stored in register 8.

The processing for the first n-bit data M1 as described above is performed by M2. The same process is repeated for M3. From K, the restored original data is sequentially stored in the restored block storage means 1o. This encryption usage mode is generally known as CBC mode, and since the content of preceding data affects the encrypted output of subsequent data, by changing the initial value of the first register 6, Same transmission data M1. M2. Effects such as the output of the first encryption means 4 being different can also be obtained for M3.

Next, a method for generating an authentication code will be explained with reference to FIG. FIG. 2 is an explanatory diagram showing the authentication code generation procedure, in which 21 is a plaintext block (Ml, M2.M3), 1
5 is the fixed butter shown in FIG. an exclusive OR operation performed by the first exclusive OR operation means 6;
31 is an authentication code finally generated. Plaintext blocks (Ml, M2.M3) 21 and fixed patterns (P) 15
are connected. First, the first n of the plaintext block 21
An exclusive OR 27 of the bit data (Ml) and the initial value (I) 22 is calculated, and an encryption process 23 is performed on it.

Next, calculate the exclusive OR 28 of the result and the second n-bit data (M2), and perform the encryption process 28 on it.
Do step 4. This is repeated in the same manner for the third n-bit data (M3) and the fixed pattern (P), and finally the authenticator 31 is obtained. This is an authentication code generation means using the CBC mode, and satisfies the following conditions for an authentication code generation means.

(1) The authenticator depends on all bits of data in the plaintext block.

(2) The plaintext is m, the authenticator generating means is f, and the authenticator is a
= f (m), it is extremely difficult to find X that satisfies f (m) = f (x).

Here, the authentication code generation procedure in FIG. 2 described above is as follows:
This is exactly the same as the data encryption procedure shown in the figure, and the authentication code generation process and data encryption process can be performed simultaneously. That is, the encryption processing 23-2 in FIG.
The output of e is transmitted to the second device 2 as the output of the encryption means 4 in FIG. 1 (encrypted output of transmission data). In particular, the output of the encryption process 26 in FIG. 2, ie, the authenticator 31, is the output of the encryption means 4 for the fixed pattern (P) 16 in FIG. 1, and is stored in the second register 8.

Next, the procedure for inspecting the authenticator will be explained with reference to FIG.

First, the control unit (not shown) of the second device 2 replaces the last n-bit data of the data stored in the restored block storage means 10 with a fixed number turn 16.

If the communication is successful, the original data to be replaced is equal to the fixed number (turn 16).Then the second device 2
In this case, the first device 1 uses the second encryption means 11 that performs the same operation as the first encryption means 4, the third register 12, and the third exclusive OR operation means 13 to Comparison data is generated using the same procedure as that used to generate No. 31. This comparison data is stored in the third register 12. Finally, the second device 2 uses the comparison means 14 to compare the authentication code 31 stored in the second register 8 and the third register 1.
The comparison data stored in 2 is compared to check whether the communication data has been tampered with.

As described above, the first device 1 on the sending side uses the same mechanism for encryption processing and authentication code generation processing, and by performing these processing at once, the number of parts (or program size) can be reduced. This can significantly improve processing speed. On the other hand, the second device 2 on the receiving side
Although it is not possible to improve the processing speed,
Since the second encryption means 11 and the decryption means 7 have many common parts, it is possible to reduce the number of parts. In particular, when the second piece g2 also performs transmission, this is because it originally has a mechanism consisting of the second encryption means 11, the third register 12, and the third exclusive OR operation means 13. , it is possible to further reduce the number of parts.

Effects of the Invention As described above, according to the present invention, by using the same mechanism using message concealment and authentication KCBG mode, it is possible to reduce the number of required parts (or program size) while maintaining a high level of security. can do. Furthermore, on the sending side, by concealing the message and generating the authentication code at the same time, it is possible to significantly increase the speed compared to conventional methods.

[Brief explanation of the drawing]

Fig. 1 is a block diagram showing an encryption processing method according to an embodiment of the present invention, Fig. 2 is an explanatory diagram showing an authentication code generation procedure according to an embodiment of the invention, and Fig. 3 is a conventional encryption processing method. FIG. 4 is a block diagram illustrating the method. FIG. 6 is a configuration diagram of transmitted data and received data in a conventional encryption processing method. 1...First device, 2...Second device, 3...Plaintext block storage means, 4...
・First encryption means, 6...first register,
6...First exclusive OR operation means, 7...
...Decoding means, 8...Second register, 9
...Second exclusive OR operation means, 1゜...
...Restored block storage means, 11...Second encryption means, 12...Third register, 13...
...Third exclusive OR operation means, 14...
・Comparison means, 15.16...Fixed pattern, 3
1... Authenticator. Name of agent: Patent attorney Shigetaka Awano and one other person

Claims (2)

[Claims] (1) At least a first device that transmits data and a second device that receives data from the first device, the first device inputs n-bit plaintext and receives n-bit a first encryption means for outputting a cryptogram, a first register, and a first exclusive OR operation means;
The device comprises: a decryption means paired with the first encryption means; a second register; a second exclusive OR operation means; 2 encryption means, a third register, a third exclusive OR operation means, and a comparison means, and the first exclusive OR operation means encodes the plaintext block every n bits. An exclusive OR operation is performed on one of the plurality of divided n-bit data and the contents of the first register, and the result is output to the first encryption means, and the first encryption means A secret operation is performed on the output from the first exclusive OR operation means and the result is output to the decryption means, and the decryption means performs a secret operation on the output from the first encryption means. The second exclusive OR operation means performs an exclusive OR operation on the output from the decoding means and the contents of the second register. Obtaining the n-bit restored data, the third exclusive OR operation means performs an exclusive OR operation on the n-bit restored data and the contents of the third register, and converts the data into the second encryption means. and the second encryption means performs an operation on the output from the third exclusive OR operation means, and further inputs the output of the first encryption means and the input to the decryption means. , the outputs of the second encryption means are stored in the first, second, and third registers, respectively, and the comparison means compares the contents of the second register with the contents of the third register. An encryption processing method characterized by comparison. (2) An IC card device using the encryption processing method according to claim 1.