JPH09251267A - Encryption device and encryption method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enhance the safety of cipher text by updating a stored content state by an internal state updating means every time encryption conversion is executed. SOLUTION: An F function 1 as an encryption conversion means receives the plaintext to be encrypted, an encryption key 5 and the internal state 6, executes the prescribed encryption conversion and produces an output 7. An internal state updating function 3 updates the internal state 6 every time the encryption conversion in an internal state storing means 2 for storing the internal state 6 and the F function 1 is executed, i.e., simultaneously with the encryption conversion. Even if the same plaintext and the cipher key are inputted, the output is changed by the updatable internal state according to such constitution and, therefore, the safety of a round function which can be an effective defense method against the differential attack based on the analysis of the input and output functions of the round function is enhanced. The device may be composed of the round functions of a smaller number of stages when the safety of about the same degree is taken into consideration.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption device and an encryption method, and more particularly to an encryption device and an encryption method for enhancing the security of ciphertext in Feistel type block cipher.

[0002]

2. Description of the Related Art Conventionally, there is known an encryption method which regards a cipher having a relatively low security as a round function and stacks the round functions to enhance the security. Such ciphers are called product ciphers, but especially Feistel
The type block cipher has an advantage that the device scale can be reduced because the encryption circuit and the decryption circuit can be shared. "Modern Cryptography," IEICE, Shinichi Ikeno, Kenji Koyama, disclose such an encryption device.

Further, Japanese Unexamined Patent Publication No. 51-108701 and Japanese Unexamined Patent Publication No. 51-108702 disclose DES (Dat) which is well known as a representative cipher of the Feistel block cipher.
It discloses the basic idea of a Encryption Standard) type encryption.

Further, Japanese Patent Laid-Open No. 6-266284 discloses a method of encrypting a long plaintext string by updating an intermediate key as a bit string controlling encryption conversion each time encryption is performed. It discloses a method of preventing a large amount of ciphertext encrypted with the same key from being given to a decryption person.

On the other hand, as an effective method for deciphering the Feistel type cipher described above, an attack method called differential attack is known in which ciphertext is analyzed by paying attention to the input / output relation of the conversion unit. In order to protect the ciphertext from such a differential attack, the number of stages of the conversion unit may be increased.

[0006]

However, all of the above-mentioned conventional techniques have a drawback that the processing speed is reduced if the number of stages of the conversion unit is increased in order to protect the ciphertext from the differential attack. On the other hand, if the processing speed is emphasized and the number of stages of the conversion unit is reduced, there is a problem that the ciphertext is decrypted by the differential attack.

The present invention has been made by paying attention to such a problem, and an object of the present invention is to obtain a ciphertext even if the device is configured with a conversion unit having a small number of stages in consideration of processing speed. An object of the present invention is to provide an encryption device and an encryption method capable of further increasing the security of.

[0008]

In order to achieve the above object, the encryption device according to the first aspect of the present invention stores a storage unit for storing an internal state and an internal state stored in the storage unit. A conversion unit including an internal state update unit for updating, data to be encrypted, an encryption key, and an encryption conversion unit that receives the internal state stored in the storage unit and performs encryption conversion. An encryption device having a plurality of stages,
Each time the encryption conversion is performed by the encryption conversion means,
The internal state stored in the storage means is updated by the internal state update means.

The encryption device according to the second aspect of the present invention includes an encryption conversion means for receiving data to be encrypted and an encryption key for performing encryption conversion, a storage means for storing an internal state, and An encryption device having a plurality of stages of conversion units each including an internal state updating unit for updating the internal state stored in the storage unit, wherein the encryption device performs the encryption conversion every time the encryption conversion unit performs the encryption conversion. While updating the internal state stored in the storage means by the internal state update means, the output of the encryption conversion means is controlled according to the internal state stored in the storage means.

In the encryption method according to the third aspect of the invention, a storage step of storing the internal state in the storage means, an internal state updating step of updating the stored internal state by the internal state updating means, and encryption should be performed. What is claimed is: 1. An encryption method for performing a conversion step a plurality of times, comprising an encryption conversion step of receiving data, an encryption key, and a stored internal state and performing encryption conversion by an encryption conversion means. Each time the encryption conversion process is performed, the internal state stored in the storage unit is updated by the internal state update unit.

The encryption method according to the fourth aspect of the present invention includes an encryption conversion step of receiving data to be encrypted and an encryption key and performing encryption conversion by the encryption conversion means, and an internal state in the storage means. Is an encryption method for performing a plurality of conversion steps including a storage step of storing the internal state and an internal state update step of updating the stored internal state by an internal state update means, wherein the encryption conversion step is performed in the encryption conversion step. And updating the internal state stored in the storage unit by the internal state updating unit, and controlling the output of the encryption conversion unit according to the internal state stored in the storage unit. To do.

[0012]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a diagram showing a configuration of a round function 8 as a conversion unit to which the present invention is applied, which receives a plaintext 4 to be encrypted, an encryption key 5 and an internal state 6 and then performs a predetermined encryption. F function 1 as an encryption conversion unit that performs an encryption conversion and outputs an output 7, an internal state storage unit 2 for storing an internal state 6, and an encryption conversion by the F function 1 each time That is, the internal state update function 3 for updating the internal state 6 simultaneously with the encryption conversion is provided. Although FIG. 1 shows the round function of the first round, the output of the round function of the previous round is input instead of the plaintext 4 in the round functions of the second round and thereafter.

According to such a configuration, even if the same plaintext and encryption key are input, the output is changed by the updatable internal state, so a differential attack based on the analysis of the input / output relation of the round function can be performed. On the other hand, it becomes an effective defense method and can increase the security of the round function. Further, when considering the same degree of safety, the device can be configured with a round function having a small number of stages. Further, since the internal state is updated at the same time as the encryption conversion processing of the F function in the round function, the processing efficiency of the entire round function remains almost unchanged, and the processing speed can be increased by the number of round functions. There are advantages.

FIG. 2 is a diagram showing a configuration example of a product cipher in which n round stages of the above round functions are arranged. In the figure, the encryption key 16 is input to the key processing unit 17 and n expanded keys 1 to
It is converted into n and input to the n round functions 12 to 15, respectively. With such a configuration, the plaintext 11 is n
It is output as ciphertext 18 through the encryption conversion processing by the round function of the round. Here, plaintext 11 and ciphertext 18
May have a fixed length or a variable length. Further, the length of the plaintext 11 and the length of the ciphertext 18 do not have to match.

FIG. 3 is a diagram showing a process in which the internal state is sequentially updated by the internal state update function 3. That is, the internal state 1 (22) is initially an internal state equal to the initial state 21, but is updated by the internal state update function 23 to become the internal state 2 (22). Next, this internal state 2
(22) is updated by the internal state update function 23.
In this way, the internal state is sequentially updated. Here, when the internal update function 23 is a one-way function, even if the internal state k having a number larger than k is deciphered because the internal state k is known to a third party, it goes back in the past. It is safer because the internal state of a number smaller than k is not known.

FIG. 4 is a diagram for explaining the operation when the round function 8 shown in FIG. 1 has an input section for inputting the internal state initialization signal 31. The internal state stored in the internal state storage means 33 is transmitted to the F function 35 and also to the internal state update function 34 to be updated to a new internal state. At this time, when the internal state initialization signal 31 supplied from the outside is input to the internal state initialization control unit 32, the internal state initialization control unit 32 initializes the internal state stored in the internal state storage unit 33. Turn into.

As described above, in this embodiment, the initialization of the internal state can be controlled from the outside. Here, in consideration of safety, the internal state initialization control unit 32 preferably has a function of monitoring the frequency of initialization. For example, it is possible to provide a monitoring mechanism for enabling initialization only once during one encryption process.

FIG. 5 is a diagram for explaining the operation when the encryption apparatus is used in the block cipher mode. Plaintext 4
1 is composed of a plurality of plaintext blocks 42, 43 and 44, the plaintext 41 is an encryption function 4 for each block.
Cipher block 5 encrypted by 6, 50, 52
Converted to 4, 55, 56. The ciphertext 53 is a juxtaposition of these.

The internal states of the encryption functions 46, 50 and 52 can be initialized for each block by initialization signals 45, 49 and 51. This allows, for example,
The plaintext block 43 and the plaintext block 44 have the same content A,
If they have A, when they are encrypted, they are converted into cipher blocks 55 and 56 having the same contents B and B.

As described above, in this embodiment, the encryption device having the initialization function can be operated in the block cipher mode.

FIG. 6 is a diagram for explaining the operation when the encryption apparatus is used in the stream encryption mode. Assuming that the plaintext 61 is composed of a plurality of plaintext blocks 62, 63, 64, the plaintext 61 is an encryption function 7 for each block.
Cipher block 7 encrypted by 0, 72, 73
Converted to 6, 77, 78. The ciphertext 75 is a juxtaposition of these. In this embodiment, the encryption function 70
The internal state of is initialized by the initialization signal 65 only once before encryption. Therefore, for example, even if the plaintext block 63 and the plaintext block 64 have the same contents A and A, when they are encrypted, the encrypted result is the cipher block 7 having different contents B and B ′.
Converted to 7,78. That is,

[Equation 1] Becomes

As described above, in this embodiment, the encryption device having the initialization function can be operated in the stream encryption mode.

FIG. 7 is a diagram for explaining the operation when the present invention is applied to secret communication. On the transmission side 87, the plaintext 81 including, for example, the plaintext block 82 and the plaintext block 83 is encrypted for each block by the encryption functions 84 and 85 to obtain cipher blocks 87 and 88. The cipher blocks 87 and 88 are transmitted to the receiving side 97 via the communication path 90. On the receiving side 97, the ciphertext 91 is decomposed into cipher blocks 92 and cipher blocks 93, and the plaintext blocks 97, 98 are obtained by decrypting the ciphertexts 91 by the decryption functions 94, 95 for each block. The original plaintext 96 is restored by juxtaposing the plaintext blocks 97 and 98.

At this time, the transmitting side 87 and the receiving side 97 are provided with the initialization signal generating sections 89 and 99, respectively, and the encryption functions 84 and 8 are set at the timings previously discussed.
5 and the internal states of the decoding functions 94 and 95 are respectively initialized signals 200, 201, 202 and 203.
To be initialized by. Initialization signal generator 8
It is assumed that the reference numerals 9 and 99 have a built-in initialization timing. Here, the initialization signal generation units 89 and 99 may be configured by, for example, a random number generator so as to exchange only the seeds of random numbers in order to reduce the communication amount at the initialization timing.

According to the above-described embodiment, in order for the receiving side 97 to restore the same plaintext as the transmitting side 87, the initialization timing as well as the decryption key must be known. Therefore, in order for an unauthorized eavesdropper to decipher the cipher, in addition to the decryption key, the initialization timing must be known, and thus more secure secret communication can be performed.

FIG. 8 is a diagram showing another embodiment in which the present invention is applied to secret communication.

In this embodiment, the plaintext block 82 corresponding to the encryption function desired to be initialized on the transmitting side 87,
Special symbols 204 and 206 are added to 83 as instruction data for instructing initialization. The plaintext blocks 82 and 83 forming the plaintext 81 are converted into cipher blocks 87 and 88 by encryption functions 84 and 85, respectively. Ciphertext 8 is the one in which cipher blocks 87 and 88 are arranged in parallel.
It becomes 6. At this time, the special symbol 2 in the plaintext block 82
04 or the special symbol 206 in the plaintext block 83 is detected, the internal states of the encryption functions 84 and 85 are initialized by the initialization signals 205 and 207, respectively. The ciphertext 86 is sent to the receiving side 97 via the communication path 90.
Sent to.

The receiving side 97 decomposes the received ciphertext 91 into cipher block 92 and cipher block 93, and plaintext blocks 97 and 98 are decrypted by decryption functions 94 and 95, respectively.
Convert to At this time, when the special symbols 208 and 210 for instructing the initialization in the plaintext blocks 97 and 98 are detected, the internal states of the decoding functions 94 and 95 are initialized by the initialization signals 209 and 211, respectively. In addition,
If necessary, special symbol 2 in plaintext blocks 97, 98
08 and 210 are removed and subsequent plaintext blocks 97 and 9
The plaintext 96 may be a juxtaposition of the eight.

As described above, in this embodiment, since the timing for initializing the internal state is included in the plaintext,
It is not necessary to discuss the initialization timing in advance between the sender and the receiver.

FIG. 9 is a diagram showing a specific configuration of the internal state update function 3 shown in FIG. 1, in which the storage element 100 and the adder 1 are provided.
02 and a linear register. The storage element 100 is an element capable of storing 1-bit information,
For example, a D flip-flop.

Various characteristic polynomials can be expressed by whether or not each tap 101 is connected. For example, when the tap 101 is connected to 1 and the tap 101 is not connected to ₀ , a characteristic polynomial represented by C _r x ^r + C _r-1 x ^r-1 +, ..., + C ₁ x + C ₀ can be expressed. . Especially,
It is known that the linear shift register outputs the maximum sequence length when the expression polynomial is a primitive polynomial (Hideki Imai, Code Theory, IEICE). As an example of the primitive polynomial, x ³¹ + x ³ +1 and the like are known.

In the linear shift register, every time a clock signal is input, the storage content of the storage element 100 is updated with the content of the storage element 100 on the left side and added by the adder 102 according to the connection state of the tap 101. The result is input to the leftmost storage element 100 and is output as the output 103.

Another method for strengthening the security of the existing block cipher will be described below by taking the DES cipher as an example.

First, the outline of the DES encryption will be described. FIG.
0 is a diagram showing the overall configuration of the DES encryption. First, the 64-bit plaintext 105 to be encrypted has the same configuration after the bit order is rearranged by the initial transposition 106 and then divided into upper 32 bits (input L113) and lower 32 bits (input R114). After 16 rounds of conversion by the round function (1 to 16) 107 of 16 rounds, the final transposition 108 is performed to obtain the desired ciphertext 109.

Each round function 107 includes an F function 110,
The inputs Li and Ri of the round function at the i-th stage are composed of the exclusive OR 111 and the left and right conversions 112.
When the key of the i-th stage is Ki, it is converted into the input of the round function of the i + 1-th stage such that Ri + 1 = Li XOR F (Ri, Ki) Li + 1 = Ri.

FIG. 11 shows the detailed structure of the F function in the DES encryption. The F-function has two inputs, a 32-bit input R115 and a 48-bit key Ki 116, and a 32-bit output 117.

The operation will be described below according to the flow of data. The input 32-bit input R115 is the expanded transpose E
(118), that is, expanded to 48-bit data by E conversion. FIG. 12 is a transposition table relating to such an enlarged transpose E, and from the upper left, shows which E-converted output bit becomes the input bit. For example, since the first bit is 32, the first bit of the output of E conversion is the same as the 32nd bit of the input. Output 2 of E conversion
The bit number is the same as the input first bit, and so on.

Next, the output 119 of the E conversion and the key Ki 116
The exclusive OR with is taken by the exclusive OR 120, and the result is divided into eight groups of 6 bits each and input to the eight S boxes (S1 to S8) 121 as substitution characters. . The S box 121 is a substitution (replacement character) table having a 6-bit input and a 4-bit output, and FIG. 14 shows an example of such a substitution table.

8 outputs of 4 bits each in the S box 121
22 are bundled into one output 123 of 32 bits and input to the P conversion (P transposition) 124. P conversion 12
In 4, the bit order is rearranged, and the output 117 of the 32-bit F function is obtained.

FIG. 13 is a table showing the contents of the P transposition 124 described above. Similar to the table of the enlarged transpose E in FIG. 12, this table also shows which input bit the output bit is from the upper left. For example, the first bit of the output of the P conversion 124 is the same as the 16th bit of the input, the second bit is the same as the 7th bit, and so on.

FIG. 15 is a diagram showing a configuration for enhancing the security of the DES encryption as a modification of the above embodiment. In this modification, the conventional F function 110 as shown in FIG. 10 is replaced with the configuration shown in FIG. 15 to enhance safety.

That is, the input R 125 and the key Ki 127 are input to the F function 126 of the conventional DES encryption and converted into the 32-bit output 128. The output 128 is divided into an input L129 and an input R130 by 16 bits.
Then, the input L129 is input as the first input 134 to the selector 133 and is also input as the first input 137 to the selector 132. Also, input R13
0 is input as the second input 135 to the selector 133 and is also input as the second input 138 to the selector 132.

The selector 131 outputs one of the two inputs 134 and 135 by the control input 133 to output 139.
Output as Similarly, the selector 132 outputs one of the two inputs 137 and 138 as the output 140 by the control input 136. Here, since the two control inputs 133 and 136 are in negative logic with each other, they always have different outputs. That is, whether or not the input L129 and the input R130 are exchanged is determined by the 1-bit control line 141 and becomes the output of the F function 126.

Since the control line 141 is connected to the internal state 142, whether or not the input L129 and the input R130 are exchanged depends on the internal state 142. The internal state 142 is updated to a new state by the internal state update function 143.

The above-mentioned configuration method is not limited to the DES cipher, but can be applied to other block ciphers having the same structure.

Although the selector is arranged in the latter stage of the F function in the above embodiment, the selector may be arranged in the former stage of the F function.

FIG. 16 is a diagram showing another modification for strengthening the security of the DES encryption. The above-mentioned enlarged transpose E118 shown in FIG. 11 is replaced with an enlarged transpose E'144 depending on the internal state 146. By doing so, it enhances safety. In FIG. 16, the input R145 is input to the expanded transpose E'144 depending on the internal state 146,
It is output as the output 147.

FIG. 17 is a diagram showing a transposition table of such an expanded transpose E '. In FIG. 17, Xi is the internal state 14
6 is input, and Ri represents the input from the input R145. From the upper left, it shows which output of E ′ conversion is the same as which bit of which input. For example, the first bit of the output is the first bit of the input from the internal state 146, and the second bit of the output. Is the first bit of the input R. The transposition of the enlarged transposition E'may be other than that shown in FIG.

FIG. 18 is a diagram showing another modification for strengthening the security of the DES encryption. Here, the safety is enhanced by dynamically exchanging the input to the S box depending on the internal state.

That is, the result of subjecting the input R148 to the expanded transpose E149 and the output 151 of the exclusive OR of the key Ki 150 are rotated by the variable rotate device 153 whose shift amount changes according to the value of the internal state 152. After that, that is, after the bit position is shifted, the data is input to the S box (S1 to S8) 155.

As the variable rotate described above, a high-speed mounting method using a barrel shifter is known. If the number of rotate bits is too small or too large, the effect of encryption becomes low, so the number of rotate bits may be limited to a certain range. For example, if the range is set from 8 bits to 40 bits, the range becomes 32 bits. In this case, the output from internal state 152 may be 5 bits.

FIG. 19 is a diagram showing another modification for strengthening the security of the DES encryption. In FIG. 19, the input R 156 and the internal state 157 in the exclusive OR 159.
After exclusive OR with the output of
8 is input. The exclusive ethical sum 159 may be replaced by another operation, for example, 32-bit addition or subtraction in which carry is ignored.

FIG. 20 is a diagram showing another modification for enhancing the security of the DES encryption. F of conventional DES encryption
In the function, the encryption keys are added by exclusive OR, but the security can be further improved by giving the operation a degree of freedom.

That is, in FIG. 20, the input R160
After the expansion transposition is performed in the expansion transposition E161, the operation specified by the output 164 of the internal state 163 is executed in the ALU 165 with the key Ki 162. ALU
The output of 165 is divided into eight groups of 6 bits and input to the S box (S1 to S8) 166. After that, the same operation as the conventional DES encryption is performed.

FIG. 21 is a diagram showing another modification for strengthening the security of the DES encryption. In this modification, safety is enhanced by replacing the rows of S boxes. DES
Since each row of the S box of the code contains one number from 0 to 15, the property does not change even if the columns are exchanged.

The 8-bit output of the internal state 167 is the upper 4
It is separated into a bit 168 and a lower 4 bits 169, each of which is used to specify which column of the S box 170 is to be exchanged. Eight internal states may be prepared to change the contents of all S boxes. Further, it is possible to reduce the number of S boxes to be changed to less than 8 in order to save the apparatus scale.

FIG. 22 is a diagram showing the configuration of the round function 177 in the decryption device for decrypting the ciphertext encrypted by the encryption device of the present invention. This round function 1
The 77 includes an F function 178, an order inversion unit 191, an internal state temporary storage unit 176, an internal state storage unit 174, and an internal state update function 175.

The block cipher is called OFB (Out Feedback Bas
It is unnecessary when used in ic) mode, but depending on the mode used, the internal state must be updated in reverse order in the decoding process. The decryption process in the Feistel block cipher device is performed by the same procedure as the encryption process in which the order of giving the intermediate key is reversed. This means that the order of giving the internal state in each round function of the present invention must be reversed.

Prior to performing the decoding process in the round function 177, the internal state stored in the internal state storage means 174 is updated by the internal state update function 175,
It is stored in the internal state temporary storage unit 176.

At the time of decryption processing, the intermediate ciphertext 171
, A decryption key 172, and a signal 17 obtained by inverting the internal state stored in the internal state temporary storage unit 176 by the order inversion unit 191.
3 and 3 are input to the F function 178, a predetermined encryption conversion is performed, and the intermediate plaintext 1 as the output of the round function 177
79 is obtained.

FIG. 23 shows the correspondence between the decryption key and the encryption key at each stage of the n-stage Feistel type encryption. At the time of decryption, the same encryption key as the encryption key used at the n-th stage, which is the final stage at the time of encryption, is used at the first round of decryption, and at the second round of decryption, at the (n-1) -th stage. Use an encryption key. The same applies hereinafter.

FIG. 24 shows the correspondence between the internal states for encryption and decryption in each stage of the Feistel type encryption according to the present invention. The internal state of the first round of decryption must be the same as the internal state of the nth stage, which is the final stage of encryption, and must be the same as the internal state of the (n-1) th round in the second round. . Hereinafter, the same applies. When the internal state update function has a one-way property, the internal states cannot be generated in reverse order and the internal state of n rounds ahead cannot be known. Is required in advance, and is stored in advance, and is output in reverse order. This is the internal state temporary storage unit 176 and the order inversion unit 191 in FIG.

FIG. 25 is a diagram showing a configuration in which the encryption device and the decryption device according to the present invention are integrated. Since the encryption device and the decryption device have the same configuration except the internal state temporary storage,
Signal E / D1 indicating whether encryption processing or decryption processing is in progress
Based on 80, the switch 181 is switched to output the internal state storage unit 182 or the internal state temporary storage unit 1
Using the configuration in which the output of 83 is input to the F function 184,
The device scale can be reduced.

FIG. 26 is a time chart of the pipeline decoding process for the delay-free decoding process. It is assumed that the same figure shows that the time elapses toward the right. The upper stage 185 shows how the internal state is updated, and the hatched portion 187 shows the internal state update process. Bottom 1
Reference numeral 86 indicates a decoding process, and a shaded portion 188 indicates a decoding process. Further, the arrow 189 corresponds to the update of the internal state and the decoding process, and the arrow 189
It indicates that the internal state 187 is used in the decoding process 190.

Considering the temporal processing flow in FIG. 26, the decoding process 188 and the next decoding process 190 are performed at the same time.
The internal state update process 187 required for the internal state update process 187 is performed, which makes it possible to avoid a delay in the process due to the internal state update process.

[0067]

According to the present invention, the security of ciphertext can be further increased even when the apparatus is configured with a small number of conversion units in consideration of the processing speed.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a round function according to an embodiment of the present invention.

FIG. 2 is a diagram showing a configuration example of a product cipher in which n round functions are juxtaposed.

FIG. 3 is a diagram showing a process in which an internal state is sequentially updated by an internal state update function.

FIG. 4 is a diagram for explaining an operation when the round function shown in FIG. 1 has an internal state initialization signal.

FIG. 5 is a diagram for explaining an operation when the encryption device is used in a block cipher mode.

FIG. 6 is a diagram for explaining an operation when the encryption device is used in the stream encryption mode.

FIG. 7 is a diagram for explaining an operation when the present invention is applied to secret communication.

FIG. 8 is a diagram showing another embodiment in which the present invention is applied to secret communication.

9 is a diagram showing a specific configuration of the internal state update function shown in FIG.

FIG. 10 is a diagram showing an overall configuration of DES encryption.

FIG. 11 is a diagram showing a detailed configuration of an F function in DES encryption.

FIG. 12 is a transposition table for an enlarged transposition E.

FIG. 13 is a table showing the contents of P transposition.

FIG. 14 is a diagram showing the contents of an S box.

FIG. 15 is a diagram showing a configuration for enhancing the security of DES encryption as a modified example of the present embodiment.

FIG. 16 is a diagram showing another modification for enhancing the security of the DES encryption.

FIG. 17 is an enlarged transposition table for the variation shown in FIG.

FIG. 18 is a diagram showing another modification for enhancing the security of the DES encryption.

FIG. 19 is a diagram showing another modification for enhancing the security of the DES encryption.

FIG. 20 is a diagram showing another modification for enhancing the security of the DES encryption.

FIG. 21 is a diagram showing another modification for strengthening the security of DES encryption.

FIG. 22 is a diagram showing a configuration of a round function in a decryption device that decrypts a ciphertext encrypted by the encryption device of the present invention.

FIG. 23 is a diagram showing correspondence between a decryption key and an encryption key in each stage of Feistel encryption.

FIG. 24 is a diagram showing correspondence between internal states for decryption and encryption in each stage of Feistel encryption.

FIG. 25 is a diagram showing a configuration in which an encryption device and a decryption device according to the present invention are integrated.

FIG. 26 is a time chart of a pipeline decoding process for a decoding process without delay.

[Explanation of symbols]

1 ... F function, 2 ... internal state storage means, 3 ... internal state update function, 4 ... plaintext, 5 ... encryption key, 6 ... internal state, 7 ... output, 8 ... round function.

Claims (16)

[Claims] 1. A storage unit for storing an internal state, an internal state updating unit for updating the internal state stored in the storage unit, data to be encrypted, an encryption key, and the storage unit. An encryption device having a plurality of stages of conversion units including: an encryption conversion unit that performs an encryption conversion in response to an internal state stored in the encryption unit, each time an encryption conversion is performed by the encryption conversion unit. To
An encryption device characterized in that the internal state stored in the storage means is updated by the internal state update means. 2. An encryption conversion means for receiving data to be encrypted and an encryption key for encryption conversion, a storage means for storing an internal state, and an internal state stored in this storage means. And an internal state updating unit for providing a plurality of stages of conversion units each including an encryption unit, each time an encryption conversion is performed by the encryption conversion unit,
The internal state stored in the storage means is updated by the internal state update means, and the output of the encryption conversion means is controlled according to the internal state stored in the storage means. Encryption device. 3. The encryption device according to claim 1, wherein the internal state updating means is a one-way function. 4. The encryption device according to claim 1, further comprising an input unit for instructing to initialize the internal state. 5. The encryption device according to claim 4, wherein the internal state is initialized every time the encryption conversion is performed by the encryption conversion means. 6. The cipher according to claim 4, wherein the internal state is initialized only once before the ciphertext obtained from the encryption device is communicated between the sender and the receiver. Device. 7. When transmitting a ciphertext obtained from an encryption device between a sender and a receiver, the internal state is initialized at a predetermined timing between them. The encryption device according to claim 4. 8. The encryption device according to claim 1, wherein the data to be encrypted includes data instructing a timing of initializing the internal state. 9. An enlarging transposing unit for enlarging and transposing the data to be encrypted by the enciphering converting unit, a computing unit for performing a predetermined computation between an output of the enlarging transposing unit and an encryption key, and this computing unit. 3. The encryption apparatus according to claim 1, further comprising a paraphrase section for separating the output from the group into a plurality of groups and performing a predetermined substitution for each group. 10. The encryption apparatus according to claim 9, wherein an updatable internal state is input to the enlarged transposing unit and the output thereof is controlled. 11. A bit position varying unit for shifting the bit position of the output from said arithmetic unit is further provided, and an updatable internal state is input to this bit position varying unit to control its output. The encryption device according to claim 9, wherein 12. The encryption apparatus according to claim 9, wherein the expanded transposing unit takes an exclusive OR with an updatable internal state before expanding and transposing the data to be encrypted. . 13. The encryption apparatus according to claim 9, wherein an updatable internal state is input to the arithmetic unit and its output is controlled. 14. The encryption device according to claim 9, wherein an updatable internal state is input to the substitute character portion and the output thereof is controlled. 15. A storing step of storing an internal state in a storing means, an internal state updating step of updating the stored internal state by an internal state updating means, data to be encrypted, an encryption key, and a stored key. An encryption conversion step of performing an encryption conversion by an encryption conversion means in response to an internal state, and a conversion step comprising a plurality of conversion steps, each time an encryption conversion is performed in the encryption conversion step. The encryption device, further comprising the step of updating the internal state stored in the storage means by the internal state update means. 16. An encryption conversion step of receiving data to be encrypted and an encryption key to perform encryption conversion by an encryption conversion means, a storage step of storing an internal state in a storage means, and a stored internal An internal state updating step of updating a state by an internal state updating means, and an encryption method comprising a plurality of conversion steps comprising: storing in the storage means every time an encryption conversion is performed in the encryption conversion step. An encryption method comprising the step of controlling the output of the encryption conversion means in accordance with the internal state stored in the storage means while updating the generated internal state by the internal state update means.