JPH1124558A - Ciphering device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To increase the safety of a difference deciphering method and a linear deciphering method. SOLUTION: Similarly to the conventional DES(data encryption standard), input data is divided into two partial data R and L and the data R is nonlinearly converted by a nonlinear function means 304 with key data; and its output and the other partial data of the L are exclusively ORed and the array of the output and partial data R is converted into the data R and L, the same process is repeated and the input data are linearly converted 341 with key data in this case as a means 304 and the output is divided into bits in0 and in1 ; and one of function structures 3430 , 3431 ...3437 which are mutually and nonlinearly converted through three nonlinear means similar to one element S-box and three exclusive OR operations and in0 and in1 are inputted to the selected structure, whose outputs out0 and out1 are subjected to bit combination to obtain the output of the means 304.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an encryption device for concealing data in data communication or storage, and more particularly to a common device for encrypting or decrypting data in block units under control of a secret key. The present invention relates to an encryption device using a key encryption method.

[0002]

2. Description of the Related Art A typical common key encryption system included in an encryption device for concealing data is a DES (Data Encryption Standard) encryption, which is a US federal standard encryption. FIG. 6 shows a functional configuration of the DES encryption. In the DES encryption, a 56-bit secret key is used to perform encryption or decryption in 64-bit data block units. In FIG. 6, the encryption process converts the 64 bits of the plaintext P into the initial transformation unit 1.
After conversion with the initial inverted value in 1, the data is divided into block data L ₀ , R ₀ every 32 bits. Next, R ₀ is used as an input to the function operation unit 12 shown in FIG. 7, and is converted into f (R ₀ , k ₀ ) under the control of the 48-bit expanded key k ₀ in the function operation unit 12. You. This conversion data f
The exclusive OR of (R ₀ , k ₀ ) and L ₀ is taken by the circuit 13, and the value is replaced with R ₀ to generate the next block data L ₁ , R ₁ . That is, R ₁ = L
_{0 (+) f (R 0} , k 0), is L ₁ = R _0. The two block data L _0, R processing stage 14 ₀ for outputting the L _1, R ₁ by the exchange of data and an exclusive OR circuit 13 and the arithmetic unit 12 ₀ as the input is configured such like processing stage 14 _{1-14 15} is provided in cascade manner.
That is, in each processing stage 14 _i (0 < i <16), R _{i + 1} =
The processing of _Li (+) f (R _i , k _i ), L _{i + 1} = R _i is performed, and finally R ₁₆ and L ₁₆ are integrated into 64 bits. Conversion is performed using the final inverted value, and 64 bits of ciphertext are output. In the decoding process, extended key k _0, k ₁ to be input to the function f, ..., only by reversing the order of _{k 14, k 15, k 15} , k 14, ..., and inputs the order of k _1, k ₀ Except for this, it can be executed in the same procedure as the encryption process. The expanded keys k ₀ , k ₁ ,..., K ₁₄ , k
_Reference numeral ₁₅ denotes an extended key generation routine 16 different from the encryption processing.
A total of 76 6-bit secret keys consisting of 16 48-bit expanded keys
It is generated by being expanded to 8 bits.

The processing inside the function operation 12 is shown in FIG.
It is performed as shown. First, the 32-bit block data
R_iIs a 48-bit data E (R_i)
Is converted to This is the expanded key k_iExclusive OR with
Taken at the path 18, and the 48-bit data E (R_i) (+) K_i
After conversion to 8
Divided into Each of these eight sub-block data
Different S-boxS ₀~ S₇Are input to each
Get the output of the Note that this S-boxS_j(J =
0, 1, ..., 7) are 4 bits from 6-bit input data
Is a non-linear conversion table for converting to output data of
This part is responsible for the essential security of the ES encryption. S
-BoxS₀~ S₇The eight output data of
After being converted to 32-bit data,
Thus, as shown in FIG._iXORed with
The output f (R_i, K_i).

Next, the decryption method will be described. DES
With regard to conventional common key cryptosystems such as cryptography, attempts have been made to decipher the cryptosystem from various aspects. Biham and A.S. Differential cryptanalysis proposed by Shamir (“Differen
tial Cryptanalysis of DES-like Cryptosystems.
oceedings of CRYPTO'90) and the linear decryption method proposed by Matsui ("Linear decryption method for DES cryptography (I)," 199).
3-year cryptography and information security symposium SCIS93
-3C).

[0005] The differential cryptanalysis method comprises two data X, X^*Difference
Minute by ΔX = X (+) X^*And when the reader gets it
Apply the two sets of plaintext and ciphertext to
Expanded key k in und_FifteenAim to seek
You. f (L₁₆, K_Fifteen) (+) f ((L₁₆(+) ΔL₁₆), k_Fifteen) = ΔR
₁₆(+) ΔR₁₄ At this time, L₁₆, ΔL₁₆, ΔR₁₆Is obtained from ciphertext
Since it is data, it is known information. For this reason, readers
Is ΔR₁₄Can be calculated correctly,
_FifteenOnly unknown constants are used, and a set of known plaintext / ciphertext is used.
And k_FifteenBy performing an exhaustive search on
Correct k_FifteenCan be found. On the other hand, ΔR₁₄To
Looking at this value, it is an intermediate difference value,
Generally, it is difficult to find. So the first round
To the first round before the last round
And each round has probability p_iAt ΔR_{i + 1}= ΔL_i(+) Δ
｛F (ΔR_i)｝, ΔL_{i + 1}= ΔR_{i + 1}Approximated as
I will keep it. The point here is a certain ΔR_iIs entered
When the key is expanded_iRegardless of the value of_iAnd Δ
｛F (ΔR_i)｝ Can be predicted. this
Can be approximated as Δ ｛f (ΔR_iAffects｝
The only thing that can be obtained is the S-box, which is a nonlinear transformation.
Moreover, in the S-box, the difference depends on the input difference.
This is because an extremely large deviation occurs in the distribution of the minute output.
For example, in S1-box, the input difference “110100”
Is converted to the output difference "0010" with a probability of 1/4
This is because Then, each S-box has probability p_si
If the relationship between the input difference and the output difference can be predicted by
An approximation of each round is obtained by combining them.
Furthermore, by connecting approximations in each round, Δ
R₁₄Is the probability P = Πp_iAt ΔL ₀, ΔR₀(ΔL₀, ΔR
₀Is known information because it is data obtained from plaintext.
). Note that this probability P is large.
The easier it is, the easier it is to break the code. In this way, expansion
Large key k_FifteenIs required, this time one stage less 15-stage DE
Considering the S cipher, the expanded key k₁₄In search of
Repeatedly go, finally the expanded key k₀Until
I will seek.

[0006] According to Biham et al.⁴⁷
If there is a selected set of known plaintext / ciphertext, DES encryption
The issue can be decrypted. Also, the linear decoding method is as follows
Constructs a linear approximation of
The goal is to find an extended key using the maximum likelihood method
It has been the target. (L₀, R₀) ・ Γ (L₀, R₀) (+) (L₁₆, R₁₆) ・ Γ (
L₁₆, R₁₆) = (K₀, K₁, ..., k_Fifteen) ・ Γ (k₀,
k₁, ..., k_FifteenHowever, Γ (X) is a method for selecting a specific bit position of X.
The role of a linear approximation expression called a mask value is a linear expression inside the cryptographic algorithm
Approximately replace with
It is to separate it from the part related to the extended key. That is,
For a plaintext / ciphertext pair,
All exclusions between the value and the value of a particular bit position in the ciphertext
The logical sum becomes a constant value, which is a specific bit position of the expanded key.
It is equal to the exclusive OR of the values of the values.
Therefore, the reader (L₀, R₀) ・ Γ (L₀, R₀)
(+) (L₁₆, R₁₆) ・ Γ (L₁₆, R₁₆)
(K₀, K₁, ..., k_Fifteen) ・ Γ (k₀, K₁,…,
k_Fifteen) (1 bit) information is obtained.
You. At this time, (L₀, R₀), (L₁₆, R ₁₆)
This is known information because it is plaintext / ciphertext data.
For this reason, the reader is Γ (L₀, R₀), Γ (L₁₆,
R₁₆), Γ (k₀, K₁, ..., k_Fifteen)
If you can (k₀, K₁, ..., k_Fifteen) ・ Γ (k
₀, K₁, ..., k_Fifteen) (1 bit)
You.

[0007] In the DES encryption, the only part where nonlinear conversion occurs is only the S-box. Therefore, if only the S-box can be linearly expressed, a linear approximation equation can be easily formed.
Therefore, it is assumed that each S-box can be linearly represented by the probability p _si . The point here is that when an input mask value for the S-box is given, the output mask value can be predicted with the probability p _si . This occurs because, in the S-box, which is a non-linear conversion table, the distribution of the difference mask value is extremely biased depending on the input mask value. For example, in S5-box, when the input mask value is “010000”, the output mask value “1111” is predicted with a probability of 3/16. These S-
By combining the mask values in the box,
Each round can be linearly approximated between the input mask value and the output mask value with the probability p _i , and by connecting the linear approximations in each round, Γ (L ₀ , R ₀ ), Γ
(L ₁₆ , R ₁₆ ), Γ (k ₀ , k ₁ ,..., K ₁₅ ) are the probability P
= 2 ^n-1 · Π | p _i −1/2 |
The larger the probability P is, the easier the decryption is.

[0008] According to Matsui, in this cryptanalysis, using two ⁴³ sets of known plaintext-ciphertext pair, it has succeeded in deciphering of the DES encryption.

[0009]

SUMMARY OF THE INVENTION It is an object of the present invention to provide a cryptographic device which is more secure than the conventional one for the differential cryptanalysis and the linear cryptanalysis.

[0010]

According to the present invention, in particular, in the nonlinear function means, a key-dependent linear conversion means for performing a linear conversion on the input data of the nonlinear function means based on the key data stored in the key storage means; Dividing means for dividing the output data of the key-dependent linear means into two bit strings; and two bit strings in one structure determined based on the key data stored in the key storage means from a plurality of predetermined structures. And a non-linear conversion means for performing non-linear conversion between the non-linear conversion means and a coupling means for coupling two output bit strings from the non-linear conversion means to obtain output data of the non-linear function means.

In order to further improve the security, the non-linear function means in the non-linear function means includes a key-dependent linear conversion means, a dividing means, a non-linear conversion means, and a coupling means, like the non-linear function means. The key data stored in the key storage means is input to the non-linear conversion means, and the same operation as the non-linear function means is recursively executed. According to the working this invention, when the probability p _si the relationship between the input difference and output difference of S-box can be expected is a _{p si <p b <1,} p b is the maximum value in the p _si, each Assuming that the number of selectable structures in a round is m, the probability of approximating each round is p _i < p _b ² / m (however, in the case of differential cryptanalysis, when the input difference to the function f is not 0, linear decryption is performed. Method, when the output mask value of the function f is not 0)
Is guaranteed. Also, when the function f is bijective (the output is always different if the input is different),
The probability as an encryption method with three or more rounds is P
<A ^{_{p i 2 <p b 4 /}} m 2. This is because the the conventional encryption method was P <p _b ^4, pressed the upper limit by a small value by ^twice m, at least m ² fold secure encryption against differential cryptanalysis and linear cryptanalysis Equipment can be provided.

[0012]

BRIEF DESCRIPTION OF THE DRAWINGS FIG.
This will be described with reference to FIG. FIG. 1 shows an embodiment of the present invention.
3 shows a functional configuration of the encryption device. Plaintext
From the input means 301 to the encryption device
Enter within. The input data P is stored in the key storage unit 322.
Key-dependent initial linear transformation method based on the accumulated key data fk
After being converted in the stage 302, the two
Data L₀, R₀Is divided into This division is, for example, 64
Bit L is data L of 32 bits each₀, R₀And bi
This is a division into two sets. Data R₀Is stored in the key storage unit 322.
Key data k₀, S₀With nonlinear function
The signal is input to the stage 304 and converted by the nonlinear function means 304.
Is performed and the data Y₀Is converted to Data Y₀And day
L₀Is calculated by the linear calculation means 305, and the data L₀ ^*
Is converted to Data L₀ ^*And data R₀Means exchange means 3
At 06, the data positions are exchanged, and L₁= R₀, R₁=
L₀ ^*Will be replaced like Hereinafter, two data L₁,
R₁, The same processing as described above is repeatedly performed. Sand
In the i-th round, two data L _i, R_iAbout
And data R_iIs stored in the key storage unit 322
Key data k_i, S_iTogether with the nonlinear function means 304
Is converted by the nonlinear function means 304,
Data Y_iIs converted to Data Y_iAnd data L_iIs linear
The data L calculated by the calculating means 305_i ^*Is converted to
You. Data L_i ^*And data R _iIs the data
Data positions are exchanged, and L_{i + 1}= R_i, R_{i + 1}= L_i ^*
Will be replaced like The linear operation means 305 is, for example, exclusive
Logical OR operation means.

Assuming that an appropriate number of repetitions (number of rounds) for ensuring the security of the encryption system is _n , data L _n and R _n are finally obtained as a result of this repetition processing. After the data L _n and R _n are combined by the final combining means 307, that is, for example, 32-bit data L _n and R _n
n is one data of 64 bits, and the combined data is converted by the key-dependent final linear conversion means 308 using the key data ek stored in the key storage means 322, and the output means 30
9 outputs the output data C as a ciphertext.

For decryption, a plaintext P is obtained from the ciphertext C by following a procedure reverse to the encryption processing procedure. That is, as in the case of the DES encryption, in FIG.
The encryption data is input instead of the input data, and the key data is ek, k _n−1 , s from the top in FIG.
_{n-1, ..., k 1} , s 1, k 0, s 0, fk it may be sequentially Ataere a.

Next, the inside of the nonlinear function means 304 will be described in detail. FIG. 2 shows a functional configuration extracted from the nonlinear function means 304. The data _Ri is
Key data k _i , s _i stored in key storage means 322
Along with the input data to the nonlinear function means 304.
The data R _i is linearly converted to data R _i ^* by key-dependent linear conversion means 341 using the key data k _i . Next, the data R _i ^* is divided into two 16-bit data in ₀ , in by, for example, 32-bit data by the dividing means 342.
It is divided into ₁ bits. Two data in ₀ , in
₁ is the data out ₀ ,
After the non-linear conversion to out ₁ , the combining means 344 outputs two data, for example, 16-bit data out ₀ and out ₁
Are bit-combined to generate 32-bit output data Y _i from the nonlinear function means 304.

Here, the non-linear conversion means 343 has the same security as the differential cryptanalysis and the linear cryptanalysis, and has three non-linear conversion means 351, 352, 3 inside.
Multiple 343 functions structure 53 contains _0, 34
3 _1, ... In, is selected by 1 Tsugakagi data s _i of the functional structures. Nonlinear conversion means 351, 352, 35
Reference numeral 3 denotes output of unique output data for each input data, similarly to one box element of the S-box of the DES encryption.

FIGS. 3 and 4 show examples of such a functional structure. In FIG. 3A, the data in ₁ is converted to the nonlinear conversion means 351.
In a non-linear transformation, its transformation results, and data in ₀ is made exclusive OR operation by the circuit 354, the operation result is nonlinear converted by the nonlinear conversion means 352, the result of the conversion data in ₁ and the circuit 355 , An exclusive OR operation is performed, and the operation result becomes data out ₁ and is nonlinearly converted by the nonlinear conversion means 353. The conversion result and the operation result of the circuit 354 are subjected to an exclusive OR operation in a circuit 356. the calculation result is out _0.

In FIG. 3B, the data in ₀ is transformed by the nonlinear conversion means 351 and input to the circuit 354, where
_An exclusive OR operation with ₁ is performed, and the data in ₁ is transformed by the non-linear conversion means 352, and then transformed by the circuit 355 into the circuit 354.
The exclusive OR operation is performed with the operation result of ( ₁₎ , the operation result is data out1, and the operation result of the circuit 354 is converted by the non-linear conversion means 353. The conversion result is obtained by the operation result of the circuit 355 and the circuit 356. An exclusive OR operation is performed and the result is data out ₀ . These and FIGS. 4A to 4F
According to the configuration shown in FIG.
2, 353 and three exclusive OR circuits 354, 35
5 and 356, the data in ₀ and in ₁ are mutually subjected to exclusive OR, nonlinear conversion, exclusive OR after nonlinear conversion, or nonlinear conversion after exclusive OR to perform data out. _0, is intended to obtain an out _1.

The key data fk, k ₀ , s ₀ ,..., K
_n-1 , s _n-1 , and ek are the key information Key input from the key input unit 320 into the encryption device and the key data generation unit 321.
Is converted by the key storage unit 322 and stored in the key storage unit 322. As the key data generating means 321, for example, D
Extended key generation routine 16 used in ES encryption device
The key data s ₀ ,
s _1, ... each key data k ₀ is, k _1, ... of the key data k ₀ to k supplied beforehand or using data of a plurality of bit position determined, or the key-dependent linear transformation means 341 of the non-linear function means _n-1 creates one or a plurality number of key data than the partial requiring to its extra to be bit-sliced those key data s _0, s _1, ..., be sequentially assigned to s _n-1 Good.

In the encryption device configured as described above, for example, the nonlinear conversion means 351 to 353 are designed so as to be able to approximately express the difference cryptanalysis and the linear cryptanalysis with a probability p _b = 2 ⁻¹² , and the key if the number of functional structures that can be selected in the data s _i is m = 2 ^3, wherein each round from that shown in the section "action" in "means to solve the problem" probability p _i <2 ^- Can be approximated by ²⁷ and 3
As a whole, the probability P < ^2-54 of the encryption device of the round or more is obtained.
Can be approximated. In the conventional encryption method, m =
1, the probability in this case is p _i < 2 ⁻²⁴ , P < 2
^-48 . From this, it can be said that the encryption device is at least ²⁶ times more secure than the differential cryptanalysis and the linear cryptanalysis.

It should be noted that the present invention is not limited to this example. For example, as shown in FIG.
1 to 353 have means for performing the same processing as the nonlinear conversion means 304, respectively.
Key data k _i0 , k _i1 , k _i2 , s for each of 53
It is also possible to _adopt a structure capable of performing nonlinear conversion by _i0 , _si1 , and _si2 . In this case, if the number of function structures that can be selected with the key data for each of the nonlinear conversion units 351 to 353 is m = 2 ³ , the number of function structures that can be selected in each round is m = 2 ¹² , and the security is higher. An encryption device can be realized.

The key-dependent initial linear transformation means 302 and the key-dependent final linear transformation means 308 need not always be provided. The key-dependent initial linear conversion means 302, the key-dependent final linear conversion means 308, and the key-dependent linear conversion means 341 are, for example, means for rotating and shifting input data by the number of bits corresponding to the key data, or between input data and key data. It is a means such as performing an exclusive OR operation. The key-dependent initial linear conversion means 302 and the key-dependent final linear conversion means 308 may each be one or one of them may be a key-independent linear conversion means. In this case, a so-called transposition table or a table that rotates and shifts by a fixed number of bits is used.

[0023]

As described above in detail, according to the present invention, in an encryption device for concealing data in data communication or storage, even with the same number of repetitions (number of rounds), compared with a conventional encryption device. , It is possible to provide a cryptographic device that is highly secure against differential cryptanalysis and linear cryptanalysis.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a functional configuration of an embodiment of the present invention.

FIG. 2 is a block diagram showing a detailed functional configuration example of a nonlinear function unit 304 in the embodiment of FIG.

FIG. 3 is a diagram showing an example of a functional configuration of various structures of a nonlinear conversion unit 343 in FIG. 2;

FIG. 4 is a diagram showing a functional configuration of various other structures of the nonlinear conversion unit 343 in FIG. 2;

FIG. 5 is a diagram showing a detailed functional configuration example instead of the nonlinear function means 304 in the embodiment of FIG. 1;

FIG. 6 is a diagram showing a functional configuration of a conventional DES encryption device.

FIG. 7 is a diagram showing a functional configuration of a function operation unit 12 of the DES encryption.

Continuing on the front page (72) Inventor Katsuhiko Aoki 1-14-5 Kichijoji Honmachi, Musashino-shi, Tokyo NTT Electronics Technology Co., Ltd. (72) Inventor Tsutomu Matsumoto 2603- Kamizuruma, Sagamihara-shi, Kanagawa 1-210

Claims (6)

[Claims] An input data is divided into two pieces of partial data by an initial dividing means, and one of these partial data is subjected to data conversion processing dependent on the key data stored in the key storing means by a non-linear function means. The output data of the non-linear function means is applied to the other of the partial data by the linear operation means, and the arrangement order of the output data of the linear operation means and the input partial data of the non-linear function means is exchanged by the exchange means. Then, the non-linear function means, the linear operation means, and the exchange means are repeated a plurality of times by the repetition means with the two exchanged data from the exchange means as two partial data in the last repetition of the repetition means. A cryptographic device that combines the two data from the exchange means into one output data by final combining means and outputs the output data; The stage includes key-dependent linear conversion means for performing linear conversion on input data based on key data stored in the key storage means, and division means for dividing output data of the key-dependent linear means into two bit strings. A non-linear conversion means for performing a non-linear conversion between the two bit strings in one structure determined based on the key data stored in the key storage means from a plurality of predetermined functional structures; A combining unit combining two output bit strings from the conversion unit to output data of the non-linear function unit. 2. The encryption device according to claim 1, wherein the non-linear conversion means in the non-linear function means includes a key-dependent linear conversion means, like the non-linear function means.
A cryptographic device comprising a dividing unit, a non-linear converting unit, and a combining unit, wherein the key data stored in the key storing unit is input, and the same operation as the non-linear function unit is performed recursively. . 3. The encryption device according to claim 1, further comprising an initial linear conversion unit that performs a linear conversion on the input data and inputs the input data to the initial division unit. . 4. The encryption device according to claim 1, further comprising a final linear conversion unit that performs a linear conversion on the output data of the final combination unit and outputs the output data of the encryption device. Characteristic encryption device. 5. The encryption device according to claim 3, wherein the initial linear conversion unit is a unit that performs a linear conversion based on the key data stored in the key storage unit. 6. The encryption device according to claim 4, wherein the final linear conversion unit is a unit that performs a linear conversion based on the key data stored in the key storage unit.