JPWO2013121710A1 - Evaluation apparatus, evaluation method, and evaluation program - Google Patents

Abstract

The evaluation apparatus 500 includes: a generation process that generates pseudo-random numbers based on basic information stored in a storage device that includes a feedback shift register; and an update process that updates basic information based on the stored basic information. By alternately repeating, the security of the pseudo random number generator that generates the pseudo random number sequence based on the key information is evaluated. The evaluation device is processing basic information that is an amount of information for updating the basic information in one update process and information for generating a pseudo-random number in one generation process. An amount U, a pseudorandom information amount m, and a key information amount L are received (501), and a pseudorandom number is generated based on a value U−m obtained by subtracting the pseudorandom information amount m from the processing basic information amount U and the key information amount L. It is determined whether the vessel is safe (502).

Description

  The present invention relates to an evaluation apparatus for evaluating the safety of a pseudorandom number generator.

  A pseudo-random number generator that generates pseudo-random numbers is known. As one of this type of pseudo-random number generator, the pseudo-random number generator described in Patent Document 1 generates a pseudo-random number based on basic information stored in a storage device including a feedback shift register; An update process for updating the basic information based on the basic information stored in the storage device is alternately repeated. Thereby, the pseudo-random number generator generates a pseudo-random number sequence based on the key information. For example, the key information is used to generate an initial value of basic information.

  In addition, a guess decision attack on a pseudo random number generator is known. In the guess decision attack, when the generated pseudo random number is known, the basic information stored in the storage device is assumed, and the pseudo random number generated based on the assumed basic information is changed to the known pseudo random number. It is an attack that identifies true basic information based on whether or not they match.

  An example is described in Non-Patent Document 1 as an evaluation method for evaluating the safety against a guess decision attack.

JP 2009-259661 A

Kota Ideguchi, Dai Watanabe, “A Method for Security Evaluation Against Guidance Decision Attacks”, Symposium on Cryptography and Information Security, SCIS2008, January 2008, 3A1-4

  However, in the evaluation method, the calculation load required for evaluating the safety of the pseudo random number generator increases as the storage capacity of the storage device included in the pseudo random number generator increases. Therefore, according to the evaluation apparatus to which the evaluation method is applied, there is a problem that the calculation load required for evaluating the safety of the pseudorandom number generator may be excessive.

  For this reason, the object of the present invention is to provide an evaluation apparatus that can solve the above-described problem that "the calculation load required for evaluating the safety of the pseudo-random number generator may become excessive" Is to provide.

In order to achieve such an object, an evaluation apparatus according to one aspect of the present invention provides:
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. It is an apparatus for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately.

Furthermore, this evaluation device
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process An information amount receiving means for receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information; ,
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudo-random information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo-random information amount U is used. A determination means for determining whether the random number generator is safe against the speculative decision attack;
Is provided.

An evaluation method according to another embodiment of the present invention is as follows.
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. This is a method for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately.

Furthermore, this evaluation method is
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudo-random information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo-random information amount U is used. This is a method for determining whether or not the random number generator is safe against the guess-decision attack.

An evaluation program according to another embodiment of the present invention is
In the information processing device,
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. It is a program for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately.

In addition, this evaluation program
In the information processing apparatus,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudo-random information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo-random information amount U is used. This is a program for executing a process for determining whether or not the random number generator is safe against a guess decision attack.

  By configuring as described above, the present invention can reduce the calculation load required for evaluating the safety of the pseudorandom number generator.

It is a block diagram showing the structure of the evaluation apparatus which concerns on 1st Embodiment of this invention. It is a block diagram showing the structure of the pseudorandom number generator which concerns on 1st Embodiment of this invention. It is the block diagram which showed the outline | summary of the function of the pseudorandom number generator. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called NLSv2. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called MUGI. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called SNOW1.0. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called SNOW2.0. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called Sosemanuk. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called Sosemanuk. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called Sosemanuk. It is explanatory drawing which showed the outline | summary of the function of the pseudorandom number generator called Sosemanuk. It is a block diagram showing the structure of the evaluation apparatus which concerns on 2nd Embodiment of this invention.

  Hereinafter, embodiments of an evaluation apparatus, an evaluation method, and an evaluation program according to the present invention will be described with reference to FIGS.

<First Embodiment>
(Constitution)
As shown in FIG. 1, the evaluation apparatus 100 according to the first embodiment is an information processing apparatus. Note that the evaluation device 100 may be a personal computer, a mobile phone terminal, a PHS (Personal Handyphone System), a PDA (Personal Data Assistance, a Personal Digital Assistant), a smartphone, a car navigation terminal, or a game terminal.

  The evaluation device 100 includes a central processing unit (CPU; Central Processing Unit) (not shown), a storage device (memory and a hard disk drive (HDD)), an input device (a keyboard and a mouse in this example), and And an output device (in this example, a display).

  The evaluation device 100 is configured to realize a function described later when the CPU executes a program stored in the storage device. In this example, the evaluation apparatus 100 evaluates the safety of the pseudorandom number generator.

Here, the pseudorandom number generator will be described.
As shown in FIG. 2, the pseudo-random number generator 200 includes a feedback shift register 201, a first conversion processing unit 202, a memory 203, a multiplexer 204, a second conversion processing unit 205, a buffer 206, , A third conversion processing unit 207.

  In the present example, the feedback shift register 201 is a linear feedback shift register (LFSR; Linear Feedback Shift Register). The feedback shift register 201 includes a plurality of register blocks. Each of the plurality of register blocks stores a predetermined number of unit bits. The number of unit bits is, for example, 32 or 64. Note that the information stored in the feedback shift register 201 is referred to as first basic information.

  The memory 203 includes a plurality of memory blocks. Each of the plurality of memory blocks stores a predetermined number of unit bits. The number of unit bits is, for example, 32 or 64. In this example, the number of unit bits of the feedback shift register 201 is equal to the number of unit bits of the memory 203. Note that the information stored in the memory 203 is referred to as second basic information.

  The feedback shift register 201 and the memory 203 constitute a storage device. Information (that is, first basic information and second basic information) stored in the storage device is called basic information. Note that the storage device may be configured only by the feedback shift register 201. Further, the feedback shift register 201 may be a non-linear feedback shift register instead of the linear feedback shift register.

  The first conversion processing unit 202 executes a first conversion process. The first conversion processing converts the first update processing basic information stored in the feedback shift register 201 into first updated basic information according to a predetermined method, and converts the first updated basic information after conversion. This is a process for outputting information to the feedback shift register 201.

  The first update processing basic information is information stored in a predetermined register block among information (first basic information) stored in a plurality of register blocks included in the feedback shift register 201. is there. Further, the amount (data size or number of bits) of the first updated basic information is the same as the amount of information stored in one register block.

  When the first updated basic information is output, the feedback shift register 201 transfers the information stored in each register block to the register block adjacent to one end when a plurality of register blocks are arranged in series. While updating to the stored information, the information stored in the register block constituting the one end is updated to the output first updated basic information.

  The multiplexer 204 uses a part of the second update processing basic information stored in the feedback shift register 201 and the third update processing basic information stored in the memory 203 as fourth update processing basic information. The data is output to the second conversion processing unit 205.

  The second update processing basic information is information stored in a predetermined register block among information (first basic information) stored in a plurality of register blocks included in the feedback shift register 201. is there. The third update processing basic information is information stored in a predetermined memory block among information (second basic information) stored in a plurality of memory blocks included in the memory 203. is there.

  The second conversion processing unit 205 executes a second conversion process. In the second conversion process, the fourth update process basic information output from the multiplexer 204 and the fifth update process basic information stored in the memory 203 are updated after the second update according to a predetermined method. This is a process of converting to basic information and outputting the converted second updated basic information to the memory 203.

  The fifth update processing basic information is information stored in a predetermined memory block among information (second basic information) stored in a plurality of memory blocks included in the memory 203.

  The memory 203 updates the information stored in a predetermined memory block among the plurality of memory blocks included in the memory 203 to the second updated basic information output by the second conversion processing unit 205. To do.

The buffer 206 stores the first generation processing basic information stored in the feedback shift register 201 and the second generation processing basic information stored in the memory 203.
The third conversion processing unit 207 executes a third conversion process. The third conversion process is a process of converting the information stored in the buffer 206 into output information as a pseudo random number according to a predetermined method and outputting the converted output information. In this example, the amount of output information is the same as the amount of information stored in one register block and the amount of information stored in one memory block.

  The pseudo-random number generator 200 generates a pseudo-random number based on the basic information stored in the storage device, and updates the basic information based on the basic information stored in the storage device. Are alternately repeated. Thereby, the pseudo random number generator 200 generates a pseudo random number sequence based on the key information.

  For example, the pseudorandom number generator 200 is configured to generate an initial value of basic information based on key information. The pseudorandom number generator 200 may be configured to use key information in at least one of the first conversion process, the second conversion process, and the third conversion process.

  In this example, the pseudo random number generator 200 is configured to operate in synchronization with the clock signal. That is, the pseudorandom number generator 200 is configured to execute one update process and one generation process in one clock cycle of the clock signal.

The update process includes a first update process and a second update process.
As described above, in the first update processing, the first conversion processing unit 202 executes the first conversion processing, and the feedback shift register 201 is output from the first conversion processing unit 202. This is a process for updating the information stored in each register block based on the updated basic information.

  As described above, in the second update process, the second conversion processing unit 205 executes the second conversion process, and the memory 203 outputs the second update output by the second conversion processing unit 205. This is a process for updating the information stored in each memory block based on the post-basic information.

  In addition, as described above, the generation process is a process in which the third conversion processing unit 207 executes the third conversion process.

  As described above, the pseudo-random number generator 200 updates the first basic information stored in the feedback shift register 201 based on only the first basic information and stores it in the memory 203 in the update process. It can be said that the second basic information being configured is configured to be updated based on the second basic information and the first basic information.

  In addition, the pseudo random number generator 200 generates pseudo random numbers based on the first basic information stored in the feedback shift register 201 and the second basic information stored in the memory 203 in the generation process. It can be said that it is configured to.

  Note that the pseudo-random number generated by the pseudo-random number generator 200 may be used as a key stream in the stream encryption method. That is, the pseudo random number generator 200 may constitute a part of an encryption device that uses the generated pseudo random number as a key stream.

  By the way, the security of the pseudo random number generator 200 corresponds to the security of the stream encryption method using the pseudo random number generated by the pseudo random number generator 200 as a key stream. Therefore, according to the evaluation apparatus 100 according to the first embodiment, it is possible to reduce the calculation load required for evaluating the security of the encryption apparatus using the stream encryption method.

(Guess decision attack)
Next, the guess decision attack will be described. FIG. 3 is a block diagram showing an outline of the functions of the pseudorandom number generator 200. The function of the pseudorandom number generator 200 includes a storage device G1, an update process execution unit G2, and a generation process execution unit G3.

  That is, the storage device G1 corresponds to the feedback shift register 201 and the memory 203. The update process execution unit G2 executes an update process. The generation process execution unit G3 executes a generation process.

Here, in order to simplify the description, it is assumed that the storage device G1 includes eight storage blocks (register blocks or memory blocks) s _{0 to} s ₇ . Further, the update process basic information is information stored in the storage block s ₂ and the storage block s ₅ , and the generation process basic information is information stored in the storage block s ₂ and the storage block s _4. Is assumed.

Here, the update process basic information is information used to update the basic information in one update process. The generation process basic information is information used for generating a pseudo random number in one generation process. The processing basic information is information included in at least one of the update processing basic information and the generation processing basic information in the basic information. That is, the processing basic information is information stored in the storage block s ₂ , the storage block s ₄ , and the storage block s ₅ .

First, in the guess decision attack, a part of the processing basic information is assumed. For example, information (assumed part) stored in the storage block s ₄ and the storage block s ₅ is assumed. Then, by using the assumed part and the known pseudo-random number, the remainder (other than the assumed part) of the processing basic information (non-assumed part, that is, information stored in the storage block s ₂ ) is obtained. It is calculated backward.

  Thereafter, by repeating the same processing, all the information stored in the storage device G1 is specified. Further, the key information can be specified by repeating the same processing.

  By the way, in the first step in the speculative decision attack, it is necessary to assume a part (assumed part) having the determination reference amount Um in the processing basic information. Here, the determination reference amount U-m is a value obtained by subtracting the pseudo random number information amount m from the processing basic information amount U. The processing basic information amount U is the amount of processing basic information. The pseudo random number information amount m is the amount of pseudo random number information.

  By the way, the process of calculating back the non-assumed part from the assumed part and the known pseudo-random number is executed as many times as the amount of the assumed part increases. Therefore, the calculation load in the first step in the guess determination attack increases as the determination reference amount U-m increases.

  By the way, by inputting each key information to the pseudo-random number generator 200, a pseudo-random number is generated, and based on whether the generated pseudo-random number matches a known pseudo-random number. The calculation load required for an attack that specifies key information (also called a brute force attack or a total number search of keys) increases as the key information amount L increases.

  Therefore, based on the determination reference amount U-m and the key information amount L, the pseudo random number generator 200 is safe against the guess decision attack (that is, the calculation load required for the guess decision attack is the brute force attack). It can be determined with sufficiently high accuracy whether or not the calculation load is higher than the required calculation load.

(function)
Next, functions of the evaluation apparatus 100 will be described. FIG. 1 is a block diagram illustrating functions of the evaluation apparatus 100. The function of the evaluation apparatus 100 includes an information amount receiving unit (information amount receiving unit) 101, a determination unit (determination unit) 102, and an output unit 103.

The information amount receiving unit 101 receives the processing basic information amount U, the pseudo random number information amount m, and the key information amount L.
The processing basic information amount U is the amount of update processing basic information and generation processing basic information among the basic information stored in the storage device. That is, the processing basic information amount U is the amount of information included in at least one of the update processing basic information and the generation processing basic information in the basic information.

  Here, the update process basic information is information used to update the basic information in one update process. That is, in this example, the update process basic information includes the first update process basic information, the second update process basic information, the third update process basic information, and the fifth update process basic information among the basic information. Information included in at least one of the information.

The generation process basic information is information used for generating a pseudo random number in one generation process. That is, in this example, the generation processing basic information is information included in at least one of the first generation processing basic information and the second generation processing basic information in the basic information.
The pseudo random number information amount m is the amount of pseudo random number information. The key information amount L is the amount of key information.

  In this example, the information amount receiving unit 101 receives information input by the user via the input device. The information amount accepting unit 101 may be configured to accept information by receiving information from an external device.

  The determination unit 102 obtains a determination reference amount U-m that is a value obtained by subtracting the pseudo-random information amount m received by the information amount receiving unit 101 from the processing basic information amount U received by the information amount receiving unit 101 ( calculate.

  Further, the determination unit 102 determines whether or not the acquired determination reference amount U-m is equal to or greater than the key information amount L received by the information amount reception unit 101.

  Then, when the determination unit 102 determines that the determination reference amount U-m is equal to or greater than the key information amount L, the determination unit 102 determines that the pseudo random number generator 200 is safe against the guess determination attack. On the other hand, when the determination unit 102 determines that the determination reference amount Um is smaller than the key information amount L, the determination unit 102 determines that the pseudo random number generator 200 is not safe against the guess decision attack.

  As described above, the determination unit 102 determines whether or not the pseudo random number generator 200 is safe against the guess decision attack based on the determination reference amount U-m and the key information amount L. be able to.

  The output unit 103 outputs determination result information representing the result of determination by the determination unit 102 via the output device.

  Next, the processing basic information amount U for the pseudorandom number generator 200 will be described with reference to a specific example.

As shown in FIG. 4, a pseudo-random number generator 200 called NLSv2 is known (see, for example, Non-Patent Document 2).
Philip Hawkes, Cameron McDonald, Michael Paddon, Gregory G. Rose, Miriam Wiggers de Vries, "Specification for NLSv2", The eSTREAM Finalists 2008, Lecture Notes in Computer Science, Springer, 2008, Vol. 4986, pp. 57-68

  In this pseudo random number generator 200, the basic processing information is information stored in eight storage blocks (register blocks or memory blocks). Specifically, the information stored in the storage blocks A1 and A2 constitutes update processing basic information. Further, the information stored in the storage blocks B1 to B4 constitutes generation processing basic information. Further, the information stored in the storage blocks AB1 and AB2 constitutes update process basic information and constitutes generation process basic information.

  Therefore, in the pseudo random number generator 200, when the number of bits (number of unit bits) stored in each storage block is 32, the processing basic information amount U is 256 (= 8 × 32) bits.

Also, as shown in FIG. 5, a pseudo random number generator 200 called MUGI is known (see, for example, Non-Patent Document 3).
Dai Watanabe, Soichi Furuya, Hirotaka Yoshida, Kazuo Takaragi, Bart Preneel, `` A New Keystream Generator MUGI '', FSE 2002, Lecture Notes in Computer Science, Springer, 2002, Vol. 2365, pp.179-194

  In this pseudo random number generator 200, the basic processing information is information stored in 10 storage blocks. Specifically, the information stored in the storage blocks A1 to A7 constitutes update process basic information. Further, the information stored in the storage blocks AB1 to AB3 constitutes update process basic information and constitutes generation process basic information.

  Therefore, in the pseudo random number generator 200, when the number of bits (number of unit bits) stored in each storage block is 32, the processing basic information amount U is 320 (= 10 × 32) bits.

Also, as shown in FIG. 6, a pseudo random number generator 200 called SNOW1.0 is known (see, for example, Non-Patent Document 4).
Patrik Ekdahl, Thomas Johansson, "SNOW-a new stream cipher", Proceedings of first NESSIE Workshop, Heverlee, Belgium, 2000

  In this pseudo random number generator 200, the basic processing information is information stored in six storage blocks. Specifically, the information stored in the storage blocks A1 and A2 constitutes update processing basic information. Further, the information stored in the storage blocks AB1 to AB4 constitutes update process basic information and constitutes generation process basic information.

  Therefore, in the pseudo random number generator 200, when the number of bits (number of unit bits) stored in each storage block is 32, the processing basic information amount U is 192 (= 6 × 32) bits.

Further, as shown in FIG. 7, a pseudo-random number generator 200 called SNOW 2.0 is known (see, for example, Non-Patent Document 5).
Patrik Ekdahl, Thomas Johansson, "A New Version of the Stream Cipher SNOW", Selected Areas in Cryptography 2002, Lecture Notes in Computer Science, Springer, 2003, Vol. 2595, pp. 47-61

  In this pseudo random number generator 200, the basic processing information is information stored in six storage blocks. Specifically, the information stored in the storage blocks A1 and A2 constitutes update processing basic information. Further, the information stored in the storage blocks AB1 to AB4 constitutes update process basic information and constitutes generation process basic information.

  Therefore, in the pseudo random number generator 200, when the number of bits (number of unit bits) stored in each storage block is 32, the processing basic information amount U is 192 (= 6 × 32) bits.

Also, as shown in FIGS. 8 to 11, a pseudorandom number generator 200 called “Sosemanuk” is known (for example, see Non-Patent Document 6).
Come Berbain, Olivier Billet, Anne Canteaut, Nicolas Courtois, Henri Gilbert, Louis Goubin, Aline Gouget, Louis Granboulan, Cedric Lauradoux, Marine Minier, Thomas Pornin, Herve Sibert, `` Sosemanuk, a Fast Software-Oriented Stream Cipher '', the eSTREA 2008, Lecture Notes in Computer Science, Springer, 2008, Vol. 4986, pp. 98-118

  The pseudo-random number generator 200 is configured to execute one update process and one generation process in four consecutive clock cycles in the clock signal.

  In the first clock cycle, as shown in FIG. 8, the pseudo-random number generator 200 uses the information stored in the storage blocks A1 to A3 as the basis for the second clock cycle following the first clock cycle. Used to update information. Further, in the first clock cycle, as shown in FIG. 8, the pseudo-random number generator 200 updates the information stored in the storage blocks AB1 to AB4 with the basic information in the second clock cycle. Used to generate pseudo-random numbers.

  Therefore, in the first clock cycle, the information stored in the storage blocks A1 to A3 constitutes update processing basic information. Further, in the first clock cycle, information stored in the storage blocks AB1 to AB4 constitutes update process basic information and constitutes generation process basic information. That is, in the first clock cycle, the information stored in the storage blocks A1 to A3 and AB1 to AB4 constitutes processing basic information.

  Further, in the second clock cycle, as shown in FIG. 9, the pseudo random number generator 200 converts the information stored in the storage blocks A4 to A5 and C2 into the third clock cycle following the second clock cycle. Used to update basic information in the clock period. Further, in the second clock cycle, as shown in FIG. 9, the pseudo random number generator 200 updates the basic information in the third clock cycle with the information stored in the storage blocks C1, C5 to C7. And used to generate pseudo-random numbers.

  Note that the information stored in the storage blocks C1 to C7 is based on information constituting the processing basic information in the first clock cycle (that is, information stored in the storage blocks A1 to A3 and AB1 to AB4). To be acquired. Therefore, in the second clock cycle, the information stored in the storage blocks A4 and A5 constitutes update processing basic information. That is, the information stored in the storage blocks A4 and A5 constitutes processing basic information.

  Further, in the third clock cycle, as shown in FIG. 10, the pseudo-random number generator 200 converts the information stored in the storage blocks A6, C9, and C13 into the fourth clock cycle following the third clock cycle. Used to update basic information in the clock period. Further, in the third clock cycle, as shown in FIG. 10, the pseudo random number generator 200 updates the basic information in the fourth clock cycle with the information stored in the storage blocks C8, C14 to C16. And used to generate pseudo-random numbers.

  The information stored in the storage blocks C8 to C16 is stored in the information constituting the processing basic information in the first clock cycle and the second clock cycle (that is, stored in the storage blocks A1 to A5 and AB1 to AB4). Information). Therefore, in the third clock cycle, the information stored in the storage block A6 constitutes update processing basic information. That is, the information stored in the storage block A6 constitutes processing basic information.

  Further, in the fourth clock cycle, as shown in FIG. 11, the pseudo random number generator 200 uses the information stored in the storage blocks A7, C18, and C23 as the first clock following the fourth clock cycle. Used to update basic information in the clock period. Further, in the fourth clock cycle, as shown in FIG. 11, the pseudo-random number generator 200 updates the basic information in the first clock cycle with the information stored in the storage blocks C17, C24 to C26. And used to generate pseudo-random numbers.

  Note that the information stored in the storage blocks C17 to C26 is information constituting the processing basic information in the first clock cycle, the second clock cycle, and the third clock cycle (that is, the storage blocks A1 to A6). , AB1 to AB4). Therefore, in the fourth clock cycle, the information stored in the storage block A7 constitutes update processing basic information. That is, the information stored in the storage block A7 constitutes processing basic information.

  Thus, in this pseudo random number generator 200, the processing basic information is information stored in 11 storage blocks. As described above, the information stored in the storage blocks A1 to A7 constitutes update processing basic information. Further, the information stored in the storage blocks AB1 to AB4 constitutes update process basic information and constitutes generation process basic information.

  Therefore, in the pseudo random number generator 200, when the number of bits (number of unit bits) stored in each storage block is 32, the processing basic information amount U is 352 (= 11 × 32) bits.

  The pseudo random number generator 200 generates a pseudo random number (output information) having an amount four times the amount of information stored in each storage block in the fourth clock cycle. That is, in the pseudo random number generator 200, when the number of bits (unit bit number) stored in each storage block is 32, the pseudo random number information amount m is 128 (= 4 × 32) bits.

(Operation)
Next, the operation of the evaluation apparatus 100 described above will be described.
First, the evaluation apparatus 100 receives the processing basic information amount U, the pseudo random number information amount m, and the key information amount L input by the user. Next, the evaluation apparatus 100 acquires (calculates) a determination reference amount U-m that is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U.

  Then, the evaluation apparatus 100 determines whether or not the acquired determination reference amount Um is greater than or equal to the accepted key information amount L.

  Next, when it is determined that the determination reference amount Um is equal to or greater than the key information amount L, the evaluation device 100 determines that the pseudo random number generator 200 is safe against the guess decision attack. On the other hand, when it is determined that the determination reference amount Um is smaller than the key information amount L, the evaluation apparatus 100 determines that the pseudo random number generator 200 is not safe against the guess decision attack.

  And the evaluation apparatus 100 outputs the determination result information showing the result of determination via an output device.

  As described above, according to the evaluation apparatus 100 according to the first embodiment of the present invention, the safety of the pseudorandom number generator 200 is determined while determining the safety of the pseudorandom number generator 200 with sufficiently high accuracy. It is possible to reduce the calculation load required to evaluate

  Note that, in the evaluation apparatus 100 according to the first embodiment, the amount of information stored in one register block, the amount of information stored in one memory block, and the information of the generated pseudorandom numbers The amount was the same. By the way, the amount of information stored in one register block, the amount of information stored in one memory block, and the amount of generated pseudo-random information may be different from each other. Good. In addition, any one of the amount of information stored in one register block, the amount of information stored in one memory block, and the amount of pseudorandom number information generated is The amount may be different from the above two.

Second Embodiment
Next, an evaluation apparatus according to a second embodiment of the present invention will be described with reference to FIG.
An evaluation apparatus 500 according to the second embodiment
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. It is an apparatus for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately.

Furthermore, this evaluation apparatus 500 is
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process An information amount receiving unit that receives a processing basic information amount U that is the amount of information to be used, a pseudo random number information amount m that is the amount of pseudorandom information, and a key information amount L that is the amount of key information. Information receiving means) 501,
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudo-random information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo-random information amount U is used. A determination unit (determination means) 502 that determines whether or not the random number generator is safe against a guess-decision attack;
Is provided.

  By the way, in the speculative decision attack, first, a portion (assumed portion) having the determination reference amount Um in the processing basic information is assumed. Then, by using the assumed part and the known pseudo-random number, a part other than the assumed part (non-assumed part) in the processing basic information is calculated backward. Therefore, the calculation load in the guess decision attack up to this stage is well represented by the determination reference amount U-m.

  By the way, by inputting each of all the key information to the pseudo-random number generator, the pseudo-random number is generated, and based on whether or not the generated pseudo-random number matches the known pseudo-random number, The computational load required for an attack that specifies key information (also called a brute force attack or a total number search of keys) is often represented by a key information amount L.

  Therefore, according to the above configuration, it is possible to reduce the calculation load required to evaluate the safety of the pseudorandom number generator while determining the safety of the pseudorandom number generator with sufficiently high accuracy.

  Although the present invention has been described with reference to the above embodiment, the present invention is not limited to the above-described embodiment. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  In each of the above-described embodiments, each function of the evaluation apparatus 100 is realized by the CPU executing a program (software), but may be realized by hardware such as a circuit.

  In each of the above embodiments, the program is stored in the storage device, but may be stored in a computer-readable recording medium. For example, the recording medium is a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, and a semiconductor memory.

  Further, any other combination of the above-described embodiment and modification examples may be adopted as another modification example of the above-described embodiment.

<Appendix>
A part or all of the above embodiment can be described as the following supplementary notes, but is not limited thereto.

(Appendix 1)
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation device for evaluating the safety of a pseudo-random number generator that generates a pseudo-random number sequence based on key information by repeating alternately,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process An information amount receiving means for receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information; ,
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo A determination means for determining whether the random number generator is safe against the speculative decision attack;
An evaluation apparatus comprising:

  By the way, in the speculative decision attack, first, a portion (assumed portion) having the determination reference amount Um in the processing basic information is assumed. Then, by using the assumed part and the known pseudo-random number, a part other than the assumed part (non-assumed part) in the processing basic information is calculated backward. Therefore, the calculation load in the guess decision attack up to this stage is well represented by the determination reference amount U-m.

  By the way, by inputting each of all the key information to the pseudo-random number generator, the pseudo-random number is generated, and based on whether or not the generated pseudo-random number matches the known pseudo-random number, The computational load required for an attack that specifies key information (also called a brute force attack or a total number search of keys) is often represented by a key information amount L.

  Therefore, according to the above configuration, it is possible to reduce the calculation load required to evaluate the safety of the pseudorandom number generator while determining the safety of the pseudorandom number generator with sufficiently high accuracy.

(Appendix 2)
The evaluation apparatus according to attachment 1, wherein
The evaluation device configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount Um is equal to or greater than the key information amount L.

  By the way, when the determination reference amount Um is equal to or greater than the key information amount L, it can be said that the calculation load required for the guess decision attack is equal to or greater than the calculation load required for the brute force attack. Therefore, according to the above configuration, the safety of the pseudorandom number generator can be determined with sufficiently high accuracy.

(Appendix 3)
The evaluation apparatus according to Supplementary Note 1 or Supplementary Note 2, wherein
The storage device further includes a memory,
The basic information includes first basic information stored in the feedback shift register and second basic information stored in the memory,
In the update process, the pseudo random number generator updates the first basic information stored in the feedback shift register based only on the first basic information, and stores the first basic information in the memory. An evaluation device configured to update second basic information based on the second basic information and the first basic information.

(Appendix 4)
The evaluation apparatus according to attachment 3, wherein
The pseudo random number generator generates the pseudo random number based on first basic information stored in the feedback shift register and second basic information stored in the memory in the generation process. An evaluation device configured to:

(Appendix 5)
An evaluation apparatus according to any one of appendix 1 to appendix 4,
The evaluation device, wherein the pseudo-random number generated by the pseudo-random number generator is used as a key stream in a stream encryption method.

  By the way, the security of the pseudo random number generator corresponds to the security of the stream encryption method using the pseudo random number generated by the pseudo random number generator as a key stream. Therefore, according to the evaluation apparatus configured as described above, it is possible to reduce the calculation load required for evaluating the security of the encryption apparatus using the stream encryption method.

(Appendix 6)
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation method for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo An evaluation method that determines whether a random number generator is safe against guess-decision attacks.

(Appendix 7)
The evaluation method according to attachment 6, wherein
An evaluation method configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount U-m is equal to or greater than the key information amount L.

(Appendix 8)
In the information processing device,
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation program for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately,
In the information processing apparatus,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo An evaluation program for executing a process for determining whether or not the random number generator is safe against a guess decision attack.

(Appendix 9)
An evaluation program according to attachment 8, wherein
An evaluation program configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount U-m is equal to or greater than the key information amount L.

  In addition, this invention enjoys the benefit of the priority claim based on the patent application of Japanese Patent Application No. 2012-030469 for which it applied for a patent in Japan on February 15, 2012, and was described in the said patent application. The contents are all included in this specification.

  The present invention can be applied to an evaluation apparatus for evaluating the safety of a pseudorandom number generator.

DESCRIPTION OF SYMBOLS 100 Evaluation apparatus 101 Information amount reception part 102 Determination part 103 Output part 200 Pseudorandom number generator 201 Feedback shift register 202 1st conversion process part 203 Memory 204 Multiplexer 205 2nd conversion process part 206 Buffer 207 3rd conversion process part 500 Evaluation Device 501 Information Amount Accepting Unit 502 Determination Unit

Claims (9)

A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation device for evaluating the safety of a pseudo-random number generator that generates a pseudo-random number sequence based on key information by repeating alternately,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process An information amount receiving means for receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information; ,
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo A determination means for determining whether the random number generator is safe against the speculative decision attack;
An evaluation apparatus comprising: The evaluation device according to claim 1,
The evaluation device configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount Um is equal to or greater than the key information amount L. The evaluation apparatus according to claim 1 or 2, wherein
The storage device further includes a memory,
The basic information includes first basic information stored in the feedback shift register and second basic information stored in the memory,
In the update process, the pseudo random number generator updates the first basic information stored in the feedback shift register based only on the first basic information, and stores the first basic information in the memory. An evaluation device configured to update second basic information based on the second basic information and the first basic information. An evaluation apparatus according to claim 3, wherein
The pseudo random number generator generates the pseudo random number based on first basic information stored in the feedback shift register and second basic information stored in the memory in the generation process. An evaluation device configured to: An evaluation apparatus according to any one of claims 1 to 4,
The evaluation device, wherein the pseudo-random number generated by the pseudo-random number generator is used as a key stream in a stream encryption method. A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation method for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo An evaluation method that determines whether a random number generator is safe against guess-decision attacks. The evaluation method according to claim 6, wherein
An evaluation method configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount U-m is equal to or greater than the key information amount L. In the information processing device,
A generation process for generating a pseudo-random number based on basic information stored in a storage device including a feedback shift register, and an update process for updating the basic information based on basic information stored in the storage device. An evaluation program for evaluating the safety of a pseudo random number generator that generates a pseudo random number sequence based on key information by repeating alternately,
In the information processing apparatus,
Of the basic information stored in the storage device, information used for updating the basic information in one update process, and generating the pseudo-random number in one generation process Receiving a processing basic information amount U which is an amount of information used, a pseudo random number information amount m which is an amount of information of the pseudo random number, and a key information amount L which is an amount of the key information;
Based on the determination reference amount U-m, which is a value obtained by subtracting the received pseudorandom information amount m from the received processing basic information amount U, and the received key information amount L, the pseudo An evaluation program for executing a process for determining whether or not the random number generator is safe against a guess decision attack. An evaluation program according to claim 8, wherein
An evaluation program configured to determine that the pseudo-random number generator is safe against a guess decision attack when the determination reference amount U-m is equal to or greater than the key information amount L.

Images