WO2010024004A1

WO2010024004A1 - Tweakable block encrypting device, tweakable block encrypting method, tweakable block encrypting program, tweakable block decrypting device, tweakable block decrypting method, and tweakable block decrypting program

Info

Publication number: WO2010024004A1
Application number: PCT/JP2009/059438
Authority: WO
Inventors: 一彦峯松
Original assignee: 日本電気株式会社
Priority date: 2008-08-29
Filing date: 2009-05-22
Publication date: 2010-03-04
Also published as: JP5333450B2; JPWO2010024004A1

Abstract

A tweakable block encrypting device includes an input means for inputting an n-bit plain text and an n-bit tweak, a tweak-dependent key deriving means for deriving a tweak-dependent key by encrypting the tweak using an n-bit block encryption function, fixing a given (n-m)-bits (where 1 < m < n/2) out of the result of the encryption to a given value, and encrypting the result of the fixing by cipher processing having an n-bit input, a means for block encryption using a mask by substituting the tweak in a keyed function, thereby generating a mask value, adding the mask value to the plain text, encrypting the result of the addition by using the n-bit block ciphers and by using the tweak-dependent key, adding the mask value to the result of the encryption, and thereby generating an encrypted text, and an output means for outputting the encrypted text.

Description

Block encryption device with adjustment value, block encryption method with adjustment value, block encryption program with adjustment value, block decryption device with adjustment value, block decryption method with adjustment value, and block decryption program with adjustment value

The present invention relates to an operation mode of a block cipher, and more particularly, to a block encryption device, method and program with adjustment value, and a decryption device, method and program which are versatile and highly secure by n-bit block cipher.

The block cipher is a set of substitutions uniquely determined by the key, and the input to the substitution corresponds to plaintext and the output corresponds to the ciphertext. The length of plaintext or ciphertext is called the block size. A block cipher having a block size of n bits is generally called an n-bit block cipher. As a technique related to block encryption / decryption, there is an “encryption method and apparatus” disclosed in Patent Document 1.

The block cipher with adjustment value is a block cipher having an adjustment value called tweak in addition to the input / output (plaintext, ciphertext, key) of a normal block cipher, and is also called a tweakable block cipher. If the adjustment value and the key are determined, it is a condition that plaintext and ciphertext correspond one-to-one. That is, the encryption function TWENC of a block cipher with an arbitrary adjustment value and the corresponding decryption function TWDEC always satisfy the following formula (1) for the plaintext M, ciphertext C, key K, and adjustment value T.

Non-Patent Document 1 discloses the formal definition and security requirements of a block cipher with an adjustment value including equation (1). To put it simply, in the case of a block cipher with adjusted values, the output of two block ciphers with different adjusted values is independent of the attacker even if the adjusted value and input are known to the attacker. It is required that it looks like a random value. When this property is satisfied, the block cipher with adjustment value is said to be secure.

Further, in Non-Patent Document 1, a theoretically safe block cipher with an adjustment value is obtained as a normal block cipher operation mode (hereinafter referred to as a mode), in other words, obtained as a conversion using a block cipher as a black box. It has been shown that However, the theoretical security here means that the security of the block cipher with adjustment value obtained as a mode of a certain block cipher can be reduced to the security of the original block cipher, that is, as long as a safe block cipher is used. It shows that the obtained block cipher with adjustment value is also safe.

In addition, the definition of security includes security when an attacker can only use a selected plaintext attack (chosen-plaintext attack, CPA), a selected plaintext attack and a selected ciphertext attack (chosen-ciphertext attack, CCA). There are two types, safety when executable in combination. The former is called CPA-security and the latter is called CCA-security.

Secure block cipher with adjustment value is known to be a key technology for realizing advanced encryption functions. For example, in Non-Patent Document 2, if a block cipher with an adjustment value having CCA-security is used, a very efficient cipher with an authentication function can be realized, and if a block cipher with an adjustment value having CCA-security is used, the efficiency is improved. It is pointed out that a message authentication code that can be executed in parallel can be realized. It is also known that the block cipher with adjustment value having CCA-security is an indispensable technique for storage encryption such as disk sector encryption.

Here, the mode proposed in Non-Patent Document 1 is referred to as LRW mode. 9A and 9B show the LRW mode using the n-bit block cipher E. In the LRW mode using an n-bit block cipher (encryption function is Enc and decryption function is Dec), in general, when key K, adjustment value T, and plaintext M are given, ciphertext is expressed by the following equation (2). Get C.

Decryption from ciphertext C to plaintext M is expressed by the following equation (3).

K1 is a block cipher key, and K2 is a keyed function F (called an offset function) that is added before and after block cipher processing. Here, F must have a property satisfying the following expression (4) for any c, x, x ′ (x ≠ x ′) when the security parameter is e (0 ≦ e ≦ 1). . However, + represents an exclusive OR (XOR).

When it has this property, f (K, *) is said to be e-almost XOR universal (e-AXU). The e-AXU function is a kind of universal hash function. In order to realize this, for example, it is well known that F (K2, T) = mul (K2, T) using multiplication mul on a finite field GF (2n). In this case, F is 1 / 2n-AXU.

The e-AXU function can be realized by a method proposed in Non-Patent Document 3 other than mul. These are known to be several times faster than general block ciphers in a specific implementation environment.

As a configuration method of the block cipher with adjustment value using the n-bit block cipher, there are the LRW mode of Non-Patent Document 1 and the XE and XEX modes of Non-Patent Document 2 which are variants thereof. The LRW mode and the XEX mode have the formats shown in the above formulas (2) and (3) and have CCA-security.

On the other hand, the XE mode has the form of the following formula (5) with the outside offset omitted, and has CPA-security.

In LRW mode, K2 is independent of K1, whereas in XE mode and XEX mode, K2 uses the result of encrypting a fixed plaintext (for example, all n bits of n bits) with Enc (K1, *). To improve the efficiency of the key size. Importantly, in any case, the security guarantee is limited to the case where the number of encryptions q processed with one key is sufficiently smaller than 2n / 2 (this is expressed as q << 2n / 2). It is. 2n / 2 is called birthday bound, and an attack using the result of encryption of the number of times about birthday bound is generally called birthday attack. Such an attack becomes a real threat when using a 64-bit block cipher, and it is considered a future risk even when a 128-bit block cipher is used.

Non-Patent Document 4 describes a configuration method of a block cipher with an adjustment value that is safe when the encryption count q is q << 2n. This is because the original block cipher is a Feistel cipher with a 2n-bit block. The problem is different because it deals with time (only the security up to the birthday bound of the block cipher block size (2n bits) is guaranteed).

Non-Patent Document 5 and other conventional methods include a method of preparing a plurality of n-bit block cipher keys for each adjustment value. This method is simple and useful when the key length is sufficiently longer than n bits (for example, 2n or 3n bits), or when the key length is n bits and the adjustment value is very short. Provide safety beyond bounds. However, if the adjustment value has a certain length (for example, n / 2 bits) and the key length is n bits, this method generally cannot guarantee safety beyond the birthday bound.

JP-A-9-230787

As described above, the block cipher with adjustment value using the block cipher has only been realized by a method that can be broken by a birthday attack.

The present invention has been made in view of the above problems, and an adjustment value-attached block encryption apparatus, method, and method that can form an adjustment value-attached block cipher having theoretical resistance to a birthday attack using a realistic block cipher. It is an object to provide a program, a decoding device, a method, and a program.

To achieve the above object, the present invention provides, as a first aspect, an input means for inputting n-bit plaintext and an n-bit adjustment value, and encrypting the adjustment value with an n-bit block cipher function. A value less than n / 2 is assumed to be m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is encrypted by an encryption process having n-bit input. The adjustment value-dependent key derivation means for generating the adjustment value-dependent key, the mask value is generated by inputting the adjustment value to the keyed function, the mask value is added to the plaintext, and the addition result is Encrypted with n-bit block cipher using the adjustment value-dependent key as a key, and adds a mask value to the encrypted result to generate a ciphertext, and a masked block encryption means for outputting the ciphertext Means and There is provided a tweakable block cipher apparatus.

In order to achieve the above object, the present invention provides, as a second aspect, input means for inputting an n-bit ciphertext and an n-bit adjustment value, and encrypting the adjustment value with an n-bit block cipher. A value greater than 1 and less than n / 2 is assumed to be m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is encrypted by an encryption process having n-bit input. An adjustment value-dependent key derivation unit for generating an adjustment value-dependent key, and generating a mask value by inputting the adjustment value to a keyed function, adding the mask value to the plaintext, and adding the result Is decrypted with a decryption function corresponding to the n-bit block cipher using the adjustment value-dependent key as a key, and the plaintext is generated by adding the mask value to the decrypted result and the plaintext is output Plaintext There is provided a tweakable block decoding device comprising a force means.

In order to achieve the above object, the present invention provides, as a third aspect, an input process for inputting n-bit plaintext and an n-bit adjustment value, and encrypting the adjustment value with an n-bit block cipher function. A value less than n / 2 is assumed to be m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is encrypted by an encryption process having n-bit input. The adjustment value-dependent key derivation process for generating the adjustment value-dependent key, the mask value is generated by inputting the adjustment value to the keyed function, the mask value is added to the plaintext, and the addition result is Encrypted with an n-bit block cipher using the adjustment value-dependent key as a key, and adds a mask value to the encrypted result to generate a ciphertext, and an output to output the ciphertext Processing and Tweakable block encryption method is to provide a.

In order to achieve the above object, the present invention provides, as a fourth aspect, an input process for inputting an n-bit ciphertext and an n-bit adjustment value, and encrypting the adjustment value with an n-bit block cipher. A value greater than 1 and less than n / 2 is assumed to be m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is encrypted by an encryption process having n-bit input. Adjustment value dependency key derivation processing for generating an adjustment value dependency key, and generating a mask value by inputting the adjustment value to a keyed function, adding the mask value to the plaintext, and the result of the addition Is decrypted with a decryption function corresponding to the n-bit block cipher using the adjustment value-dependent key as a key, and the plaintext is generated by adding the mask value to the decrypted result and the plaintext is output. Plaintext There is provided a tweakable block decoding method having a force canceling, the.

To achieve the above object, the present invention, as a fifth aspect, causes a computer to execute the block encryption method with adjustment value according to the third aspect of the present invention. A program is provided.

In order to achieve the above object, according to a sixth aspect of the present invention, there is provided a block decoding with adjustment value, characterized by causing a computer to execute the block decoding method with adjustment value according to the fourth aspect of the present invention. A program is provided.

ADVANTAGE OF THE INVENTION According to this invention, the block encryption apparatus with an adjustment value which can form the block cipher with an adjustment value which has theoretical tolerance to a birthday attack using a realistic block cipher, a method and a program, and a decoding apparatus, a method and a program Can provide.

It is a figure which shows the structure of the block encryption apparatus with an adjustment value which concerns on 1st Embodiment which implemented this invention suitably. It is a figure which shows the data flow in the adjustment value dependence key derivation | leading-out part and the block encryption part with a mask. It is a figure which shows the data flow in the adjustment value dependence key derivation | leading-out part at the time of omitting addition of the mask value by the side of a ciphertext, and a block encryption part with a mask. It is a figure which shows the flow of operation | movement of the block encryption apparatus with an adjustment value which concerns on 1st Embodiment. It is a figure which shows the structure of the block decoding apparatus with an adjustment value which concerns on 2nd Embodiment which implemented this invention suitably. It is a figure which shows the data flow in the adjustment value dependence key derivation | leading-out part and the block decoding part with a mask. It is a figure which shows the data flow in the adjustment value dependence key derivation | leading-out part and the block decoding part with a mask at the time of omitting addition of the mask value by the side of a ciphertext. It is a figure which shows the flow of operation | movement of the block decoding apparatus with an adjustment value which concerns on 2nd Embodiment. It is a figure which shows the operation | movement of encryption and a decoding in LRW mode.

The present invention efficiently implements an efficient block cipher with an adjustment value that guarantees safety beyond birthday bounds.

In the present invention, when the block cipher E (n-bit key, n-bit block) used as a component is theoretically safe and m <n / 2 is a security parameter, the number of plaintext / ciphertext used by the attacker This is because it has theoretical security when is sufficiently smaller than 2 (n + m) / 2, that is, has theoretical resistance to a birthday attack by 2n / 2 encryptions. The strength of resistance can be controlled by m.

Also, if the key is longer than n, it has higher security. This is due to the fact that a new block cipher key is derived for each adjustment value and used for encryption / decryption. Is about 2n / 2, the probability that the n-bit keys coincide by chance is almost 1, and a birthday attack using this fact is established.

To prevent this, the number of key variations is limited to 2m using the mpad function, and by adding mask value addition depending on the adjustment value before and after the block cipher, the security beyond the birthday bound in the selected ciphertext attack can be increased. Guaranteed. If the addition of the mask value on the ciphertext side is omitted, only the security beyond the birthday bound against the selected plaintext attack is guaranteed instead of slightly simplifying the processing.

Hereinafter, preferred embodiments of the present invention will be described.

[First Embodiment]
A first embodiment in which the present invention is suitably implemented will be described.

FIG. 1 shows a configuration of a block encryption apparatus with adjustment values according to the present embodiment. The block encryption device with adjustment value 10 includes an input unit 100, an adjustment value dependency key deriving unit 101, a block encryption unit with mask 102, and an output unit 103.

The block encryption device with adjustment value 10 can be realized by a CPU, a memory, and a disk.

Each functional unit of the block encryption device with adjustment value can be realized by storing a program on a disk and operating the program on the CPU.

The block cipher to be used is n-bit block, n'-bit key

And the length of the adjustment value is n bits. m (1 <m <n / 2) is a security parameter, which determines safety.

The input unit 100 inputs an n-bit plaintext M to be encrypted and an n-bit adjustment value T. The input unit 100 is realized as a character input device such as a keyboard.

FIG. 2 shows a flow of information in the adjustment value-dependent key derivation unit 101 and the block encryption unit 102 with mask. As shown in FIG. 3, if the ciphertext side mask value addition is omitted, only the security beyond the birthday bound against the selected plaintext attack is guaranteed instead of slightly simplifying the processing.

The adjustment value-dependent key deriving unit 101 generates a new block cipher key called an adjustment value-dependent key, depending on the input adjustment value T and key K.

Specifically, when n ′ = n, the adjustment value-dependent key L can be realized as the following equation (6).

However, the block cipher keys K1 and K2 are derived from the device key K by any method (for example, K is 2n bits or more, the first n bits are K1, and the next n bits are K2). Can be realized). Mpad is a function that fixes any n-m bits (m is a security parameter) of n bits to an arbitrary value. For example, this can be realized by setting the upper n-m bits to all zeros.

The encryption process using the key K2 can be realized by an arbitrary encryption function having an n-bit input and an n′-bit output, such as a one-way hash function with a key. In particular, when n '= n, the encryption process with key K2 is Stefan Lucks, The Sum of PRPs Is a Secure PRF, EUROCRYPT 2000, International Conference on the Theory and Application of Cryptographic Technologies, Bruges, Belgium-May 14, Belgium-May. 18, 2000, Proceeding. Lecture Notes in Computer Science 1807 Springer 2000, pp. 470-484. This can also be realized by using the SUM mode described in T. Iwata, New Blockcipher Modes of Operation if n '> n. With Beyond the Birthday Bound Security, Fast Software Encryption, 13th International Workshop, FSE 2006, Graz, Austria, March 15-17, 2006, Revised Selected Papers.Lecture Notes in Computer Science, 4047 Spring 40, 322 It can also be realized by using CENC mode.

The masked block encryption unit 102 encrypts plaintext M into ciphertext C using the mask value based on the adjustment value dependency key L and the adjustment value T output from the adjustment value dependency key derivation unit 101.

Specifically, when a ciphertext attack selected by an attacker is assumed, ciphertext C is expressed by the following formula (7), and when only plaintext selection attack is assumed, the following formula (8) is expressed.

Here, K3 is a key derived from the key K of the device in the same manner as K1 and K2 in the above equation (6), and F (K3, T) inputs T to the keyed function F using the key K3. The result (n bits). F needs to be an e-AUX function defined by the above equation (4) for two different adjustment values T and T ′. This can be realized, for example, by taking the multiplication mul (K3, T) on the finite field GF (2n) of the n-bit key K3 and the adjustment value T. At this time, F is defined by the following equation (9), and F is a 1 / 2n-AXU function.

The output unit 103 outputs the ciphertext C output from the block cipher unit 102 with mask. The output unit 103 can be realized by a computer display, a printer, or the like.

When the block encryption device with adjustment value according to the present embodiment is specifically used for encryption in communication or data storage, the block cipher of the n-bit block and the n-bit adjustment value obtained in the present embodiment in some encryption mode It is possible to use it. For example, it can be used in Tweak Block Chaining, Tweak Chain Hash, Tweakable Authenticated Encryption, etc., which are described in Non-Patent Document 1, which are block cipher modes with adjustment values.

Furthermore, for data storage encryption such as hard disks, the modes discussed in the standardization of storage encryption methods in IEEE can be applied. In this method, encryption is performed in parallel as in the ECB mode while adding a mask value according to the sector of the hard disk and the byte position in the sector (one sector is usually 512 bytes). In this method, for example, n = 128, and the encryption function of the 128-bit block and 128-bit adjustment value-attached block cipher obtained in this embodiment is set to TENC (key K, adjustment value T, plaintext M encryption is TENC ( K, T, M)), the sector contents are first divided into 128 bits (16 bytes). The result of division is (m1, m2, ..., m32), where mi is 16 bytes. At this time, mi (i = 1, ..., 32) is encrypted as TENC (K, (SecNum || i), mi). However, SecNum is a sector number, and || represents concatenation of bit sequences. That is, the i-th block of the sector number SecNum is encrypted with the adjustment value (SecNum || i).

FIG. 4 shows an operation flow of the block encryption apparatus with adjustment value according to the present embodiment.

First, n-bit plaintext M and n-bit adjustment value T are input via the input means (step S101), and the adjustment value-dependent key derivation unit 101 obtains the adjustment value-dependent key L according to the above equation (6). (Step S102). Next, the block encryption unit 102 generates a mask value S according to the above equation (7) (step S103), and further performs encryption with M mask according to the above equation (7) using L as a key and S as a mask value. A ciphertext C is obtained (step S104). Finally, the obtained ciphertext C is output by the output unit 103 (step S105).

Thus, according to the present embodiment, a block cipher with an adjustment value having theoretical resistance to a birthday attack can be formed using a realistic block cipher.

[Second Embodiment]
A second embodiment in which the present invention is suitably implemented will be described.

FIG. 5 shows the configuration of the block decoding apparatus with adjustment values according to the present embodiment. The block decoding device with adjustment value 20 includes an input unit 200, an adjustment value dependent key derivation unit 201, a block decoding unit 202 with mask, and an output unit 203.

The block decoder with adjustment value 20 can be realized by a CPU, a memory, and a disk.

Each functional unit of the block decoder with adjustment value can be realized by storing a program on a disk and operating the program on the CPU.

Each functional unit constituting the block decoding device with adjustment value will be described.

FIG. 6 shows the flow of information in the adjustment value-dependent key derivation unit 201 and the masked block decryption unit 302. As shown in FIG. 7, if the ciphertext side mask value addition is omitted, the process can be slightly simplified, but only the security beyond the birthday bound against the selected plaintext attack is guaranteed.

As in the first embodiment, a block cipher to be used is an n-bit block, an n′-bit key (n ′ ≧ n), and a security parameter is m (1 <m <n / 2).

The input unit 200 inputs an n-bit ciphertext C to be decrypted and an n-bit adjustment value T. The input unit 200 can be realized by a character input device such as a keyboard.

The adjustment value dependency key derivation unit 201 is the same as the adjustment value dependency key derivation unit 101 in the first embodiment.

The block decryption unit with mask 202 decrypts the ciphertext C into plaintext M using the mask value based on the adjustment value dependency key L and the adjustment value T output from the adjustment value dependency key derivation unit 201. Specifically, if the decryption function of the block cipher is Dec (key K, decryption of ciphertext C is Dec (K, C)), and the assumed ciphertext attack by an attacker is assumed, plaintext M is expressed by the following formula (10) When only the selected plaintext attack is assumed, the following equation (11) is obtained.

Here, K3 is a key derived from the device key K, and the keyed function F is the same as that used by the masked block encryption unit 102 in the first embodiment.

The output unit 203 outputs the plaintext M output by the block decryption unit with mask 202. The output unit 203 can be realized by a computer display, a printer, or the like.

FIG. 8 shows an operation flow of the block decoding apparatus with adjustment values according to the present embodiment.

First, the n-bit ciphertext C and the adjustment value T are input using the input unit 200 (step S201), and the adjustment value dependency key L is obtained by the adjustment value dependency key derivation unit 201 according to the above equation (6) (step S201). S202). Next, the mask value block decoding unit 202 generates a mask value S according to the above equation (10) (step S203). Further, decryption with a mask is performed on the ciphertext C according to the above equation (10) using L as a key and S as a mask value to obtain plaintext M (step S204). Finally, the obtained plaintext M is output by the output unit 203 (step S205).

As described above, according to this embodiment, it is possible to decrypt a block cipher with an adjustment value that has theoretical resistance to a birthday attack formed by using a realistic block cipher.

In addition, each said embodiment is an example of suitable implementation of this invention, and this invention is not limited to these.

For example, the present invention is applicable to uses such as authentication and encryption in wireless or wired data communication, and uses such as encryption of data on a storage and prevention of tampering.

Thus, the present invention can be variously modified.

This application claims the benefit of priority based on Japanese Patent Application No. 2008-221657 filed on August 29, 2008, the entire disclosure of which is incorporated herein by reference.

DESCRIPTION OF SYMBOLS 10 Block encryption apparatus with adjustment value 20 Block decryption apparatus with

adjustment value

100, 200 Input part 101, 201 Adjustment value dependence key derivation part 102 Block encryption part with mask 103, 203 Output part 202 Block decryption part with mask

Claims

an input means for inputting an n-bit plaintext and an n-bit adjustment value;
The adjusted value is encrypted with an n-bit block cipher function, and a value greater than 1 and less than n / 2 is set as m, and arbitrary nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result , And an adjustment value dependent key derivation means for generating an adjustment value dependency key by encrypting with an encryption process having an n-bit input,
A mask value is generated by inputting the adjustment value to a keyed function, the mask value is added to the plaintext, and the addition result is encrypted with an n-bit block cipher using the adjustment value-dependent key as a key. A block encryption means with a mask for generating a ciphertext by adding the mask value to the encrypted result;
Output means for outputting the ciphertext;
A block encryption device with an adjustment value, comprising:
The adjustment value-dependent key derivation unit generates an n-bit block cipher key based on a device key, and uses the generated block cipher key in the cryptographic processing. Block encryption device with adjustment value.
an input means for inputting an n-bit ciphertext and an n-bit adjustment value;
The adjusted value is encrypted with an n-bit block cipher, and a value greater than 1 and less than n / 2 is set to m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is , An adjustment value-dependent key derivation means for generating an adjustment value-dependent key by encrypting with an encryption process having an n-bit input;
A mask value is generated by inputting the adjustment value to a keyed function, the mask value is added to the plaintext, and the addition result corresponds to an n-bit block cipher using the adjustment value-dependent key as a key. A block decoding unit with mask for generating a plaintext by decrypting with a decryption function and adding the mask value to the decrypted result; a plaintext output unit for outputting the plaintext;
A block decoding apparatus with an adjustment value.
The adjustment value-dependent key derivation unit generates an n-bit block cipher key based on a device key, and uses the generated block cipher key in the cryptographic process. Block decoder with adjustment value.
an input process for inputting an n-bit plaintext and an n-bit adjustment value;
The adjusted value is encrypted with an n-bit block cipher function, and a value greater than 1 and less than n / 2 is set as m, and arbitrary nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result , And an adjustment value-dependent key derivation process for generating an adjustment value-dependent key by encrypting with an encryption process having an n-bit input,
A mask value is generated by inputting the adjustment value to a keyed function, the mask value is added to the plaintext, and the addition result is encrypted with an n-bit block cipher using the adjustment value-dependent key as a key. A block encryption process with a mask for generating a ciphertext by adding the mask value to the encrypted result;
An output process for outputting the ciphertext;
A block encryption method with an adjustment value comprising:
an input process for inputting an n-bit ciphertext and an n-bit adjustment value;
The adjusted value is encrypted with an n-bit block cipher, and a value greater than 1 and less than n / 2 is set to m, and any nm bits of the encrypted result are fixed to an arbitrary value, and the fixed result is , An adjustment value-dependent key derivation process for generating an adjustment value-dependent key by encrypting with an encryption process having an n-bit input;
A mask value is generated by inputting the adjustment value to a keyed function, the mask value is added to the plaintext, and the addition result corresponds to an n-bit block cipher using the adjustment value-dependent key as a key. Decrypting with a decryption function, adding a mask value to the decrypted result and generating a plaintext by masking, a plaintext output process for outputting the plaintext,
A block decoding method with adjustment value, comprising:
A block encryption program with adjustment value, which causes a computer to execute the block encryption method with adjustment value according to claim 5.
A block decoding program with adjustment value, which causes a computer to execute the block decoding method with adjustment value according to claim 6.