WO2011155039A1 - Message authentication code calculation device, message authentication code calculation method, and message authentication code calculation program - Google Patents

Abstract

A message authentication code calculation algorithm having a favorable calculation efficiency and high safety is configured. A value (M) corresponding to communication data is divided into i-pieces of values (p) having m-n-bit length, and among the values, i-1-pieces of values (p) are added with a secret key (k) having n-bit length (S110 to S130). A fixed value (IV1) having n-bit length and a value (p[1]||k[1]) having m-bit length are input to a compressibility function (h) to obtain a value (c[1]) having n-bit length (S140). By sequentially using j=2 to i-1, a value (c[j-1]) having n-bit length and a value (p[j]||k[j]) having m-bit length are input to the compressibility function (h) to obtain a value (c[j]) having n-bit length (S141). A fixed value (IV2) having n-bit length and a value (p[i]||c[i-1]) having m-bit length are input to the compressibility function (h) to obtain a value (c[i]) having n-bit length, and the value (c[i]) is output as a message authentication code of the value (M) (S142, S150).

Description

Message authentication code calculation device, message authentication code calculation method, and message authentication code calculation program

The present invention relates to, for example, a message authentication code calculation device, a message authentication code calculation method, and a message authentication code calculation program for efficiently calculating a message authentication code.

Non-Patent Document 1 describes a zipper hash function (zipper hash function).
Even if the zipper hash function is configured using an ideal compression function (WFILRO (Weakened Fixed Input Length Random Oracle)) whose unidirectionality is broken, it cannot be strongly distinguished from a random oracle.

Non-Patent Document 2 describes a double-pipe hash function.
The double pipe hash function cannot be strongly distinguished from a random oracle even if it is configured using an ideal compression function whose unidirectionality is broken.

Non-Patent Document 3 describes a hash function that has high computational efficiency and is a hash function that cannot be strongly discriminated from a random oracle even when configured using an ideal compression function with broken unidirectionality. .

Non-Patent Document 4 and Non-Patent Document 5 describe a highly secure message authentication code calculation algorithm (HMAC: Keyed Hash Functions and Message Authentication) using a hash function.

The zipper hash function described in Non-Patent Document 1 and the double-pipe hash function described in Non-Patent Document 2 are strongly distinguished from random oracles even if they are configured using an ideal compression function whose unidirectionality is broken. Although impossible, calculation efficiency is poor.
In Non-Patent Document 3, a hash function that cannot be strongly discriminated from a random oracle even when configured using an ideal compression function with broken unidirectionality, is more efficient than a zipper hash function or a double-pipe hash function. A good hash function has been proposed.

On the other hand, HMAC described in Non-Patent Documents 4 and 5 is a message authentication code calculation algorithm using a general hash function algorithm, and has been proposed as a message authentication code calculation algorithm having provable security.
However, in order for HMAC to have provable security, it is necessary to use a secure hash function algorithm. It is pointed out that a key recovery attack is possible when using a hash function algorithm with weak security.
Further, HMAC secures provable security by executing the hash function algorithm twice, so that calculation efficiency is poor.

For example, the present invention can construct a message authentication code computation algorithm with high computational efficiency using a random oracle and a hash function that cannot be strongly discriminated even if it is constructed using an ideal compression function with broken unidirectionality. The purpose is to do so.

The message authentication code computing device of the present invention is:
A communication data input unit for inputting communication data communicated between specific information processing apparatuses;
A communication data dividing unit that divides data including communication data input to the communication data input unit into first to i-th divided data;
A secret key data storage unit for storing first to i-1th secret key data;
The a-th (a = 1, 2,..., I−1) division data obtained by the communication data division unit and the a-th secret key data stored in the secret key data storage unit are included. a secret key addition data generation unit that generates m-bit length data as the a-th secret key addition data;
A predetermined first additional data having an n-bit length and the secret key-added data generating unit using a compression function for calculating new data having an n-bit length based on the n-bit data and the m-bit data. A first compressed code calculation unit that calculates first new data having an n-bit length as a first compressed code based on the first secret key-added data having an m-bit length generated by
Using the first compression code calculated by the first compression code calculation unit, the second to (i-1) -th secret key addition data generated by the secret key addition data generation unit, and the compression function, Second compression for calculating b-th new data based on b-th compressed code and b-th secret key additional data as b-th (b = 2,..., I-1) compressed code A code calculator;
Generate m-bit length data including compressed code additional data including the i-th divided data obtained by the communication data dividing unit and the i-1th compressed code calculated by the second compressed code calculating unit. A compressed code additional data generation unit,
Based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length generated by the compressed code additional data generating unit, new data having an n-bit length is converted into the new data using the compression function. A message authentication code calculation unit that calculates the message authentication code of the communication data.

The message authentication code computing device according to the present invention makes it difficult to specify an input value to the compression function by adding a secret key to the input value (divided data obtained by dividing communication data) to the compression function. Thus, for example, a message authentication code calculation algorithm with high calculation efficiency is configured using a hash function algorithm that cannot be strongly discriminated from a random oracle even if configured using an ideal compression function whose unidirectionality is broken. be able to.

1 is a schematic diagram of a communication system 100 according to Embodiment 1. FIG. FIG. 3 is a functional configuration diagram of a message authentication code calculation device 200 according to the first embodiment. 5 is a flowchart showing a message authentication code calculation method in the first embodiment. FIG. 3 is a structural diagram of a message authentication code calculation algorithm in the first embodiment. FIG. 3 is a diagram illustrating an example of hardware resources of the message authentication code calculation device 200 according to the first embodiment. The function block diagram of the message authentication code calculating apparatus 200 in Embodiment 2. FIG. 9 is a flowchart showing a message authentication code calculation method in the second embodiment. FIG. 9 is a structural diagram of a message authentication code calculation algorithm in the second embodiment. The function block diagram of the message authentication code calculating apparatus 200 in Embodiment 3. FIG. 10 is a flowchart illustrating a message authentication code calculation method according to Embodiment 3. FIG. 11 is a structural diagram of a message authentication code calculation algorithm in the third embodiment. FIG. 14 is another example of a functional configuration diagram of the message authentication code calculation device 200 according to the third embodiment. 10 is another example of a flowchart showing a message authentication code calculation method according to Embodiment 3. FIG. 14 is another example of the structure diagram of the message authentication code calculation algorithm in the third embodiment.

Embodiment 1 FIG.
A mode in which secret key data is added to the divided data obtained by dividing the communication data, and each secret key added data to which the secret key data is added is input to a compression function to generate a message authentication code for the communication data will be described.

FIG. 1 is a schematic diagram of a communication system 100 according to the first embodiment.
An overview of the communication system 100 according to Embodiment 1 will be described with reference to FIG.

In the communication system 100, the user terminal device A102 and the user terminal device B103 communicate communication data 104 (user data, original data) via the network 101. At this time, in order to ensure that the communication data 104 is not unauthorized communication data that has been falsified by another user terminal device or generated by impersonating another person, the communication data 104 includes data called “message authentication code 105”. Is granted.

The user terminal device A102 and the user terminal device B103 include a communication unit 111, a communication data generation unit 112, a communication data verification unit 113, and a message authentication code generation unit 119.
The communication unit 111 transmits and receives the communication data 104 and the message authentication code 105.
The communication data generation unit 112 generates communication data 104 to be transmitted.
The communication data verification unit 113 verifies the received communication data 104.
The message authentication code generation unit 119 generates a message authentication code 105 for the communication data 104.

In addition, the user terminal device A102 and the user terminal device B103 store in advance the same key data that is kept secret from other communication terminal devices. Hereinafter, this key data is referred to as “secret key 106”. The secret key 106 is also called a “shared key”.

For example, when communication data is transmitted from the user terminal device A102 to the user terminal device B103, the following processing is performed in the user terminal device A102.
The communication data generation unit 112 generates communication data 104. The message authentication code generation unit 119 generates the message authentication code 105 based on the communication data 104 generated by the communication data generation unit 112 and the secret key 106 stored in advance. The communication unit 111 transmits the communication data 104 generated by the communication data generation unit 112 and the message authentication code 105 generated by the message authentication code generation unit 119 to the user terminal device B103.

Further, the following processing is performed in the user terminal device B103.
The communication unit 111 receives the communication data 104 and the message authentication code 105 transmitted by the user terminal device A102. The message authentication code generation unit 119 generates the message authentication code 105 based on the communication data 104 received by the communication unit 111 and the secret key 106 stored in advance. The communication data verification unit 113 compares the message authentication code 105 received by the communication unit 111 with the message authentication code 105 generated by the message authentication code generation unit 119. If the message authentication codes 105 match, it is guaranteed that the communication data 104 received by the communication unit 111 is legitimate communication data transmitted by the user terminal device A102. On the other hand, if the message authentication code 105 does not match, the communication data 104 received by the communication unit 111 is unauthorized communication data that has been altered or generated by another user terminal device.

Hereinafter, a method for generating a message authentication code in the first embodiment will be described.
The function of the message authentication code calculation device 200 described below corresponds to the message authentication code generation unit 119 provided in the user terminal device A102 and the user terminal device B103.

FIG. 2 is a functional configuration diagram of the message authentication code calculation device 200 according to the first embodiment.
A functional configuration of the message authentication code computing device 200 according to Embodiment 1 will be described with reference to FIG.

The message authentication code calculation device 200 includes an arbitrary length value input unit 210, an arbitrary length value division unit 220, a secret key addition unit 230, a compression function calculation unit 240, a message authentication code output unit 250, and a calculation device storage unit 290.

The computing device storage unit 290 (an example of a secret key data storage unit) stores various data used by the message authentication code computing device 200.
For example, the arithmetic device storage unit 290 stores first to i−1th secret key data.

Arbitrary length value input section 210 (an example of a communication data input section) inputs communication data communicated between specific information processing apparatuses (for example, the above-described user terminal apparatus).

Arbitrary length value dividing unit 220 (an example of a communication data dividing unit) divides data including communication data input to arbitrary length value input unit 210 into first to i-th divided data.

The secret key addition unit 230 (an example of the secret key addition data generation unit) is the a-th (a = 1, 2,..., I−1) division data obtained by the arbitrary length value division unit 220 and the arithmetic unit. The m-bit data including the a-th secret key data stored in the storage unit 290 is generated as the a-th secret key additional data.

The compression function calculation unit 240 calculates a message authentication code of communication data using a compression function that calculates new data of n-bit length based on n-bit length data and m-bit length data.
The compression function calculation unit 240 includes a first compression function calculation unit 241, a second compression function calculation unit 242, and a third compression function calculation unit 243.

The first compression function calculation unit 241 (an example of a first compression code calculation unit) includes predetermined first additional data having an n-bit length and a first secret key having an m-bit length generated by the secret key addition unit 230 Based on the additional data, a first new data having an n-bit length is calculated as a first compressed code using a compression function.

The second compression function calculation unit 242 (an example of a second compression code calculation unit) generates the first compression code calculated by the first compression function calculation unit 241 and the second to second generated by the secret key addition unit 230. Using the i-1 secret key addition data and the compression function, the b-1 compression code and the b secret key addition data are used as the b-th (b = 2,..., i-1) compression code. The b-th new data based on and is calculated.

The third compression function calculation unit 243 (an example of a compression code additional data generation unit and a message authentication code calculation unit) is calculated by the i-th divided data obtained by the arbitrary length value division unit 220 and the second compression function calculation unit. Further, m-bit data including the i-1th compressed code is generated as compressed code additional data.
The third compression function calculation unit 243 uses the compression function based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length to transfer new data having an n-bit length to the communication data. Is calculated as the message authentication code.

The message authentication code output unit 250 outputs the message authentication code of the communication data calculated by the compression function calculation unit 240.

Hereinafter, the communication data is referred to as “arbitrary length value M”, the divided data is referred to as “predetermined length value p”, the secret key data is referred to as “secret key k”, and the secret key additional data is referred to as “value x”.
The compression function is referred to as “compression function h”, the first additional data is referred to as “fixed value IV1”, and the second additional data is referred to as “fixed value IV2”.
Further, the j-th (j = 1, 2,..., I−1) compression code is referred to as “value C [j]”, and the message authentication code is referred to as “value C [i]”.

FIG. 3 is a flowchart showing a message authentication code calculation method in the first embodiment.
A message authentication code calculation method according to Embodiment 1 will be described with reference to FIG.

(S110: Arbitrary length input step)
The arbitrary length value input unit 210 inputs a value M having an arbitrary bit length, and stores the input value M in the arithmetic device storage unit 290.
Hereinafter, the bit length (data size) of the value M is assumed to be “i times mn bits”. “M” is a predetermined natural number, and “n” is a predetermined natural number smaller than m. “I” is a natural number that changes according to the bit length of the arbitrary length value M.
It progresses to S120 after S110.

(S120: Arbitrary length value dividing step)
The arbitrary length value dividing unit 220 acquires the value M input in S110 from the arithmetic device storage unit 290, and divides the acquired value M into mn bit lengths to obtain i values p [1],. . . , Value p [i]. That is, the values p [1],. . . , P [i] are combined to give the value M.
The arbitrary length value dividing unit 220 generates the generated values p [1],. . . , Value p [i] is stored in the arithmetic device storage unit 290.
It progresses to S130 after S120.

(S130: private key addition step)
The secret key adding unit 230 generates the values p [1],. . . , Value p [i] excluding value p [i]. . . , Value p [i−1] is acquired from the arithmetic unit storage unit 290.
The secret key adding unit 230 includes secret keys k [1],. . . , The secret key k [i−1] is acquired from the arithmetic device storage unit 290. It is assumed that the arithmetic device storage unit 290 stores in advance a sufficient number of secret keys k whose order is determined. Each secret key k is a specific value having an n-bit length. All the secret keys k may have the same value, all the secret keys k may have different values, or the plurality of secret keys k may have the same value and the remaining secret keys may have different values.
The secret key adding unit 230 receives the values p [1],. . . , Values p [i−1], n-bit secret keys k [1],. . . , The secret key k [i−1] is added and the value x [1],. . . , A value x [i−1] is generated. That is, the secret key adding unit 230 generates the value x [1] by adding the secret key k [1] to the value p [1], and adds the secret key k [2] to the value p [2]. Generate the value x [2]. Similarly, the secret key adding unit 230 adds the secret key k [j] to the value p [jw] to generate the value x [jw] (jw = 3,..., I−1).
The secret key adding unit 230 generates the generated values x [1],. . . , Value x [i−1] is stored in the arithmetic device storage unit 290.

The secret key adding unit 230 may add the secret key k [j] (j = 1,..., I−1) to any position of the value p [j].
That is, the secret key adding unit 230 may add the secret key k [j] before or after the value p [j], or may insert the secret key k [j] into the value p [j]. Good.

After S130, the process proceeds to S140.

(S140: First compression function calculation step)
The first compression function calculation unit 241 acquires the value x [1] generated in S130 from the arithmetic device storage unit 290, and uses the n-bit fixed value IV1 and the m-bit length value x [1] as a compression function. The value c [1] having an n-bit length is calculated by inputting to h.
The first compression function calculation unit 241 stores the calculated value c [1] in the arithmetic device storage unit 290.
The compression function h is to calculate a new value c having an n-bit length from an n-bit length value and an m-bit length value. The fixed value IV1 is assumed to be predetermined.
It progresses to S141 after S140.

(S141: Second compression function calculation step)
The second compression function calculation unit 242 acquires the value c [1] calculated in S140 and the value x [2] generated in S130 from the arithmetic device storage unit 290, and the value c [1] having an n-bit length. And m-bit length value x [2] are input to compression function h to calculate n-bit length value c [2].
The second compression function calculation unit 242 repeats the processing in order from jw = 3 to i−1, and uses the value c [jw−1] calculated immediately before and the value x [jw] generated in S131 as the compression function. The value c [jw] is calculated by inputting to h. Thus, in addition to the value c [2], the values c [3],. . . , Value c [i−1] is calculated.
The second compression function calculator 242 calculates the calculated values c [2],. . . , Value c [i−1] is stored in the arithmetic device storage unit 290.
It progresses to S142 after S141.

(S142: third compression function calculation step)
The third compression function calculation unit 243 obtains the value p [i] generated in S120 and the value c [i−1] calculated in S141 from the arithmetic device storage unit 290, and has a value of mn bit length. An n-bit length value c [i−1] is added to p [i] to generate an m-bit length value x [i]. At this time, the value c [i-1] may be added to any position of the value p [i].
The third compression function calculation unit 243 inputs the n-bit fixed value IV2 and the m-bit length value x [i] to the compression function h, calculates the n-bit length value c [i], and calculates the calculated value. c [i] is stored in the arithmetic device storage unit 290.
It progresses to S150 after S142.

(S150: Message authentication code output step)
The message authentication code output unit 250 acquires the value c [i] calculated in S142 from the arithmetic device storage unit 290, and outputs the acquired value c [i] as a message authentication code of the value M.
By S150, the message authentication code calculation method ends.

In the above message authentication code calculation method (see FIG. 3), when “i = 2”, that is, when the value M is divided into two values p [1] and p [2], S141 is not executed. .
In the case of “i = 1”, that is, in the case of “value M = value p [1]”, S130, S140, and S141 are not executed.

In the embodiment, “Z = h (X, Y)” means that when an n-bit length X and an m-bit length Y are input to the compression function h, an n-bit length Z is calculated.
“X || Y” means a value (data) obtained by adding “Y” to an arbitrary place of “X”.

FIG. 4 is a structural diagram of a message authentication code calculation algorithm in the first embodiment.
The above message authentication code calculation method (see FIG. 3) can be represented as shown in FIG.

The value M corresponding to the communication data is i values p [1],. . . , Value p [i] and values p [1],. . . , Values p [i−1], n-bit secret keys k [1],. . . The secret key [k−1] is added (S110 to S130).
The n-bit fixed value IV1 and the m-bit length value p [1] || k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
In order from j = 2 to i−1, an n-bit length value c [j−1] and an m-bit length value p [j] || [k [j] are input to the compression function h to obtain an n-bit length value A value c [j] is obtained (S141).
The n-bit length fixed value IV2 and the m-bit length value p [i] || c [i-1] are input to the compression function h to obtain the n-bit length value c [i]. The value c [i] is output as a message authentication code of the value M (S142, S150).

S110 to S150 may be executed in parallel processing in which processing is executed in parallel, instead of sequential processing in which processing is executed in order.
For example, S110 to S150 may be executed by stream processing. Stream processing is a method of processing input data in the order of input in bit units rather than data units, and is a type of parallel processing.

Multiple values c [1],. . . , C [i], even if the same compression function h is used i times, a plurality of compression functions h [1],. . . , H [i] may be used.

As the compression function h, SHA-256 (Secure Hash Algorithm-256) can be used. The SHA-256 outputs a 256-bit length value when a 256-bit length value and a 512-bit length value are input.
That is, when SHA-256 is used as the compression function h, the fixed value IV1, the fixed value IV2, the value c [j], and the secret key k [j] are 256 (= n) bit length values. The value x [j] is a 512 (= m) bit length value, and the value p [j] is a 256 (= mn) bit length value.

The compression function h may be calculated by a compression function calculation device provided separately from the message authentication code calculation device 200.

FIG. 5 is a diagram illustrating an example of hardware resources of the message authentication code calculation device 200 according to the first embodiment.
In FIG. 5, the message authentication code calculation device 200 includes a CPU 911 (Central Processing Unit). The CPU 911 is connected to the ROM 913, the RAM 914, the communication board 915, the display device 901, the keyboard 902, the mouse 903, and the magnetic disk device 920 via the bus 912, and controls these hardware devices.

The communication board 915 is wired or wirelessly connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line.

The magnetic disk device 920 stores an OS 921 (operating system), a window system 922, a program group 923, and a file group 924.

The program group 923 includes a program for executing a function described as “unit” in the embodiment. The program is read and executed by the CPU 911. In other words, the program causes the computer to function as “to part” and causes the computer to execute the procedures and methods of “to part”.

The file group 924 includes various data (input, output, determination result, calculation result, processing result, etc.) used in “˜part” described in the embodiment.

In the embodiment, arrows included in the configuration diagrams and flowcharts mainly indicate input and output of data and signals.

In the embodiment, what is described as “to part” may be “to circuit”, “to apparatus”, and “to device”, and “to step”, “to procedure”, and “to processing”. May be. That is, what is described as “˜unit” may be implemented by any of firmware, software, hardware, or a combination thereof.

In the first embodiment, for example, the following message authentication code computing device 200 has been described.

The message authentication code calculation device 200 includes a predetermined length value input unit (for example, secret key addition unit 230), a secret key addition unit 230, a compression function calculation unit 240, and a message authentication code output unit 250.
The predetermined length value input unit includes i values p [1],. . . , Input the value p [i].
The secret key adding unit 230 receives the values p [1],. . . , Value p [i], i−1 values p [1],. . . , Value p [i−1] for each secret key k [1],. . . , The secret key k [i−1] and the values x [1],. . . , A value x [i−1] is generated.
The compression function calculation unit 240 sequentially adds a value c [j−1] (value c [0] is a fixed value IV1) from j = 1 to i−1 and a value x [j] generated by the secret key addition unit 230. To obtain a value c [j] which is a result of calculating the compression function h.
The compression function calculation unit 240 inputs a fixed value IV2 and a value x [i] obtained by adding the value c [i-1] to the value p [i] and inputs a value c [i] that is a result of calculating the compression function h. Get.
The message authentication code output unit 250 outputs the value c [i] obtained by the compression function calculation unit 240.

The predetermined length value input unit has i values and mn bit length values p [1],... For a predetermined natural number m and a natural number n smaller than the natural number m. . . , Input the value p [i].
The secret key adding unit 230 receives the mn bit length values p [1],. . . , Value p [i], i−1 values p [1],. . . , Values p [i−1], n-bit secret keys k [1],. . . , The secret key k [i−1], and the value x [1],. . . , A value x [i−1] is generated.
The compression function calculation unit 240 sequentially outputs a value c [j−1] having an n-bit length from j = 1 to i−1 (a value c [0] is a fixed value IV1 having an n-bit length) and a secret key adding unit 230. To obtain an n-bit length value c [j-1], which is a result of calculating the compression function h using the m-bit length value x [j] generated by Get.
The compression function calculation unit 240 adds an m-bit length value x [i] by adding an n-bit length value c [i-1] to an n-bit length fixed value IV2 and an mn bit-length value p [i]. Are input to obtain a value c [i] having an n-bit length as a result of calculating the compression function h.

In the message authentication code calculation method according to the first embodiment (see FIGS. 3 and 4), the divided values p [1],. . . , P [i-1] and secret keys k [1],. . . , K [i−1] added values x [1],. . . , X [i−1] are input to the compression function h, making it difficult to specify the value M.
For this reason, a message authentication code computation algorithm with high computational efficiency should be constructed using a random oracle and a hash function algorithm that cannot be strongly discriminated even if constructed using an ideal compression function with broken unidirectionality. Can do.

The following describes a hash function algorithm that cannot be strongly discriminated from a random oracle even if it is configured using an ideal compression function with broken unidirectionality.

Random oracle is a function that records in advance a list indicating a pair of input value and output value, and outputs an output value corresponding to the input value based on the list.

A cryptographic algorithm that is secure when using a random oracle is considered secure when a secure hash function is used instead of a random oracle.
For example, cryptographic algorithms such as OAEP (Optical Asymmetric Encryption Padding) and PSS (Probabilistic Signature Scheme) have been proven to be safe when using random oracles.

However, in order to be secure even when a random oracle is used and a secure cryptographic algorithm uses a secure hash function instead of a random oracle, the hash function needs to be indistinguishable from a random oracle. is there.
That is, a cryptographic algorithm that is secure when using a random oracle is safe when a hash function that cannot be strongly distinguished from a random oracle is used.
For example, EMD (Exploited Merkle-Damgard) and MDP (Mercle-Damgard with Permutation) are hash functions that cannot be strongly distinguished from random oracles.

The hash function is a function that inputs an arbitrary length value and outputs a fixed length value.
The hash function is a compression function that inputs a value having a predetermined input length and outputs a value having a predetermined output length, and an input length that calculates a fixed length output value from an arbitrary length input value using the compression function. And an enlargement algorithm.

In general, a hash function that cannot be distinguished strongly from a random oracle is configured using an ideal compression function (FILRO (Fixed Input Length Random Oracle)).
However, a hash function that cannot be strongly distinguished from a random oracle even if it is a hash function configured using an ideal compression function (WFILRO) whose unidirectionality is broken instead of an ideal compression function (FILRO). Yes (see Non-Patent Documents 1 and 2).
In addition, there is a hash function that is not strongly distinguishable from a random oracle unless configured using an ideal compression function (FILRO).

A hash function that cannot be strongly discriminated from a random oracle even if configured using an ideal compression function (WFILRO) with broken unidirectionality is random unless configured using an ideal compression function (FILRO). It is safer than a hash function that is not strongly distinguishable from Oracle.

Here, a secure hash function, an ideal compression function (FILRO), and an ideal compression function (WFILRO) whose unidirectionality is broken will be described.

First, a secure hash function will be described.
The properties to be satisfied by the secure hash function include three properties of “collision resistance”, “second development difficulty”, and “development resistance”.
Hereinafter, the hash function is described as “H”.

The collision difficulty is a property that it is difficult to find two values M and M ′ that satisfy “H (M) = H (M ′)”.
The second development calculation difficulty is a property that it is difficult to find a value M ′ that satisfies “H (M) = H (M ′)” for a random value M.
The development calculation difficulty is a property that it is difficult to find a value M satisfying “z = H (M)” with respect to a random value z.

Next, an ideal compression function (FILRO) will be described.
An ideal compression function (FILRO) is a compression function having a “list” and an “oracle”.

The list is data indicating combinations of input values and output values. For example, the list shows a pair of an input value (x, y) and an output value z for each input value (x, y).
Oracle is a function for outputting an output value corresponding to an input value based on a list. For example, Oracle specifies an output value z that is paired with the input value (x, y) from the list, and outputs the specified output value z. That is, Oracle outputs a value z that satisfies “f1 (x, y) = z” for the input value (x, y).

Next, an ideal compression function (WFILRO) whose unidirectionality is broken will be described.
The ideal compression function (WFILRO) whose unidirectionality is broken is a compression function having “an oracle that breaks unidirectionality” in addition to the above “list” and “oracle”.

An oracle that breaks unidirectionality is a function that outputs an input value corresponding to an output value based on a list.
An example of an Oracle that breaks unidirectionality is shown below.

Oracle 1 that breaks unidirectionality selects one value (x, y) at random from all values (x, y) that satisfy “f1 (x, y) = z” for value z, and selects The obtained value (x, y) is output.
Oracle 2 that breaks the unidirectionality randomly selects one value y from all the values y that satisfy “f1 (x, y) = z” for the values x and z, and selects the selected value y. Output. When there is no value y satisfying “f1 (x, y) = z” for the value x and the value z, the oracle 2 outputs predetermined identification information.
Oracle 3 that breaks the unidirectionality randomly selects one value x from all the values x that satisfy “f1 (x, y) = z” for the values y and z, and selects the selected value x. Output. If there is no value x satisfying “f1 (x, y) = z” for the value y and the value z, the Oracle 3 outputs predetermined identification information.

The ideal compression function (WFILRO) whose unidirectionality is broken is a compression function that is less secure than the ideal compression function (FILRO) because it has an “oracle that breaks unidirectionality”.
An attacker can attack the ideal compression function (FILRO) using “list” and “Oracle”, and the “list” against the ideal compression function (WFILRO) whose unidirectionality is broken. It is possible to attack using "Oracle" and "Oracle that breaks unidirectionality". In other words, the ideal compression function (WFILRO) whose unidirectionality has been broken has more functions to be given to the attacker than the ideal compression function (FILRO), and thus is easily attacked by the attacker and is less secure.

Finally, an MD (Merkle-Damgard) structure will be described as a typical input length expansion algorithm for a hash function.

The MD structure is the following algorithm.
(Step 1) Strengthen MD padding is applied to the input value M to create an m × i-bit value M ′.
(Step 2) The value M ′ is changed to an m-bit value p [1],. . . , P [i].
(Step 3) Values p [1],. . . , P [i], c [j] = h (c [j−1], p [j]) is calculated. Here, c [0] is an n-bit fixed value. The compression function h is a function that inputs two values, an n-bit value c [j−1] and an m-bit value p [j], and outputs an n-bit value c [j].
(Step 4) Output c [i].

Embodiment 2. FIG.
Processing data having a data length i times mn bits is generated by adding predetermined data having a specific data length to the communication data, and a message authentication code for the communication data is generated based on the generated processing data. A form is demonstrated.
With this configuration, the message authentication code for communication data can be generated even if the data length of communication data is not i times mn bits.
Hereinafter, items different from the first embodiment will be mainly described. Other matters are the same as those in the first embodiment.

FIG. 6 is a functional configuration diagram of the message authentication code computing device 200 according to the second embodiment.
A functional configuration of the message authentication code computing device 200 according to Embodiment 2 will be described with reference to FIG.

The message authentication code computing device 200 includes a padding unit 260 in addition to the configuration described in the first embodiment (see FIG. 2).

The padding unit 260 (an example of a processing data generation unit) adds processing data having a specific length to the communication data input to the arbitrary length value input unit 210 and has processing data having a data length i times mn bits. Is generated.

Arbitrary length value dividing unit 220 (an example of a communication data dividing unit) divides processing data generated by padding unit 260 into first to i-th divided data having an mn bit length.

Hereinafter, the communication data is referred to as “value M”, the data added to the communication data is referred to as “padding value”, the processing data is referred to as “value M ′”, and the divided data is referred to as “value p”.

FIG. 7 is a flowchart showing a message authentication code calculation method according to the second embodiment.
A message authentication code calculation method according to the second embodiment will be described with reference to FIG.

In the message authentication code calculation method, the padding step (S111) is executed in addition to the processing described in the first embodiment (see FIG. 3).
The arbitrary length value dividing step (S121) is a process in which “value M” in S120 described in the first embodiment is replaced with “value M ′”.
Hereinafter, the padding step (S111) will be mainly described.

In S110, the arbitrary length value input unit 210 inputs the value M having an arbitrary bit length, and stores the input value M in the arithmetic device storage unit 290. It progresses to S111 after S110.

(S111: Padding step)
The padding unit 260 acquires the value M input in S110 from the arithmetic device storage unit 290, inputs the acquired value M to the padding function pad, and obtains a value M ′ having a bit length i times mn bits. calculate.
The padding unit 260 stores the calculated value M ′ in the arithmetic device storage unit 290.

The padding function pad is a function that generates a value having a bit length i times mn bits by adding a specific padding value to the input value when the bit length of the input value is not i times mn bits. is there. “I” is an arbitrary or predetermined natural number.

For example, the padding function pad adds “1 || 0... 0 || <M>” as the padding value to the input value M, and generates a value M ′ having a bit length i times mn bits. Generate.
That is, the padding value has “1” at the beginning and <M> at the end, and one or more “0” s between “1” and <M>.
Here, <M> is data having a bit length of 64 bits, and the bit length | M | of the value M is indicated by 64 bits. <M> having a bit length of 64 bits can indicate a data size of a maximum of 2 64 bits as the bit length | M | of the value M.
By using such a padding value, the collision difficulty of the output value M ′ can be increased. However, the padding value may be a value other than the above, such as “0” for all bits or “1” for all bits.

After S111, the process proceeds to S121.

In S121, the arbitrary length value dividing unit 220 acquires the value M ′ calculated in S111 from the arithmetic device storage unit 290, and divides the acquired value M ′ into mn bit lengths to obtain i values p [ 1],. . . , Value p [i], and the generated values p [1],. . . , Value p [i] is stored in the arithmetic device storage unit 290.
It progresses to S130 after S121.

The processes after S130 are the same as those in the first embodiment (see FIG. 3).

FIG. 8 is a structural diagram of a message authentication code calculation algorithm in the second embodiment.
The above message authentication code calculation method (see FIG. 7) can be represented as shown in FIG.

A value M corresponding to the communication data is input to the padding function pad to obtain a value M ′ having a bit length i times mn bits (S110, S111).
The value M ′ is an i value p [1],. . . , Value p [i] and values p [1],. . . , Values p [i−1], n-bit secret keys k [1],. . . , The secret key [k-1] is added (S121, S130).
The n-bit fixed value IV1 and the m-bit length value p [1] || k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
In order from j = 2 to i−1, an n-bit length value c [j−1] and an m-bit length value p [j] || [k [j] are input to the compression function h to obtain an n-bit length value A value c [j] is obtained (S141).
The n-bit length fixed value IV2 and the m-bit length value p [i] || c [i-1] are input to the compression function h to obtain the n-bit length value c [i]. The value c [i] is output as a message authentication code of the value M (S142, S150).

The padding function pad may be calculated by a padding function calculation device provided separately from the message authentication code calculation device 200.

In Embodiment 2, for example, the following message authentication code computing device 200 has been described.

The message authentication code computing device 200 includes an arbitrary length value input unit 210, a padding unit 260, and an arbitrary length value dividing unit 220.
The arbitrary length value input unit 210 inputs a value M having an arbitrary bit length.
The padding unit 260 generates a value M ′ having a bit length i times mn bits by adding a predetermined value to the value M input by the arbitrary length value input unit 210.
The arbitrary length value dividing unit 220 divides the value M ′ generated by the padding unit 260 to mn bit length values p [1],. . . , Value p [i].

Embodiment 3 FIG.
A mode in which a necessary number of secret keys are generated based on one secret key, and a message authentication code for communication data is generated using the generated necessary number of secret keys will be described.
With this configuration, it is not necessary to store a large number of secret keys in the message authentication code calculation device 200 in advance so that the number of secret keys is not insufficient.
Hereinafter, matters different from the first embodiment and the second embodiment will be mainly described. Other matters are the same as those in the first or second embodiment.

FIG. 9 is a functional configuration diagram of the message authentication code computing device 200 according to the third embodiment.
A functional configuration of the message authentication code computing device 200 according to Embodiment 3 will be described with reference to FIG.

The message authentication code calculation device 200 includes a secret key input unit 270, an extended key calculation unit 271, and an extended key division unit 272 in addition to the configuration described in the first embodiment (see FIG. 2).

A secret key input unit 270 (an example of a secret key data input unit) inputs secret key data having an arbitrary length.
The extended key calculation unit 271 (an example of the extended key data generation unit) expands new secret key data having a data length of i−1 times n bits based on the secret key data input to the secret key input unit 270. The key data is generated by a predetermined algorithm.
The extended key division unit 272 (an example of the extended key data division unit) divides the extended key data generated by the extended key calculation unit 271 into first to i-1th secret key data having an n-bit length.
The arithmetic device storage unit 290 (an example of the secret key data storage unit) stores the first to i−1th secret key data having an n-bit length obtained by the extended key dividing unit 272.

Hereinafter, the secret key data of arbitrary length is “secret key ik”, the new secret key data having a data length that is n−1 times n bits is “extended key ek”, and the secret key data of n bits is “secret key” k ".

FIG. 10 is a flowchart illustrating a message authentication code calculation method according to the third embodiment.
A message authentication code calculation method according to Embodiment 3 will be described with reference to FIG.

In the message authentication code calculation method, in addition to the processing described in the first embodiment (see FIG. 3), S210 to S230 are executed.
Hereinafter, S210 to S230 will be mainly described.

(S210: Secret key input step)
The secret key input unit 270 inputs a secret key ik having an arbitrary bit length, and stores the input secret key ik in the arithmetic device storage unit 290.
It progresses to S220 after S210.

(S220: Extended key calculation step)
The extended key calculation unit 271 acquires the secret key ik input in S210 from the arithmetic device storage unit 290, inputs the acquired secret key ik to the extended key calculation function ek_gen, and has a bit length i−1 times n bits. An expanded key ek having is calculated.
The expanded key calculation unit 271 stores the calculated expanded key ek in the arithmetic device storage unit 290.
The extended key calculation function ek_gen is a function that generates an extended key ek having a bit length i−1 times n bits by a predetermined algorithm based on the input secret key ik. For example, the extended key calculation function ek_gen generates an extended key ek using an algorithm used for a technique called a key schedule. The technique for generating an expanded key is a technique that is also used in techniques such as block ciphers.
It progresses to S230 after S220.

(S230: Extended key division step)
The extended key splitting unit 272 acquires the extended key ek generated in S220 from the arithmetic device storage unit 290.
The extended key division unit 272 divides the extended key ek having a bit length i−1 times n bits into i−1 pieces by n bits.
The extended key dividing unit 272 converts the i−1 values of n bits long obtained by dividing the extended key ek into the secret keys k [1],. . . , And stored in the arithmetic device storage unit 290 as a secret key k [i−1]. That is, the secret keys k [1],. . . , The extended key ek is obtained by combining the secret key k [i−1].
The n−1-bit i−1 values generated in S230 are converted into secret keys k [1],. . . , Secret key k [i-1] is used in the secret key adding step (S130).

S110, S120, and S130 to S150 are the same as those in the first embodiment (see FIG. 3).

FIG. 11 is a structural diagram of a message authentication code calculation algorithm in the third embodiment.
The above message authentication code calculation method (see FIG. 10) can be represented schematically as shown in FIG.

An arbitrary-length secret key ik is input to the extended key calculation function ek_gen to obtain an extended key ek having a bit length i−1 times n bits, and the extended key ek is i−1 secret keys having an n-bit length. k [1],. . . , And divided into secret keys k [i−1] (S210 to S230).
The value M corresponding to the communication data is i values p [1],. . . , Value p [i] and values p [1],. . . , Values p [i−1], n-bit secret keys k [1],. . . The secret key [k−1] is added (S110 to S130).
The n-bit fixed value IV1 and the m-bit length value p [1] || k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
In order from j = 2 to i−1, an n-bit length value c [j−1] and an m-bit length value p [j] || [k [j] are input to the compression function h to obtain an n-bit length value A value c [j] is obtained (S141).
The n-bit length fixed value IV2 and the m-bit length value p [i] || c [i-1] are input to the compression function h to obtain the n-bit length value c [i]. The value c [i] is output as a message authentication code of the value M (S142, S150).

The extended key calculation function ek_gen may be calculated by an extended key calculation function device provided separately from the message authentication code calculation device 200.

Further, as in the second embodiment, a value M ′ which is i times mn bits may be generated from a value M having an arbitrary length.
FIG. 12 shows a functional configuration of the message authentication code calculation device 200 in this case. FIG. 13 shows a flowchart of the message authentication code calculation method, and FIG. 14 shows the configuration of the message authentication code calculation algorithm.

In Embodiment 3, for example, the following message authentication code computing device 200 has been described.

The message authentication code computing device 200 includes a secret key input unit 270, an extended key calculation unit 271 and an extended key division unit 272.
The secret key input unit 270 inputs a secret key ik of arbitrary length bits.
The expanded key calculation unit 271 generates an expanded key ek from the secret key ik input by the secret key input unit 270.
The extended key dividing unit 272 divides the extended key ek generated by the extended key calculating unit 271 to obtain an n-bit secret key k [1],. . . , A secret key k [i-1] is generated.

100 communication system, 101 network, 102 user terminal device A, 103 user terminal device B, 104 communication data, 105 message authentication code, 106 secret key, 111 communication unit, 112 communication data generation unit, 113 communication data verification unit, 119 message Authentication code generation unit, 200 Message authentication code arithmetic unit, 210 Arbitrary length value input unit, 220 Arbitrary length value division unit, 230 Secret key addition unit, 240 Compression function calculation unit, 241 First compression function calculation unit, 242 Second compression Function calculation unit, 243 Third compression function calculation unit, 250 Message authentication code output unit, 260 Padding unit, 270 Private key input unit, 271 Extended key calculation unit, 272 Extended key division unit, 290 Arithmetic device storage unit, 901 Display device 902 Keyboard , 903 mouse, 911 CPU, 912 Bus, 913 ROM, 914 RAM, 915 communication board, 920 a magnetic disk device, 921 OS, 922 Window system, 923 Program group, 924 File group.

Claims (8)

1. A communication data input unit for inputting communication data communicated between specific information processing apparatuses;
   A communication data dividing unit that divides data including communication data input to the communication data input unit into first to i-th divided data;
   A secret key data storage unit for storing first to i-1th secret key data;
   The a-th (a = 1, 2,..., I−1) division data obtained by the communication data division unit and the a-th secret key data stored in the secret key data storage unit are included. a secret key addition data generation unit that generates m-bit length data as the a-th secret key addition data;
   A predetermined first additional data having an n-bit length and the secret key-added data generating unit using a compression function for calculating new data having an n-bit length based on the n-bit data and the m-bit data. A first compressed code calculation unit that calculates first new data having an n-bit length as a first compressed code based on the first secret key-added data having an m-bit length generated by
   Using the first compression code calculated by the first compression code calculation unit, the second to (i-1) -th secret key addition data generated by the secret key addition data generation unit, and the compression function, Second compression for calculating b-th new data based on b-th compressed code and b-th secret key additional data as b-th (b = 2,..., I-1) compressed code A code calculator,
   Generate m-bit length data including compressed code additional data including the i-th divided data obtained by the communication data dividing unit and the i-1th compressed code calculated by the second compressed code calculating unit. A compressed code additional data generation unit,
   Based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length generated by the compressed code additional data generating unit, new data having an n-bit length is converted into the new data using the compression function. A message authentication code calculation device comprising: a message authentication code calculation unit that calculates a message authentication code of communication data.
2. The communication data dividing unit converts data having a data length i times mn bits including the communication data input to the communication data input unit from the first to i-th divided data of mn bit length. Split and
   The secret key addition data generation unit generates an a-th secret key addition data having an m-bit length by adding an a-th secret key data having an n-bit length to the a-th division data having an mn bit length. The message authentication code calculation device according to claim 1.
3. The message authentication code computing device further includes:
   A processing data generation unit for generating processing data having a data length i times mn bits by adding predetermined data of a specific length to the communication data input to the communication data input unit;
   3. The message authentication code calculation according to claim 2, wherein the communication data division unit divides the processing data generated by the processing data generation unit into first to i-th division data having a length of mn bits. apparatus.
4. The message authentication code computing device further includes:
   A secret key data input part for inputting secret key data of arbitrary length;
   An expanded key data generation unit that generates new secret key data having a data length of i-1 times n bits as expanded key data based on the secret key data input to the secret key data input unit, according to a predetermined algorithm; ,
   An extended key data dividing unit for dividing the extended key data generated by the extended key data generating unit into first to i-1 secret key data having an n-bit length,
   2. The message authentication code calculation according to claim 1, wherein the secret key data storage unit stores first to i-1th secret key data having an n-bit length obtained by the extended key data dividing unit. apparatus.
5. The communication data dividing unit converts data having a data length i times mn bits including the communication data input to the communication data input unit from the first to i-th divided data of mn bit length. Split and
   The secret key addition data generation unit generates an a-th secret key addition data having an m-bit length by adding an a-th secret key data having an n-bit length to the a-th division data having an mn bit length. The message authentication code computing device according to claim 4.
6. The message authentication code computing device further includes:
   A processing data generation unit for generating processing data having a data length i times mn bits by adding predetermined data of a specific length to the communication data input to the communication data input unit;
   6. The message authentication code calculation according to claim 5, wherein the communication data division unit divides the processing data generated by the processing data generation unit into first to i-th division data having a length of mn bits. apparatus.
7. The communication data input unit inputs communication data communicated between specific information processing devices,
   The communication data dividing unit divides data including communication data input to the communication data input unit into first to i-th divided data,
   The secret key-added data generating unit is configured to store the a-th (a = 1, 2,..., I−1) divided data obtained by the communication data dividing unit and the a-th stored in the secret key data storage unit. M-bit length data including the secret key data is generated as the a-th secret key additional data,
   A first compression code calculation unit uses a compression function for calculating new data having an n-bit length based on data having an n-bit length and data having an m-bit length, and a predetermined first addition having an n-bit length Calculating first new data having an n-bit length as a first compressed code based on the data and the first secret key-adding data having an m-bit length generated by the secret-key-added data generating unit;
   A second compressed code calculating unit configured to calculate the first compressed code calculated by the first compressed code calculating unit and the second to i−1th secret key added data generated by the secret key added data generating unit; And the compression function, the b-th new code based on the b-th compressed code and the b-th secret key additional data as the b-th (b = 2,..., I-1) compressed code. The correct data,
   The compressed code additional data generating unit has an m-bit length including the i-th divided data obtained by the communication data dividing unit and the i-1th compressed code calculated by the second compressed code calculating unit. Generate data as compressed code additional data,
   The message authentication code calculation unit uses the compression function to generate n bits based on predetermined second additional data having an n-bit length and m-bit length compressed code additional data generated by the compressed code additional data generation unit A message authentication code calculation method, characterized in that long new data is calculated as a message authentication code of the communication data.
8. Communication data input processing for inputting communication data communicated between specific information processing devices;
   A communication data dividing process for dividing the data including the communication data input in the communication data input process into first to i-th divided data;
   M including the a-th (a = 1, 2,..., I−1) divided data obtained by the communication data dividing process and the a-th secret key data stored in the secret key data storage unit. Secret key addition data generation processing for generating bit length data as the a-th secret key addition data;
   Using the compression function for calculating new n-bit length data based on the n-bit length data and the m-bit length data, the predetermined first additional data having the n-bit length and the secret key addition data generation process A first compressed code calculation process for calculating first new data having an n-bit length as a first compressed code based on the first secret key-added data having an m-bit length generated by
   Using the first compression code calculated by the first compression code calculation process, the second to (i-1) -th secret key addition data generated by the secret key addition data generation process, and the compression function, Second compression for calculating b-th new data based on b-th compressed code and b-th secret key additional data as b-th (b = 2,..., I-1) compressed code Code calculation process,
   Generate m-bit length data including compressed code additional data including the i-th divided data obtained by the communication data dividing process and the i-1th compressed code calculated by the second compressed code calculating process. Compressed code additional data generation processing,
   Based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length generated by the compressed code additional data generation process, new data having an n-bit length is converted to the new data using the compression function. A message authentication code calculation program that causes a computer to execute message authentication code calculation processing that is calculated as a message authentication code of communication data.

Images