WO2011155039A1 - Dispositif, procédé et programme de calcul de code d'authentification de message - Google Patents

Dispositif, procédé et programme de calcul de code d'authentification de message Download PDF

Info

Publication number
WO2011155039A1
WO2011155039A1 PCT/JP2010/059818 JP2010059818W WO2011155039A1 WO 2011155039 A1 WO2011155039 A1 WO 2011155039A1 JP 2010059818 W JP2010059818 W JP 2010059818W WO 2011155039 A1 WO2011155039 A1 WO 2011155039A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
secret key
bit length
unit
value
Prior art date
Application number
PCT/JP2010/059818
Other languages
English (en)
Japanese (ja)
Inventor
亨 反町
Original Assignee
三菱電機株式会社
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 三菱電機株式会社 filed Critical 三菱電機株式会社
Priority to PCT/JP2010/059818 priority Critical patent/WO2011155039A1/fr
Publication of WO2011155039A1 publication Critical patent/WO2011155039A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3242—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Definitions

  • the present invention relates to, for example, a message authentication code calculation device, a message authentication code calculation method, and a message authentication code calculation program for efficiently calculating a message authentication code.
  • Non-Patent Document 1 describes a zipper hash function (zipper hash function). Even if the zipper hash function is configured using an ideal compression function (WFILRO (Weakened Fixed Input Length Random Oracle)) whose unidirectionality is broken, it cannot be strongly distinguished from a random oracle.
  • WFILRO Wired Fixed Input Length Random Oracle
  • Non-Patent Document 2 describes a double-pipe hash function.
  • the double pipe hash function cannot be strongly distinguished from a random oracle even if it is configured using an ideal compression function whose unidirectionality is broken.
  • Non-Patent Document 3 describes a hash function that has high computational efficiency and is a hash function that cannot be strongly discriminated from a random oracle even when configured using an ideal compression function with broken unidirectionality. .
  • Non-Patent Document 4 and Non-Patent Document 5 describe a highly secure message authentication code calculation algorithm (HMAC: Keyed Hash Functions and Message Authentication) using a hash function.
  • HMAC Hash Functions and Message Authentication
  • Non-Patent Document 1 and the double-pipe hash function described in Non-Patent Document 2 are strongly distinguished from random oracles even if they are configured using an ideal compression function whose unidirectionality is broken. Although impossible, calculation efficiency is poor.
  • Non-Patent Document 3 a hash function that cannot be strongly discriminated from a random oracle even when configured using an ideal compression function with broken unidirectionality, is more efficient than a zipper hash function or a double-pipe hash function. A good hash function has been proposed.
  • HMAC described in Non-Patent Documents 4 and 5 is a message authentication code calculation algorithm using a general hash function algorithm, and has been proposed as a message authentication code calculation algorithm having provable security.
  • HMAC in order for HMAC to have provable security, it is necessary to use a secure hash function algorithm. It is pointed out that a key recovery attack is possible when using a hash function algorithm with weak security. Further, HMAC secures provable security by executing the hash function algorithm twice, so that calculation efficiency is poor.
  • the present invention can construct a message authentication code computation algorithm with high computational efficiency using a random oracle and a hash function that cannot be strongly discriminated even if it is constructed using an ideal compression function with broken unidirectionality. The purpose is to do so.
  • a secret key addition data generation unit that generates m-bit length data as the a-th secret key addition data;
  • a code calculator Generate m-bit length data including compressed code additional data including the i-th divided data obtained by the communication data dividing unit and the i-1th compressed code calculated by the second compressed code calculating unit.
  • a compressed code additional data generation unit Based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length generated by the compressed code additional data generating unit, new data having an n-bit length is converted into the new data using the compression function.
  • a message authentication code calculation unit that calculates the message authentication code of the communication data.
  • the message authentication code computing device makes it difficult to specify an input value to the compression function by adding a secret key to the input value (divided data obtained by dividing communication data) to the compression function.
  • a message authentication code calculation algorithm with high calculation efficiency is configured using a hash function algorithm that cannot be strongly discriminated from a random oracle even if configured using an ideal compression function whose unidirectionality is broken. be able to.
  • FIG. 1 is a schematic diagram of a communication system 100 according to Embodiment 1.
  • FIG. FIG. 3 is a functional configuration diagram of a message authentication code calculation device 200 according to the first embodiment.
  • 5 is a flowchart showing a message authentication code calculation method in the first embodiment.
  • FIG. 3 is a structural diagram of a message authentication code calculation algorithm in the first embodiment.
  • FIG. 3 is a diagram illustrating an example of hardware resources of the message authentication code calculation device 200 according to the first embodiment.
  • FIG. 9 is a flowchart showing a message authentication code calculation method in the second embodiment.
  • FIG. 9 is a structural diagram of a message authentication code calculation algorithm in the second embodiment.
  • FIG. 10 is a flowchart illustrating a message authentication code calculation method according to Embodiment 3.
  • FIG. 11 is a structural diagram of a message authentication code calculation algorithm in the third embodiment.
  • FIG. 14 is another example of a functional configuration diagram of the message authentication code calculation device 200 according to the third embodiment.
  • 10 is another example of a flowchart showing a message authentication code calculation method according to Embodiment 3.
  • FIG. 14 is another example of the structure diagram of the message authentication code calculation algorithm in the third embodiment.
  • Embodiment 1 A mode in which secret key data is added to the divided data obtained by dividing the communication data, and each secret key added data to which the secret key data is added is input to a compression function to generate a message authentication code for the communication data will be described.
  • FIG. 1 is a schematic diagram of a communication system 100 according to the first embodiment. An overview of the communication system 100 according to Embodiment 1 will be described with reference to FIG.
  • the user terminal device A102 and the user terminal device B103 communicate communication data 104 (user data, original data) via the network 101.
  • the communication data 104 includes data called “message authentication code 105”. Is granted.
  • the user terminal device A102 and the user terminal device B103 include a communication unit 111, a communication data generation unit 112, a communication data verification unit 113, and a message authentication code generation unit 119.
  • the communication unit 111 transmits and receives the communication data 104 and the message authentication code 105.
  • the communication data generation unit 112 generates communication data 104 to be transmitted.
  • the communication data verification unit 113 verifies the received communication data 104.
  • the message authentication code generation unit 119 generates a message authentication code 105 for the communication data 104.
  • the user terminal device A102 and the user terminal device B103 store in advance the same key data that is kept secret from other communication terminal devices.
  • this key data is referred to as “secret key 106”.
  • the secret key 106 is also called a “shared key”.
  • the communication data generation unit 112 generates communication data 104.
  • the message authentication code generation unit 119 generates the message authentication code 105 based on the communication data 104 generated by the communication data generation unit 112 and the secret key 106 stored in advance.
  • the communication unit 111 transmits the communication data 104 generated by the communication data generation unit 112 and the message authentication code 105 generated by the message authentication code generation unit 119 to the user terminal device B103.
  • the communication unit 111 receives the communication data 104 and the message authentication code 105 transmitted by the user terminal device A102.
  • the message authentication code generation unit 119 generates the message authentication code 105 based on the communication data 104 received by the communication unit 111 and the secret key 106 stored in advance.
  • the communication data verification unit 113 compares the message authentication code 105 received by the communication unit 111 with the message authentication code 105 generated by the message authentication code generation unit 119. If the message authentication codes 105 match, it is guaranteed that the communication data 104 received by the communication unit 111 is legitimate communication data transmitted by the user terminal device A102. On the other hand, if the message authentication code 105 does not match, the communication data 104 received by the communication unit 111 is unauthorized communication data that has been altered or generated by another user terminal device.
  • the function of the message authentication code calculation device 200 described below corresponds to the message authentication code generation unit 119 provided in the user terminal device A102 and the user terminal device B103.
  • FIG. 2 is a functional configuration diagram of the message authentication code calculation device 200 according to the first embodiment.
  • a functional configuration of the message authentication code computing device 200 according to Embodiment 1 will be described with reference to FIG.
  • the message authentication code calculation device 200 includes an arbitrary length value input unit 210, an arbitrary length value division unit 220, a secret key addition unit 230, a compression function calculation unit 240, a message authentication code output unit 250, and a calculation device storage unit 290.
  • the computing device storage unit 290 (an example of a secret key data storage unit) stores various data used by the message authentication code computing device 200.
  • the arithmetic device storage unit 290 stores first to i ⁇ 1th secret key data.
  • Arbitrary length value input section 210 (an example of a communication data input section) inputs communication data communicated between specific information processing apparatuses (for example, the above-described user terminal apparatus).
  • Arbitrary length value dividing unit 220 (an example of a communication data dividing unit) divides data including communication data input to arbitrary length value input unit 210 into first to i-th divided data.
  • the m-bit data including the a-th secret key data stored in the storage unit 290 is generated as the a-th secret key additional data.
  • the compression function calculation unit 240 calculates a message authentication code of communication data using a compression function that calculates new data of n-bit length based on n-bit length data and m-bit length data.
  • the compression function calculation unit 240 includes a first compression function calculation unit 241, a second compression function calculation unit 242, and a third compression function calculation unit 243.
  • the first compression function calculation unit 241 (an example of a first compression code calculation unit) includes predetermined first additional data having an n-bit length and a first secret key having an m-bit length generated by the secret key addition unit 230 Based on the additional data, a first new data having an n-bit length is calculated as a first compressed code using a compression function.
  • the second compression function calculation unit 242 (an example of a second compression code calculation unit) generates the first compression code calculated by the first compression function calculation unit 241 and the second to second generated by the secret key addition unit 230.
  • the b-th new data based on and is calculated.
  • the third compression function calculation unit 243 (an example of a compression code additional data generation unit and a message authentication code calculation unit) is calculated by the i-th divided data obtained by the arbitrary length value division unit 220 and the second compression function calculation unit. Further, m-bit data including the i-1th compressed code is generated as compressed code additional data. The third compression function calculation unit 243 uses the compression function based on the predetermined second additional data having an n-bit length and the compressed code additional data having an m-bit length to transfer new data having an n-bit length to the communication data. Is calculated as the message authentication code.
  • the message authentication code output unit 250 outputs the message authentication code of the communication data calculated by the compression function calculation unit 240.
  • the communication data is referred to as “arbitrary length value M”
  • the divided data is referred to as “predetermined length value p”
  • the secret key data is referred to as “secret key k”
  • the secret key additional data is referred to as “value x”.
  • the compression function is referred to as “compression function h”
  • the first additional data is referred to as “fixed value IV1”
  • the second additional data is referred to as “fixed value IV2”.
  • the message authentication code is referred to as “value C [i]”.
  • FIG. 3 is a flowchart showing a message authentication code calculation method in the first embodiment. A message authentication code calculation method according to Embodiment 1 will be described with reference to FIG.
  • the arbitrary length value input unit 210 inputs a value M having an arbitrary bit length, and stores the input value M in the arithmetic device storage unit 290.
  • the bit length (data size) of the value M is assumed to be “i times mn bits”.
  • M is a predetermined natural number
  • n is a predetermined natural number smaller than m.
  • I is a natural number that changes according to the bit length of the arbitrary length value M. It progresses to S120 after S110.
  • the arbitrary length value dividing unit 220 acquires the value M input in S110 from the arithmetic device storage unit 290, and divides the acquired value M into mn bit lengths to obtain i values p [1],. . . , Value p [i]. That is, the values p [1],. . . , P [i] are combined to give the value M.
  • the arbitrary length value dividing unit 220 generates the generated values p [1],. . . , Value p [i] is stored in the arithmetic device storage unit 290. It progresses to S130 after S120.
  • the secret key adding unit 230 generates the values p [1],. . . , Value p [i] excluding value p [i]. . . , Value p [i ⁇ 1] is acquired from the arithmetic unit storage unit 290.
  • the secret key adding unit 230 includes secret keys k [1],. . . , The secret key k [i ⁇ 1] is acquired from the arithmetic device storage unit 290. It is assumed that the arithmetic device storage unit 290 stores in advance a sufficient number of secret keys k whose order is determined. Each secret key k is a specific value having an n-bit length.
  • the secret key adding unit 230 receives the values p [1],. . . , Values p [i ⁇ 1], n-bit secret keys k [1],. . . , The secret key k [i ⁇ 1] is added and the value x [1],. . . , A value x [i ⁇ 1] is generated. That is, the secret key adding unit 230 generates the value x [1] by adding the secret key k [1] to the value p [1], and adds the secret key k [2] to the value p [2].
  • the secret key adding unit 230 generates the generated values x [1],. . . , Value x [i ⁇ 1] is stored in the arithmetic device storage unit 290.
  • the first compression function calculation unit 241 acquires the value x [1] generated in S130 from the arithmetic device storage unit 290, and uses the n-bit fixed value IV1 and the m-bit length value x [1] as a compression function.
  • the value c [1] having an n-bit length is calculated by inputting to h.
  • the first compression function calculation unit 241 stores the calculated value c [1] in the arithmetic device storage unit 290.
  • the compression function h is to calculate a new value c having an n-bit length from an n-bit length value and an m-bit length value.
  • the fixed value IV1 is assumed to be predetermined. It progresses to S141 after S140.
  • the second compression function calculation unit 242 acquires the value c [1] calculated in S140 and the value x [2] generated in S130 from the arithmetic device storage unit 290, and the value c [1] having an n-bit length. And m-bit length value x [2] are input to compression function h to calculate n-bit length value c [2].
  • the value c [jw] is calculated by inputting to h.
  • the values c [3],. . . , Value c [i ⁇ 1] is calculated.
  • the second compression function calculator 242 calculates the calculated values c [2],. . . , Value c [i ⁇ 1] is stored in the arithmetic device storage unit 290. It progresses to S142 after S141.
  • the third compression function calculation unit 243 obtains the value p [i] generated in S120 and the value c [i ⁇ 1] calculated in S141 from the arithmetic device storage unit 290, and has a value of mn bit length. An n-bit length value c [i ⁇ 1] is added to p [i] to generate an m-bit length value x [i]. At this time, the value c [i-1] may be added to any position of the value p [i].
  • the third compression function calculation unit 243 inputs the n-bit fixed value IV2 and the m-bit length value x [i] to the compression function h, calculates the n-bit length value c [i], and calculates the calculated value.
  • c [i] is stored in the arithmetic device storage unit 290. It progresses to S150 after S142.
  • the message authentication code output unit 250 acquires the value c [i] calculated in S142 from the arithmetic device storage unit 290, and outputs the acquired value c [i] as a message authentication code of the value M.
  • S150 the message authentication code calculation method ends.
  • Y means a value (data) obtained by adding “Y” to an arbitrary place of “X”.
  • FIG. 4 is a structural diagram of a message authentication code calculation algorithm in the first embodiment.
  • the above message authentication code calculation method (see FIG. 3) can be represented as shown in FIG.
  • the value M corresponding to the communication data is i values p [1],. . . , Value p [i] and values p [1],. . . , Values p [i ⁇ 1], n-bit secret keys k [1],. . .
  • the secret key [k ⁇ 1] is added (S110 to S130).
  • k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
  • [k [j] are input to the compression function h to obtain an n-bit length value
  • a value c [j] is obtained (S141).
  • c [i-1] are input to the compression function h to obtain the n-bit length value c [i].
  • the value c [i] is output as a message authentication code of the value M (S142, S150).
  • S110 to S150 may be executed in parallel processing in which processing is executed in parallel, instead of sequential processing in which processing is executed in order.
  • S110 to S150 may be executed by stream processing.
  • Stream processing is a method of processing input data in the order of input in bit units rather than data units, and is a type of parallel processing.
  • SHA-256 (Secure Hash Algorithm-256) can be used as the compression function h.
  • the compression function h may be calculated by a compression function calculation device provided separately from the message authentication code calculation device 200.
  • FIG. 5 is a diagram illustrating an example of hardware resources of the message authentication code calculation device 200 according to the first embodiment.
  • the message authentication code calculation device 200 includes a CPU 911 (Central Processing Unit).
  • the CPU 911 is connected to the ROM 913, the RAM 914, the communication board 915, the display device 901, the keyboard 902, the mouse 903, and the magnetic disk device 920 via the bus 912, and controls these hardware devices.
  • the CPU 911 Central Processing Unit
  • the CPU 911 is connected to the ROM 913, the RAM 914, the communication board 915, the display device 901, the keyboard 902, the mouse 903, and the magnetic disk device 920 via the bus 912, and controls these hardware devices.
  • the communication board 915 is wired or wirelessly connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line.
  • a communication network such as a LAN (Local Area Network), the Internet, or a telephone line.
  • the magnetic disk device 920 stores an OS 921 (operating system), a window system 922, a program group 923, and a file group 924.
  • OS 921 operating system
  • window system 922 window system
  • program group 923 program group 923
  • file group 924 file group
  • the program group 923 includes a program for executing a function described as “unit” in the embodiment.
  • the program is read and executed by the CPU 911.
  • the program causes the computer to function as “to part” and causes the computer to execute the procedures and methods of “to part”.
  • the file group 924 includes various data (input, output, determination result, calculation result, processing result, etc.) used in “ ⁇ part” described in the embodiment.
  • arrows included in the configuration diagrams and flowcharts mainly indicate input and output of data and signals.
  • what is described as “to part” may be “to circuit”, “to apparatus”, and “to device”, and “to step”, “to procedure”, and “to processing”. May be. That is, what is described as “ ⁇ unit” may be implemented by any of firmware, software, hardware, or a combination thereof.
  • the message authentication code calculation device 200 includes a predetermined length value input unit (for example, secret key addition unit 230), a secret key addition unit 230, a compression function calculation unit 240, and a message authentication code output unit 250.
  • the predetermined length value input unit includes i values p [1],. . . , Input the value p [i].
  • the secret key adding unit 230 receives the values p [1],. . . , Value p [i], i ⁇ 1 values p [1],. . . , Value p [i ⁇ 1] for each secret key k [1],. . . , The secret key k [i ⁇ 1] and the values x [1],. . .
  • a value x [i ⁇ 1] is generated.
  • the compression function calculation unit 240 inputs a fixed value IV2 and a value x [i] obtained by adding the value c [i-1] to the value p [i] and inputs a value c [i] that is a result of calculating the compression function h. Get.
  • the message authentication code output unit 250 outputs the value c [i] obtained by the compression function calculation unit 240.
  • the predetermined length value input unit has i values and mn bit length values p [1],... For a predetermined natural number m and a natural number n smaller than the natural number m. . . , Input the value p [i].
  • the secret key adding unit 230 receives the mn bit length values p [1],. . . , Value p [i], i ⁇ 1 values p [1],. . . , Values p [i ⁇ 1], n-bit secret keys k [1],. . . , The secret key k [i ⁇ 1], and the value x [1],. . . , A value x [i ⁇ 1] is generated.
  • a value c [0] is a fixed value IV1 having an n-bit length
  • a secret key adding unit 230 To obtain an n-bit length value c [j-1], which is a result of calculating the compression function h using the m-bit length value x [j] generated by Get.
  • the compression function calculation unit 240 adds an m-bit length value x [i] by adding an n-bit length value c [i-1] to an n-bit length fixed value IV2 and an mn bit-length value p [i]. Are input to obtain a value c [i] having an n-bit length as a result of calculating the compression function h.
  • the divided values p [1],. . . , P [i-1] and secret keys k [1],. . . , K [i ⁇ 1] added values x [1],. . . , X [i ⁇ 1] are input to the compression function h, making it difficult to specify the value M.
  • a message authentication code computation algorithm with high computational efficiency should be constructed using a random oracle and a hash function algorithm that cannot be strongly discriminated even if constructed using an ideal compression function with broken unidirectionality. Can do.
  • the following describes a hash function algorithm that cannot be strongly discriminated from a random oracle even if it is configured using an ideal compression function with broken unidirectionality.
  • Random oracle is a function that records in advance a list indicating a pair of input value and output value, and outputs an output value corresponding to the input value based on the list.
  • a cryptographic algorithm that is secure when using a random oracle is considered secure when a secure hash function is used instead of a random oracle.
  • cryptographic algorithms such as OAEP (Optical Asymmetric Encryption Padding) and PSS (Probabilistic Signature Scheme) have been proven to be safe when using random oracles.
  • a cryptographic algorithm that is secure when using a random oracle is safe when a hash function that cannot be strongly distinguished from a random oracle is used.
  • EMD Exploited Merkle-Damgard
  • MDP Mercle-Damgard with Permutation
  • the hash function is a function that inputs an arbitrary length value and outputs a fixed length value.
  • the hash function is a compression function that inputs a value having a predetermined input length and outputs a value having a predetermined output length, and an input length that calculates a fixed length output value from an arbitrary length input value using the compression function. And an enlargement algorithm.
  • a hash function that cannot be distinguished strongly from a random oracle is configured using an ideal compression function (FILRO (Fixed Input Length Random Oracle)).
  • FILRO Fixed Input Length Random Oracle
  • WFILRO ideal compression function
  • FILRO hash function that cannot be strongly distinguished from a random oracle even if it is a hash function configured using an ideal compression function (WFILRO) whose unidirectionality is broken instead of an ideal compression function (FILRO).
  • WFILRO ideal compression function
  • FILRO hash function that is not strongly distinguishable from a random oracle unless configured using an ideal compression function (FILRO).
  • a hash function that cannot be strongly discriminated from a random oracle even if configured using an ideal compression function (WFILRO) with broken unidirectionality is random unless configured using an ideal compression function (FILRO). It is safer than a hash function that is not strongly distinguishable from Oracle.
  • WFILRO ideal compression function
  • FILRO ideal compression function
  • the properties to be satisfied by the secure hash function include three properties of “collision resistance”, “second development difficulty”, and “development resistance”.
  • the hash function is described as “H”.
  • An ideal compression function is a compression function having a “list” and an “oracle”.
  • the list is data indicating combinations of input values and output values.
  • the list shows a pair of an input value (x, y) and an output value z for each input value (x, y).
  • Oracle is a function for outputting an output value corresponding to an input value based on a list.
  • the ideal compression function (WFILRO) whose unidirectionality is broken is a compression function having “an oracle that breaks unidirectionality” in addition to the above “list” and “oracle”.
  • An oracle that breaks unidirectionality is a function that outputs an input value corresponding to an output value based on a list.
  • An example of an Oracle that breaks unidirectionality is shown below.
  • the ideal compression function (WFILRO) whose unidirectionality is broken is a compression function that is less secure than the ideal compression function (FILRO) because it has an “oracle that breaks unidirectionality”.
  • An attacker can attack the ideal compression function (FILRO) using “list” and “Oracle”, and the “list” against the ideal compression function (WFILRO) whose unidirectionality is broken. It is possible to attack using "Oracle” and "Oracle that breaks unidirectionality”.
  • the ideal compression function (WFILRO) whose unidirectionality has been broken has more functions to be given to the attacker than the ideal compression function (FILRO), and thus is easily attacked by the attacker and is less secure.
  • the MD structure is the following algorithm.
  • Step 1 Strengthen MD padding is applied to the input value M to create an m ⁇ i-bit value M ′.
  • Step 2 The value M ′ is changed to an m-bit value p [1],. . . , P [i].
  • c [0] is an n-bit fixed value.
  • the compression function h is a function that inputs two values, an n-bit value c [j ⁇ 1] and an m-bit value p [j], and outputs an n-bit value c [j].
  • Step 4 Output c [i].
  • Embodiment 2 Processing data having a data length i times mn bits is generated by adding predetermined data having a specific data length to the communication data, and a message authentication code for the communication data is generated based on the generated processing data. A form is demonstrated. With this configuration, the message authentication code for communication data can be generated even if the data length of communication data is not i times mn bits.
  • items different from the first embodiment will be mainly described. Other matters are the same as those in the first embodiment.
  • FIG. 6 is a functional configuration diagram of the message authentication code computing device 200 according to the second embodiment. A functional configuration of the message authentication code computing device 200 according to Embodiment 2 will be described with reference to FIG.
  • the message authentication code computing device 200 includes a padding unit 260 in addition to the configuration described in the first embodiment (see FIG. 2).
  • the padding unit 260 (an example of a processing data generation unit) adds processing data having a specific length to the communication data input to the arbitrary length value input unit 210 and has processing data having a data length i times mn bits. Is generated.
  • Arbitrary length value dividing unit 220 (an example of a communication data dividing unit) divides processing data generated by padding unit 260 into first to i-th divided data having an mn bit length.
  • the communication data is referred to as “value M”
  • the data added to the communication data is referred to as “padding value”
  • the processing data is referred to as “value M ′”
  • the divided data is referred to as “value p”.
  • FIG. 7 is a flowchart showing a message authentication code calculation method according to the second embodiment. A message authentication code calculation method according to the second embodiment will be described with reference to FIG.
  • the padding step (S111) is executed in addition to the processing described in the first embodiment (see FIG. 3).
  • the arbitrary length value dividing step (S121) is a process in which “value M” in S120 described in the first embodiment is replaced with “value M ′”.
  • the padding step (S111) will be mainly described.
  • the arbitrary length value input unit 210 inputs the value M having an arbitrary bit length, and stores the input value M in the arithmetic device storage unit 290. It progresses to S111 after S110.
  • the padding unit 260 acquires the value M input in S110 from the arithmetic device storage unit 290, inputs the acquired value M to the padding function pad, and obtains a value M ′ having a bit length i times mn bits. calculate.
  • the padding unit 260 stores the calculated value M ′ in the arithmetic device storage unit 290.
  • the padding function pad is a function that generates a value having a bit length i times mn bits by adding a specific padding value to the input value when the bit length of the input value is not i times mn bits. is there. “I” is an arbitrary or predetermined natural number.
  • the padding function pad adds “1
  • the padding value has “1” at the beginning and ⁇ M> at the end, and one or more “0” s between “1” and ⁇ M>.
  • ⁇ M> is data having a bit length of 64 bits
  • of the value M is indicated by 64 bits.
  • ⁇ M> having a bit length of 64 bits can indicate a data size of a maximum of 2 64 bits as the bit length
  • the padding value may be a value other than the above, such as “0” for all bits or “1” for all bits.
  • the arbitrary length value dividing unit 220 acquires the value M ′ calculated in S111 from the arithmetic device storage unit 290, and divides the acquired value M ′ into mn bit lengths to obtain i values p [ 1],. . . , Value p [i], and the generated values p [1],. . . , Value p [i] is stored in the arithmetic device storage unit 290. It progresses to S130 after S121.
  • FIG. 8 is a structural diagram of a message authentication code calculation algorithm in the second embodiment.
  • the above message authentication code calculation method (see FIG. 7) can be represented as shown in FIG.
  • a value M corresponding to the communication data is input to the padding function pad to obtain a value M ′ having a bit length i times mn bits (S110, S111).
  • the value M ′ is an i value p [1],. . . , Value p [i] and values p [1],. . . , Values p [i ⁇ 1], n-bit secret keys k [1],. . . , The secret key [k-1] is added (S121, S130).
  • k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
  • [k [j] are input to the compression function h to obtain an n-bit length value
  • a value c [j] is obtained (S141).
  • c [i-1] are input to the compression function h to obtain the n-bit length value c [i].
  • the value c [i] is output as a message authentication code of the value M (S142, S150).
  • the padding function pad may be calculated by a padding function calculation device provided separately from the message authentication code calculation device 200.
  • Embodiment 2 for example, the following message authentication code computing device 200 has been described.
  • the message authentication code computing device 200 includes an arbitrary length value input unit 210, a padding unit 260, and an arbitrary length value dividing unit 220.
  • the arbitrary length value input unit 210 inputs a value M having an arbitrary bit length.
  • the padding unit 260 generates a value M ′ having a bit length i times mn bits by adding a predetermined value to the value M input by the arbitrary length value input unit 210.
  • the arbitrary length value dividing unit 220 divides the value M ′ generated by the padding unit 260 to mn bit length values p [1],. . . , Value p [i].
  • Embodiment 3 A mode in which a necessary number of secret keys are generated based on one secret key, and a message authentication code for communication data is generated using the generated necessary number of secret keys will be described. With this configuration, it is not necessary to store a large number of secret keys in the message authentication code calculation device 200 in advance so that the number of secret keys is not insufficient.
  • matters different from the first embodiment and the second embodiment will be mainly described. Other matters are the same as those in the first or second embodiment.
  • FIG. 9 is a functional configuration diagram of the message authentication code computing device 200 according to the third embodiment. A functional configuration of the message authentication code computing device 200 according to Embodiment 3 will be described with reference to FIG.
  • the message authentication code calculation device 200 includes a secret key input unit 270, an extended key calculation unit 271, and an extended key division unit 272 in addition to the configuration described in the first embodiment (see FIG. 2).
  • a secret key input unit 270 (an example of a secret key data input unit) inputs secret key data having an arbitrary length.
  • the extended key calculation unit 271 (an example of the extended key data generation unit) expands new secret key data having a data length of i ⁇ 1 times n bits based on the secret key data input to the secret key input unit 270.
  • the key data is generated by a predetermined algorithm.
  • the extended key division unit 272 (an example of the extended key data division unit) divides the extended key data generated by the extended key calculation unit 271 into first to i-1th secret key data having an n-bit length.
  • the arithmetic device storage unit 290 (an example of the secret key data storage unit) stores the first to i ⁇ 1th secret key data having an n-bit length obtained by the extended key dividing unit 272.
  • the secret key data of arbitrary length is “secret key ik”
  • the new secret key data having a data length that is n ⁇ 1 times n bits is “extended key ek”
  • the secret key data of n bits is “secret key” k ".
  • FIG. 10 is a flowchart illustrating a message authentication code calculation method according to the third embodiment. A message authentication code calculation method according to Embodiment 3 will be described with reference to FIG.
  • S210 to S230 are executed.
  • S210 to S230 will be mainly described.
  • the secret key input unit 270 inputs a secret key ik having an arbitrary bit length, and stores the input secret key ik in the arithmetic device storage unit 290. It progresses to S220 after S210.
  • the extended key calculation unit 271 acquires the secret key ik input in S210 from the arithmetic device storage unit 290, inputs the acquired secret key ik to the extended key calculation function ek_gen, and has a bit length i ⁇ 1 times n bits. An expanded key ek having is calculated. The expanded key calculation unit 271 stores the calculated expanded key ek in the arithmetic device storage unit 290.
  • the extended key calculation function ek_gen is a function that generates an extended key ek having a bit length i ⁇ 1 times n bits by a predetermined algorithm based on the input secret key ik.
  • the extended key calculation function ek_gen generates an extended key ek using an algorithm used for a technique called a key schedule.
  • the technique for generating an expanded key is a technique that is also used in techniques such as block ciphers. It progresses to S230 after S220.
  • the extended key splitting unit 272 acquires the extended key ek generated in S220 from the arithmetic device storage unit 290.
  • the extended key division unit 272 divides the extended key ek having a bit length i ⁇ 1 times n bits into i ⁇ 1 pieces by n bits.
  • the extended key dividing unit 272 converts the i ⁇ 1 values of n bits long obtained by dividing the extended key ek into the secret keys k [1],. . . , And stored in the arithmetic device storage unit 290 as a secret key k [i ⁇ 1]. That is, the secret keys k [1],. . .
  • the extended key ek is obtained by combining the secret key k [i ⁇ 1].
  • the n ⁇ 1-bit i ⁇ 1 values generated in S230 are converted into secret keys k [1],. . . , Secret key k [i-1] is used in the secret key adding step (S130).
  • S110, S120, and S130 to S150 are the same as those in the first embodiment (see FIG. 3).
  • FIG. 11 is a structural diagram of a message authentication code calculation algorithm in the third embodiment.
  • the above message authentication code calculation method (see FIG. 10) can be represented schematically as shown in FIG.
  • An arbitrary-length secret key ik is input to the extended key calculation function ek_gen to obtain an extended key ek having a bit length i ⁇ 1 times n bits, and the extended key ek is i ⁇ 1 secret keys having an n-bit length.
  • the value M corresponding to the communication data is i values p [1],. . . , Value p [i] and values p [1],. . . , Values p [i ⁇ 1], n-bit secret keys k [1],. . .
  • the secret key [k ⁇ 1] is added (S110 to S130).
  • k [1] are input to the compression function h to obtain the n-bit length value c [1] (S140).
  • [k [j] are input to the compression function h to obtain an n-bit length value
  • a value c [j] is obtained (S141).
  • c [i-1] are input to the compression function h to obtain the n-bit length value c [i].
  • the value c [i] is output as a message authentication code of the value M (S142, S150).
  • the extended key calculation function ek_gen may be calculated by an extended key calculation function device provided separately from the message authentication code calculation device 200.
  • FIG. 12 shows a functional configuration of the message authentication code calculation device 200 in this case.
  • FIG. 13 shows a flowchart of the message authentication code calculation method, and
  • FIG. 14 shows the configuration of the message authentication code calculation algorithm.
  • Embodiment 3 for example, the following message authentication code computing device 200 has been described.
  • the message authentication code computing device 200 includes a secret key input unit 270, an extended key calculation unit 271 and an extended key division unit 272.
  • the secret key input unit 270 inputs a secret key ik of arbitrary length bits.
  • the expanded key calculation unit 271 generates an expanded key ek from the secret key ik input by the secret key input unit 270.
  • the extended key dividing unit 272 divides the extended key ek generated by the extended key calculating unit 271 to obtain an n-bit secret key k [1],. . . , A secret key k [i-1] is generated.
  • 100 communication system 101 network, 102 user terminal device A, 103 user terminal device B, 104 communication data, 105 message authentication code, 106 secret key, 111 communication unit, 112 communication data generation unit, 113 communication data verification unit, 119 message Authentication code generation unit, 200 Message authentication code arithmetic unit, 210 Arbitrary length value input unit, 220 Arbitrary length value division unit, 230 Secret key addition unit, 240 Compression function calculation unit, 241 First compression function calculation unit, 242 Second compression Function calculation unit, 243 Third compression function calculation unit, 250 Message authentication code output unit, 260 Padding unit, 270 Private key input unit, 271 Extended key calculation unit, 272 Extended key division unit, 290 Arithmetic device storage unit, 901 Display device 902 Keyboard , 903 mouse, 911 CPU, 912 Bus, 913 ROM, 914 RAM, 915 communication board, 920 a magnetic disk device, 921 OS, 922 Window system, 923 Program group, 924 File group.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Power Engineering (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Compression, Expansion, Code Conversion, And Decoders (AREA)

Abstract

Selon l'invention, un algorithme de calcul de code d'authentification de message présentant un rendement arithmétique satisfaisant et une grande sécurité, est composé. (S110 à S130) Une valeur (M) correspondant à des données de communication est détaillée en i valeurs (p) d'une longueur en bits de m-n; et une clé secrète (k) d'une longueur en bits de n, est ajoutée à i-1 de ces valeurs (p). (S140) Une valeur (c) [1] d'une longueur en bits de n, est obtenue par entrée, dans une fonction de compression (h), d'une valeur fixe (IV1) d'une longueur en bits de n et d'une valeur (p) [1]||k[1] d'une longueur en bits de m. (S141) Une valeur (c) [j] d'une longueur en bits de n, est obtenue par entrée, dans la fonction de compression (h), dans l'ordre à partir de j=2 jusqu'à i-1, d'une valeur (c) [j-1] d'une longueur en bits de n et d'une valeur (p) [j]||k[j] d'une longueur en bits de m. (S142, S150) Une valeur (c) [i] d'une longueur en bits de n, est obtenue par entrée, dans la fonction de compression (h), d'une valeur fixe (IV2) d'une longueur en bits de n et d'une valeur (p) [i]||c[i-1] d'une longueur en bits de m; et une valeur c [i] est émise en sortie en tant que code d'authentification de message de la valeur (M).
PCT/JP2010/059818 2010-06-10 2010-06-10 Dispositif, procédé et programme de calcul de code d'authentification de message WO2011155039A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/JP2010/059818 WO2011155039A1 (fr) 2010-06-10 2010-06-10 Dispositif, procédé et programme de calcul de code d'authentification de message

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2010/059818 WO2011155039A1 (fr) 2010-06-10 2010-06-10 Dispositif, procédé et programme de calcul de code d'authentification de message

Publications (1)

Publication Number Publication Date
WO2011155039A1 true WO2011155039A1 (fr) 2011-12-15

Family

ID=45097669

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2010/059818 WO2011155039A1 (fr) 2010-06-10 2010-06-10 Dispositif, procédé et programme de calcul de code d'authentification de message

Country Status (1)

Country Link
WO (1) WO2011155039A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111052670A (zh) * 2017-09-01 2020-04-21 三菱电机株式会社 加密装置、解密装置、加密方法、解密方法、加密程序和解密程序
CN116186747A (zh) * 2023-04-27 2023-05-30 暗链科技(深圳)有限公司 自适应哈希加密方法、非易失性可读存储介质及电子设备

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006019152A1 (fr) * 2004-08-19 2006-02-23 Hitachi, Ltd. Dispositif de generation de code d'authentification de message, dispositif de verification de code d'authentification de message et procede de generation de code d'authentification de message

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006019152A1 (fr) * 2004-08-19 2006-02-23 Hitachi, Ltd. Dispositif de generation de code d'authentification de message, dispositif de verification de code d'authentification de message et procede de generation de code d'authentification de message

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
FERGUSON, N. ET AL.: "Helix Fast Encryption and Authentication in a Single Cryptographic Primitive", LECTURE NOTES IN COMPUTER SCIENCE, vol. 2887, 2003, pages 330 - 346 *
NAITO, Y. ET AL.: "How to Construct Cryptosystems and Hash Functions in Weakened Random Oracle Models", CRYPTOLOGY EPRINT ARCHIVE, REPORT 2009/550, 16 November 2009 (2009-11-16) *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111052670A (zh) * 2017-09-01 2020-04-21 三菱电机株式会社 加密装置、解密装置、加密方法、解密方法、加密程序和解密程序
CN111052670B (zh) * 2017-09-01 2024-02-09 三菱电机株式会社 加密装置、解密装置、加密方法、解密方法和计算机能读取的存储介质
CN116186747A (zh) * 2023-04-27 2023-05-30 暗链科技(深圳)有限公司 自适应哈希加密方法、非易失性可读存储介质及电子设备

Similar Documents

Publication Publication Date Title
KR100889127B1 (ko) 메시지 인증자 생성 장치, 메시지 인증자 검증 장치, 및메시지 인증 시스템
KR101809386B1 (ko) 인증 암호 장치, 인증 암호 방법 및 컴퓨터 판독가능한 기록 매체
JP5447510B2 (ja) タグ生成装置、タグ検証装置、通信システム、タグ生成方法、タグ検証方法および記録媒体
JP6740902B2 (ja) 認証暗号化方法、認証復号方法および情報処理装置
CN101202623B (zh) 消息验证码产生方法、验证/加密和验证/解密方法
US20130195266A1 (en) Apparatus and Method for Producing a Message Authentication Code
CN106452791B (zh) 一种无信任中心的量子数字签名方法
JP6305642B2 (ja) メッセージ認証子生成装置、メッセージ認証子生成方法及びメッセージ認証子生成プログラム
CN111066077B (zh) 加密装置、加密方法、解密装置以及解密方法
US11463235B2 (en) Encryption device, encryption method, program, decryption device, and decryption method
WO2013065241A1 (fr) Dispositif de génération de label mac incrémentiel, procédé, programme et dispositif d'authentification de message
CN110336673B (zh) 一种基于隐私保护的区块链设计方法
WO2016088453A1 (fr) Appareil de chiffrement, appareil de déchiffrement, système de traitement cryptographique, procédé de chiffrement, procédé de déchiffrement, programme de chiffrement et programme de déchiffrement
JP5047198B2 (ja) 秘密計算システム、秘密計算方法、秘密計算装置、検証装置、およびプログラム
CN106452790B (zh) 一种无信任中心的多方量子数字签名方法
US9049004B2 (en) Low-power encryption apparatus and method
CN111432403A (zh) 基于区块链的数据审计方法及装置
WO2020213114A1 (fr) Dispositif de génération de liste de labels mac, dispositif de vérification de liste de labels mac, procédé et programme
JP2002049310A (ja) 暗復号装置、認証装置及び記憶媒体
WO2011155039A1 (fr) Dispositif, procédé et programme de calcul de code d'authentification de message
US11177936B2 (en) Message authenticator generation apparatus
US11115187B2 (en) Apparatus and method for block ciphers for real-time data transmission
WO2020095382A1 (fr) Dispositif de chiffrement authentifié, dispositif de déchiffrement authentifié, procédé de chiffrement authentifié, procédé de déchiffrement authentifié, programme de chiffrement authentifié, et programme de déchiffrement authentifié
JP6033504B1 (ja) メッセージ認証子生成装置
JP2015082077A (ja) 暗号化装置、制御方法、及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10852878

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10852878

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: JP