WO2022254513A1

WO2022254513A1 - Cryptographic device, method, and program

Info

Publication number: WO2022254513A1
Application number: PCT/JP2021/020665
Authority: WO
Inventors: 洋介藤堂; 悠佐々木
Original assignee: 日本電信電話株式会社
Priority date: 2021-05-31
Filing date: 2021-05-31
Publication date: 2022-12-08
Also published as: JPWO2022254513A1; JP7529154B2

Abstract

A cryptographic device according to an embodiment encrypts a plain text or decrypts a cipher text by a block cipher that uses an extended generalized Feistel-type round function, and comprises: a substitution table generation processing unit that generates a substitution table of a predetermined size which is determined according to the block cipher and in which there is no high probability propagation with the same input and output differences; and a cryptographic processing unit that performs the encryption or the decryption by the block cipher using the generated substitution table. The high probability propagation with the same input and output differences is propagation through which, when an input difference indicating two inputs to the substitution table is given, transition probability to an output difference having the same value as the input difference among output differences indicating output differences corresponding to the input difference becomes maximum.

Description

CRYPTOGRAPHIC APPARATUS, METHOD, AND PROGRAM

The present invention relates to cryptographic devices, methods, and programs.

A cryptographic method that encrypts plaintext with a certain key and uses the same key to decrypt the ciphertext is called symmetric key cryptography, and a method called block cipher is known as a type of symmetric key cryptography. A block cipher is a method in which data to be encrypted is divided into appropriate lengths called blocks (for example, 64 bits or 128 bits) and each block is encrypted. Block ciphers include, for example, DES cipher (Non-Patent Document 1), Lilliput cipher (Non-Patent Document 2), and the like. Among these, the Lilliput cipher is assumed to be implemented on a device with poor computational resources, and is also called a lightweight cipher.

In block ciphers, a block is encrypted by repeatedly applying a function called a round function to the block multiple times. Round functions include, for example, Feistel type round functions. Both the DES cipher and the Lilliput cipher are block ciphers using a Feistel type round function.

A derivative of the Feistel type is the generalized Feistel type, and the block shuffle generalized Feistel type (Non-Patent Document 3) and the extended generalized Feistel type (Non-Patent Document 2) are known as those with increased stirring speed. The extended generalized Feistel type round function is a round function used in the Lilliput cipher, and is composed of a nonlinear part, a linear part, and a permutation part.

The more iterations of the round function, the better the data will be mixed and the higher the security. Therefore, it is necessary to minimize the number of iterations of the round function within the range where safety can be ensured. At this time, the number of iterations of the round function is determined by conducting security evaluations for various cryptanalysis methods, but the evaluation for differential cryptanalysis (Non-Patent Document 4) is considered to be the most important.

However, since lightweight cryptography is assumed to be implemented on devices with poor computational resources, it is not possible to perform complex operations in the nonlinear and linear parts of the extended generalized Feistel round function. For this reason, it is difficult to efficiently improve security against differential cryptanalysis, the number of iterations of the round function increases, and the performance of cryptographic processing may deteriorate accordingly.

An embodiment of the present invention has been made in view of the above points, and aims to improve the security against differential cryptanalysis of block ciphers using extended generalized Feistel type round functions.

To achieve the above object, a cryptographic device according to one embodiment is a cryptographic device that encrypts plaintext or decrypts ciphertext by a block cipher using an extended generalized Feistel round function, wherein: a permutation table generation processing unit that generates a permutation table of a determined predetermined size in which there is no high-probability propagation with the same input-output difference; and a cryptographic processing unit that performs the encryption or the decryption by, and the high-probability propagation with the same input-output difference is given the input difference representing two inputs to the permutation table, the It is the propagation in which the transition probability to the output difference having the same value as the input difference among the output differences representing the output difference corresponding to the input difference is maximized.

It is possible to improve the security against differential cryptanalysis of block ciphers using extended generalized Feistel type round functions.

FIG. 4 is a diagram showing the round function of the Feistel cipher; FIG. 10 is a diagram showing the round function of the generalized Feistel cipher; FIG. 4 is a diagram showing the round function of the Lilliput cipher; FIG. 10 is a diagram showing a differential distribution table of S-Boxes of the Lilliput cipher; FIG. 11 shows the best differential properties up to 13 rounds of the Lilliput cipher; FIG. 10 is a diagram showing an example of a difference distribution table of an S-Box that does not have high-probability propagation with the same input-output difference; FIG. 10 is a diagram showing an example of the best differential characteristics up to 12 rounds of an S-Box that does not have high-probability propagation with the same input-output differential. It is a figure which shows an example of the hardware constitutions of the encryption apparatus based on this embodiment. It is a figure which shows an example of a functional structure of the cryptographic apparatus based on this embodiment. FIG. 10 is a diagram for explaining an example of permutation table generation processing and encryption processing according to the embodiment; FIG. 10 is a diagram showing a comparison example between the Lilliput cipher and the case where its S-Box is replaced with Equation (2);

An embodiment of the present invention will be described below.

<Theoretical configuration>
The theoretical configuration of the technique proposed in this embodiment and various techniques, concepts, etc. necessary for the explanation thereof will be described below.

≪Differential cryptanalysis≫
In differential cryptanalysis, when there is a set (P,C) of a plaintext and its encrypted ciphertext and another set (P',C'), attention is paid to the difference between the two sets. The difference Δ between the two data is the exclusive OR

defined by The plaintext difference ΔP is

and the ciphertext difference ΔC is

is.

Assume that the block length of the block cipher is n bits. In the case of an ideal block cipher, the probability of outputting two ciphertexts with a specific ciphertext difference ΔC for two plaintexts with a specific plaintext difference ΔP is 2 ⁻ⁿ .

Block ciphers are considered vulnerable to differential cryptanalysis when there is a bias in the agitation algorithm of the block cipher to be attacked, and ΔP, ΔC with the above probabilities greater than 2 ⁻ⁿ exist. Conversely, block cipher designers aim to make the above probability smaller than 2 ⁻ⁿ for arbitrary ΔP and ΔC.

Whether or not there exist ΔP, ΔC with the above probabilities greater than 2 ⁻ⁿ depends on how the round function is constructed and the number of iterations of the round function.

<<Feistel type round function>>
A Feistel type is known as one of the methods of configuring the round function. A block cipher using a Feistel-type round function is also called a Feistel-type cipher.

In a block cipher that uses a Feistel-type round function, one block of data is divided into two pieces of data. Divided data is called a branch.

Figure 1 shows the round function of the Feistel-type cipher. As shown in FIG. 1, in the Feistel-type cipher round function, the right branch and the subkey are input to the F-function, whose output is XORed with the left branch. The right and left branches are then exchanged. For example, the DES cipher has a block length of 64 bits and splits the 64-bit input into two 32-bit values.

A generalized Feistel type is a derivative of the Feistel type. In the generalized Feistel type, the data of each branch is further divided into a plurality of data. These divided data are called bytes.

Figure 2 shows the round function of the generalized Feistel-type cipher. As shown in FIG. 2, the round function of the generalized Feistel cipher consists of a nonlinear part and a permutation part.

In the non-linear part, the value obtained by XORing the subkey with respect to each byte of the right branch is transformed using a permutation table called S-Box, and this transformed value is exclusive with the corresponding byte of the right branch. Logically OR. Here, a subkey is a value obtained by inputting a key (also called a common key or a shared key, etc.) to a key scheduling function and repeating the round function. Since it is known that the XOR of subkeys does not affect the calculation of differential cryptanalysis probabilities, a detailed description is omitted. The S-Box is a permutation table in which output values corresponding to all input values (16 input values for 4 bits, 256 input values for 8 bits) are recorded. Note that "S" in the figure represents the S-Box.

In the replacement part, the right branch is moved to the left branch, and the left branch is moved to the right branch. Here, when moving the left branch to the right branch, the byte positions are cyclically shifted.

The generalized Feistel-type cipher has the advantage of making the implementation circuit smaller, but the input data churning speed is inferior to the normal Feistel-type cipher. Generalized Feistel ciphers with increased agitation speed include block shuffle generalized Feistel ciphers and extended generalized Feistel ciphers. The block-shuffle generalized Feistel-type cipher improves the agitation speed by changing the permutation part from permutation of left and right branches and cyclic shift of the left branch to permutation (block shuffle) in units of blocks based on the deBruijn graph. . The extended generalized Feistel-type cipher further inserts a linear part between the nonlinear part and the permutation part to improve the stirring speed.

An example of an extended generalized Feistel-type cipher is the Lilliput cipher with a block length of 64 bits.

Figure 3 shows the round function of the Lilliput cipher. As shown in FIG. 3, the round function of the Lilliput cipher consists of a nonlinear part, a linear part, and a permutation part. The non-linear part is composed of subkey XOR, S-Box and right branch XOR, the linear part is composed of multiple exclusive ORs, and the replacement part is composed of block shuffle. Since the block length of the Lilliput cipher is 64 bits, the branch length is 32 bits and the byte length is 4 bits. The S-Box is a permutation table that converts a 4-bit input value into a 4-bit output value.

≪Differential characteristic probability≫
When calculating the probability of obtaining two ciphertexts with a ciphertext difference ΔC from two plaintexts with a plaintext difference ΔP with a Feistel-type round function, the difference value after each round is usually determined, and the differential transition probability of each round is Evaluate by the product of

That is, the number of iterations of the round function is r, the difference between two plaintexts is Δ ₀ , and the difference after i rounds (i=1, 2, . . . , r) is _Δr . Let DP _F [Δ _A , Δ _B ] be the probability (difference transition probability) that two inputs with a difference Δ _A are converted into two inputs with a difference Δ _B after application of the function F. At this time, the differential characteristic probability DCP[Δ ₀ , Δ _r ] of the differential characteristics (Δ ₀ , Δ ₁ , . . . , Δ _r ) is calculated as follows.

Block cipher designers must therefore ensure that DCP[Δ ₀ ,Δ _r ] is less than 2 ⁻ⁿ when the block length is n bits.

Considering implementation performance, an excellent design is one that minimizes the number of iterations of the round function and minimizes the differential characteristic probability.

When two inputs having a certain difference Δ _in are given to an arbitrary linear transformation, the difference Δ _out of the two outputs corresponding to the two inputs is determined with a probability of one. Therefore, the linear part alone does not improve security against differential cryptanalysis. Hereinafter, the difference _Δin input to a certain part, transformation, function, etc. is referred to as an input difference, and the difference _Δout output corresponding to it is referred to as an output difference.

On the other hand, in the case of nonlinear transformation, the transition from a certain input difference Δ _in to a certain output difference Δ _out is stochastic, and the probability depends on the specifications of the nonlinear conversion, that is, the specifications of the S-Box.

Because of this property, most existing designs ignore the details of linear transformations and are designed to minimize the maximum differential transition probability of S-Boxes. For the maximum differential transition probability of the S-Box, the probability (differential transition probability of the S-Box) is calculated by counting the number of times the differential transition is satisfied in all combinations of the input difference Δ _in and the output difference Δ _out . Specifically, let s be the size of the S-Box and compute the following for all combinations of Δ _in and Δ _out .

The size s of the S-Box is the number of bits of the input/output value of the S-Box. For example, the size of an S-Box that takes 4-bit input/output values is s=4, and the size of an S-Box that takes 8-bit input/output values is s=8.

The highest probability among all (Δ _in , Δ _out ) is the S-Box's maximum differential transition probability, except for the case of Δ _in =Δ _out =0, which corresponds to the situation of no difference.

≪Linear cryptanalysis≫
Linear cryptanalysis is known as a cryptanalysis method as important as differential cryptanalysis, and there is a maximum linear transition probability corresponding to the maximum differential transition probability. It is known that the 4-bit S-Box that minimizes both the maximum differential transition probability and the maximum linear transition probability exists only by applying affine transformation to the inputs and outputs of the 16 S-Boxes shown in Table 1 below. It is

A new S-Box generated by applying an affine transformation to the input and output of an S-Box is said to be affine equivalent to the original S-Box. It is known that the maximum differential transition probability and the maximum linear transition probability always match in affine equivalent S-Boxes. Many existing designs using 4-bit S-Boxes, including the Lilliput cipher, use S-Boxes that are affine equivalent to any of the 16 S-Boxes shown in Table 1.

FIG. 4 shows the values of the numerator of equation (1) for all combinations of the input difference Δ _in and the output difference Δ _out for the S-Box actually used in the Lilliput cipher (that is, the difference from Δ _in to Δ _out The number of occurrences of transitions) is calculated. This is called a difference distribution table. The probability of transition from the input difference Δ _in to the output difference Δ _out (difference transition probability of S-Box) is obtained by dividing the value in the difference distribution table by ²⁴ . In FIG. 4, the maximum value is 4 except for the case of Δ _in =Δ _out =0, so it can be seen that the maximum differential transition probability of S-Box is 4/2 ⁴ =2 ⁻² .

<<Proposed method>>
Lightweight ciphers such as Lilliput ciphers are expected to be implemented on devices with relatively poor computational resources, such as IoT devices. cannot be executed. For this reason, it is difficult to efficiently improve security against differential cryptanalysis, the number of iterations of the round function increases, and the performance of cryptographic processing may deteriorate accordingly. Although the extended generalized Feistel-type cipher has improved agitation performance compared to the generalized Feistel-type cipher, it is still slower than the normal Feistel-type cipher. is still difficult and the number of iterations of the round function can increase.

Therefore, the following describes a method that can reduce the differential characteristic probability with a smaller number of iterations than existing designs, targeting block ciphers that use an extended generalized Feistel type round function, such as the Lilliput cipher. The proposed method uses a permutation table (S-Box) that satisfies properties that are effective for block ciphers that use extended generalized Feistel-type round functions.

In the extended generalized Feistel-type cipher, the linear part of the round function XORs the bytes of the right branch with the bytes of the left branch. When this XOR cancels the difference in the left branch and results in bytes with no difference, the number of S-Boxes to which the bytes with difference are input decreases in the next round function.

The differential characteristic probability has the characteristic of being maximized when the number of bytes with the differential as input of the S-Box is minimized. Therefore, in a differential characteristic in which the differential characteristic probability is maximized, the linear part often cancels the difference of the bytes in the left branch to zero difference.

Considering the above properties, using a substitution table (S-Box) that satisfies the following properties can be expected to improve security against differential cryptanalysis.

We focus only on (Δ _in , Δ _out ) that take high probability values among the differential transition probabilities of the S-Box (where Δ _in and Δ _out are assumed to be non-zero). Such a pair of input difference and output difference (Δ _in , Δ _out ) is called high-probability propagation. Consider the existence of high-probability propagation with the same input-output difference such that a certain difference Δ _in =Δ propagates to the difference Δ _out =Δ with high probability.

This proposed method uses an S-Box in which there is no high-probability propagation with the same input-output difference. In addition, it is considered that there is no existing cryptosystem design that focuses on the existence of high-probability propagation with the same input-output difference.

FIG. 4 shows a differential distribution table of S-Boxes used in the Lilliput cipher. In the difference distribution table shown in FIG. 4, portions with the same input/output difference are shown in bold. In the difference distribution table shown in FIG. 4, the number of appearances where both Δ _in and Δ _out are 0x6 is 4, and the pair of this input difference Δ _in =0x6 and output difference Δ _out =0x6 is highly probable propagation. .

Fig. 5 shows the best differential characteristics (difference characteristics with the highest differential characteristic probability) when the round function of the Lilliput cipher is repeated 13 times. In FIG. 5, ΔL represents the difference in the left branch after i iterations of the round function, and ΔR represents the difference in the right branch after i iterations of the round function. Note that round 0 is the plaintext difference. ΔY is obtained by rearranging the difference of the output of the S-Box obtained by inputting ΔR into the S-Box.

For example, the ΔR of round 0 is "00000600", which means that the difference in the third byte from the right in the right branch is 0x6, and there is no difference in the other bytes. Similarly, for example, the ΔL of round 0 is "66660600", which means that in the left branch, the difference between the 3rd, 5th, 6th, 7th, and 8th bytes from the right is 0x6, and the other bytes are It shows that there is no difference.

Also, for example, the ΔY of round 0 is “00600000”, which is the first from the right of the difference after applying the subkey XOR to the ΔR of round 0 and transforming it with the S-Box. 2nd byte from right, 3rd byte from right, 4th byte from right, 5th byte from right, 6th byte from right, 7th byte from right, 8th byte from right, 8th byte from right, 7th byte from right, 8th byte from right It indicates that the difference after moving to the 6th byte, the 5th byte from the right, the 4th byte from the right, the 3rd byte from the right, the 2nd byte from the right, and the 1st byte from the right is "00600000".

　As shown in Fig. 5, it can be seen that all bytes with a difference are 0x6 in the Lilliput cipher. Also, as shown in FIG. 4, when the input and output differences are both 0x6, the propagation is highly probable.

　By using an S-Box that does not have high-probability propagation with the same input-output difference, it is possible to improve security against differential cryptanalysis.

For example, the S-Box shown below is a specific example in which high-probability propagation with the same input-output difference does not exist.

FIG. 6 shows the difference distribution table of this S-Box. As shown in FIG. 6, when the input and output differences are the same (shown in bold in FIG. 6), the difference propagation probability is at most 2/16= ^2-3 . FIG. 7 shows the best differential characteristics when this S-Box is used instead of the S-Box of the Lilliput cipher and the round function is repeated 12 times. As shown in FIG. 7, the difference between each byte is no longer a simple value that is all 0x6. Therefore, the linear part of the round function can prevent the difference between the bytes of the left branch from being canceled and result in a zero difference, and the difference characteristic probability can be further reduced.

Note that, in the present embodiment, mainly block ciphers (in particular, lightweight ciphers such as Lilliput ciphers) using a 4-bit S-Box in the nonlinear part of the extended generalized Feistel type round function have been described. It goes without saying that this method can be similarly applied to block ciphers using S-Boxes of any size in the nonlinear part of the Feistel-type round function.

<Hardware Configuration of Encryption Device 10>
Next, the hardware of the cryptographic device 10 that performs cryptographic processing (encryption, decryption, or both) by block cipher using an extended generalized Feistel type round function that uses the S-Box described in the proposed method in the nonlinear part The hardware configuration is shown in FIG. As shown in FIG. 8, the encryption device 10 according to this embodiment has an input device 101, a display device 102, an external I/F 103, a communication I/F 104, a processor 105, and a memory device . Each of these pieces of hardware is communicably connected via a bus 107 .

The input device 101 is, for example, a keyboard, mouse, touch panel, various physical buttons, and the like. The display device 102 is, for example, a display. Note that the cryptographic device 10 may not include at least one of the input device 101 and the display device 102, for example.

The external I/F 103 is an interface with an external device such as the recording medium 103a. The cryptographic device 10 can perform reading and writing of the recording medium 103 a via the external I/F 103 . Examples of the recording medium 103a include CD (Compact Disc), DVD (Digital Versatile Disk), SD memory card (Secure Digital memory card), USB (Universal Serial Bus) memory card, and the like.

The communication I/F 104 is an interface for connecting the cryptographic device 10 to a communication network. The processor 105 is, for example, various arithmetic units such as a CPU (Central Processing Unit) and an MPU (Micro-Processing Unit). The memory device 106 is, for example, various storage devices such as HDD (Hard Disk Drive), SSD (Solid State Drive), flash memory, RAM (Random Access Memory), and ROM (Read Only Memory).

The cryptographic device 10 according to the present embodiment has the hardware configuration shown in FIG. 8, so that it can implement various processes described later. Note that the hardware configuration shown in FIG. 8 is merely an example, and the cryptographic device 10 may have various hardware other than the illustrated hardware.

<Functional Configuration of Encryption Device 10>
Next, FIG. 9 shows the functional configuration of a cryptographic device 10 that performs cryptographic processing by block cipher using an extended generalized Feistel type round function that uses the S-Box described in the proposed method in the nonlinear section. As shown in FIG. 9, the encryption device 10 according to this embodiment has a substitution table generation processing unit 201 and an encryption processing unit 202 . These units are implemented by, for example, processing that one or more programs installed in the cryptographic device 10 cause the processor 105 to execute.

The substitution table generation processing unit 201 generates a substitution table (S-Box) by the proposed method described above. That is, the permutation table generation processing unit 201 generates an input-output difference in an S-Box having the same size as the S-Box used in the nonlinear part of the extended generalized Feistel type round function of the block cipher that realizes the encryption processing unit 202. The S-Box that does not have the same high-probability propagation is generated as the S-Box used in the cryptographic processing unit 202 . For example, when the encryption processing unit 202 is realized by Lilliput encryption or the like, the permutation table generation processing unit 201 selects 16 S-Boxes shown in Table 1 and their affine equivalent S-Boxes, and the input/output difference is An S-Box that does not have the same high-probability propagation is generated as an S-Box to be used in cryptographic processing section 202 . Note that the permutation table generation processing unit 201 may, for example, identify and generate an S-Box that has the same input-output difference and does not have high-probability propagation from the difference distribution table of the S-Box of the corresponding size.

The encryption processing unit 202 uses the S-Box generated by the replacement table generation processing unit 201 to perform encryption processing using a predetermined block cipher (eg, Lilliput encryption, etc.). That is, the encryption processing unit 202 generates, for example, a ciphertext from a plaintext and transmits the generated ciphertext to another cryptographic device, or decrypts a ciphertext received from another cryptographic device.

Note that FIG. 9 is an example, and for example, the replacement table generation processing unit 201 and the encryption processing unit 202 may be provided in different devices. Specifically, for example, the permutation table generation device having the permutation table generation processing unit 201 and the encryption device having the encryption processing unit 202 may be configured.

<Permutation table generation processing and encryption processing>
Next, FIG. 10 shows the flow of permutation table generation processing and encryption processing executed by the cryptographic device 10 according to this embodiment. As shown in FIG. 10, first, the replacement table generation processing unit 201 generates an S-Box used by the encryption processing unit 202 (S101). Note that the generation of the S-Box may be executed before the cryptographic processing, for example, it may be executed in advance, or may be executed immediately before the cryptographic processing is executed each time. Next, the encryption processing unit 202 uses the S-Box generated by the replacement table generation processing unit 201 to perform encryption processing (encryption of plaintext or decryption of ciphertext) by a predetermined block cipher (S102). When the encryption device 10 functions as an encryption device, the encryption processing unit 202 encrypts plaintext to generate a ciphertext, and then transmits the ciphertext to another encryption device. On the other hand, when the cryptographic device 10 functions as a decryption device, the cryptographic processor 202 decrypts ciphertexts received from other cryptographic devices.

<Experimental results>
In the following, the results of experiments conducted to confirm the effectiveness of the proposed method will be explained.

FIG. 11 shows how the maximum differential characteristic probability changes with respect to the number of iterations of the round function when the S-Box of the Lilliput cipher is replaced with the S-Box shown in Equation (2). The Lilliput cipher has a block length of 64 bits and is a block cipher using an extended generalized Feistel type round function, and its S-Box has high-probability propagation with the same input-output difference.

In FIG. 11, "original" indicates the case where the conventional S-Box is used in the Lilliput cipher, and "ours" indicates the case where the S-Box shown in Equation (2) is used in the Lilliput cipher. The horizontal axis represents the number of iterations of the round function, and the vertical axis represents the value obtained by log ₂ with respect to the maximum differential characteristic probability (MDCP).

As shown in FIG. 11, in the original Lilliput cipher with high-probability propagation of the same input-output difference, 14 rounds must be repeated in order to ensure that the maximum differential characteristic probability is less than ^2-64 .

On the other hand, in the Lilliput cipher (ours) replaced with the S-Box shown in Equation (2), it is possible to guarantee that the maximum differential characteristic probability is smaller than 2 ⁻⁶⁴ after 13 iterations. In this way, when security is improved by one or more iterations of the round function compared to differential cryptanalysis, the number of iterations can be reduced while maintaining the same security. It can be improved. Also, if the number of iterations is the same as before replacement, the security against differential cryptanalysis can be improved.

The present invention is not limited to the specifically disclosed embodiments described above, and various modifications, alterations, combinations with known techniques, etc. are possible without departing from the scope of the claims. .

10 encryption device 101 input device 102 display device 103 external I/F
103a recording medium 104 communication I/F
105 Processor 106 Memory Device 107 Bus 201 Permutation Table Generation Processing Unit 202 Encryption Processing Unit

Claims

A cryptographic device that encrypts plaintext or decrypts ciphertext by block cipher using an extended generalized Feistel type round function,
a permutation table generation processing unit that generates a permutation table of a predetermined size determined according to the block cipher, in which there is no high-probability propagation with the same input-output difference;
a cryptographic processing unit that performs the encryption or the decryption by the block cipher using the generated permutation table;
has
In the high-probability propagation with the same input-output difference, when an input difference representing two inputs to the permutation table is given, among the output differences representing the difference of the output corresponding to the input difference, the input difference A cryptographic device that maximizes the transition probability to the output difference that has the same value as .
The cryptographic device according to claim 1, wherein the block cipher is Lilliput cipher, and the size is 4 bits.
The replacement table generation processing unit
A permutation table in which there is no high-probability propagation with the same input/output difference is generated from 16 predetermined permutation tables and a permutation table obtained by applying an affine transformation to the input and output of the permutation table. 3. A cryptographic device according to claim 2.
A cryptographic device that encrypts plaintext or decrypts ciphertext by block cipher using an extended generalized Feistel type round function,
a permutation table generation processing procedure for generating a permutation table of a predetermined size determined according to the block cipher, in which there is no high-probability propagation with the same input-output difference;
a cryptographic processing procedure for performing the encryption or the decryption by the block cipher using the generated permutation table;
and run
In the high-probability propagation with the same input-output difference, when an input difference representing two inputs to the permutation table is given, among the output differences representing the difference of the output corresponding to the input difference, the input difference is the propagation that maximizes the transition probability to the output difference that is the same value as .
A program that causes a computer to function as the cryptographic device according to any one of claims 1 to 3.