Encryption device, decryption device, encryption method, decryption method, and computer readable medium
11438137 · 2022-09-06
Assignee
Inventors
Cpc classification
G09C1/00
PHYSICS
H04L9/32
ELECTRICITY
H04L9/06
ELECTRICITY
H04L2209/12
ELECTRICITY
H04L9/0618
ELECTRICITY
H04L2209/20
ELECTRICITY
H04L9/0637
ELECTRICITY
International classification
H04L9/06
ELECTRICITY
Abstract
An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S.sub.0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.
Claims
1. An encryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption device comprising: processing circuitry to: receive a message M; divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m], set to a variable S data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c, update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order, generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m, generate an authenticator T of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated, transmit the generated authenticator T and ciphertext C to a decryption device.
2. The encryption device according to claim 1, wherein the processing circuitry divides public data A into blocks of b′ bits, so as to generate data A[1], . . . , data A[a], sets fixed data IV of n bits to the variable S, updates the variable S with data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′=n−b′ bits is added, then updates the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, for each integer i=1, . . . , a in ascending order, and uses, as the data S.sub.0, the variable S that has been updated.
3. The encryption device according to claim 1, wherein the data X[i] is the data M[i] to a least significant side of which a bit string of c bits is added, and wherein the data C[i] is generated by extracting most significant b bits of the variable S.
4. A decryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption device comprising: processing circuitry to: receive an authenticator T and a ciphertext C, divide the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C [m], set to a variable S data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c, update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order, generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m, generate an authenticator T′ of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated, and outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.
5. The decryption device according to claim 4, wherein the processing circuitry divides public data A into blocks of b′ bits, so as to generate data A[1], . . . , data A[a], sets fixed data IV of n bits to the variable S, updates the variable S with data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′=n−b′ bits is added, then updates the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, for each integer i=1, . . . , a in ascending order, and uses, as the data S.sub.0, the variable S that has been updated.
6. The decryption device according to claim 4, wherein the data X[i] is the data M[i] to a least significant side of which a bit string of c bits is added, and wherein the data C[i] is generated by extracting most significant b bits of the variable S.
7. The decryption device according to claim 4, wherein the processing circuitry determines whether or not the authenticator T′ and an authenticator T corresponding to the message M coincide with each other.
8. An encryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption method comprising: receiving a message M, dividing the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]; setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c; updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generating data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order; generating a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m; and updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T oft bits from the variable S that has been updated, where t is an integer of 1 or greater; and transmitting the generated authenticator T and ciphertext C to a decryption device.
9. A decryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption method comprising: receiving an authenticator T and a ciphertext C; dividing the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m]; setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c; updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculating data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order; generating a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m; updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T′ oft bits from the variable S that has been updated, where t is an integer of 1 or greater; and outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.
10. A non-transitory computer readable medium storing an encryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption program causing a computer to execute: a reception process to receive a message M; a division process to divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]; a variable setting process to set to a variable S data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c; a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order; a ciphertext generation process to generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m; an authenticator generation process to generate an authenticator T of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated; and a transmission process to transmit the generated authenticator T and ciphertext C to a decryption device.
11. A non-transitory computer readable medium storing a decryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption program causing a computer to execute: a reception process to receive an authenticator T and ciphertext C; a division process to divide a ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m]; a variable setting process to set to a variable S data of obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c; a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order; a message generation process to generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m; and an authenticator generation process to generate an authenticator T′ of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated; an output process to output, when the received authenticator T is equal to the generated authenticator T′, the generated message M.
Description
BRIEF DESCRIPTION OF DRAWINGS
(1)
(2)
(3)
(4)
(5)
(6)
(7)
(8)
(9)
(10)
(11)
(12)
DESCRIPTION OF EMBODIMENTS
First Embodiment
(13) In a first embodiment, an authenticated encryption algorithm constructed using an encryption function E of a block cipher with a block size n will be described.
(14) *** Description of Variables and Notation ***
(15) Variables and notation in the following description will be described.
(16) An integer b, an integer c, an integer b″, and an integer c″ satisfy the relationships c=n−b and c″=n−b″. An integer t satisfies the relationship t≤n.
(17) A y-bit representation of an integer x will be denoted as str[y](x). For example, str[4](2) denotes 0010. The most significant w bits of a bit string z of n bits will be denoted as msb[w](z), and the least significant w bits will be denoted as Lsb[w](z). The bit length of a bit string w will be denoted as Len(w).
(18) Each of const[1], const[2], and const[3] is an integer that is not 0 and is a value different from one another.
(19) *** Description of Configuration ***
(20) A configuration of an encryption device 10 according to the first embodiment will be described with reference to
(21) The encryption device 10 includes hardware of a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected with other hardware components via signal lines and controls these other hardware components.
(22) The encryption device 10 includes, as functional components, an acceptance unit 111, a division unit 112, a variable setting unit 113, a function calculation unit 114, an authenticator generation unit 115, a ciphertext generation unit 116, and an output unit 117. The functions of the functional components of the encryption device 10 are realized by software.
(23) The storage 13 stores programs for realizing the functions of the functional components of the encryption device 10. These programs are read into the memory 12 by the processor 11 and executed by the processor 11. This realizes the functions of the functional components of the encryption device 10.
(24) A configuration of a decryption device 20 according to the first embodiment will be described with reference to
(25) The decryption device 20 includes hardware of a processor 21, a memory 22, a storage 23, and a communication interface 24. The processor 21 is connected with other hardware components via signal lines and controls these other hardware components.
(26) The decryption device 20 includes, as functional components, an acceptance unit 211, a division unit 212, a variable setting unit 213, a function calculation unit 214, an authenticator generation unit 215, a message generation unit 216, and an output unit 217. The functions of the functional components of the decryption device 20 are realized by software.
(27) The storage 23 stores programs for realizing the functions of the functional components of the decryption device 20. These programs are read into the memory 22 by the processor 21 and executed by the processor 21. This realizes the functions of the functional components of the decryption device 20.
(28) Each of the processors 11 and 21 is an integrated circuit (IC) that performs processing. As a specific example, each of the processors 11 and 21 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU).
(29) Each of the memories 12 and 22 is a storage device to temporarily store data. As a specific example, each of the memories 12 and 22 is a static random access memory (SRAM) or a dynamic random access memory (DRAM).
(30) Each of the storages 13 and 23 is a storage device to store data. As a specific example, each of the storages 13 and 23 is a hard disk drive (HDD). Alternatively, each of the storages 13 and 23 may be a portable storage medium, such as a Secure Digital (SD) memory card, CompactFlash (CF, registered trademark), a NAND flash, a flexible disk, an optical disc, a compact disc, a Blu-ray (registered trademark) disc, or a digital versatile disk (DVD).
(31) Each of the communication interfaces 14 and 24 is an interface to communicate with an external device. As a specific example, each of the communication interfaces 14 and 24 is a port of Ethernet (registered trademark), Universal Serial Bus (USB), or High-Definition Multimedia Interface (HDMI, registered trademark).
(32) *** Description of Operation ***
(33) Operation of the encryption device 10 and the decryption device 20 according to the first embodiment will be described with reference to
(34) The operation of the encryption device 10 according to the first embodiment corresponds to an encryption method according to the first embodiment. The operation of the encryption device 10 according to the first embodiment also corresponds to processes of an encryption program according to the first embodiment.
(35) The operation of the decryption device 20 according to the first embodiment corresponds to a decryption method according to the first embodiment. The operation of the decryption device 20 according to the first embodiment also corresponds to processes of a decryption program according to the first embodiment.
(36) The operation of the encryption device 10 according to the first embodiment will be described with reference to
(37) (Step S11: Acceptance Process)
(38) The acceptance unit 111 accepts input of a message M to be encrypted.
(39) Specifically, the acceptance unit 111 accepts, via the communication interface 14, the message M that is input by a user through operation of an input device.
(40) (Step S12: Division Process)
(41) The division unit 112 determines whether or not a length Len(M) of the message M accepted in step S11 is a multiple of b bits. If the length Len(M) is not a multiple of b bits, 1 is added to the end of the message M and a bit string of 0 is further added to the end so that the length Len(M) is a multiple of b bits, so as to generate data M*. On the other hand, if the length Len(M) is a multiple of b bits, the message M is treated as the data M*.
(42) The division unit 112 divides the data M* from the beginning into blocks of b bits, so as to generate data M[1], . . . , data M[m], where “m” is an integer of 1 or greater.
(43) (Step S13: Variable Setting Process)
(44) The variable setting unit 113 sets, to a variable S internal to the encryption device 10, data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of an initial parameter N of b″ bits and a constant const[1] of c″ bits. That is, the variable setting unit 113 calculates S=S.sub.0 XOR (N∥const[1]).
(45) In the first embodiment, the data S.sub.0 is fixed data IV. The variable S internal to the encryption device 10 is a variable stored in the memory 12 of the encryption device 10.
(46) (Step S14: Function Calculation Process)
(47) The function calculation unit 114 executes the following processes A to C for each integer i=1, . . . , m in ascending order.
(48) (Process A)
(49) The function calculation unit 114 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E of the block cipher using as input the variable S and a key K. Note here that the key K is shared between the encryption device 10 and the decryption device 20 in advance.
(50) That is, the function calculation unit 114 calculates S=E.sub.K(S).
(51) (Process B)
(52) The function calculation unit 114 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process A and data X[i] that is data M[i] to which a bit string of c bits is added. Here, the function calculation unit 114 uses the data X[i] that is the data M[i] to the end of which c bits of 0 are added.
(53) That is, the function calculation unit 114 calculates S=S XOR (M[i]∥0.sup.c.
(54) (Process C)
(55) The function calculation unit 114 extracts b bits from the variable S updated in the process B so as to generate data C[i]. Here, the function calculation unit 114 extracts the most significant b bits of the variable S so as to generate the data C[i].
(56) That is, the function calculation unit 114 calculates C[i]=msb[b](S).
(57) (Step S15: Authenticator Generation Process)
(58) If the length of the message M is a multiple of b bits, the authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S14 and a constant const[2]. Here, the authenticator generation unit 115 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[2] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 115 calculates S=S XOR (0.sup.b∥str[c](const[2])).
(59) On the other hand, if the length of the message M is not a multiple of b bits, the authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S14 and a constant const[3]. Here, the authenticator generation unit 115 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[3] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 115 calculates S=S XOR (0.sup.b∥str[c](const[3])).
(60) The authenticator generation unit 115 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S that has been updated. That is, the authenticator generation unit 115 calculates S=E.sub.K(S).
(61) Then, the authenticator generation unit 115 extracts, as an authenticator T, t bits from the variable S that has been updated. Here, the authenticator generation unit 115 extracts the most significant t bits from the variable S, so as to generate the authenticator T. That is, the authenticator generation unit 115 calculates T=msb[t](S).
(62) (Step S16: Ciphertext Generation Process)
(63) The ciphertext generation unit 116 concatenates the respective pieces of the data c[i] for each integer i=1, . . . , m calculated in step S14. The ciphertext generation unit 116 extracts only the most significant bits of the length Len(M) of the message M from the concatenated data, so as to generate a ciphertext C that is the encrypted message M.
(64) That is, the ciphertext generation unit 116 calculates C=msb[Len(M)](C[1]∥ . . . ∥C[m−1]∥C[m]).
(65) (Step S17: Output Process)
(66) The output unit 117 outputs the authenticator T calculated in step S15 and the ciphertext C generated in step S16.
(67) Specifically, the output unit 117 transmits the authenticator T and the ciphertext C to the decryption device 20 via the communication interface 14.
(68) The operation of the decryption device 20 according to the first embodiment will be described with reference to
(69) (Step S21: Acceptance Process)
(70) The acceptance unit 211 accepts input of the authenticator T and the ciphertext C.
(71) Specifically, the acceptance unit 111 receives, via the communication interface 24, the authenticator T and the ciphertext C transmitted by the encryption device 10.
(72) (Step S22: Division Process)
(73) The division unit 212 divides the ciphertext C accepted in step S21 from the beginning into blocks of b bits, so as to generate data C[1], . . . , data C[m].
(74) If a length Len(C) of the ciphertext C is not a multiple of b bits, a length Len(C[m]) of the data C[m] is shorter than b bits. If the length Len(C) is a multiple of b bits, the length Len(C[m]) is b bits.
(75) (Step S23: Variable Setting Process)
(76) The variable setting unit 213 sets, to a variable S internal to the decryption device 20, data obtained by calculating an exclusive OR using, as input, data S.sub.0 of n bits and data Y that is a concatenation of the initial parameter N of b″ bits and the constant const[1] of c″ bits. That is, the variable setting unit 213 calculates S=S.sub.0 XOR (N∥const[1]).
(77) In the first embodiment, the data S.sub.0 is the fixed value IV. The data S.sub.0 that is set here is the same data as the data S.sub.0 that is set in step S13 of
(78) (Step S24: Function Calculation Process)
(79) The function calculation unit 214 executes the following processes A′ to C′ for each integer i=1, . . . , m−1 in ascending order. Then, the function calculation unit 214 executes processes D′ to E′.
(80) (Process A′)
(81) The function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E of the block cipher using as input the variable S and the key K. Note here that the key K is shared between the encryption device 10 and the decryption device 20 in advance.
(82) That is, the function calculation unit 214 calculates S=E.sub.K(S).
(83) (Process B′)
(84) The function calculation unit 214 calculates an exclusive OR using, as input, b bits extracted from the variable S updated in the process A′ and data C[i], so as to calculate data M[i]. Here, the function calculation unit 214 extracts the most significant b bits of the variable S updated in the process A′, and calculates the exclusive OR using as input the extracted data and the data C[i].
(85) That is, the function calculation unit 214 calculates M[i]=C[i] XOR msb[b](S).
(86) (Process C′)
(87) The function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process A′ and data X[i] that is the data M[i] to which a bit string of c bits is added. Here, the function calculation unit 214 uses the data X[i] that is the data M[i] to the end of which c bits of 0 are added.
(88) That is, the function calculation unit 214 calculates S=S XOR (M[i]∥0.sup.c.
(89) (Process D′)
(90) The function calculation unit 214 calculates an exclusive OR using, as input, bits of the length Len(C[m]) extracted from the beginning of the variable S updated in the process C′ and the data C[m], so as to calculate data M[m].
(91) That is, the function calculation unit 214 calculates M[m]=C[m] XOR msb[Len(C[m])](S).
(92) (Process E′)
(93) If a length Len(M[m]) of the data M[m] generated in the process D′ is shorter than b bits, the function calculation unit 214 adds 1 to the end of the data M[m] and further adds a bit string of 0 to the end so that the length Len(M[m]) is b bits, so as to generate data M*[m]. On the other hand, if the length Len(M[m]) is b bits, the data M[m] is treated as the data M*[m].
(94) Then, the function calculation unit 214 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S updated in the process C′ and data X[m] that is the data M*[m] to which a bit string of c bits is added. Here, the function calculation unit 214 uses the data X[m] that is the data M*[m] to the end of which c bits of 0 are added.
(95) That is, the function calculation unit 214 calculates S=S XOR (M*[m]∥0.sup.c).
(96) (Step S25: Authenticator Generation Process)
(97) If the length of the ciphertext C is a multiple of b bits, the authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S24 and the constant const[2]. Here, the authenticator generation unit 215 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[2] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 215 calculates S=S XOR (0.sup.b∥str[c](const[2])).
(98) On the other hand, if the length of the ciphertext C is not a multiple of b bits, the authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in step S24 and the constant const[3]. Here, the authenticator generation unit 215 calculates the exclusive OR using as input the variable S and data that is a bit string of c bits representing the constant const[3] to the beginning of which b bits of 0 are added. That is, the authenticator generation unit 215 calculates S=S XOR (0.sup.b∥str[c](const[3])).
(99) The authenticator generation unit 215 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S that has been updated. That is, the authenticator generation unit 215 calculates S=E.sub.K(S).
(100) Then, the authenticator generation unit 215 extracts, as an authenticator T′, t bits from the variable S that has been updated. Here, the authenticator generation unit 215 extracts the most significant t bits from the variable S, so as to generate the authenticator T′. That is, the authenticator generation unit 215 calculates T′=msb[t](S).
(101) (Step S26: Message Generation Process)
(102) The message generation unit 216 concatenates the respective pieces of the data M[i] for each integer i=1, . . . , m calculated in step S24. The ciphertext generation unit 116 extracts only the most significant bits of the length Len(C) of the ciphertext C from the concatenated data, so as to generate a message M that is the decrypted ciphertext C.
(103) That is, the ciphertext generation unit 116 calculates M=msb[Len(C)](M[1]∥ . . . ∥M[m−1]∥M[m]).
(104) (Step S27: Output Process)
(105) If the authenticator T accepted in step S21 and the authenticator T′ calculated in step S25 coincide with each other, the output unit 217 outputs the message M generated in step S25. Specifically, the output unit 217 transmits the message M to a display device or the like via the communication interface 24.
(106) On the other hand, if the authenticator T accepted in step S21 and the authenticator T′ calculated in step S26 do not coincide with each other, the output unit 217 outputs a message indicating that the authenticator T and the authenticator T′ do not coincide with each other.
(107) *** Effects of First Embodiment ***
(108) As described above, the encryption device 10 and the decryption device 20 according to the first embodiment allow the construction of an authenticated encryption algorithm from the encryption function E of the block cipher and the exclusive OR (XOR) without using a decryption function of the block cipher. The size of the variable S, which is an internal variable, is n bits. Therefore, the size of the internal variable can be made smaller than that of the authenticated encryption algorithm JAMBU while the implementation size is equivalent to that of the authenticated encryption algorithm JAMBU.
(109) *** Other Configurations ***
(110) <First Variation>
(111) In the first embodiment, the functions of the functional components of the encryption device 10 and the decryption device 20 are realized by software. As a first variation, however, the functions of the functional components of the encryption device 10 and the decryption device 20 may be realized by hardware. With respect to this first variation, differences from the first embodiment will be described.
(112) A configuration of an encryption device 10 according to the first variation will be described with reference to
(113) When the functions of the functional components are realized by hardware, the encryption device 10 includes an electronic circuit 15, in place of the processor 11, the memory 12, and the storage 13. The electronic circuit 15 is a dedicated electronic circuit that realizes the functions of the units of the encryption device 10 and the functions of the memory 12 and the storage 13.
(114) A configuration of a decryption device 20 according to the first variation will be described with reference to
(115) When the functions of the functional components are realized by hardware, the decryption device 20 includes an electronic circuit 25, in place of the processor 21, the memory 22, and the storage 23. The electronic circuit 25 is a dedicated electronic circuit that realizes the functions of the units of the decryption device 20 and the functions of the memory 22 and the storage 23.
(116) Each of the electronic circuits 15 and 25 is assumed to be a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, a logic IC, a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).
(117) The functions of the units of the encryption device 10 may be realized by a single electronic circuit 15. The functions of the units of the encryption device 10 may be distributed among and realized by a plurality of electronic circuits 15. Similarly, the functions of the units of the decryption device 20 may be realized by a single electronic circuit 25. The functions of the units of the decryption device 20 may be distributed among and realized by a plurality of electronic circuits 25.
(118) <Second Variation>
(119) As a second variation, some of the functions may be realized by hardware, and the rest of the functions may be realized by software. That is, some of the functions of the functional components of the encryption device 10 may be realized by hardware, and the rest of the functions may be realized by software. Similarly, some of the functions of the functional components of the decryption device 20 may be realized by hardware, and the rest of the functions may be realized by software.
(120) Each of the processors 11 and 21, the memories 12 and 22, the storages 13 and 23, and the electronic circuits 15 and 25 is referred to as processing circuitry. That is, the functions of the units of the encryption device 10 and the decryption device 20 are realized by the processing circuitry.
Second Embodiment
(121) A second embodiment differs from the first embodiment in that public data A is involved. In the second embodiment, this difference will be described and description of the same portions will be omitted.
(122) *** Description of Variables and Notation ***
(123) An integer b′ and an integer c′ satisfy the relationship c′=n−b′.
(124) The value of const[4] and the value of const[5] are different from each other. The value of const[4] and the value of const[5] are different from the value of const[1].
(125) *** Description of Configuration ***
(126) A configuration of an encryption device 10 according to the second embodiment will be described with reference to
(127) The encryption device 10 differs from the encryption device 10 illustrated in
(128) A configuration of a decryption device 20 according to the second embodiment will be described with reference to
(129) The decryption device 20 differs from the decryption device 20 illustrated in
(130) *** Description of Operation ***
(131) Operation of the encryption device 10 and the decryption device 20 according to the second embodiment will be described with reference to
(132) The operation of the encryption device 10 according to the second embodiment corresponds to an encryption method according to the second embodiment. The operation of the encryption device 10 according to the second embodiment also corresponds to processes of an encryption program according to the second embodiment.
(133) The operation of the decryption device 20 according to the second embodiment corresponds to a decryption method according to the second embodiment. The operation of the decryption device 20 according to the second embodiment also corresponds to processes of a decryption program according to the second embodiment.
(134) The operation of the encryption device 10 and the decryption device 20 according to the second embodiment will be described with reference to
(135) The encryption device 10 performs processes indicated in
(136) Similarly, the decryption device 20 executes the processes indicated in
(137) In the following description, the execution of the processes indicated in
(138) (Step S31: Acceptance Process)
(139) The acceptance unit 111 accepts input of public data A.
(140) Specifically, the acceptance unit 111 receives, via the communication interface 14, the public data A that is input by a user through operation of an input device. The acceptance unit 111 may obtain the public data A from an external server or the like.
(141) (Step S32: Division Process)
(142) The division unit 112 determines whether or not a length Len(A) of the public data A accepted in step S31 is a multiple of b′ bits. If the length Len(A) is not a multiple of b′ bits, 1 is added to the end of the pubic data A and a bit string of 0 is further added to the end so that the length Len(A) is a multiple of b′ bits, so as to generate data A*. On the other hand, if the length Len(A) is a multiple of b′ bits, the public data A is treated as the data A*.
(143) The division unit 112 divides the data A* generated in step S32 into blocks of b′ bits, so as to generate data A[1], . . . , data A[a] each having b′ bits, where “a” is an integer of 1 or greater.
(144) (Step S33: Variable Setting Process)
(145) The variable setting unit 113 sets fixed data IV of n bits to a variable S internal to the encryption device 10. The fixed data IV is data whose least significant c′ bits are different from those of const[1], const[2], const[3], const[4], and const[5].
(146) (Step S34: Advance Calculation Process)
(147) The advance calculation unit 118 executes the following processes A″ to B″ for each integer i=1, . . . , a−1 in ascending order. Then, processes C″ to E″ are executed.
(148) (Process A″)
(149) The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′ bits is added. Here, the advance calculation unit 118 uses the data X* [i] that is the data A[i] to the end of which c′ bits of 0 are added.
(150) That is, the advance calculation unit 118 calculates S=S XOR (A[i]∥0.sup.c′).
(151) (Process B″)
(152) The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S updated in the process A″ and the key K.
(153) That is, the advance calculation unit 118 calculates S=E.sub.K(S).
(154) (Process C″)
(155) The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S and data X*[a] that is the data A[a] to which a bit string of c′ bits is added. Here, the advance calculation unit 118 uses the data X*[a] that is the data A[a] to the end of which c′ bits of 0 are added.
(156) That is, the advance calculation unit 118 calculates S=S XOR (A[a]∥0.sup.c′).
(157) (Process D″)
(158) If the length of the public data A is a multiple of b′ bits, the advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in the process B″ and a constant const[4]. Here, the advance calculation unit 118 calculates the exclusive OR using as input the variable S and data that is a bit string of c′ bits representing the constant const[4] to the beginning of which b′ bits of 0 are added. That is, the advance calculation unit 118 calculates S=S XOR (0.sup.b′∥str[c′](const[4])).
(159) On the other hand, if the length of the public data A is not a multiple of b′ bits, the advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating an exclusive OR using as input the variable S calculated in the process B″ and a constant const[5]. Here, the advance calculation unit 118 calculates the exclusive OR using as input the variable S and data that is a bit string of c′ bits representing the constant const[5] to the beginning of which b′ bits of 0 are added. That is, the advance calculation unit 118 calculates S=S XOR (0.sup.b′∥str[c′](const[5])).
(160) (Process E″)
(161) The advance calculation unit 118 updates the variable S by setting, to the variable S, data obtained by calculating the encryption function E using as input the variable S updated in the process D″. That is, the advance calculation unit 118 calculates S=E.sub.K(S).
(162) *** Effects of Second Embodiment ***
(163) As described above, the encryption device 10 and the decryption device 20 according to the second embodiment allow the construction of an authenticated encryption algorithm from the encryption function E of the block cipher and the exclusive OR (XOR) without using a decryption function of the block cipher, even when the public data A is involved. The size of the variable S, which is an internal variable, is n bits. Therefore, the size of the internal variable can be made smaller than that of the authenticated encryption algorithm JAMBU while the implementation size is equivalent to that of the authenticated encryption algorithm JAMBU.
(164) Examples of the fixed data IV, const[1], const[2], const[3], const[4], and const[5] will be described. For example, the fixed data IV is 0.sup.n, const[1] is 3, const[2] is 1, const[3] is 2, const[4] is 1, and const[5] is 2. In this case, it is required that the integer c′≥3 and the integer c″≥3.
(165) The value of the integer c is determined by taking security into consideration. In the authenticated encryption algorithms described in the first and second embodiments, security can be assured until the number of times the encryption function E of the block cipher is invoked in the encryption function Enc exceeds 2.sup.n/2 times, or the number of times the encryption function E of the block cipher is invoked upon failure of verification in the decryption function Dec exceeds 2.sup.c. When the number of times the encryption function E of the block cipher is invoked exceeds either of these numbers of times, the key K needs to be changed in order to assure security.
(166) For example, when the number of times the encryption function E of the block cipher is invoked upon failure of verification in the decryption function Dec is limited to 2.sup.16, the minimum value of the integer c is 16.
REFERENCE SIGNS LIST
(167) 10: encryption device, 11: processor, 12: memory, 13: storage, 14: communication interface, 15: electronic circuit, 111: acceptance unit, 112: division unit, 113: variable setting unit, 114: function calculation unit, 115: authenticator generation unit, 116: ciphertext generation unit, 117: output unit, 118: advance calculation unit, 20: decryption device, 21: processor, 22: memory, 23: storage, 24: communication interface, 25: electronic circuit, 211: acceptance unit, 212: division unit, 213: variable setting unit, 214: function calculation unit, 215: authenticator generation unit, 216: message generation unit, 217: output unit, 218: advance calculation unit.