Authentication encryption device, authentication encryption method, and authentication encryption program

Abstract

An initial processing unit (21) generates a secret value (B) on the basis of a secret key in authentication encryption. The function F processing unit (22) repeats a process for updating the secret value (B) by block encryption using the secret value (B) generated by the initial processing unit (21) as an input block for block encryption. The ciphertext processing unit (23) uses the secret value (B) updated by the function F processing unit (22) to execute at least one of an encryption process for encrypting the plaintext (M) and a decryption process for decrypting the ciphertext (C).

Description

Technical Field

[0001] This disclosure relates to authentication encryption that uses block encryption. Background Technology

[0002] Authentication encryption algorithms are encryption algorithms that simultaneously possess both concealment and tamper detection capabilities. When using authentication encryption algorithms, communication can occur without obscuring plaintext between the two parties, and the receiver can verify whether the message sent through the communication path has been tampered with.

[0003] The authentication encryption algorithm has two functions: encryption function Enc and decryption function Dec.

[0004] The encryption function Enc takes a secret key K, a one-time random number N, a header A, and plaintext M as input, and outputs ciphertext C and a tamper-proof tag. Furthermore, the one-time random number N uses a different value for each encryption, ensuring that the same value is used only when the secret key K remains unchanged.

[0005] The decryption function Dec takes the secret key K, a one-time random number N, a header A, ciphertext C, and a tamper detection token Tag as input. If the input values ​​are unaltered, it outputs the plaintext M; if they are altered, it outputs a value indicating forgery. Hereinafter, a value indicating forgery will be denoted as "reject".

[0006] Suppose that sender Alice and receiver Bob are communicating using an authentication encryption algorithm. Alice and Bob share a secret key K beforehand.

[0007] The sender, Alice, takes the secret key K, a one-time random number N, a header A, and the plaintext M as input, calculates the encryption function Enc, and generates the ciphertext C and the authentication token Tag for tamper detection. Alice then sends the one-time random number N, the header A, the ciphertext C, and the authentication token Tag to the receiver, Bob.

[0008] The receiver, Bob, takes the secret key K, a one-time random number N, the header A, the ciphertext C, and the authentication token Tag used for tamper detection as input, calculates the decryption function Dec, and determines that no tampering has been detected. If no tampering has been detected, plaintext M is generated.

[0009] Additionally, the header A is a publicly available value. Furthermore, the sender, Alice, sets a different random number N for each encryption, avoiding the use of the same value repeatedly.

[0010] The security of authentication encryption algorithms includes concealment and integrity. The definitions of concealment and integrity are described in non-patent literature 4.

[0011] Anonymity defines security by ensuring that plaintext is not leaked from ciphertext. In the game of anonymity security, an attacker accesses either the encryption function Enc of the authentication encryption algorithm or the Oracle that outputs random numbers; the attacker must identify which one has been accessed. The probability of the attacker identifying this is called the identification probability. The lower the identification probability, the higher the anonymity security.

[0012] Integrity defines the security of publicly available data or ciphertext as unalterable. In the game of integrity security, the goal is for an attacker to access the encryption function `Enc` and decryption function `Dec` of an authentication encryption algorithm, inputting forged publicly available data, ciphertext, and authentication tokens into `Dec`, and successfully passing the tampering check. The probability of passing the tampering check is called the forgery probability. The lower the forgery probability, the higher the integrity security.

[0013] One method for constructing authentication encryption algorithms is using block encryption.

[0014] Block encryption E is a function that takes a k-bit key component X and an n-bit input block Y as input and outputs an n-bit output block Z. It is denoted as Z = E(X, Y). When the key X is fixed, block encryption E becomes an n-bit permutation function.

[0015] Block encryption includes, for example, AES as described in Non-Patent Document 2 and Skinny as described in Non-Patent Document 3. AES is an abbreviation for Advanced Encryption Standard.

[0016] In the operation of the authentication encryption algorithm, a secret value that depends on the secret key and a public value that does not depend on the secret key are used.

[0017] The (d+1)-order masking described in non-patent documents 1, 4-7, etc., is a countermeasure installation method against side-channel attacks. In (d+1)-order masking, to protect the secret key, the secret value is divided into d+1 values. When the secret value is v bits, it is divided into d+1 v-bit values ​​through masking. This results in a structure where the original secret value cannot be recovered without obtaining all d+1 secret values. The secret value in the masking installation is calculated while it is divided into d+1 values. Therefore, the smaller the size of the secret value, the smaller the size of the masking installation.

[0018] The minimum size of the secret value is explained below. Let's define the desired security level of the authentication encryption algorithm as 's' bits, and the plaintext block size as 'b' bits. The secret value needed to encrypt each 'b' bit plaintext block is different from the 's' bit secret value. Therefore, the minimum size is 's + b' bits.

[0019] Security level s is designed to allow multiple methods to be 128 bits or more. Furthermore, the plaintext block size b is a value greater than 1.

[0020] Patent document 1 and non-patent document 8 describe an authentication encryption method using block encryption. For a target security level s, the secret value of this authentication encryption is 2s bits, and the plaintext block size is b = s bits. The secret value is minimized only when the plaintext block size is b = s bits; the plaintext block size cannot be outside the range of b = s bits.

[0021] Non-patent document 9 describes an authentication encryption method using block encryption. For a target security level s, the secret value of this authentication encryption is 1.5s bits, and the plaintext block size is b = 0.5s. The block size is minimized only when the plaintext block size is b = 0.5s bits; the plaintext block size cannot be outside the range of b = 0.5s bits.

[0022] Existing technical documents

[0023] Patent documents

[0024] Patent Document 1: International Publication No. 2022-215249

[0025] Non-patent literature

[0026] Non-patent literature 1: Hannes Gross, Stefan Mangard, and Thomas Korak. Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order. IACR ePrint 2016 / 486, 2016.

[0027] Non-patent document 2: National Institute of Standards and Technology (NIST). Announcing the Advanced Encryption Standard (AES). FIPS PUB 197, 2001.

[0028] Non-Patent Document 3: Christof Beierle, Jeremy Jean, Stefan Kolbl, Gregor Leander, Amir Mordi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim. The SKINNY family of block ciphers and its low-latency variant MANTIS. In CRYPTO 2016, pages 123-153, LNCS volume 9815, Springer, 2016.

[0029] Non-Patent Document 4: Tetsu Iwata, Keisuke Ohashi, and Kazuhiko Minematsu. Breaking and Repairing GCM Security Proofs. CRYPTO 2012, Proceedings. pages 31-49. LNCS volume 7417. Springer. 2012.

[0030] Non-Patent Document 5: Svetla Nikova, Christian Rechberger, and Vincent Rijmen. Threshold implementations against side-channel attacks and glitches. In Information and Communications Security, 8th International Conference, ICICS 2006, pages 529-545, LNCS volume 4307. Springer. 2006.

[0031] Non-Patent Document 6: Oscar Reparaz, Begul Bilgin, Svetla Nikova, Benedikt Gierlichs, and Ingrid Verbauwhde. Consolidating masking schemes. In CRYPTO 2015, LNCS volume 9215, pages 764-783, Springer, 2015.

[0032] Non-patent document 7: Gaetan Cassiers, Benjamin Gregoire, Itamar Levi, and Francois-Xavier Standaert. Hardware private circuits: From trivialcomposition to full verification. IEEE Trans. Computers, 70(10): 1677-1690,2021.

[0033] Non-patent document 8: Yusuke Naito, Yu Sasaki, Takeshi Sugawara. AES-LBBB: AESMode for Lightweight and BBB-Secure Authenticated Encryption. IACR Trans.Cryptogr. Hardw. Embed. Syst. 2021 (3): 298-333 (2021).

[0034] Non-Patent Document 9: Yusuke Naito, Yu Sasaki, and Takeshi Sugawara. Secret CanBe Public: Low-Memory AEAD Mode for High-Order Masking. CRYPTO2022: page 315-345. Summary of the Invention

[0035] The problem that the invention aims to solve

[0036] For a target security level s and a plaintext block size b, there exists an authenticated encryption that uses the block encryption with the smallest secret value only when b=s or b=0.5s.

[0037] The purpose of this disclosure is to enable a structure that allows the secret value to be set to a minimum of s+b bits when the plaintext block size b is set to any value.

[0038] Methods for solving problems

[0039] The authentication encryption apparatus disclosed herein comprises: an initial processing unit that generates a secret value B based on a secret key in authentication encryption; a function F processing unit that updates the secret value B by using the secret value B generated by the initial processing unit as an input block for block encryption; and a ciphertext processing unit that uses the secret value B updated by the function F processing unit to perform at least one of encrypting plaintext M and decrypting ciphertext C.

[0040] Invention Effects

[0041] In this disclosure, the secret value B is used as the input block for block encryption, and the secret value B is updated through block encryption. Thus, even when the plaintext block size b is set to an arbitrary value, it is possible to achieve a structure that sets the secret value to a minimum of s+b bits.

[0042] By setting b < 0.5s, masked installation is performed using block encryption as described in Non-Patent Documents 2 and 3. Therefore, compared to masked installation using the methods described in Patent Document 1 and Non-Patent Documents 8 and 9, the installation size can be reduced. Attached Figure Description

[0043] Figure 1 This is a structural diagram of the authentication encryption device 10 according to Embodiment 1.

[0044] Figure 2 This is an explanatory diagram of block encryption E in implementation method 1.

[0045] Figure 3 This is an explanatory diagram of function F in implementation method 1.

[0046] Figure 4 This is a flowchart of the processing of function F in implementation method 1.

[0047] Figure 5 This is a flowchart illustrating the processing of the encryption function Enc in Implementation Method 1.

[0048] Figure 6 This is a flowchart of the initial processing in the encryption function Enc of Implementation Method 1.

[0049] Figure 7 This is an explanatory diagram of the header processing in the encryption function Enc of Implementation Method 1.

[0050] Figure 8 This is a flowchart of the header processing in the encryption function Enc of Implementation Method 1.

[0051] Figure 9 This is an explanatory diagram of the main processing in the encryption function Enc of Implementation Method 1.

[0052] Figure 10This is a flowchart of the main processing in the encryption function Enc of Implementation Method 1.

[0053] Figure 11 This is an explanatory diagram of the authentication process in the encryption function Enc of Implementation Method 1.

[0054] Figure 12 This is a flowchart of the authentication process in the encryption function Enc of Implementation Method 1.

[0055] Figure 13 This is an explanatory diagram of the main processing in the decryption function Dec of Implementation Method 1.

[0056] Figure 14 This is a flowchart of the main processing in the decryption function Dec of Implementation Method 1.

[0057] Figure 15 This is a flowchart of the authentication process in the decryption function Dec of Implementation Method 1.

[0058] Figure 16 This is a structural diagram of the authentication encryption device 10 in Modified Example 1.

[0059] Figure 17 This is a diagram illustrating the structure of the authentication encryption device 10 in Modified Example 1. Detailed Implementation

[0060] Implementation method 1. Structural description

[0061] Reference Figure 1 The structure of the authentication encryption device 10 in Implementation Method 1 will be explained.

[0062] The authentication encryption device 10 is a computer.

[0063] The authentication and encryption device 10 includes hardware such as a processor 11, memory 12, storage 13, and a communication interface 14. The processor 11 is connected to other hardware via signal lines and controls these other hardware components.

[0064] Processor 11 is the IC that performs processing. IC is an abbreviation for Integrated Circuit. Specifically, processor 11 may be a CPU, DSP, or GPU. CPU is an abbreviation for Central Processing Unit. DSP is an abbreviation for Digital Signal Processor. GPU is an abbreviation for Graphics Processing Unit.

[0065] Memory 12 is a storage device for temporary data storage. Specifically, memory 12 is SRAM or DRAM. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0066] Memory 13 is a storage device for storing data. As a specific example, memory 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. Alternatively, memory 13 can also be a removable recording medium such as an SD (trademarked) memory card, CompactFlash (trademarked), NAND flash memory, floppy disk, optical disc, compact disc, Blu-ray disc, or DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0067] Communication interface 14 is an interface used for communicating with external devices. Specifically, communication interface 14 is a port for Ethernet (registered trademark), USB, or HDMI (registered trademark). USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition Multimedia Interface.

[0068] As functional structural elements, the authentication and encryption device 10 includes an initial processing unit 21, a function F processing unit 22, a ciphertext processing unit 23, and an authentication processing unit 24. The ciphertext processing unit 23 includes an encryption processing unit 231 and a decryption processing unit 232. The functions of each functional structural element of the authentication and encryption device 10 are implemented through software.

[0069] The memory 13 stores a program that implements the functions of each functional structural element of the authentication and encryption device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. Thus, the functions of each functional structural element of the authentication and encryption device 10 are implemented.

[0070] exist Figure 1 Only one processor 11 is shown in the diagram. However, there can be multiple processors 11, and multiple processors 11 can cooperate to execute programs that implement various functions.

[0071] Description of the action

[0072] Reference Figures 2-15This explains the operation of the authentication encryption device 10 in Implementation Method 1.

[0073] The operation steps of the authentication encryption device 10 in Embodiment 1 are equivalent to the authentication encryption method in Embodiment 1. Furthermore, the program that implements the operation of the authentication encryption device 10 in Embodiment 1 is equivalent to the authentication encryption program in Embodiment 1.

[0074] As a premise

[0075] The operator shown in Equation 1 represents the XOR operator.

[0076] [Formula 1]

[0077] 0 i Let the i-bit string be 0, and set 1 to 0. i Set the i-bit string to 1.

[0078] For a bit string X, let the bit length of X be |X|. When X is an empty column, |X| = 0.

[0079] For two bit strings X and Y, set X||Y as the bit string that combines the bits of Y after X.

[0080] The function f is a scatter function that takes a one-time random number N, a count value ctr, and a split value w as input and outputs a c-bit value. That is, if (N, ctr, w) ≠ (N', ctr', w'), then the function f is a function that makes f(N, ctr, w) ≠ f(N', ctr', w').

[0081] As an example of function f, we have a function where c1, c2, and c3 are set as c = c1 + c2 + c3, N is set as c1 bits, ctr is set as c2 bits, and w is set as c3 bits, and f(N, ctr, w) = N||ctr||w.

[0082] In the following examples, `ctr` and `w` are represented as integers. In actual use, they are converted to bit strings.

[0083] The function ozp[i] takes a value of less than i bits as input and outputs a value of i bits. The function ozp[i] is injective for inputs of less than i-1 bits.

[0084] As an example of the function ozp[i], there is the following function. For a value V of more than 1 bit and less than i - 1 bits, 1 bit is combined after V, and then a bit string of 0s is combined in a way that the bit length is i. The value thus obtained is used as the output of the function ozp[i](V). For a value V of i bits, the value V is used as the output of the function ozp[i](V). For an empty string V, 0 i is used as the output of the function ozp[i](V).

[0085] The function zp[i] is a function that takes a value of i bits or less as input and outputs a value of i bits. The function zp[i] outputs different values for two input values of the same bit length but different.

[0086] As an example of the function zp[i], there is the following function. For a value V of i - 1 bits or less, the value obtained by combining a bit string of 0s in a way that the bit length is i after V is used as the output of the function zp[i](V). For a value V of i bits, the value V is used as the output of the function zp[i](V).

[0087] The function tr[i] is a function that outputs a specified i bits in the input bit string when the input is a bit string of i bits or more. As an example of the function tr[i], there is a function that outputs the high-order i bits or the low-order i bits of the input bit string.

[0088] The function tr[i] is an injective function when the input is a bit string of more than 1 bit and less than i - 1 bits. As an example of the function tr[i], there are the functions cited as examples of the function zp[i] or the function ozp[i].

[0089] Let b be an integer satisfying 0 < b ≤ n. n is the size of the input block of the block cipher. Let t be an integer satisfying 0 < t. Let r be an integer satisfying 0 < r. Let w be an integer satisfying t / b ≤ w. Let the length of the encryption key of the block cipher be k = r + c.

[0090] Function F

[0091] The authenticated encryption device 10 uses the function F to construct authenticated encryption. In the function F, the block cipher E is used.

[0092] Refer to Figure 2 to describe the block cipher E in Embodiment 1.

[0093] The block cipher E is a function that takes a k-bit key component X and an n-bit input block Y as input and outputs an n-bit output block Z. This block cipher E is as Figure 2 shown.

[0094] Reference Figure 3 and Figure 4 This describes the function F in Implementation Method 1.

[0095] Function F takes an r-bit value T, an n-bit value B, a one-time random number N, a count value ctr, and a segmentation value w as input, and outputs an r-bit value T' and an n-bit value B'. That is, (T', B') = F(N, ctr, w, T, B). The count value ctr is set to a different value for each process. Function F is processed by function F processing unit 22.

[0096] The processing of function F will be explained in detail.

[0097] (Step S101: B Update Process)

[0098] The function F processing unit 22 takes the value obtained by combining the one-time random number N, the count value ctr, and the segmentation value w into the output value after the value T as the key component of the block encryption E. Furthermore, the function F processing unit 22 takes the value B as the input block of the block encryption E. Then, the function F processing unit 22 calculates the block encryption E, thereby updating the value B and generating the value B'.

[0099] (Step S102: T update process)

[0100] The processing unit 22 of function F updates value T and generates value T' by XORing the output value obtained by inputting value B' into function tr[r] with value T.

[0101] (Step S103: Output processing)

[0102] The function F processing unit 22 outputs a group of r-bit values ​​T' and n-bit values ​​B'.

[0103] Encryption function Enc

[0104] The encryption function Enc in the authentication encryption implemented by the authentication encryption device 10 of Embodiment 1 is explained.

[0105] The input values ​​to the encryption function Enc are an r+n bit secret key K, a one-time random number N, a header A, and plaintext M. The header A can also be an empty column. Furthermore, the plaintext M can also be an empty column.

[0106] like Figure 5 As shown, the encryption function Enc executes initial processing, header processing, main processing, and authentication processing sequentially. The following explains the initial processing, header processing, main processing, and authentication processing.

[0107] <Initial Processing>

[0108] Reference Figure 6 This section explains the initial processing in the encryption function Enc of Implementation Method 1.

[0109] The initial processing in the encryption function Enc is the processing of values ​​used in the processing described later.

[0110] (Step S11: Key component setting process)

[0111] The initial processing unit 21 sets the high-order r bits of the secret key K as key component K1 and the low-order n bits as key component K2. Furthermore, the initial processing unit 21 sets the high-order b bits of key component K2 as key component K21 and the remaining nb bits as key component K22. That is, K = K1||K2, K2 = K21||K22.

[0112] The initial processing unit 21 may also extract key component K1 as a predetermined r bits of the secret key K, and key component K2 as the remaining n bits of the secret key K. Furthermore, the initial processing unit 21 may also extract key component K21 as a predetermined b bits of key component K2, and key component K22 as the remaining nb bits of key component K2.

[0113] The initial processing unit 21 sets key component K1 to the value IVt and key component K2 to the value IVb. Values ​​IVt and IVb are used in the header processing.

[0114] (Step S12: Segmentation)

[0115] The initial processing unit 21 divides the header A and plaintext M.

[0116] Specifically, the initial processing unit 21 divides the header A into header elements A[1], A[2], ..., A[a] starting from the beginning and dividing it into plaintext elements M[1], M[2], ..., M[m ...].

[0117] When header A is not an empty column, header elements A[1], A[2], ..., A[a-1] are n-bit values, and header element A[a] is a value of more than 1 bit and less than n bits. Header A is the value formed by combining the bits of header elements A[1], A[2], ..., A[a]. When header A is an empty column, let a=1, and set header element A[1] as an empty column.

[0118] When plaintext M is not an empty column, plaintext elements M[1], M[2], ..., M[m-1] are b-bit values, and plaintext element M[m] is a value between 1 bit and b bits. Plaintext M is the value formed by combining the plaintext elements M[1], M[2], ..., M[m]. When plaintext M is an empty column, let m=1, and set plaintext element M[1] as an empty column.

[0119] <Head Processing>

[0120] Reference Figure 7 and Figure 8 This explains the header processing in the encryption function Enc of Implementation Method 1.

[0121] The header processing in the encryption function Enc is as follows: using the values ​​IVt and IVb set in the initial processing, the header elements A[1], A[2], ..., A[a] generated in the initial processing are processed to generate the values ​​Ht, Hb and the segmentation value dA.

[0122] (Step S21: Initial value setting process)

[0123] The function F processing unit 22 sets the value IVt to the value T. [0] Set the value IVb to the value B [0].

[0124] (Step S22: Function F processing)

[0125] When the value a, which is the number of segments in the head A, is greater than 1, the function F processing unit 22 performs the following processing (1) and (2) on each integer i = 1, ..., a-1 in ascending order. On the other hand, when the value a, which is the number of segments in the head A, is 1, the function F processing unit 22 processes the value T... [0] is set to value T [a-1], value B [0] is set to value B [a-1].

[0126] (1) Function F's processing unit 22 will compare the value A[i] with the value B. The XOR of [i-1] is set to the value B. [i-1].

[0127] (2) Function F processing unit 22 will process a one-time random number N, an integer i, 0, and a value T. [i-1] and the value B Using [i-1] as input, compute the function F, thereby generating the value T. [i] Sum of values ​​B [i].

[0128] Here, the value T [0] Sum B [0] is a secret value generated based on the secret key in authenticated encryption. That is, the function F processing unit 22 will use the secret value T [i - 1], the one-time random number N, the value i of the counter ctr, and the value generated by the division number (here 0) are set as the key components of the block cipher E. In addition, the function F processing unit 22 sets the secret value B[i - 1] as the input block of the block cipher E. Then, the function F processing unit 22 updates the secret value T [i - 1] and the secret value B [i - 1], generating the secret value T [i] and the secret value B [i].

[0129] (Step S23: Value B update process)

[0130] The function F processing unit 22 sets the exclusive OR of the output value and the value B [a - 1] as the value B [a], and the output value is obtained by inputting the value A[i] into the function ozp[n]. In addition, the function F processing unit 22 sets the value T [a - 1] as the value T [a].

[0131] (Step S24: Value dA setting process) ]

[0132] The function F processing unit 22 sets the value dA according to whether |A[a]| = n. In Embodiment 1, the function F processing unit 22 sets 1 as the value dA when |A[a]| = n. The function F processing unit 22 sets 2 as the value dA when |A[a]| < n.

[0133] (Step S25: Output value setting process)

[0134] The function F processing unit 22 sets the value T [a] as the value Ht, and sets the value B [a] as the value Hb.

[0135] The function F processing unit 22 may also update the value T[i-1] with a permutation of r bits P1 before step S22(1). Similarly, the function F processing unit 22 may also update the value B[i-1] with a permutation of n bits P2 before step S22(1). Furthermore, the function F processing unit 22 may also update the value T[i] with a permutation of r bits P1' after step S22(2). Similarly, the function F processing unit 22 may also update the value B[i] with a permutation of n bits P2' after step S22(2). In addition, other operations such as addition, subtraction, and multiplication may be used instead of XOR used in the head processing.

[0136] <Main Processor>

[0137] Reference Figure 9 and Figure 10 This describes the main processing in the encryption function Enc of Implementation Method 1.

[0138] The main processing in the encryption function Enc is as follows: using the values ​​Ht, Hb and dA set in the header processing, the plaintext elements M[1], M[2], ..., M[m] generated in the initial processing are processed to generate the values ​​St, Sb, dM and ciphertext C.

[0139] Furthermore, the function h in the following processing is an n-bit permutation. As a function h, Equation 2 provides a unique solution for the variable Z for the n-bit values ​​S and Z.

[0140] [Equation 2]

[0141] For example, the function h has a way of using multiplication of the generating source on GF(2n). That is, when the generating source is u, h(Z) = u·Z.

[0142] (Step S31: Initial value setting process)

[0143] The function F processing unit 22 sets the value Ht to the value T[0] and the value Hb to the value B[0].

[0144] (Step S32: Function F processing)

[0145] When plaintext element M[1] is not an empty column, the function F processing unit 22 performs the following (1) to (3) processing for each integer i=1, ...,m in ascending order. On the other hand, when plaintext element [1] is an empty column, the function F processing unit 22 sets the value T[0] to the value T[m] and sets the value B[0] to the value B[m].

[0146] (1) The function F processing unit 22 takes a one-time random number N, an integer i, a value dA, a value T[i-1] and a value B[i-1] as input, calculates the function F, and generates the value T[i] and the value B[i].

[0147] Here, the values ​​T[0] and B[0] are secret values ​​updated through header processing. That is, the function F processing unit 22 sets the value generated using the secret value T[i-1], the one-time random number N, the value i as the count value ctr, and the number of segments (dA in this case) as the key components of the block encryption E. In addition, the function F processing unit 22 sets the secret value B[i-1] as the input block of the block encryption E. Then, the function F processing unit 22 updates the secret value T[i-1] and the secret value B[i-1] through the block encryption E, generating the secret value T[i] and the secret value B[i].

[0148] (2) The encryption processing unit 231 of the ciphertext processing unit 23 uses the secret value B[i] generated by the function F processing unit 22 to update the secret value B[i-1] to generate the encryption element C[i].

[0149] Specifically, the encryption processing unit 231 sets the XOR operation of the output value obtained by inputting the value B[i] to the function tr[|M[i]|], the output value obtained by inputting the value K21 to the function tr[|M[i]|], and the plaintext element M[i] as the encryption element C[i]. Furthermore, when the integer i ≠ m, since |M[i]| is b bits, there is no need to use the function tr[|M[i]|] to convert the value K21. That is, it is the same whether the value K21 is directly used as the XOR input, rather than the output value obtained by inputting the value K21 to the function tr[|M[i]|].

[0150] (3) The function F processing unit 22 sets the value B[i] as the XOR of the output value obtained by inputting the input value B[i] to the function h and the output value obtained by inputting the plaintext element M[i] to the function ozp[b] and then inputting it to the function zp[n]. In addition, when the integer i ≠ m, since |M[i]| is b bits, there is no need to use the function ozp[b]. That is, it is the same whether the plaintext element M[i] is directly used as the input of the function zp[n] instead of the output value obtained by inputting the plaintext element M[i] to the function ozp[b].

[0151] (Step S33: Output value setting process)

[0152] The function F processing unit 22 sets the value T[m] to the value St and the value B[m] to the value Sb.

[0153] (Step S34: Value dM processing)

[0154] The function F processing unit 22 sets the value dM according to whether |M[m]| = b. In Embodiment 1, when |M[m]| = b, the function F processing unit 22 sets 3 as the value dM. When |M[m]| < b, the function F processing unit 22 sets 4 as the value dM.

[0155] (Step S35: Ciphertext generation process)

[0156] The encryption processing unit 231 of the ciphertext processing unit 23 combines the encryption elements C[1],..., C[m] bits generated in (2) of Step S32 to generate the ciphertext C. For example, the encryption processing unit 231 sets the ciphertext C = C[1]||C[2]||...||C[m].

[0157] The processing in (2) of Step S32 and the processing in Step S35 are encryption processes. In the encryption process, for each integer i of i = 1,..., m, the encryption processing unit 231 generates the encryption element C[i] according to the secret value B[i] generated by the function F processing unit 22. Then, the encryption processing unit 231 uses the encryption elements C[i] for each integer i of i = 1,..., m to generate the ciphertext C obtained by encrypting the plaintext M.

[0158] The function F processing unit 22 can also update the value T[i - 1] with a certain r-bit permutation before (1) of Step S32. Similarly, the function F processing unit 22 can also update the value B[i - 1] with a certain n-bit permutation before (1) of Step S32. In addition, the function F processing unit 22 can also update the value T[i] with a certain r-bit permutation after (3) of Step S32. Similarly, the function F processing unit 22 can also update the value B[i] with a certain n-bit permutation after (3) of Step S32. In addition, other operations such as addition, subtraction, and multiplication can be used instead of the exclusive OR used in the main process.

[0159] <Authentication process>

[0160] Refer to Figure 11 and Figure 12 , and explain the authentication process in the encryption function Enc of Embodiment 1.

[0161] The authentication process in the encryption function Enc is a process of generating the authentication tag Tag using the values St, Sb, and dM set in the main process.

[0162] (Step S41: Initial value setting process)

[0163] The function F processing unit 22 sets the value St as the value T’[0] and sets the value Sb as the value B’[0].

[0164] (Step S42: Function F processing)

[0165] The processing unit 22 of function F performs the following processing (1) and (2) on each integer i = 1, ..., w in ascending order. w is a pre-set value.

[0166] (1) The function F processing unit 22 takes a one-time random number N, an integer i, a value dM, a value T'[i-1] and a value B'[i-1] as input, calculates the function F, and generates the value T'[i] and the value B'[i].

[0167] Here, the values ​​T'[0] and B'[0] are the secret values ​​updated in the main processing. That is, the function F processing unit 22 sets the value generated using the secret value T'[i-1], the one-time random number N, the value i as the count value ctr, and the number of segments (dM in this case) as the key components of the block encryption E. In addition, the function F processing unit 22 sets the secret value B'[i-1] as the input block of the block encryption E. Then, the function F processing unit 22 updates the secret values ​​T'[i-1] and B'[i-1] through the block encryption E, generating the secret values ​​T'[i] and B'[i].

[0168] (2) The authentication processing unit 24 sets the XOR of the output value obtained by inputting the secret value B'[i] into the function tr[b] and the value K21 as the authentication element Tag[i].

[0169] (Step S43: Authentication token generation process)

[0170] The authentication processing unit 24 combines the authentication element bits Tag[1], ..., Tag[w] generated in step S42 (2) to generate an authentication symbol Tag. For example, the authentication processing unit 24 sets the authentication symbol Tag=tr[t] (Tag[1]||...||Tag[w]).

[0171] Decryption function Dec

[0172] The decryption function Dec, implemented by the authentication encryption device 10 of Embodiment 1, is explained.

[0173] The input values ​​to the decryption function Dec are an r+n bit secret key K, a one-time random number N, a header A, ciphertext C, and a tamper detection token Tag'. Here, the tamper detection token Tag' provided as the input value to the decryption function Dec is the tamper detection token Tag generated by the encryption function Enc. To distinguish it from the tamper detection token Tag generated in the following description, the tamper detection token provided as the input value to the decryption function Dec will be referred to as tamper detection token Tag'.

[0174] In the decryption function Dec, similarly to the encryption function Enc, initial processing, header processing, main processing, and authentication processing are executed sequentially. The initial processing, main processing, and authentication processing are explained below. The header processing is the same as in the encryption function Enc.

[0175] <Initial Processing>

[0176] Reference Figure 6 This explains the initial processing in the decryption function Dec of Implementation Method 1.

[0177] The initial processing in the decryption function Dec is the processing of values ​​used in the processing described later.

[0178] The processing in step S11 is the same as that in the case of the encryption function Enc.

[0179] (Step S12: Segmentation)

[0180] The initial processing unit 21 divides the header A and the ciphertext C.

[0181] Specifically, similar to the case of the encryption function Enc, the initial processing unit 21 divides the header A into header elements A[1], A[2], ..., A[a]. In addition, the initial processing unit 21 divides the ciphertext C into encryption elements C[1], C[2], ..., C[m] starting from the beginning and dividing it into b bits each.

[0182] When the ciphertext C is not an empty column, the encrypted elements C[1], C[2], ..., C[m-1] are the values ​​of b bits, and the encrypted element C[m] is a value of more than 1 bit and less than b bits. The ciphertext C is the value formed by combining the bits of the encrypted elements C[1], C[2], ..., C[m]. When the ciphertext C is an empty column, let m=1, and set the encrypted element C[1] as an empty column.

[0183] <Main Processor>

[0184] Reference Figure 13 and Figure 14 This explains the main processing in the decryption function Dec of Implementation Method 1.

[0185] The main processing in the decryption function Dec is as follows: using the values ​​Ht, Hb and dA set in the header processing, the encrypted elements C[1], C[2], ..., C[m] generated in the initial processing are processed to generate the values ​​St, Sb, dM and plaintext M.

[0186] In addition, similar to the function h used in the main processing in the encryption function Enc, the function h in the following processing is an n-bit permutation.

[0187] Processing in step S51 and Figure 10The processing in step S31 is the same. In addition, the processing in step S53 is the same as Figure 10 the processing in step S33.

[0188] (Step S52: Function F processing)

[0189] When the encryption element C[1] is not an empty column, the function F processing unit 22 performs the following processes (1) to (3) in ascending order for each integer i = 1,..., m.

[0190] The process of (1) is the same as Figure 10 the process of (1) in step S32. In addition, the process of (3) is the same as Figure 10 the process of (3) in step S32.

[0191] (2) The decryption processing unit 232 of the ciphertext processing unit 23 generates the plaintext element M[i] using the secret value B[i] generated by updating the secret value B[i - 1] by the function F processing unit 22.

[0192] Specifically, the decryption processing unit 232 sets the exclusive OR of the output value obtained by inputting the value B[i] to the function tr[|C[i]|], the output value obtained by inputting the value K21 to the function tr[|C[i]|], and the encryption element C[i] as the plaintext element M[i]. In addition, when the integer i ≠ m, since |C[i]| is b bits, it is not necessary to convert the value K21 using the function tr[|C[i]|]. That is, instead of the output value obtained by inputting the value K21 to the function tr[|C[i]|], directly using the value K21 as the input of the exclusive OR is the same.

[0193] (Step S54: Value dM processing)

[0194] The function F processing unit 22 sets the value dM according to whether |C[m]| = b. In Embodiment 1, when |C[m]| = b, the function F processing unit 22 sets 3 as the value dM. When |C[m]| < b, the function F processing unit 22 sets 4 as the value dM.

[0195] (Step S55: Plaintext generation processing)

[0196] The decryption processing unit 232 of the ciphertext processing unit 23 combines the plaintext elements M[1],..., M[m] bits generated in (2) of step S52 to generate the plaintext M. For example, the decryption processing unit 232 sets the plaintext M = M[1]||M[2]||...||M[m].

[0197] Step S52 (2) and step S55 are decoding processes. In the decryption process, the decryption processing unit 232 generates plaintext element M[i] for each integer i = 1, ..., m, based on the secret value B[i] generated by the function processing unit 22 F. Then, the decryption processing unit 232 uses the plaintext element M[i] for each integer i = 1, ..., m to generate plaintext M obtained by decrypting the ciphertext C.

[0198] The function F processing unit 22 can also update the value T[i-1] by a permutation of some r bits before step S52 (1). Similarly, the function F processing unit 22 can also update the value B[i-1] by a permutation of some n bits before step S52 (1). Furthermore, the function F processing unit 22 can also update the value T[i] by a permutation of some r bits after step S52 (3). Similarly, the function F processing unit 22 can also update the value B[i] by a permutation of some n bits after step S52 (3). In addition, other operations such as addition, subtraction, and multiplication can be used instead of XOR used in the main processing.

[0199] <Authentication Processing>

[0200] Reference Figure 15 This explains the authentication process in the decryption function Dec of Implementation Method 1.

[0201] (Step S61: Authentication token generation process)

[0202] The authentication encryption device 10 performs the authentication process described in the encryption function Enc. Figure 12 The processing in steps S41 to S43. As a result, the authentication encryption device 10 generates an authentication token (Tag).

[0203] (Step S62: Tampering detection and processing)

[0204] The authentication processing unit 24 determines whether the authentication token Tag generated in step S61 is consistent with the authentication token Tag' provided as input.

[0205] If the authentication token Tag matches the authentication token Tag', the authentication processing unit 24 proceeds to step S63. On the other hand, if the authentication token Tag does not match the authentication token Tag', the authentication processing unit 24 proceeds to step S64.

[0206] (Step S63: Plaintext output processing)

[0207] The authentication processing unit 24 outputs the plaintext M generated in the main processing.

[0208] (Step S64: Processing forged information output)

[0209] The authentication processing unit 24 outputs a value indicating that the value has been forged, thus rejecting the application.

[0210] Effects of Implementation Method 1

[0211] As described above, the authentication encryption device 10 of Embodiment 1 uses the secret value B as the input block for block encryption and updates the secret value B through block encryption. Therefore, even when the plaintext block size b is set to an arbitrary value, a structure that minimizes the secret value to s+b bits can be achieved.

[0212] Specifically, if for the target security level s, the number of bits r and the number of bits n are set to r+n=s, then the authentication encryption implemented by the authentication encryption device 10 of Implementation Method 1 becomes s-bit secure authentication encryption.

[0213] The authentication encryption implemented by the authentication encryption device 10 of Embodiment 1 can be used as a tamper detection algorithm by setting the plaintext M and ciphertext C to empty columns.

[0214] The authentication encryption implemented by the authentication encryption device 10 in Embodiment 1 can use a random number of fixed length, which is the same as or less than the one-time random number, for one secret key K for authentication encryption. The XOR operation of this random number with the one-time random number is then used to obtain a new one-time random number. Furthermore, in addition to using a random number to update the one-time random number, a new count value can also be obtained by XORing a random number of fixed length, which is the same as or less than the count value, with each count value.

[0215] By updating the one-time random number and the count value using a one-time random number and an XOR operation between the count value and the random number, the multi-user security of the authentication encryption described in the following literature can also be guaranteed. A fixed random number is used for each key, and a different random number is used whenever the key is changed. (Reference: Viet Tung Hoang, Stefano Tessaro, Aishwarya Thiruvengadam: The Multi-user Security of GCM, Revisited: TightBounds for Nonce Randomization. CCS 2018. ACM. pp. 1429-1440.)

[0216] Furthermore, the security described in the background art with reference to non-patent document 4 is security for a single user.

[0217] Other structures

[0218] <Variation Example 1>

[0219] In Implementation Example 1, each functional structural element is implemented in software. However, as a variation 1, each functional structural element can also be implemented in hardware. Regarding this variation 1, the differences from Implementation Example 1 will be explained.

[0220] Reference Figure 16 This illustrates the structure of the authentication encryption device 10 in Modified Example 1.

[0221] When the various functional structural elements are implemented in hardware, the authentication and encryption device 10 includes an electronic circuit 15 to replace the processor 11, memory 12, and storage device 13. The electronic circuit 15 is a dedicated circuit that implements the functions of the various functional structural elements, memory 12, and storage device 13.

[0222] As for electronic circuit 15, it can be assumed to be a single circuit, a composite circuit, a programmable processor, a parallel programmable processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), or a FPGA (Field-Programmable Gate Array).

[0223] Each functional structural element can be implemented through a single electronic circuit 15, or the functional structural elements can be distributed among multiple electronic circuits 15.

[0224] For example, such as Figure 17 As shown, the authentication encryption device 10 can be considered as an electronic circuit 15 comprising an initial processing processor that performs initial processing unit 21 processing, a function F processing processor that performs function F processing unit 22 processing, a ciphertext processing processor that performs ciphertext processing unit 23 processing, and an authentication processing processor that performs authentication processing unit 24 processing.

[0225] Furthermore, a block encryption processor for performing block encryption E can be prepared separately from the function F processing processor in the function F processing unit 22. Additionally, the ciphertext processing processor can be divided into an encryption processing processor that performs the encryption processing unit 231's processing and a decryption processing processor that performs the decryption processing unit 232's processing. Furthermore, the authentication processing processor can be divided into an authentication token generation processor that generates authentication tokens (Tags) and a tampering detection processor that performs tampering detection processing.

[0226] <Variation Example 2>

[0227] As a variation 2, some of the functional structural elements can be implemented in hardware, while other functional structural elements can be implemented in software.

[0228] The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are referred to as a processing circuit. That is, the functions of each functional structural element are implemented by the processing circuit.

[0229] <Variant Example 3>

[0230] In Embodiment 1, the authentication encryption device 10 implements both the encryption function Enc and the decryption function Dec. However, the authentication encryption device 10 may also implement only either the encryption function Enc or the decryption function Dec. When the authentication encryption device 10 implements only either the encryption function Enc or the decryption function Dec, the authentication encryption device 10 only needs to include the functional structural elements required for the implementation. Specifically, when the authentication encryption device 10 implements only the encryption function Enc, the decryption processing unit 232 of the ciphertext processing unit 23 is not required. In addition, when the authentication encryption device 10 implements only the decryption function Dec, the encryption processing unit 231 of the ciphertext processing unit 23 is not required.

[0231] In addition, the "unit" in the above description may be replaced with "circuit", "process", "sequence", "processing", or "processing circuit".

[0232] The embodiments and variant examples of the present disclosure have been described above. Several of these embodiments and variant examples may be implemented in combination. In addition, any one or several of them may be partially implemented. Further, the present disclosure is not limited to the above embodiments and variant examples, and various modifications can be made as needed.

[0233] Reference Signs Description

[0234] 10: Authentication encryption device; 11: Processor; 12: Memory; 13: Storage; 14: Communication interface; 15: Electronic circuit; 21: Initial processing unit; 22: Function F processing unit; 23: Ciphertext processing unit; 231: Encryption processing unit; 232: Decryption processing unit; 24: Authentication processing unit.

Claims

1. An authentication and encryption device, the authentication and encryption device comprising: The initial processing unit generates a secret value B based on the secret key used in the authentication encryption. Function F, a processing unit, takes the secret value B generated by the initial processing unit as the input block for block encryption and updates the secret value B through block encryption; and The ciphertext processing unit uses the secret value B updated by the function F processing unit to perform at least one of the processes of encrypting plaintext M and decrypting ciphertext C.

2. The authentication and encryption device according to claim 1, wherein, The initial processing unit generates an r-bit key component K1 extracted from the r+n-bit secret key, and generates an n-bit key component K2 remaining after extracting the key component K1 from the secret key, which serves as the secret value B. The function F processing unit uses the value T generated as the key component K1 as the key component of the block encryption, and updates the secret value B through the block encryption.

3. The authentication and encryption device according to claim 2, wherein, The function F processing unit uses a value generated by using a one-time random number provided as input in the authentication encryption, in addition to the value T, as a key component of the block encryption.

4. The authentication encryption device according to claim 2 or 3, wherein, The function F processing unit repeatedly performs the following processing: using the new secret value B generated by updating the secret value B as the input block of the block encryption, using the value generated by using the new value T as the key component of the block encryption, and updating the secret value B through the block encryption, wherein the new value T is generated based on the new secret value B and the value T.

5. The authentication and encryption device according to any one of claims 1 to 4, wherein, The function F processes the secret value B at a certain point in time as secret value B[0]. For each integer i = 1, ..., m, in ascending order, the secret value B[i-1] is used as the input block for block encryption. The secret value B[i-1] is updated through the block encryption to generate the secret value B[i]. The ciphertext processing unit uses the secret value B[i] of each integer i=1,...,m to perform at least one of the processes of encrypting plaintext M and decrypting ciphertext C.

6. The authentication and encryption device according to claim 5, wherein, The ciphertext processing unit performs at least one of encryption and decryption processes. In the encryption process, encryption elements C[i] are generated based on the secret value B[i] of each integer i = 1, ..., m and the plaintext elements M[i] obtained by dividing the plaintext M into m parts. Using the encryption elements C[i] of each integer i = 1, ..., m, ciphertext C is generated to encrypt the plaintext M. In the decryption process, plaintext element M[i] is generated based on the secret value B[i] of each integer i=1, ...,m and the encrypted element C[i] obtained by dividing the ciphertext C. The plaintext element M[i] of each integer i=1, ...,m is used to generate the plaintext M obtained by decrypting the ciphertext C.

7. The authentication and encryption device according to claim 6, wherein, In the encryption process, the ciphertext processing unit generates the encryption element C[i] using key component K21 for each integer i = 1, ..., m, where key component K21 is at least a part of the initial value of the secret value generated by the initial processing unit. In the decryption process, the ciphertext processing unit generates the plaintext element M[i] for each integer i = 1, ..., m using key component K21, where key component K21 is at least a part of the initial value of the secret value generated by the initial processing unit.

8. The authentication and encryption device according to any one of claims 1 to 7, wherein, The function F processing unit uses the secret value B, which is used in the encryption of plaintext M or the decryption of ciphertext C by the ciphertext processing unit, as the input block for the block encryption, and further updates the secret value B through the block encryption. The authentication encryption device further includes an authentication processing unit that uses the secret value B, which is further updated by the function F processing unit, to generate an authentication token Tag.

9. The authentication and encryption device according to claim 8, wherein, The function F processing unit sets the secret value B used in the encryption of plaintext M or the decryption of ciphertext C by the ciphertext processing unit as secret value B'[0]. For each integer i=1,...,w, in ascending order, the secret value B'[i-1] is used as the input block for block encryption, and the secret value B'[i-1] is updated through the block encryption to generate secret value B'[i]. The authentication processing unit generates an authentication element Tag[i] using the secret value B'[i] for each integer i of i=1, ..., w, and generates the authentication symbol Tag using the authentication element Tag[i] for each integer i of i=1, ..., w.

10. The authentication encryption device according to claim 9, wherein, The authentication processing unit generates the authentication element Tag[i] for each integer i = 1, ..., w using key component K21, where key component K21 is at least a part of the initial value of the secret value generated by the initial processing unit.

11. The authentication and encryption device according to any one of claims 5 to 7, wherein, The function F processing unit performs the following header processing: after updating the secret value B generated by the initial processing unit using the header A provided as input in the authentication encryption, the updated secret value B is used as the input block for the block encryption, and the secret value B is updated through the block encryption. The function F processing unit sets the secret value B of the time point that was updated in the head processing as the secret value B[0].

12. The authentication and encryption device according to claim 11, wherein, The function F processing unit performs the following header processing: setting the secret value B generated by the initial processing unit as the secret value B. [0], for each integer i=1, ..., a-1 in ascending order, the secret value B is updated using the head element A[i] from the head element A[1], ..., A[a] obtained by dividing the head A into a parts. After [i-1], the updated secret value B will be... [i-1] serves as the input block for block encryption, through which the secret value B is updated. [i-1] generates the secret value B. [i], use header element A[a] to update secret value B. [a-1].

13. An authentication encryption method, wherein, The computer generates a secret value B based on the secret key used in the authentication encryption. The computer uses the secret value B as the input block for block encryption, and updates the secret value B through the block encryption. The computer uses the updated secret value B to perform at least one of the processes of encrypting plaintext M and decrypting ciphertext C.

14. An authentication encryption program that enables a computer to function as an authentication encryption device, the authentication encryption device performing the following processing: Initial processing involves generating a secret value B based on the secret key used in the authentication encryption. Function F processes the secret value B generated through the initial processing as the input block for block encryption, and updates the secret value B through block encryption; and The ciphertext processing involves using the updated secret value B processed by the function F to perform at least one of the processes of encrypting the plaintext M and decrypting the ciphertext C.

Images