Authenticated encryption setup, authenticated encryption method, and authenticated encryption program

Abstract

An initial processing unit (21) generates a secret value B as a secret key during authenticated encryption. A function-F processing unit (22) repeats a process of setting the secret value B generated by the initial processing unit (21) as an input block of a block cipher and updating the secret value B using the block cipher. A ciphertext processing unit (23) performs at least one process of encrypting a plaintext M and one process of decrypting a ciphertext C using the secret value B updated by the function-F processing unit (23).

Description

Technical field

[0001] The present disclosure relates to authenticated encryption using a block cipher or block encryption. Background on the state of the art

[0002] An authenticated encryption algorithm is an encryption algorithm that simultaneously provides confidentiality and tamper detection capabilities. Using an authenticated encryption algorithm allows two parties to communicate with each other in plaintext while maintaining confidentiality, and also allows a recipient to verify whether a message transmitted over a communication channel has been tampered with.

[0003] The Authenticated Encryption Algorithm comprises two algorithms: an encryption function Enc and a decryption function Dec.

[0004] The encryption function `Enc` is a function that takes as inputs a secret key `K`, a nonce `N`, a header `A`, and a plaintext `M`, and outputs a ciphertext `C` and an authenticator tag to detect manipulations. A different value is used for the nonce `N` in each encryption, and the same value is never used unless the secret key `K` is changed.

[0005] The decryption function `Dec` is a function that takes as inputs a secret key `K`, a nonce `N`, a header `A`, a ciphertext `C`, and an authenticator tag for manipulation detection. It outputs a plaintext `M` if the input values ​​have not been manipulated, and a value indicating forgery if the input values ​​have been manipulated. Hereinafter, a value indicating forgery is referred to as `reject`.

[0006] It is assumed that a sender, Alice, and a receiver, Bob, communicate using the Authenticated Encryption algorithm. Alice and Bob share a secret key K in advance.

[0007] The sender Alice computes the encryption function Enc using a secret key K, a nonce N, a header A, and a plaintext M as inputs to generate a ciphertext C and an authenticator tag for tamper detection. The sender Alice then sends the nonce N, the header A, the ciphertext C, and the authenticator tag to the receiver Bob.

[0008] The receiver Bob calculates the decryption function Dec using the secret key K, the nonce N, the header A, the ciphertext C and the authentication tag for manipulation detection as inputs to determine if no manipulation was detected, and generates the plaintext M if no manipulation has occurred.

[0009] The header A is a value that can be made public. The sender Alice sets the nonce N to a different value for each encryption and does not use the same value.

[0010] The security of the authenticated encryption algorithm encompasses confidentiality and correctness. The definitions of confidentiality and correctness are described in non-patent literature.4

[0011] Confidentiality is security defined as the inability to read plaintext from ciphertext. In a confidentiality security game, an attacker accesses one of the encryption functions (Enc) of the Authenticated Encryption algorithm and an oracle that generates a random number, and attempts to identify which function is being accessed. The probability of the attacker correctly identifying the function is called the identification probability. The lower the identification probability, the higher the level of confidentiality.

[0012] Correctness is a security measure that defines the immutability of public data or ciphertext. In a correctness security game, an attacker accesses the encryption function Enc and the decryption function Dec of the Authenticated Encryption algorithm, feeds forged public data, ciphertext, and authenticator into the decryption function Dec, and attempts to pass a tamper check. The probability of passing the tamper check is called the forgery probability. The lower the forgery probability, the higher the security of confidentiality.

[0013] One method for constructing an authenticated encryption algorithm is the use of a block cipher or block encryption.

[0014] A block cipher E is a function that takes as inputs a key component X of k bits and an input block Y of n bits, and outputs a block Z of n bits. This is expressed as Z = E(X, Y). If the key X is fixed, the block cipher E is a permutation of n bits.

[0015] Examples of block ciphers are AES, described in non-patent literature 2, Skinny, described in non-patent literature 3, and so on. AES is an abbreviation for Advanced Encryption Standard.

[0016] The Authenticated Encryption algorithm uses secret values ​​that depend on a secret key and public values ​​that do not depend on the secret key.

[0017] The (d+1) order masking described in non-patent literature 1, 4 to 7, etc., is a method for implementing countermeasures against side-channel attacks. In (d+1) order masking, a secret value is partitioned into d+1 values ​​to protect a secret key. If the secret value is v bits, it is partitioned into d+1 values ​​of v bits in a masking implementation. This is designed so that the original secret value cannot be recovered unless all d+1 secret values ​​are preserved. The masking implementation computes the secret value while it continues to partition into d+1 values. Thus, the smaller the size of the secret value, the smaller the size of the masking implementation.

[0018] The minimum size of a secret value is described. It is assumed that the security level to be achieved by the authenticated encryption algorithm is s bits and the plaintext block size is b bits. In addition to a secret value of s bits, a further secret value is needed to encrypt each plaintext block of b bits. Therefore, the minimum size is s + b bits.

[0019] The security level s is designed for 128 bits or higher in many models. The block size b of a plaintext is a value of 1 or greater.

[0020] Patent literature 1 and non-patent literature 8 describe an authenticated encryption using a block cipher. For the desired security level s, the size of a secret value in this authenticated encryption is 2s bits and the block size of a plaintext is b = s bits. The minimum size of a secret value is only achieved if the block size of a plaintext is b = s bits, and the block size of a plaintext cannot be in any range other than b = s bits.

[0021] Non-patent literature 9 describes an authenticated encryption using a block cipher. For the desired security level s, the size of a secret value in this authenticated encryption is 1.5s bits and the block size of a plaintext is b = 0.5s bits. The minimum size is only achieved if the block size of a plaintext is b = 0.5s bits, and the block size of a plaintext cannot be in any range other than b = 0.5s bits. Reference list patent literature

[0022] Patent literature 1: WO 2022-215249 A1 Non-patented literature Non-patent literature 1: Hannes Gross, Stefan Mangard and Thomas Korak. Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order. IACR ePrint 2016 / 486, 2016. Non-Patent Literature 2: National Institute of Standards and Technology (NIST). Announcing the Advanced Encryption Standard (AES). FIPS PUB 197, 2001. Non-Patent Literature 3: Christof Beierle, Jeremy Jean, Stefan Kolbl, Gregor Leander, Amir Moradi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim. The SKINNY family of block ciphers and its low-latency variant MANTIS. In CRYPTO2016, pages 123–153, LNCS Volume 9815, Springer, 2016. Non-patent literature 4: Tetsu Iwata, Keisuke Ohashi, and Kazuhiko Minematsu. Breaking and Repairing GCM Security Proofs. CRYPTO 2012, Proceedings. Pages 31–49. LNCS Volume 7417. Springer. 2012. Non-patent literature 5: Svetla Nikova, Christian Rechberger, and Vincent Rijmen. Threshold implementations against side-channel attacks and glitches. In Information and Communications Security, 8th International Conference, ICICS 2006, pages 529–545, LNCS Volume 4307. Springer. 2006. Non-patent literature 6: Oscar Reparaz, Begul Bilgin, Svetla Nikova, Benedikt Gierlichs and Ingrid Verbauwhede. Consolidating masking schemes. In CRYPTO 2015, LNCS Volume 9215, pages 764-783, Springer, 2015. Non-patent literature 7: Gaetan Cassiers, Benjamin Gregoire, Itamar Levi, and Francois-Xavier Standaert. Hardware private circuits: From trivial composition to full verification. IEEE Trans. Computer, 70 (10): 1677–1690, 2021. Non-Patent Literature 8: Yusuke Naito, Yu Sasaki, Takeshi Sugawara. AES-LBBB: AES Mode for Lightweight and BBB-Secure Authenticated Encryption. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2021 (3): 298-333 (2021). Non-Patent Literature 9: Yusuke Naito, Yu Sasaki and Takeshi Sugawara. Secret Can Be Public: Low-Memory AEAD Mode for High-Order Masking. CRYPTO2022: Pages 315-345. Summary of the invention: Technical problem

[0023] There is an authenticated encryption using a block cipher where, for the desired security level s and the block size b of a plaintext, the size of a secret value is only minimized if b = s or b = 0.5s.

[0024] The aim of the present disclosure is to enable the realization of a configuration that allows a secret value to be minimized to s + b bits when the block size b of a plaintext is set to an arbitrary value. Solution to the task

[0025] An authenticated encryption device according to the present disclosure comprises an initial processing unit for generating a secret value B from a secret key in authenticated encryption; a function-F processing unit for setting the secret value B generated by the initial processing unit as an input block of a block cipher and for updating the secret value B using the block cipher; and a ciphertext processing unit for executing at least one process of encrypting a plaintext M and a process of decrypting a ciphertext C using the secret value B updated by the function-F processing unit. Advantageous effects of the invention

[0026] In the present disclosure, a secret value B is set as the input block of a block cipher, and the secret value B is updated using the block cipher. This makes it possible to implement a configuration that allows a secret value to be minimized to s + b bits, even if a plaintext block size b is set to an arbitrary value.

[0027] If masking is implemented using the block ciphers described in non-patent literature 2 and 3 by setting b < 0.5s, the implementation size can be reduced compared to cases where masking is implemented using the methods described in patent literature 1 and non-patent literature 8 and 9. Brief description of the drawings Fig. Figure 1 is a configuration diagram of an authenticated encryption device 10 according to embodiment 1. Fig. Figure 2 is a representation describing a block cipher E according to embodiment 1. Fig. Figure 3 is a representation that describes a function F according to embodiment 1. Fig. 4 is a flowchart of processes of function F according to embodiment 1. Fig. Figure 5 is a flowchart illustrating the processes of an encryption function Enc according to embodiment 1. Fig. Figure 6 is a flowchart of an initial process in the encryption function Enc according to embodiment 1. Fig. Figure 7 is a representation that describes a header process in the encryption function Enc according to embodiment 1. Fig. Figure 8 is a flowchart of the header process in the encryption function Enc according to embodiment 1. Fig. Figure 9 is a representation that describes a main process in the encryption function Enc according to embodiment 1. Fig. Figure 10 is a flowchart of the main process in the encryption function Enc according to embodiment 1. Fig. Figure 11 is a representation that describes an authentication process in the encryption function Enc according to embodiment 1. Fig. Figure 12 is a flowchart of the authentication process in the encryption function Enc according to embodiment 1. Fig. Figure 13 is a representation that describes a main process in a decryption function Dec according to embodiment 1. Fig. Figure 14 is a flowchart of the main process in the decryption function Dec according to embodiment 1. Fig. Figure 15 is a flowchart of the authentication process in the decryption function Dec according to embodiment 1. Fig. Figure 16 is a configuration diagram of the Authenticated Encryption Setup 10 according to variant 1. Fig. Figure 17 is a representation showing an example of the configuration of the Authenticated Encryption Setup 10 according to variant 1. Description of embodiments Embodiment 1.*** Description of configuration ***

[0028] A configuration of an authenticated encryption device 10 according to embodiment 1 is described with reference to Fig. 1 described.

[0029] The Authenticated Encryption Facility 10 is a computer.

[0030] The authenticated encryption device 10 comprises a processor 11, a working memory 12, a storage device 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these other hardware components.

[0031] Processor 11 is an integrated circuit (IC) that performs processing. IC stands for Integrated Circuit. Specific examples of processor 11 are a CPU, a DSP, and a GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0032] Random Access Memory (RAM) is a storage device used to temporarily store data. Specific examples of RAM are SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0033] Memory 13 is a storage device used to store data. A specific example of memory 13 is an HDD. HDD stands for Hard Disk Drive. Alternatively, memory 13 can also be a portable recording medium, such as an SD memory card (registered trademark), CompactFlash (registered trademark), NAND flash memory, a flexible disk, an optical disc, a compact disc, a Blu-ray disc (registered trademark), or a DVD. SD stands for Secure Digital. DVD stands for Digital Versatile Disc.

[0034] Communication interface 14 is an interface for communicating with external devices. Specific examples of communication interface 14 are an Ethernet port (registered trademark), a USB port, and an HDMI port (registered trademark). USB stands for Universal Serial Bus. HDMI stands for High-Definition Multimedia Interface.

[0035] The Authenticated Encryption Device 10 comprises, as functional components, an initial processing unit 21, a function-F processing unit 22, a ciphertext processing unit 23, and an authentication processing unit 24. The ciphertext processing unit 23 comprises an encryption processing unit 231 and a decryption processing unit 232. The functions of the functional components of the Authenticated Encryption Device 10 are implemented by software.

[0036] Memory 13 stores programs that implement the functions of the functional components of the Authenticated Encryption Device 10. These programs are read into memory 12 by processor 11 and executed by processor 11. This is how the functions of the functional components of the Authenticated Encryption Device 10 are implemented.

[0037] In Fig. Figure 1 shows only a single processor 11. However, there can also be a multitude of processors 11, and these multiple processors 11 can work together to execute the programs that implement the functions. *** Description of a Functionality ***

[0038] In the Fig. Sections 2 to 15 describe the operation of the authenticated encryption device 10 according to embodiment 1.

[0039] A process for the operation of the authenticated encryption device 10 according to embodiment 1 corresponds to an authenticated encryption method according to embodiment 1. A program that implements the operation of the authenticated encryption device 10 according to embodiment 1 corresponds to an authenticated encryption program according to embodiment 1. **Previous Description**

[0040] The operator specified in Formula 1 is an exclusive OR operator.

[0041] 0 i Let be an i-bit string of 0, and 1 i Let be an i-bit string of 1.

[0042] For a bit sequence X, the bit length of X is denoted as |X|. If X is an empty string, |X| = 0.

[0043] For two bit sequences X and Y, let X | | Y be a bit sequence obtained by concatenating the bits of X and Y in this order.

[0044] A function f is a surjective function that takes as inputs a nonce N, a counter value ctr, and a division value w, and outputs a value of c bits. That is, if (N, ctr, w) ≠ (N', ctr', w'), then the function f is such that f(N, ctr, w) ≠ f(N', ctr', w').

[0045] An example of the function f is a function where c1, c2 and c3 = c1 + c2 + c3, N is c1 bits, ctr is c2 bits, w is c3 bits and f(N, ctr, w) = N | | ctr | | w.

[0046] In the following examples, ctr and w are expressed as integers. They must be converted to bit strings for actual use.

[0047] A function ozp[i] is a function that takes an input value of i bits or less and outputs a value of i bits. The function ozp[i] is injective for inputs of i - 1 bits or less.

[0048] An example of the function `ozp[i]` is the following function. For a value V between 1 bit and i - 1 bits, the output of the function `ozp[i](V)` is a value obtained by concatenating a bit from 1 to V and then concatenating a bit string from 0 to i, so that the bit length is i. For a value V with i bits, the output of the function `ozp[i](V)` is the value V. For an empty string V, the output of the function `ozp[i](V)` is 0. i .

[0049] A function zp[i] is a function that takes an input value of i bits or less and outputs a value of i bits. The function zp[i] is a function that outputs different values ​​for two different input values ​​with the same bit length.

[0050] An example of the function zp[i] is the following function. For a value V between 1 bit and i - 1 bits, the output of a function zp[i](V) is a value obtained by concatenating a bit sequence from 0 to V such that the bit length is i. For a value V of i bits, the output of the function zp[i](V) is the value V.

[0051] A function `tr[i]` is a function that outputs predetermined i bits of an input bit sequence when the input is a bit sequence of i bits or more. An example of a function `tr[i]` is one that outputs the most significant i bits or the least significant i bits of an input bit sequence.

[0052] The function tr[i] is injective if the input is a bit sequence between 1 bit and i - 1 bits. Examples of the function tr[i] are those described as examples of the function zp[i] and the function ozp[i].

[0053] Let b be an integer such that 0 < b ≤ n, where n is the size of an input block of a block cipher. Let t be an integer such that 0 < t. Let r be an integer such that 0 < r. Let w be an integer such that t / b ≤ w. Let the length of an encryption key of the block cipher be k = r + c. ** Function F **

[0054] Authenticated Encryption Facility 10 creates an authenticated encryption using a function F. A block cipher E is used in the function F.

[0055] With reference to Fig. 2 describes the block cipher E in embodiment 1.

[0056] The block cipher E is a function that takes as inputs a key component X with k bits and an input block Y with n bits, and outputs a block Z with n bits. This block cipher E is implemented as in Fig. 2 shown.

[0057] In the Fig. 3 and Fig. 4 describes the function F according to embodiment 1.

[0058] The function F is a function that takes as inputs a value T with r bits, a value B with n bits, a nonce N, a counter value ctr, and a division value w, and outputs a value T' with r bits and a value B' with n bits. That is, (T', B') = F(N, ctr, w, T, B). The counter value ctr is incremented for each process, and a different value is set. The function F is processed by the Function F Processing Unit 22.

[0059] The processes of function F are described in detail. (Step S101: B-Update Process)

[0060] Function F processing unit 22 sets a value obtained by concatenating a value T and then an output value obtained by inputting a nonce N, a counter value ctr, and a division value w into function f as the key component of the block cipher E. Function F processing unit 22 sets a value B as the input block of the block cipher E. Then, Function F processing unit 22 computes the block cipher E to update the value B in order to produce a value B'. (Step S102: T-update process)

[0061] Function F processing unit 22 performs an exclusive OR operation on an output value obtained by inputting the value B' into a function tr[r] and the value T to update the value T in order to produce a value T'. (Step S103: Output process)

[0062] The function F processing unit 22 outputs a set of the value T' of r bits and the value B' of n bits. ** Encryption function Enc **

[0063] An encryption function Enc in the authenticated encryption, which is implemented by the authenticated encryption device 10 according to embodiment 1, is described.

[0064] The input values ​​of the encryption function Enc are a secret key K of r + n bits, a nonce N, a header A, and a plaintext M. The header A can be an empty string. The plaintext M can be an empty string.

[0065] As in Fig. As specified in point 5, the encryption function Enc executes an initial process, a header process, a main process, and an authentication process sequentially. The initial process, the header process, the main process, and the authentication process are described below. <anfangsprozess>

[0066] Based on Fig. Section 6 describes the initial process in the encryption function Enc according to embodiment 1.

[0067] The initial process in the encryption function Enc is a process of setting values ​​and the like, which are to be used in the processes to be described later. (Step S11: Key Component Setting Process)

[0068] The initial processing unit 21 sets the most significant r bits of the secret key K as key component K1 and sets the least significant n bits as key component K2. The initial processing unit 21 sets the most significant b bits of key component K2 as key component K21 and sets the remaining n - b bits as key component K22. That is, K = K1 | | K2 and K2 = K21 | | K22.

[0069] The initial processing unit 21 can extract the key component K1 as predetermined r bits of the secret key K and set the key component K2 as the remaining n bits of the secret key K. Likewise, the initial processing unit 21 can extract the key component K21 as predetermined b bits of the key component K2 and set the key component K22 as the remaining n - b bits of the key component K2.

[0070] The initial processing unit 21 sets the key component K1 to a value IVt and sets the key component K2 to a value IVb. The values ​​IVt and IVb are used in the header process. (Step S12: Division process)

[0071] The initial processing unit 21 splits the header A and the plaintext M.

[0072] Specifically, the initial processing unit 21 divides the header A into the header elements A[1], A[2], ..., and A[a] every n bits from the beginning. The initial processing unit 21 divides the plaintext M into plaintext elements M[1], M[2], ..., and M[m] every b bits from the beginning.

[0073] If the header A is not an empty string, each of the header elements A[1], A[2], ..., and A[a-1] is n bits, and the header element A[a] is a value between 1 and n bits. The header A is a value obtained by concatenating the bits of the header elements A[1], A[2], ..., and A[a]. If the header A is an empty string, then a = 1, and the header element A[1] is an empty string.

[0074] If the plaintext M is not an empty string, each of the plaintext elements M[1], M[2], ..., M[m-1] has b bits, and the plaintext element M[m] is a value between 1 bit and b bits. The plaintext M is a value obtained by concatenating the bits of the plaintext elements M[1], M[2], ..., and M[m]. If the plaintext M is an empty string, then m = 1 and the plaintext element M[1] is an empty string. <header-prozess>

[0075] Based on Fig. 7 and Fig. Section 8 describes the header process in the encryption function Enc according to embodiment 1.

[0076] The header process in the encryption function Enc is a process of processing the header elements A[1], A[2], ..., and A[a] generated in the initial process using the values ​​IVt and IVb set in the initial process, and generating a value Ht, a value Hb, and a division value dA. (Step S21: Initial value setting process)

[0077] The function F processing unit 22 sets the value IVt as a value T*[0] and sets the value IVb as a value B*[0]. (Step S22: Function-F process)

[0078] If a value a, which is a division number of the header A, is greater than 1, the Function F processing unit 22 performs the following processes (1) and (2) for each integer i in ascending order, where i = 1, ..., a-1. If the value a, which is the division number of the header A, is 1, the Function F processing unit 22 sets the value T*[0] as a value T*[a-1] and sets the value B*[0] as a value B*[a-1]. (1) The function F processing unit 22 sets the exclusive OR of a value a[i] and a value B*[i-1] to the value B*[i-1]. (2) The Function F Processing Unit 22 computes the function F using the nonce N, the integer i, 0, a value T*[i-1] and the value B*[i-1] as inputs to generate a value T*[i] and a value B*[i].

[0079] It should be noted that the values ​​T*[0] and B*[0] are secret values ​​generated from the secret key in the authenticated encryption. Specifically, Function F Processing Unit 22 sets a value as a key component of the block cipher E, generated using the secret value T*[i-1], the nonce N, the value i (which is the counter ctr), and the division number (in this case, 0). Function F Processing Unit 22 sets the secret value B*[i-1] as the input block of the block cipher E. Then, Function F Processing Unit 22 updates the secret values ​​T*[i-1] and B*[i-1] using the block cipher E to generate the secret values ​​T*[i] and B*[i]. (Step S23: Value B Update Process)

[0080] Function F processing unit 22 sets the exclusive OR of an output value obtained by inputting the value A[i] into a function ozp[n] and the value B*[a-1] as the value B*[a]. Function F processing unit 22 sets the value T*[a-1] as the value T*[a]. (Step S24: Value-dA setting process)

[0081] The function-F processing unit 22 sets the value dA depending on whether |A[a]| is equal to n or not. In embodiment 1, if |A[a]| is equal to n, the function-F processing unit 22 sets the value dA to 1. If |A[a]| is less than n, the function-F processing unit 22 sets the value dA to 2. (Step S25: Output value setting process)

[0082] The function F processing unit 22 sets the value T*[a] as the value Ht and sets the value B*[a] as the value Hb.

[0083] Function F processing unit 22 can update a value T[i-1] with a specific permutation P1 of r bits before (1) of step S22. Similarly, function F processing unit 22 can update a value B[i-1] with a specific permutation P2 of n bits before (1) of step S22. Function F processing unit 22 can update a value T[i] with a specific permutation P1' of r bits after (2) of step S22. Similarly, function F processing unit 22 can update a value B[i] with a specific permutation P2' of n bits after (2) of step S22. Instead of the exclusive OR used in the header process, other operations such as addition, subtraction, and multiplication can also be used. <hauptprozess>

[0084] Based on Fig. 9 and Fig. 10 describes the main process in the encryption function Enc according to embodiment 1.

[0085] The main process in the encryption function Enc is a process of processing the plaintext elements M[1], M[2], ..., and M[m] generated in the initial process using the values ​​Ht, Hb and dA set in the header process to generate a value St, a value Sb, a value dM and a ciphertext C.

[0086] It should be noted that in the following process, a function h is a permutation of n bits. The function h is such a permutation that for a value S with n bits and a variable Z, formula 2 has a unique solution for the variable Z. h(Z)⊕Z=S

[0087] One method for the function h is, for example, the use of multiplication by a generator on GF(2n). That is, h(Z) = u · Z, where u is a generator. (Step S31: Initial value setting process)

[0088] The function F processing unit 22 sets the value Ht as a value T[0] and sets the value Hb as a value B[0]. (Step S32: Function-F process)

[0089] If the plaintext element M[1] is not an empty string, the function-F processing unit 22 executes the following processes (1) to (3) for each integer i in ascending order, where i = 1, ..., m. If the plaintext element [1] is an empty string, the function-F processing unit 22 sets the value T[0] as a value T[m] and sets the value B[0] as a value B[m].

[0090] (1) The Function F Processing Unit 22 computes the function F using the nonce N, the integer i, the value dA, the value T[i-1] and the value B[i-1] as inputs to generate a value T[i] and a value B[i].

[0091] It should be noted that the values ​​T[0] and B[0] are secret values ​​that are updated in the header process. That is, function F processing unit 22 sets a value as a key component of the block cipher E, generated using the secret value T[i-1], the nonce N, the value i (which is the counter ctr), and the division number (in this case, dA). Function F processing unit 22 sets the secret value B[i-1] as the input block of the block cipher E. Then, function F processing unit 22 updates the secret values ​​T[i-1] and B[i-1] using the block cipher E to generate the secret values ​​T[i] and B[i].

[0092] (2) The encryption processing unit 231 of the ciphertext processing unit 23 generates a cipher element C[i] using the secret value B[i], which is generated by updating the secret value B[i-1] by the function-F processing unit 22.

[0093] Specifically, the encryption processing unit 231 sets the exclusive OR of an output value obtained by inputting the value B[i] into a function tr[|MI[i]|], an output value obtained by inputting the value K21 into the function tr[|M[i]|], and a plaintext element M[i] as the ciphertext element C[i]. It should be noted that if the integer i ≠ m, |M[i]| is b bits, so it is not necessary to convert the value K21 using the function tr[|M[i]|]. That is, the same result can be obtained by directly inputting the value K21 into the exclusive OR, instead of the output value obtained when the value K21 is input into the function tr[|M[i]|].

[0094] (3) The function F processing unit 22 represents the exclusive OR of an output value obtained by inputting the value B[i] into the function h, and of an output value obtained by inputting an output value obtained by inputting the plaintext element M[i] into a function ozp[b] into a function zp[n], as the value B[i]. It should be noted that if the integer i ≠ m, |M[i]| is b bits, so that the function ozp[b] need not be used. That is, the same result can be obtained by inputting the plaintext element M[i] directly into the function zp[n], instead of the output value obtained when the plaintext element M[i] is input into the function ozp[b]. (Step S33: Output value setting process)

[0095] The function F processing unit 22 sets the value T[m] as the value St and sets the value B[m] as the value Sb. (Step S34: Value-dM process)

[0096] The function-F processing unit 22 sets the value dm depending on whether |A[a]| equals b or not. In embodiment 1, if |M[m]| equals b, the function-F processing unit 22 sets the value dM to 3. If |M[m]| is less than b, the function-F processing unit 22 sets the value dM to 4. (Step S35: Ciphertext generation process)

[0097] The encryption processing unit 231 of the ciphertext processing unit 23 generates the ciphertext C by concatenating the bits of the cipher elements C[1], ..., and C[m] generated in (2) of step S32. For example, the ciphertext processing unit 231 sets the ciphertext C as C[1] | | C[2] | | ... | | C[m].

[0098] The process of (2) of S32 and the process of step S35 constitute an encryption process. In the encryption process, the encryption processing unit 231 generates the cipher element C[i] from the secret value B[i] generated by the function-F processing unit 22 for each integer i, where i = 1,..., m. Then, the encryption processing unit 231 generates the ciphertext C, which is the encrypted plaintext M, using the cipher element C[i] for each integer i, where i = 1, ..., m.

[0099] Function F processing unit 22 can update the value T[i-1] with a specific permutation of r bits before (1) of step S32. Similarly, function F processing unit 22 can update the value B[i-1] with a specific permutation of n bits before (1) of step S32. Function F processing unit 22 can update the value T[i] with a specific permutation of r bits after (3) of step S32. Similarly, function F processing unit 22 can update the value B[i] with a specific permutation of n bits after (3) of step S32. Instead of the exclusive OR used in the main process, other operations such as addition, subtraction, and multiplication can also be used. <authentifizierungsprozess>

[0100] Based on Fig. 11 and Fig. 12 describes the authentication process in the encryption function Enc according to embodiment 1.

[0101] The authentication process in the encryption function Enc is a process to generate an authenticator tag using the values ​​St, Sb, and dM, which are set in the main process. (Step S41: Initial value setting process)

[0102] The function F processing unit 22 sets the value St as a value T'[0] and sets the value Sb as a value B'[0]. (Step S42: Function-F process)

[0103] The Function F processing unit 22 performs the following processes (1) and (2) for each integer i in ascending order, where i = 1, ..., w, and w is a preset value.

[0104] (1) The Function F Processing Unit 22 computes the function F using the nonce N, the integer i, the value dM, a value T'[i-1] and a value B'[i-1] as inputs to generate a value T'[i] and a value B'[i].

[0105] It should be noted that the values ​​T'[0] and B'[0] are secret values ​​that are updated in the main process. Specifically, function F processing unit 22 sets a value as a key component of block cipher E, generated using the secret value T'[i-1], the nonce N, the value i (which is the counter ctr), and the division number (in this case, dM). Function F processing unit 22 sets the secret value B'[i-1] as the input block of block cipher E. Then, function F processing unit 22 updates the secret values ​​T'[i-1] and B'[i-1] using block cipher E to generate the secret values ​​T'[i] and T'[i].

[0106] (2) The authentication processing unit 24 sets the exclusive OR of an output value obtained by inputting the secret value B'[i] into a function tr[b] and the value K21 as the authentication element Tag[i]. (Step S43: Authenticator generation process)

[0107] The authentication processing unit 24 generates the authenticator Tag by concatenating the bits of the authentication elements Tag[1], ..., Tag[w], which are generated in (2) of step S42. For example, the authentication processing unit 24 sets the authenticator Tag as tr[t](Tag[1] | | ... | | Tag[w]). **Decryption function Dec**

[0108] A decryption function Dec in the authenticated encryption, which is implemented by the authenticated encryption device 10 according to embodiment 1, is described.

[0109] The input values ​​of the decryption function Dec are a secret key K of r + n bits, a nonce N, a header A, a ciphertext C, and an authenticator tag for tamper detection. It is important to note that the authenticator tag specified as an input value to the decryption function Dec is the authenticator tag generated by the encryption function Enc. The authenticator given as an input value to the decryption function Dec is referred to as the authenticator tag to distinguish it from an authenticator tag to be generated in the following description.

[0110] The decryption function Dec, like the encryption function Enc, executes an initial process, a header process, a main process, and an authentication process sequentially. The initial process, the main process, and the authentication process are described below. The header process is the same as in the encryption function Enc. <anfangsprozess>

[0111] Based on Fig. Section 6 describes the initial process in the decryption function Dec according to embodiment 1.

[0112] The initial process in the decryption function Dec is a process of setting values ​​and the like, which are to be used in the processes to be described later.

[0113] The process of step S11 is the same as the process for the encryption function Enc. (Step S12: Division process)

[0114] The initial processing unit 21 splits the header A and the ciphertext C.

[0115] Specifically, the initial processing unit 21 divides the header A into header elements A[1], A[2], ..., and A[a], as in the encryption function Enc. The initial processing unit 21 divides the ciphertext C every b bits from the beginning into cipher elements C[1], C[2], ... and C[m].

[0116] If the ciphertext C is not an empty string, each of the cipher elements C[1], C[2], ..., and C[m-1] is b bits, and the cipher element C[m] is a value between 1 bit and b bits. The ciphertext C is a value resulting from the concatenation of the bits of the cipher elements C[1], C[2], ..., and C[m]. If the ciphertext C is an empty string, m = 1 and the cipher element C[1] is an empty string. <hauptprozess>

[0117] Based on Fig. 13 and Fig. 14 describes the main process in the decryption function Dec according to embodiment 1.

[0118] The main process in the decryption function Dec is a process of processing the cipher elements C[1], C[2], ..., and C[m] generated in the initial process using the value Ht, the value Hb and the value dA set in the header process to generate a value St, a value Sb, a value dM and a plaintext M.

[0119] It should be noted that the function h in the following process is a permutation of n bits, like the function h used in the encryption function Enc in the main process.

[0120] The process of step S51 is the same as the process of step S31 in Fig. 10. The process of step S53 is the same as the process of step S33 in Fig. 10. (Step S52: Function-F process)

[0121] If the cipher element C[1] is not an empty string, the function F processing unit 22 performs the following processes (1) to (3) for each integer i in ascending order, where i = 1, ..., m.

[0122] The process of (1) is the same as the process of (1) of step S32 in Fig. 10. The process of (3) is the same as the process of (3) of step S32 in Fig. 10.

[0123] (2) The decryption processing unit 232 of the ciphertext processing unit 23 generates a plaintext element M[i] using the secret value B[i], which is generated by updating the secret value B[i-1] by the function-F processing unit 22.

[0124] Specifically, the decryption processing unit 232 performs the exclusive OR of an output value obtained by inputting the value B[i] into a function tr[|C[i]|], an output value obtained by inputting the value K21 into the function tr[|C[i]|], and the cipher element C[i] as the plaintext element M[i]. It should be noted that if the integer i ≠ m, |C[i]| is b bits, so it is not necessary to convert the value K21 using the function tr[|C[i]|]. That is, the same result can be obtained by directly inputting the value K21 into the exclusive OR, instead of the output value obtained by inputting the value K21 into the function tr[|C[i]|]. (Step S54: Value-dM process)

[0125] The function-F processing unit 22 sets the value dm depending on whether |C[m]| equals b or not. In embodiment 1, if |C[m]| equals b, the function-F processing unit 22 sets the value dM to 3. If |C[m]| is less than b, the function-F processing unit 22 sets the value dM to 4. (Step S55: Plaintext generation process)

[0126] The decryption processing unit 232 of the ciphertext processing unit 23 generates the plaintext M by concatenating the bits of the plaintext elements M[1], ..., and M[m] generated in (2) of step S52. For example, the decryption processing unit 232 outputs the plaintext M as M[1] | | M[2] | | ... | | M[m].

[0127] The process of (2) of S52 and the process of step S55 constitute a decryption process. In the decryption process, the decryption processing unit 232 generates the plaintext element M[i] from the secret value B[i] generated by the function-F processing unit 22 for each integer i, where i = 1,..., m. Then, the decryption processing unit 232 generates the plaintext M, which is the decrypted ciphertext C, using the plaintext element M[i] for each integer i, where i = 1, ..., m.

[0128] Function F processing unit 22 can update the value T[i-1] with a specific permutation of r bits before (1) of step S52. Similarly, function F processing unit 22 can update the value B[i-1] with a specific permutation of n bits before (1) of step S52. Function F processing unit 22 can update the value T[i] with a specific permutation of r bits after (3) of step S52. Similarly, function F processing unit 22 can update the value B[i] with a specific permutation of n bits after (3) of step S52. Instead of the exclusive OR used in the main process, other operations such as addition, subtraction, and multiplication can also be used. <authentifizierungsprozess>

[0129] Based on Fig. 15 describes the authentication process in the decryption function Dec according to embodiment 1. (Step S61: Authenticator generation process)

[0130] The Authenticated Encryption Setup 10 executes the processes from step S41 to step S43 in Fig. 12, which are described in the encryption function Enc during the authentication process. Subsequently, the Authenticated Encryption facility 10 generates an authenticator tag. (Step S62: Manipulation Determination Process)

[0131] The authentication processing unit 24 determines whether the authenticator Tag generated in step S61 matches the authenticator Tag' given as input.

[0132] If the authenticator tag matches the authenticator tag, the authentication processing unit 24 proceeds to step S63. If the authenticator tag does not match the authenticator tag, the authentication processing unit 24 proceeds to step S64. (Step S63: Plain text output process)

[0133] The authentication processing unit 24 outputs the plaintext M generated in the main process. (Step S64: Counterfeit Information Output Process)

[0134] The authentication processing unit 24 outputs reject, a value that indicates forgery. *** Effects of embodiment 1 ***

[0135] As described above, the authenticated encryption device 10 according to embodiment 1 sets the secret value B as the input block of a block cipher and updates the secret value B using the block cipher. This implements a configuration that makes it possible to minimize a secret value to s + b bits, even if the block size b of a plaintext is set to an arbitrary value.

[0136] Specifically, the authenticated encryption implemented by the authenticated encryption device 10 according to embodiment 1 is a secure authenticated encryption with s-bit for the desired security level s when the number of bits r and the number of bits n are set as r + n = s.

[0137] The authenticated encryption implemented by the authenticated encryption device 10 according to embodiment 1 can be used as a manipulation detection algorithm by setting the plaintext M and the ciphertext C as empty strings.

[0138] The authenticated encryption implemented by the authenticated encryption device 10 according to embodiment 1 can be configured such that, for a secret key K, a random number of equal or shorter length than a nonce is specified for the authenticated encryption, and the exclusive OR of this random number and the nonce is used as the new nonce. In addition to the random number for updating the nonce, a random number of equal or shorter length than a counter value can be specified for a single secret key K, and the exclusive OR of this random number and each counter value can be used as the new counter value.

[0139] Updating the nonce and counter value using the exclusive OR of the nonce and a random number, or the exclusive OR of the counter value and a random number, also ensures the multi-user security of authenticated encryption described in the following document. A single random number is assigned to a single key, and a different random number must be used each time the key changes. (Document: Viet Tung Hoang, Stefano Tessaro, Aishwarya Thiruvengadam: The Multi-user Security of GCM, Revisited: Tight Bounds for Nonce Randomization. CCS 2018. ACM. pp. 1429-1440).

[0140] It should be noted that the safety described in non-patent literature 4 of the prior art applies to individual users. *** Other configurations ***<Variante 1>

[0141] In embodiment 1, the functional components are implemented by software. In variant 1, however, the functional components can also be implemented by hardware. The differences between variant 1 and embodiment 1 are described below.

[0142] Based on Fig. Section 16 describes a configuration of the Authenticated Encryption Setup 10 according to variant 1.

[0143] If the functional components are implemented by hardware, the Authenticated Encryption Device 10 contains an electronic circuit 15 instead of the processor 11, the main memory 12 and the storage 13. The electronic circuit 15 is a dedicated electronic circuit that implements the functions of the functional components, the main memory 12 and the storage 13.

[0144] The electronic circuit 15 is assumed to be a single circuit, a composite circuit, a programmed processor, parallel programmed processors, a logic IC, a gate assembly (GA), an application-specific integrated circuit (ASIC), or a field-programmable gate assembly (FPGA).

[0145] The functional components can be implemented by a single electronic circuit 15 or can be distributed across a multitude of electronic circuits 15 and implemented by them.

[0146] As in Fig. As shown in Figure 17, the Authenticated Encryption Device 10 can, for example, be configured as the electronic circuit 15 comprising an initial processing processor that performs the processes of the initial processing unit 21, a function-F processor that performs the processes of the function-F processing unit 22, a ciphertext processing processor that performs the processes of the ciphertext processing unit 23, and an authentication processing processor that performs the processes of the authentication processing unit 24.

[0147] A block cipher processor, which performs the processes of block cipher E among the processes of function-F processing unit 22, can be provided separately from the function-F processing processor. The ciphertext processing processor can be subdivided into an encryption processing processor, which performs the processes of encryption processing unit 231, and a decryption processing processor, which performs the processes of decryption processing unit 232. The authentication processing processor can be subdivided into an authenticator generation processor, which generates an authenticator tag, and a manipulation detection processor, which performs the manipulation detection process. <Variante 2>

[0148] In variant 2, some of the functional components can be implemented by hardware and the rest of the functional components by software.

[0149] The processor 11, the main memory 12, the storage 13, and the electronic circuit 15 are referred to as the processing circuit. This means that the functions of the functional components are implemented by the processing circuit. <Variante 3>

[0150] In embodiment 1, the authenticated encryption device 10 implements both the encryption function Enc and the decryption function Dec. However, the authenticated encryption device 10 can implement only one of the encryption function Enc and the decryption function Dec. If the authenticated encryption device 10 implements only one of the encryption function Enc and the decryption function Dec, it only needs to contain the functional components necessary for that implementation. If the authenticated encryption device 10 implements only the encryption function Enc, the decryption processing unit 232 of the ciphertext processing unit 23 is not required.If the Authenticated Encryption Unit 10 only implements the Decryption Function Dec, the Encryption Processing Unit 231 of the Ciphertext Processing Unit 23 is not required.

[0151] “Unit” in the above description can be interpreted as “circuit”, “step”, “sequence”, “process” or “processing circuit”.

[0152] The embodiments and variants of the present disclosure have been described above. Two or more of these embodiments and variants can also be implemented in combination. Alternatively, one or more of them can be partially implemented. It should be noted that the present disclosure is not limited to the embodiments and variants mentioned above, and various modifications can be made as required. Reference symbol list

[0153] 10: Authenticated encryption device; 11: Processor; 12: Main memory; 13: Storage; 14: Communication interface; 15: Electronic circuit; 21: Initial processing unit; 22: Function-function-F processing unit; 23: Ciphertext processing unit; 231: Encryption processing unit; 232: Decryption processing unit; 24: Authentication processing unit. QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] WO 2022-215249 A1

[0022] Cited non-patent literature

[0000] Hannes Gross, Stefan Mangard und Thomas Korak. Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order. IACR ePrint 2016 / 486, 2016

[0022] National Institute of Standards and Technology (NIST). Announcing the Advanced Encryption Standard (AES). FIPS PUB 197, 2001

[0022] Christof Beierle, Jeremy Jean, Stefan Kolbl, Gregor Leander, Amir Moradi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich und Siang Meng Sim. The SKINNY family of block ciphers and its low-latency variant MANTIS. In CRYPTO2016, Seiten 123-153, LNCS Band 9815, Springer, 2016

[0022] Tetsu Iwata, Keisuke Ohashi und Kazuhiko Minematsu. Breaking and Repairing GCM Security Proofs. CRYPTO 2012, Proceedings. Seiten 31-49. LNCS Band 7417. Springer. 2012

[0022] Svetla Nikova, Christian Rechberger und Vincent Rijmen. Threshold implementations against side-channel attacks and glitches. In Information and Communications Security, 8th International Conference, ICICS 2006, Seiten 529-545, LNCS Band 4307. Springer. 2006

[0022] Oscar Reparaz, Begul Bilgin, Svetla Nikova, Benedikt Gierlichs und Ingrid Verbauwhede. Consolidating masking schemes. In CRYPTO 2015, LNCS Band 9215, Seiten 764-783, Springer, 2015

[0022] Gaetan Cassiers, Benjamin Gregoire, Itamar Levi und Francois-Xavier Standaert. Hardware private circuits: From trivial composition to full verification. IEEE Trans. Computer, 70 (10) :1677-1690, 2021

[0022] Yusuke Naito, Yu Sasaki, Takeshi Sugawara. AES-LBBB: AES Mode for Lightweight and BBB-Secure Authenticated Encryption. IACR Trans. Kryptogr. Hardw. Embed. Syst. 2021 (3): 298-333 (2021

[0022] Yusuke Naito, Yu Sasaki und Takeshi Sugawara. Secret Can Be Public: Low-Memory AEAD Mode for High-Order Masking. CRYPTO2022: Seite 315-345

[0022] Viet Tung Hoang, Stefano Tessaro, Aishwarya Thiruvengadam: The Multi-user Security of GCM, Revisited: Tight Bounds for Nonce Randomization. CCS 2018. ACM. S. 1429-1440

[0139] < / authentifizierungsprozess> < / hauptprozess> < / anfangsprozess> < / authentifizierungsprozess> < / hauptprozess> < / anfangsprozess>

Claims

[1] Authenticated encryption device, comprising: an initial processing unit for generating a secret value B from a secret key in authenticated encryption; a function-F processing unit for setting the secret value B generated by the initial processing unit as an input block of a block cipher and for updating the secret value B using the block cipher; and a ciphertext processing unit for executing at least one process of encrypting a plaintext M and a process of decrypting a ciphertext C using the secret value B updated by the function-F processing unit. [2] Authenticated encryption device according to claim 1, wherein the initial processing unit generates a key component K1 of r bits, which is extracted from the secret key of r + n bits, and generates a key component K2 of n bits as the secret value B, where the key component K2 is the n bits that remain after the key component K1 has been extracted from the secret key, and where the function F processing unit sets a value generated using a value T, which is the key component K1, as a key component of the block cipher and updates the secret value B using the block cipher. [3] Authenticated encryption device according to claim 2, wherein the function F processing unit sets a value generated using a nonce that is given as input in the authenticated encryption, in addition to the value T as the key component of the block cipher. [4] Authenticated encryption device according to claim 2 or 3, wherein the function F processing unit repeatedly performs a process of setting a new secret value B, which is generated by updating the secret value B as an input block of the block cipher, setting a value generated using a new value T generated from the new secret value B and the value T as a key component of the block cipher, and updating the secret value B using the block cipher. [5] Authenticated encryption device according to any one of claims 1 to 4, wherein the function F processing unit sets a secret value B at a given time as secret value B[0], sets a secret value B[i-1] as an input block of a block cipher, and updates the secret value B[i-1] using the block cipher to generate a secret value B[i] for each integer i in ascending order, where i = 1, ..., m, and wherein the ciphertext processing unit performs at least one of a process of encrypting a plaintext M and a process of decrypting a ciphertext C using the secret value B[i] for each integer i, where i = 1, ..., m. [6] Authenticated encryption device according to claim 5, wherein the ciphertext processing unit performs at least one of an encryption process of generating a cipher element C[i] from the secret value B[i] for each integer i, where i = 1, ..., m, and a plaintext element M[i], generated by dividing a plaintext M into m parts, and generating a ciphertext C, which is the encrypted plaintext M, using the cipher element C[i] for each integer i, where i = 1, ..., m, and a decryption process of generating a plaintext element M[i] from the secret value B[i] for each integer i, where i = 1, ..., m, and a ciphertext element C[i], obtained by dividing a ciphertext C, and generating a plaintext M, which is the decrypted ciphertext C, using the plaintext element M[i] for each integer i, where i = 1, ..., m. [7] Authenticated encryption device according to claim 6, wherein in the encryption process the ciphertext processing unit generates the cipher element C[i] using a key component K21 which is at least part of an initial value of the secret value, which is the secret value generated by the initial processing unit, for each integer i, where i = 1, ..., m, and wherein in the decryption process the ciphertext processing unit generates the plaintext element M[i] using a key component K21 which is at least part of an initial value of the secret value, which is the secret value generated by the initial processing unit, for each integer i, where i = 1, ..., m. [8] Authenticated encryption device according to any one of claims 1 to 7, wherein the function F processing unit sets the secret value B, which is used in a process of encrypting a plaintext M or a process of decrypting a ciphertext C, by the ciphertext processing unit as an input block of the block cipher and furthermore updates the secret value B using the block cipher, and the Authenticated Encryption Device further includes an authentication processing unit for generating an authenticator tag using the secret value B, which is further updated by the function F processing unit. [9] Authenticated encryption device according to claim 8, wherein the function F processing unit sets the secret value B, which is used in a process of encrypting a plaintext M or a process of decrypting a ciphertext C by the ciphertext processing unit, as a secret value B'[0], sets a secret value B'[i-1] as an input block of a block cipher, and updates the secret value B'[i-1] using the block cipher to generate a secret value B'[i] for each integer i in ascending order, where i = 1, ..., w, and wherein the authentication processing unit generates an authentication element Tag[i] using the secret value B'[i] for each integer i where i = 1, ..., w, and generates the authenticator Tag using the authentication element Tag[i] for each integer i where i = 1, ..., w. [10] Authenticated encryption device according to claim 9, wherein the authentication processing unit generates the authentication element Tag[i] using a key component K21 which is at least part of an initial value of the secret value which is the secret value generated by the initial processing unit, for each integer i, where i = 1, ..., w. [11] Authenticated encryption device according to any one of claims 5 to 7, wherein the function F processing unit performs a header process of updating the secret value B generated by the initial processing unit with a header A given as an input in the authenticated encryption, then setting the updated secret value B as an input block of the block cipher and updating the secret value B using the block cipher, and setting the secret value B as a secret value B[0] at a time after it has been updated by the header process. [12] Authenticated encryption device according to claim 11, where the function F processing unit performs the header process of setting the secret value B generated by the initial processing unit as secret value B*[0], updating a secret value B*[i-1] using a header element A[i] of header elements A[1], ... A[a] obtained by dividing the header A into "a" pieces, then setting the updated secret value B*[i-1] as the input block of a block cipher, updating the secret value B*[i-1] using the block cipher to generate a secret value B*[i] for each integer i in ascending order where i = 1, ..., a-1, and updating a secret value B*[a-1] using the header element A[a]. [13] Authenticated encryption methods, including: Generating a secret value B from a secret key in authenticated encryption by a computer; Setting the secret value B as an input block of a block cipher and updating the secret value B using the block cipher, by the computer; and Execution by the computer of at least one process of encrypting a plaintext M and one process of decrypting a ciphertext C using the updated secret value B. [14] Authenticated encryption program that causes a computer to act as an authenticated encryption device in order to perform: an initial process of generating a secret value B from a secret key in authenticated encryption; a function-F process of setting the secret value B generated by the initial process as an input block of a block cipher and updating the secret value B using the block cipher; and a ciphertext process of executing at least one process of encrypting a plaintext M and a process of decrypting a ciphertext C using the secret value B updated by the function F process.

Images