Authentication encryption device, authentication decryption device, authentication encryption system, method and program

Abstract

To provide an authentication encryption device capable of efficiently performing authentication encryption processing by using an encryption primitive whose output length is longer than its input length.SOLUTION: A plain sentence division part 302 divides a plain sentence at a prescribed ratio into a first plain sentence and a second plain sentence. A first encryption part 310 acquires a first ciphertext according to an encryption function, by using a mask value obtained based on a first value and a plurality of plain sentence blocks respectively. A second encryption part 320 acquires a second ciphertext, by using a value excluding the values used for encryption of the first plain sentence out of encryption results outputted from the encryption function in the encryption of the first plain sentence, and using the second plain sentence. An authenticating tag generation part 360 generates a first tag. The authenticating tag generation part 360 generates a second tag. The authenticating tag generation part 360 generates an authenticating tag T.SELECTED DRAWING: Figure 23

Description

[Technical field]

[0001] The present disclosure relates to an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, a method, and a program. [Background technology]

[0002] There is a known technology called authenticated encryption (AE) that uses a secret key shared in advance to simultaneously encrypt a plaintext message and calculate an authentication tag for detecting tampering. By applying authenticated encryption AE to a communication path, it becomes possible to conceal the contents against eavesdropping and to detect unauthorized tampering, thereby achieving strong protection of the communication contents. Known technologies related to authenticated encryption include those disclosed in Patent Document 1 and Non-Patent Documents 1 to 6, for example.

[0003] Non-Patent Document 1 discloses an authentication encryption method called "ChaCha20-Poly1305". "ChaCha20-Poly1305" is a technology that combines an encryption method called "ChaCha20" and a tamper detection method called "Poly1305". "ChaCha20-Poly1305" performs encryption processing using encryption primitives (encryption components) whose output length is longer than their input length. "ChaCha20" is disclosed in, for example, Non-Patent Document 2. "Poly1305" is disclosed in, for example, Non-Patent Document 3. Non-Patent Document 4 discloses an encryption method called "SalSa20" related to "ChaCha20". Non-Patent Document 5 discloses an encryption method called "XSalSa20" which is an improved version of "SalSa20". Non-Patent Document 6 discloses an encryption method called "XChaCha20" which is an improved version of "ChaCha20". Patent Document 1 discloses an authenticated encryption method called OTR (Offset Two-Round) method. OTR is an authenticated encryption method that realizes authenticated encryption with the computational cost substantially equivalent to the encryption of plaintext only. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Unexamined Patent Application Publication No. 2016-075765 [Non-Patent Document]

[0005] [Non-Patent Document 1] Y. Nir, and A. Langley, "ChaCha20 and Poly1305 for IETF Protocols", June 2018, https: / / www.rfc-editor.org / rfc / rfc8439.html [Non-Patent Document 2] Daniel J. Bernstein, "ChaCha, a variant of Salsa20", 2008.01.20, https: / / cr.yp.to / chacha / chacha-20080120.pdf [Non-Patent Document 3] Daniel J. Bernstein, "The Poly1305-AES Message-Authentication Code", 2005.03.29, https: / / link.springer.com / chapter / 10.1007 / 11502760_3 [Non-Patent Document 4] Daniel J. Bernstein, "The Salsa20 family of stream ciphers", 2007.12.25, http: / / cr.yp.to / snuffle / salsafamily-20071225.pdf [Non-Patent Document 5] Daniel J. Bernstein, "Extending the Salsa20 nonce", 2008.11.28, https: / / cr.yp.to / snuffle / xsalsa-20081128.pdf [Non-Patent Document 6] S. Arciszewski, "XChaCha: eXtended-nonce ChaCha and AEAD_XChaCha20_Poly1305", January 10, 2020, https: / / datatracker.ietf.org / doc / html / draft-irtf-cfrg-xchacha-03 Summary of the Invention [Problem to be solved by the invention]

[0006] The technology in Non-Patent Document 1 encrypts plaintext, and then generates a tag for tamper detection using the ciphertext. Therefore, the encryption of plaintext and the generation of the tag each incur substantially the same computational costs. Therefore, the technology in Non-Patent Document 1 may not be able to perform authentication encryption processing efficiently, compared to a method that realizes authentication encryption with the computational cost of only encrypting plaintext.

[0007] The object of the present disclosure has been made to solve such problems, and is to provide an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, a method, and a program that are capable of efficiently performing authenticated encryption processing using cryptographic primitives whose output length is longer than the input length. [Means for solving the problem]

[0008] The authenticated encryption device according to the present disclosure includes a plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio, a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and using each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of plaintext blocks having a length corresponding to the input length, by the encryption function to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks, and a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext using a value other than the value used for encrypting the first plaintext among the encryption results output from the encryption function and the second plaintext; an authentication tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a part of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; has.

[0009] The authentication and decryption device according to the present disclosure includes a ciphertext division means for dividing a ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio, a first decryption means for obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function to obtain a plurality of plaintext blocks corresponding to the plurality of ciphertext blocks, and a first plaintext obtained by decrypting the first ciphertext. a second decryption means for obtaining a second plaintext obtained by decrypting the second ciphertext and using a value other than a value used to decrypt the plaintext, the second ciphertext; a verification tag generation means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plurality of plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; and a verification means for verifying the presence or absence of tampering by comparing the verification tag with an input authentication tag and performing control to output a verification result.

[0010] The authentication encryption system according to the present disclosure includes an authentication encryption device and an authentication decryption device that communicates with the authentication encryption device, the authentication encryption device including plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio, and a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and a plurality of plaintext blocks obtained by dividing the first plaintext into a length corresponding to the input length, and a plurality of plaintext blocks corresponding to the plurality of plaintext blocks are generated by the encryption function. a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext by obtaining a plurality of ciphertext blocks obtained by encrypting the first plaintext; a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext by using a value other than a value used for encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext and the second plaintext; and generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plurality of plaintext blocks and a mask value obtained based on the first value. and an authentication tag generating means for generating an authentication tag by using a second value obtained by encrypting the nonce using an encryption function and the second ciphertext to generate a second tag, wherein the authentication / decryption device generates an authentication tag by using the encryption function to divide a ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio, and a mask value obtained based on the first value obtained by encrypting the nonce using the encryption function and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length. a first decryption means for acquiring a plurality of plaintext blocks corresponding to a block, and acquiring a first plaintext obtained by decrypting the first ciphertext; a second decryption means for acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; and generating a first tag by the encryption function, by using a value obtained based on an exclusive OR of a portion of the plurality of plaintext blocks, and a mask value obtained based on the first value;The authentication system further includes a verification tag generating means for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag, and a verification means for comparing the verification tag with an input authentication tag to verify whether or not tampering has occurred and performing control to output a verification result.

[0011] Also, the authenticated encryption method according to the present disclosure includes: dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length to obtain a mask value based on a first value obtained by encrypting a nonce using the encryption function corresponding to an encryption primitive having an output length longer than an input length; and using each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of plaintext blocks having lengths corresponding to the input length, obtaining a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks by the encryption function to obtain a first ciphertext obtained by encrypting the first plaintext; the encryption function generates a second ciphertext obtained by encrypting the second plaintext using a value other than the value used for encrypting the first plaintext among the encryption results output from the encryption function in the encryption process and the second plaintext, generates a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generates a second tag using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag.

[0012] Also, an authentication decryption method according to the present disclosure includes: dividing a ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having lengths corresponding to the input length, to obtain a first plaintext obtained by decrypting the first ciphertext; A second plaintext is obtained by decrypting the second ciphertext using a value other than the value used to decrypt the first ciphertext and the second ciphertext, a first tag is generated by the encryption function using a value obtained based on the exclusive OR of a portion of the multiple plaintext blocks and a mask value obtained based on the first value, a second tag is generated by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag, and the verification tag is compared with an input authentication tag to verify the presence or absence of tampering and perform control to output the verification result.

[0013] The program according to the present disclosure includes a step of dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; a step of obtaining a first ciphertext by encrypting the first plaintext using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of plaintext blocks having a length corresponding to the input length, by the encryption function, thereby obtaining a first ciphertext by encrypting the first plaintext; the step of obtaining a second ciphertext obtained by encrypting the second plaintext, using a value other than the value used for encrypting the first plaintext among the encryption results output from an encryption function, and the second plaintext; generating a first tag by the encryption function, using a value obtained based on an exclusive OR of a portion of the plurality of plaintext blocks, and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext, thereby generating an authentication tag.

[0014] The program according to the present disclosure includes a step of dividing a ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; a step of obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function; and a step of decrypting the first ciphertext by using the encryption function to obtain a plurality of plaintext blocks corresponding to the plurality of ciphertext blocks. the step of obtaining a second plaintext obtained by decrypting the second ciphertext using a value other than the value used in the first encryption function and the second ciphertext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plurality of plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; and performing a control step of verifying the presence or absence of tampering by comparing the verification tag with an input authentication tag and outputting the verification result. Effect of the Invention

[0015] According to the present disclosure, it is possible to provide an authentication encryption device, an authentication decryption device, an authentication encryption system, a method, and a program that are capable of efficiently performing authentication encryption processing using cryptographic primitives whose output length is longer than the input length. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an authentication encryption device according to a first comparative example. [Diagram 2] FIG. 11 is a diagram illustrating a configuration of an authentication encryption device according to a second comparative example. [Diagram 3]FIG. 1 is a diagram illustrating a configuration of an authenticated encryption system according to a first embodiment. [Figure 4] FIG. 1 is a diagram illustrating a configuration of an authentication encryption device according to a first embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 8] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 9] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by the authenticated encryption device according to the first embodiment. [Figure 11] FIG. 2 is a diagram illustrating a configuration of an authentication and decryption device according to a first embodiment. [Figure 12] FIG. 4 is a diagram illustrating an outline of calculations in an authentication and decryption process executed by the authentication and decryption device according to the first embodiment. [Figure 13] FIG. 4 is a diagram illustrating an outline of calculations in an authentication and decryption process executed by the authentication and decryption device according to the first embodiment. [Figure 14] FIG. 4 is a diagram illustrating an outline of calculations in an authentication and decryption process executed by the authentication and decryption device according to the first embodiment. [Figure 15] FIG. 4 is a diagram illustrating an outline of calculations in an authentication and decryption process executed by the authentication and decryption device according to the first embodiment. [Figure 16] FIG. 4 is a diagram illustrating an outline of calculations in an authentication and decryption process executed by the authentication and decryption device according to the first embodiment. [Figure 17]4 is a flowchart showing an authentication encryption method executed in the authentication encryption device according to the first embodiment; [Figure 18] 5 is a flowchart showing an authentication and decryption method executed by the authentication and decryption device according to the first embodiment. [Figure 19] FIG. 11 is a diagram for explaining a second modified example. [Figure 20] FIG. 11 is a diagram illustrating a configuration of an authentication encryption device according to a second embodiment. [Figure 21] FIG. 11 is a diagram illustrating an outline of calculations in an authenticated encryption process executed by an authenticated encryption device according to a second embodiment. [Figure 22] FIG. 11 is a diagram illustrating a configuration of an authentication and decryption device according to a second embodiment. [Diagram 23] FIG. 11 is a diagram illustrating a configuration of an authentication encryption device according to a third embodiment. [Figure 24] FIG. 11 is a diagram illustrating a configuration of an authentication and decryption device according to a third embodiment. [Diagram 25] FIG. 1 is a block diagram illustrating an example of the hardware configuration of a calculation processing device capable of realizing an apparatus and a system according to each embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] (Outline of this embodiment) Prior to the description of the present embodiment, an outline of the present embodiment will be described. Note that the present embodiment will be described below, but the following embodiment does not limit the invention according to the claims. Also, not all of the combinations of features described in the embodiment are necessarily essential to the solution of the invention. Also, in the following description, the indexes (English letters) used are not necessarily common throughout this specification. For example, index i may mean different things in one context and another. Also, the present embodiment will be described below using drawings, but it should be noted that each drawing used in the description of each embodiment does not apply only to that embodiment. In other words, each drawing may be applied to all of the embodiments.

[0018] First, we will explain the basic input and output of authenticated encryption (AE). In the following explanation, we consider communication between Alice and Bob, two people who share a secret key K, and send a message encrypted by authenticated encryption from Alice to Bob.

[0019] The encryption function of authenticated encryption is Enc, and the decryption function is Dec. Furthermore, the plain text to be encrypted is M, and a variable N (initial vector) called a nonce is further introduced. Furthermore, the associated data (AD) is A. Here, the associated data A (header) is a value that is not encrypted but is used for tamper detection. The associated data A is not necessary.

[0020] First, the encryption process on Alice's side will be explained. After generating a nonce N, Alice executes a process expressed as (C, T) = Enc_K (N, A, M). Here, Enc_K is an encryption function with a private key K as a parameter, and C is the ciphertext. Furthermore, T is a fixed-length variable for detecting tampering, called a tag (authentication tag). Alice sends a set (N, A, C, T) of nonce N, associated data A, ciphertext C, and tag T to Bob.

[0021] Next, the decryption process on Bob's side will be described. Let the information received by Bob be (N', A', C', T'). In this case, Bob executes Dec_K(N', A', C', T') as the decryption process. Note that Dec_K is a decryption function with the key K as a parameter. If there is tampering by a third party Eve during the communication and (N', A', C', T') ≠ (N, A, C, T), an error message (error symbol ⊥) indicating that there has been tampering is output for Dec_K(N', A', C', T'). That is, in this case, tampering is detected. On the other hand, if there is no tampering during the communication and (N', A', C', T') = (N, A, C, T), the plaintext M encrypted by Alice is correctly decrypted for Dec_K(N', A', C', T').

[0022] Also, in the above process, it is usually important to prevent the nonce N from accidentally matching a past value in encryption. For this reason, the encryption side uses some kind of state variable such as a counter to prevent the nonce from matching. That is, typically, the most recently used N is stored as a state variable, and N is incremented each time, thereby realizing that the nonce N does not overlap with past values.

[0023] FIG. 1 is a diagram showing a configuration of an authentication encryption device 70 according to a first comparative example. FIG. 1 shows a configuration of an authentication encryption device 70 realized using the ChaCha20-Poly1305 authentication encryption method according to Non-Patent Document 1. FIG. 1 also shows an outline of the calculation of the authentication encryption device 70 according to the first comparative example. In the following description, "ChaCha20-Poly1305" may be simply written as "CP". The authentication encryption device 70 according to the first comparative example has an encryption unit 72, a key generation unit 74, and a tag generation unit 76.

[0024] The encryption unit 72 performs encryption by the above-mentioned ChaCha20 encryption method using the random function CC_K. Here, the random function CC_K is an encryption function (cryptographic primitive) with an input length of 128 bits and an output length of 512 bits. Therefore, the random function CC_K is a cryptographic primitive with an input length longer than the output length. A 256-bit key K is input to the random function CC_K. The random function CC_K is a function whose output value appears random with respect to the input value. It is also extremely difficult to determine the input value from the output value of the random function CC_K. The random functions CC_K with different input keys can be regarded as independent functions.

[0025] The encryption unit 72 generates a key stream Z necessary for encrypting the plaintext M in a counter mode using a random function CC_K. Then, the encryption unit 72 encrypts the plaintext M using the key stream Z to obtain a ciphertext C.

[0026] Here, it is assumed that the length of plaintext M is 512×m bits. That is, m corresponds to the number of blocks when plaintext M is divided into 512-bit plaintext blocks. In this case, the encryption unit 72 inputs 32-bit counter values ​​“1”, “2”, . . . , “m” and a 96-bit nonce N to m random functions CC_K. Then, the encryption unit 72 obtains a 512×m-bit key stream Z obtained by concatenating the values ​​output from each random function CC_K. Then, the encryption unit 72 obtains a ciphertext C by performing an exclusive OR (XOR) between the plaintext M and the key stream Z.

[0027] The key generation unit 74 generates keys R and S to be used by the tag generation unit 76. Specifically, the key generation unit 74 inputs a 32-bit counter value "0" and a nonce N to a random function CC_K. Then, the key generation unit 74 divides the upper 256 bits of the output value of the random function CC_K into 128-bit portions to generate 128-bit keys R and S.

[0028] The tag generation unit 76 generates an authentication tag T by the Poly1305 tamper detection method described above. Specifically, the tag generation unit 76 inputs the ciphertext C, the associated data A, and the keys R and S to a MAC (Message Authentication Code) function by Poly1305. As a result, the tag generation unit 76 obtains the 128-bit tag T output from the MAC function. Note that if there is no associated data A, it is not necessary to input the associated data A to the MAC function.

[0029] More specifically, when there is no associated data A, the tag generation unit 76 obtains the tag T by calculating the sum of the output H_R(C) of the polynomial hash function defined by the key R and the key S in mod(2^128). That is, the tag generation unit 76 obtains the tag T by performing an operation defined in mod(2^128) using the output H_R(C) of the polynomial hash function defined by the key R and the key S. That is, the following formula (1) holds.

number

[0030] Moreover, the output H_R(C) of the polynomial hash function is expressed by the following equation (2).

number

[0031] Fig. 2 is a diagram showing a configuration of an authentication encryption device 80 according to a second comparative example. Fig. 2 shows a configuration of the authentication encryption device 80 realized using the OTR authentication encryption method according to Patent Document 1. Fig. 2 is also a diagram showing an outline of the calculation of the authentication encryption device 80 according to the second comparative example.

[0032] Here, the OTR method is an authenticated encryption method that uses a block cipher as a cryptographic primitive. The OTR method is also a "rate 1" authenticated encryption method with an encryption rate of "1". In other words, the OTR method is an authenticated encryption method that uses a block cipher only once for one plaintext block. The OTR method performs encryption using a two-stage Feistel structure. Therefore, the same cryptographic primitive (encryption function) is used in the encryption process and the decryption process. In other words, the decryption function, which is the inverse function of the encryption function used in the encryption process, is not required in the decryption process. With the above configuration, the OTR method can achieve authenticated encryption with the same amount of processing as a usage mode that performs only encryption.

[0033] The authentication encryption device 80 according to the second comparative example includes an encryption unit 82 and a tag generation unit 86. The encryption unit 82 and the tag generation unit 86 use a block cipher function E_K, the input length and output length of which are both n bits, as an encryption component (encryption function).

[0034] As described above, the encryption unit 82 encrypts the plaintext using the two-round Feistel structure. Specifically, the encryption unit 82 encrypts the nonce N using the block cipher function E_K to obtain the value L. When encrypting the plaintext, the encryption unit 82 uses the exclusive OR of a mask value derived from the value L as the input to the block cipher function E_K in the two-round Feistel structure. Note that the mask values ​​corresponding to the block cipher functions E_K are required to be different from each other.

[0035] Specifically, the encryption unit 82 encrypts each pair of an odd-numbered plaintext block M[2j-1] and the next even-numbered plaintext block M[2j] in plaintext blocks M[1],...,M[m] using a two-stage Feistel structure. Note that j is an integer between 1 and l. If m is an even number, then l=m / 2, and if m is an odd number, then l=(m+1) / 2.

[0036] The encryption unit 82 inputs the exclusive OR of the plaintext block M[1] and the mask value L to the block cipher function E_K to obtain the encryption result E_K(L,M[1]). Then, the encryption unit 82 obtains the exclusive OR of the encryption result E_K(L,M[1]) and the plaintext block M[2] as the ciphertext block C[1] corresponding to the plaintext block M[1]. The encryption unit 82 also inputs the exclusive OR of the ciphertext block C[1] and the mask value 3L to the block cipher function E_K to obtain the encryption result E_K(3L,C[1]). Then, the encryption unit 82 obtains the exclusive OR of the encryption result E_K(3L,C[1]) and the plaintext block M[1] as the ciphertext block C[2] corresponding to the plaintext block M[2].

[0037] The encryption unit 82 also inputs the exclusive OR of the plaintext block M[3] and the mask value 2L to the block cipher function E_K to obtain the encryption result E_K(2L,M[3]). The encryption unit 82 then inputs the exclusive OR of the encryption result E_K(2L,M[3]) and the plaintext block M[4] as the ciphertext block C[3] corresponding to the plaintext block M[3]. The encryption unit 82 also inputs the exclusive OR of the ciphertext block C[3] and the mask value 2·3L to the block cipher function E_K to obtain the encryption result E_K(2·3L,C[3]). The encryption unit 82 then inputs the exclusive OR of the encryption result E_K(2·3L,C[3]) and the plaintext block M[3] as the ciphertext block C[4] corresponding to the plaintext block M[4].

[0038] Similarly, the encryption unit 82 inputs the exclusive OR of the plaintext block M[2j-1] and the mask value 2^(j-1)·L to the block cipher function E_K to obtain the encryption result E_K(2^(j-1)·L,M[2j-1]). Then, the encryption unit 82 obtains the exclusive OR of the encryption result E_K(2^(j-1)·L,M[2j-1]) and the plaintext block M[2j] as the ciphertext block C[2j-1] corresponding to the plaintext block M[2j-1]. The encryption unit 82 also inputs the exclusive OR of the ciphertext block C[2j-1] and the mask value 2^(j-1)·3L to the block cipher function E_K to obtain the encryption result E_K(2^(j-1)·3L,C[2j-1]). Then, the encryption unit 82 obtains the exclusive OR of the encryption result E_K(2^(j-1)·3L, C[2j-1]) and the plaintext block M[2j-1] as the ciphertext block C[2j] corresponding to the plaintext block M[2j].

[0039] The process for the final plaintext block differs depending on whether m is an odd number or an even number. When m is an even number, the encryption unit 82 inputs the exclusive OR of the plaintext block M[m-1] and the mask value 2^(l-1)·L to the block cipher function E_K to obtain the encryption result Z. Note that Z=E_K(2^(l-1)·L,M[m-1]). Here, the bit length x of the final plaintext block M[m] may be less than n bits. Therefore, the encryption unit 82 obtains msb{|M[m]|}(Z) by truncating the encryption result Z to the bit length x of the plaintext block M[m] (1≦x≦n). Note that msb{|M[m]|}(Z) is a bit string of the most significant x bits of the encryption result Z. Also, x=|M[m]|. In other words, |M[i]| indicates the bit length of the bit string M[i].

[0040] Then, the encryption unit 82 obtains the exclusive OR of msb{|M[m]|}(Z) and the plaintext block M[m] as the ciphertext block C[m] corresponding to the plaintext block M[m]. The number of bits of the ciphertext block C[m] is the same as the number of bits of the plaintext block M[m]. The encryption unit 82 also performs padding processing such as one-zero padding processing on the ciphertext block C[m] to obtain an n-bit bit string pad(C[m]) corresponding to the ciphertext block C[m]. The encryption unit 82 also inputs the exclusive OR of the bit string pad(C[m]) and the mask value 2^(l-1)·3L to the block cipher function E_K to obtain the encryption result E_K(2^(l-1)·3L,pad(C[m])). Then, the encryption unit 82 obtains the exclusive OR of the encryption result E_K(2^(l-1)·3L,pad(C[m])) and the plaintext block M[m-1] as the ciphertext block C[m-1] corresponding to the plaintext block M[m-1].

[0041] When m is an odd number, the encryption unit 82 inputs the mask value 2^(l-1)·L to the block cipher function E_K to obtain the encryption result E_K(2^(l-1)·L). The encryption unit 82 then obtains msb{|M[m]|}(E_K(2^(l-1)·L)) by truncating the encryption result E_K(2^(l-1)·L) so that the number of bits becomes x of the plaintext block M[m]. The encryption unit 82 then obtains the exclusive OR of msb{|M[m]|}(E_K(2^(l-1)·L)) and the plaintext block M[m] as the ciphertext block C[m] corresponding to the plaintext block M[m]. Note that the number of bits of the ciphertext block C[m] is the same as the number of bits of the plaintext block M[m].

[0042] The tag generator 86 obtains a checksum Σ by exclusive ORing the even-numbered plaintext blocks. When m is an even number, the checksum Σ is expressed by the following formula 3. Note that the symbol with a "+" in a circle indicates exclusive OR (XOR).

number

[0043] When m is an odd number, the checksum Σ is expressed by the following Equation 4.

number

[0044] The tag generator 86 inputs the exclusive OR of the obtained checksum Σ and the appropriate mask value to the block cipher function E_K, and obtains the encryption result as the authentication tag T. Note that if |M[m]| ≠ n, that is, if the number of bits of the final plaintext block M[m] is not n, the "appropriate mask value" is 3 2 L * In addition, if |M[m]|=n, that is, if the number of bits in the final plaintext block M[m] is n, then the “appropriate mask value” is 7L * Note that when m is an even number, L *= 2^(l-1) 3L. Also, if m is an odd number, L * = 2^(l-1) L.

[0045] Here, from the viewpoint of calculation cost, the problem of the first comparative example will be described. The OTR method according to the second comparative example is an authentication encryption method of the "rate 1 method" in which the encryption rate is "1". In contrast, in the ChaCha20-Poly1305 method according to the first comparative example, after encrypting the plaintext, a tag for tamper detection is generated using the ciphertext. Therefore, in the ChaCha-Poly1305 method according to the first comparative example, the calculation cost for the plaintext length increases compared to the rate 1 method. In other words, in the ChaCha-Poly1305 method according to the first comparative example, there is a risk that the authentication encryption process cannot be performed efficiently compared to the rate 1 method. Therefore, even if the encryption primitive used in the ChaCha-Poly1305 method according to the first comparative example is used, it is desired that the calculation cost is as close as possible to the calculation cost of the rate 1 method. Furthermore, the encryption primitive used in the ChaCha-Poly1305 method according to the first comparative example is a random function CC_K that does not have a decryption function. Therefore, it is desirable to make the computational cost as close as possible to that of a rate 1 scheme even when using cryptographic primitives that do not have a decryption function.

[0046] In contrast, as described below, in this embodiment, the encryption primitive used in the OTR method according to the second comparative example is replaced with an encryption primitive such as that used in the ChaCha20-Poly1305 method according to the first comparative example. In other words, in this embodiment, the block cipher function E_K used in the OTR method according to the second comparative example is replaced with an encryption primitive such as the random function CC_K used in the ChaCha20-Poly1305 method according to the first comparative example. Here, in the random function CC_K, the input length is 128 bits, whereas the output length is 512 bits. Therefore, if the block cipher function E_K used in the OTR method is simply replaced with the random function CC_K, a bit string of 384 bits, which is the difference between the output length and the input length, will be left over. Therefore, in the device according to this embodiment, the authentication encryption process is performed using the 384-bit surplus bit string as well.

[0047] That is, the device according to the present embodiment divides a plaintext into a first plaintext and a second plaintext. The device according to the present embodiment generates a first ciphertext and a first tag for the first plaintext using a configuration in which the block cipher function E_K used in the OTR method is replaced with a random function CC_K. That is, the device according to the present embodiment performs processing corresponding to the above-mentioned OTR method for the first plaintext. However, the device according to the present embodiment uses a cryptographic primitive such as the random function CC_K whose output length is longer than the input length when encrypting the first plaintext. Note that the device according to the present embodiment does not need to use the random function CC_K as a cryptographic primitive when encrypting the first plaintext. That is, the device according to the present embodiment may use a cryptographic primitive other than the random function CC_K as long as the cryptographic primitive has an output length longer than the input length.

[0048] Furthermore, the device according to the present embodiment generates a second ciphertext and a second tag using the second plaintext and the above-mentioned 384-bit surplus bit string. That is, the device according to the present embodiment generates the second ciphertext by XORing the second plaintext and the key stream, which is a concatenation of the surplus bit strings. Note that the device according to the present embodiment generates the second tag by inputting the second ciphertext to a MAC function based on Poly1305. That is, the device according to the present embodiment performs processing on the second plaintext corresponding to the above-mentioned ChaCha20-Poly1305.

[0049] With the above-described configuration, the device according to the present embodiment can realize authenticated encryption with reduced computational cost compared to the first comparative example, even when using an encryption primitive in which the input length is longer than the output length, as used in the first comparative example. That is, the device according to the present embodiment can efficiently perform authenticated encryption processing, even when using an encryption primitive in which the input length is longer than the output length. That is, compared to the first comparative example, the device according to the present embodiment can greatly reduce the data size input to the MAC function by Poly1305, with almost no change in the number of calls of the required random function CC_K.

[0050] In addition, the device according to the present embodiment uses a MAC function based on Poly1305 from the viewpoint of security when generating the second tag using the second plaintext and the redundant bit string. That is, for secure tamper detection in authenticated encryption, it is necessary that it is difficult to forge a tag when even one bit of the ciphertext is tampered with. Here, for example, it is assumed that a method similar to the OTR method is adopted for "tamper detection of the second ciphertext obtained by exclusive ORing the key stream obtained from the concatenation of the second plaintext and the redundant bit string". That is, it is assumed that a method is adopted in which a checksum is calculated by the sum (XOR) of plaintext blocks and this checksum is encrypted to generate a tag. In this case, it becomes easy to perform tampering as follows. That is, a tamperer can easily make the checksum value the same as the legitimate checksum by appropriately adjusting the difference between the forged ciphertext and the legitimate ciphertext. By tampering with the ciphertext in this way, a tamperer can forge a tag. In contrast, by generating a tag by inputting the second ciphertext to a MAC function as in this embodiment, it is possible to ensure security more reliably.

[0051] (Embodiment 1) Hereinafter, the embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary. As described above, the authentication encryption device according to the first embodiment corresponds to a configuration in which the cryptographic primitive used in the second comparative example is replaced with the cryptographic primitive used in the first comparative example. In the following description, the random function CC_K used in the first comparative example is used as the cryptographic primitive in the first embodiment, but the configuration is not limited to this. As the cryptographic primitive, any cryptographic primitive whose output length is longer than the input length may be used.

[0052] FIG. 3 is a diagram showing a configuration of the authentication encryption system 1 according to the first embodiment. The authentication encryption system 1 includes an authentication encryption device 10 and an authentication decryption device 20. The authentication encryption device 10 and the authentication decryption device 20 may be physically integrated or may be separate. When the authentication encryption device 10 and the authentication decryption device 20 are physically separate from each other, the authentication encryption device 10 and the authentication decryption device 20 are connected to each other so as to be able to communicate with each other via wire or wirelessly. Also, components of the authentication encryption device 10 described later may be realized by different devices. Similarly, components of the authentication decryption device 20 described later may be realized by different devices. Also, in the example of communication between Alice and Bob described above, the authentication encryption device 10 corresponds to Alice, and the authentication decryption device 20 corresponds to Bob. That is, communication is performed between the authentication encryption device 10 and the authentication decryption device 20.

[0053] <Authentication Encryption Device> FIG. 4 is a diagram showing a configuration of the authentication encryption device 10 according to the first embodiment. Also, FIGS. 5 to 10 are diagrams showing an outline of an operation in the authentication encryption process executed by the authentication encryption device 10 according to the first embodiment. As shown in FIG. 4, the authentication encryption device 10 according to the first embodiment includes an input unit 100, a plaintext division unit 102, and a nonce processing unit 104. Furthermore, the authentication encryption device 10 according to the first embodiment includes a first encryption unit 110, a second encryption unit 120, a checksum calculation unit 130, a first tag generation unit 140, a second tag generation unit 150, a tag integration unit 160, and an output unit 170. Also, the first tag generation unit 140, the second tag generation unit 150, and the tag integration unit 160 configure an authentication tag generation unit 162. That is, the authentication encryption device 10 includes the authentication tag generation unit 162.

[0054] The authentication encryption device 10 can be realized by an information processing device such as a computer. That is, the authentication encryption device 10 has an arithmetic device such as a CPU (Central Processing Unit) and a storage device such as a memory or a disk. The authentication encryption device 10 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0055] The input unit 100 functions as an input means. The plaintext division unit 102 functions as a plaintext division means. The nonce processing unit 104 functions as a nonce processing means. The first encryption unit 110 functions as a first encryption means. The second encryption unit 120 functions as a second encryption means. The checksum calculation unit 130 functions as a checksum calculation means. The first tag generation unit 140 functions as a first tag generation means. The second tag generation unit 150 functions as a second tag generation means. The tag integration unit 160 functions as a tag integration means (first tag integration means). The authentication tag generation unit 162 functions as an authentication tag generation means. The output unit 170 functions as an output means.

[0056] The input unit 100 accepts input of a nonce N, plain text M to be encrypted, and related data A. The input unit 100 may be realized by an input device such as a keyboard. The input unit 100 may accept input of the nonce N, plain text M, and related data A from an external device connected via a network, for example. Note that there may be cases where the related data A does not exist, in which case the related data A is not input.

[0057] The input unit 100 may generate the nonce N. In this case, the nonce N is generated so that there is no overlap with past values. That is, the input unit 100 generates a nonce N different from a value generated in the past. Specifically, for example, the input unit 100 first generates an arbitrary fixed value. Also, the input unit 100 stores the value of the nonce generated immediately before. Then, when generating a nonce N for the second or subsequent times, the input unit 100 outputs a value obtained by adding 1 to the stored immediately previous value. In this manner, the input unit 100 may generate a nonce N different from a value generated in the past by outputting a value obtained by adding 1 to the value already output one time ago. Note that the input unit 100 may generate a nonce in a manner different from the above-mentioned example, as long as it can generate a value different from a value generated in the past. Alternatively, another component such as a nonce generation unit may generate the nonce N.

[0058] The input unit 100 outputs the plaintext M to the plaintext division unit 102. In addition, the input unit 100 outputs the nonce N to the nonce processing unit 104. In addition, the input unit 100 outputs the associated data A to the second tag generation unit 150.

[0059] The plaintext division unit 102 divides the plaintext M into a first plaintext M_O and a second plaintext M_C at a predetermined ratio. Specifically, the plaintext division unit 102 divides the plaintext M into the first plaintext M_O and the second plaintext M_C so that |M_O|:|M_C|=128:384. That is, the plaintext division unit 102 divides the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio between the input length n1 and the length n3 obtained by subtracting the input length n1 from the output length n2. In other words, the plaintext division unit 102 divides the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio n1:n3. Note that n1 is the input length of the random function CC_K, which is a cryptographic primitive, and n1=128 bits. Furthermore, n2 is the output length of the random function CC_K, which is a cryptographic primitive, and n2 = 512 bits. Therefore, n3 = 512 - 128 = 384 bits.

[0060] More specifically, the plaintext division unit 102 divides the plaintext M into lengths corresponding to the output length of the encryption primitive. That is, the plaintext division unit 102 divides the plaintext M into plaintext parts M[1], . . . , M[m], each of which is n2=512 bits, where m is the number of plaintext parts. If the bit length of the plaintext M is not a multiple of 512, |M[m]|<512.

[0061] The plaintext division unit 102 divides the 512-bit plaintext part M[i] into a 128-bit plaintext block M_O[i] and a 384-bit plaintext block M_C[i] for each of i=1,...,m. That is, the plaintext division unit 102 divides the plaintext part M[i] into an n1-bit plaintext block M_O[i] and an n3-bit plaintext block M_C[i]. As a result, the plaintext division unit 102 obtains a first plaintext M_O where M_O=M_O[1]||M_O[2]||···||M_O[m]. The plaintext division unit 102 also obtains a second plaintext M_C where M_C=M_C[1]||M_C[2]||···||M_C[m]. Here, "||" indicates a concatenation of bit strings. When |M[m]|=512, |M_O|:|M_C|=128:384. As described later, the first plaintext M_O is processed by the OTR method with the random function CC_K as the encryption primitive. The second plaintext M_C is processed by the ChaCha20-Poly1305 method. The plaintext division unit 102 outputs the first plaintext M_O to the first encryption unit 110. The plaintext division unit 102 outputs the second plaintext M_C to the second encryption unit 120.

[0062] If 128<|M[m]|<512, the plaintext division unit 102 may divide the plaintext part M[m] into M_O[m] of 128 bits and M_C[m] of less than 384 bits. If |M[m]|≦128, the plaintext division unit 102 may divide the plaintext part M[m] into M_O[m] of less than 128 bits and M_C[m] of 0 bits. In other words, if |M[m]|≦128, the plaintext division unit 102 may treat the plaintext part M[m] as it is as M_O[m].

[0063] The nonce processing unit 104 processes the nonce N using a random function CC_K. Specifically, as shown in FIG. 5, the nonce processing unit 104 inputs the 128-bit nonce N to the random function CC_K to obtain an output 512-bit bit string (random number). The nonce processing unit 104 also divides the 512-bit bit string into bit strings L_1, L_2, L_3, and L_4, each of which is 128 bits (=n1). The nonce processing unit 104 then outputs the bit strings L_1 and L_2 to the first encryption unit 110. The nonce processing unit 104 also outputs the bit strings L_3 and L_4 to the second tag generation unit 150. The bit strings L_1 and L_2 (first value) are used to obtain a mask value used in the encryption process of the first plaintext M_O. Moreover, the bit strings L_3 and L_4 (second value) are used as a key for generating a second tag T_C corresponding to the second plaintext M_C. That is, the bit strings L_3 and L_4 correspond to the above-mentioned keys R and S.

[0064] The first encryption unit 110 encrypts the first plaintext M_O by the OTR method using a random function CC_K. At this time, the first encryption unit 110 encrypts the plaintext blocks M_O[1], . . . , M_O[m] into which the first plaintext M_O is divided, using a mask value obtained based on bit strings L_1 and L_2. That is, the first encryption unit 110 obtains the first ciphertext C_O by the random function CC_K, using the mask value obtained based on values ​​L_1 and L_2 obtained by encrypting a nonce N using the random function CC_K and each of the multiple plaintext blocks M_O[i]. In addition, the first encryption unit 110 obtains the first ciphertext C_O by using the exclusive OR of the plaintext block and a first random number of the number of bits corresponding to the input length among the encryption results output from the random function CC_K (encryption function). Here, the first ciphertext C_O corresponds to the value into which the first plaintext M_O is encrypted. As described above, the multiple plaintext blocks M_O[i] are obtained by dividing the first plaintext M_O into blocks of a length corresponding to the input length of the random function CC_K.

[0065] Specifically, as shown in FIG. 6, the first encryption unit 110 performs encryption on each pair of plaintext block M_O[2j-1] and plaintext block M_O[2j] using a two-stage Feistel structure. Here, plaintext block M_O[2j-1] is an odd-numbered plaintext block in plaintext blocks M_O[1], . . . , M_O[m]. Also, plaintext block M_O[2j] is an even-numbered plaintext block next to plaintext block M_O[2j-1]. Here, j is an integer between 1 and l. Also, l=m / 2 when m is an even number, and l=(m+1) / 2 when m is an odd number. As will be described later, the first encryption unit 110 obtains a first ciphertext C_O by using an exclusive OR between a first random number of bits corresponding to the input length n1 among the encryption results output from a random function CC_K (encryption function) and the plaintext block M_O[i]. The first random number corresponds to a random number z_i, which will be described later.

[0066] The first encryption unit 110 inputs the exclusive OR of the 128-bit plaintext block M_O[1] and the 128-bit mask value L_1 to the random function CC_K. As a result, the first encryption unit 110 obtains the 512-bit (=n2) encryption result CC_K(L_1, M_O[1]). Then, the first encryption unit 110 divides the encryption result CC_K(L_1, M_O[1]) into a 128-bit (=n1) random number z_1 and a 384-bit (=n3) random number S_1. For example, the first encryption unit 110 may set the upper 128 bits of the encryption result CC_K(L_1, M_O[1]) as the random number z_1 and the lower 384 bits as the random number S_1. This also applies to the plaintext blocks M_O[i] other than i=1. Here, the random number S_1 corresponds to the surplus bit string described above.

[0067] Then, the first encryption unit 110 obtains the exclusive OR of the random number z_1 and the plaintext block M_O[2] as the ciphertext block C_O[1] corresponding to the plaintext block M_O[1]. The first encryption unit 110 also inputs the exclusive OR of the ciphertext block C_O[1] and the mask value L_2 to a random function CC_K to obtain the encryption result CC_K(L_2, C_O[1]). The first encryption unit 110 then divides the encryption result CC_K(L_2, C_O[1]) into a 128-bit (=n1) random number z_2 and a 384-bit (=n3) random number S_2. The first encryption unit 110 obtains the exclusive OR of the random number z_2 and the plaintext block M_O[1] as the ciphertext block C_O[2] corresponding to the plaintext block M_O[2]. Here, the random number S_2 corresponds to the surplus bit string described above.

[0068] The first encryption unit 110 also inputs the exclusive OR of the 128-bit plaintext block M_O[3] and the 128-bit mask value 2·L_1 to the random function CC_K. As a result, the first encryption unit 110 obtains a 512-bit encryption result CC_K(2·L_1, M_O[3]). The first encryption unit 110 then divides the encryption result CC_K(2·L_1, M_O[3]) into a 128-bit (=n1) random number z_3 and a 384-bit (=n3) random number S_3. Here, the random number S_3 corresponds to the surplus bit string described above.

[0069] Then, the first encryption unit 110 obtains the exclusive OR of the random number z_3 and the plaintext block M_O[4] as the ciphertext block C_O[3] corresponding to the plaintext block M_O[3]. The first encryption unit 110 also inputs the exclusive OR of the ciphertext block C_O[3] and the mask value 2·L_2 to a random function CC_K to obtain the encryption result CC_K(2·L_2, C_O[3]). The first encryption unit 110 then divides the encryption result CC_K(2·L_2, C_O[3]) into a 128-bit (=n1) random number z_4 and a 384-bit (=n3) random number S_4. Then, the first encryption unit 110 obtains the exclusive OR of the random number z_4 and the plaintext block M_O[3] as the ciphertext block C_O[4] corresponding to the plaintext block M_O[4]. Here, the random number S_4 corresponds to the surplus bit string described above.

[0070] Similarly, the first encryption unit 110 inputs the exclusive OR of the 128-bit plaintext block M_O[2j-1] and the 128-bit mask value 2^(j-1)·L_1 to the random function CC_K. As a result, the first encryption unit 110 obtains a 512-bit encryption result CC_K(2^(j-1)·L_1, M_O[2j-1]). Then, the first encryption unit 110 divides the encryption result CC_K(2^(j-1)·L_1, M_O[2j-1]) into a 128-bit (=n1) random number z_(2j-1) and a 384-bit (=n3) random number S_(2j-1). Here, the random number S_(2j-1) corresponds to the surplus bit string described above.

[0071] Then, the first encryption unit 110 obtains the exclusive OR of the random number z_(2j-1) and the plaintext block M_O[2j] as the ciphertext block C_O[2j-1] corresponding to the plaintext block M_O[2j-1]. The first encryption unit 110 also inputs the exclusive OR of the ciphertext block C_O[2j-1] and the mask value 2^(j-1)·L_2 to a random function CC_K to obtain the encryption result CC_K(2^(j-1)·L_2, C_O[2j-1]). The first encryption unit 110 then divides the encryption result CC_K(2^(j-1)·L_2, C_O[2j-1]) into a 128-bit (=n1) random number z_(2j) and a 384-bit (=n3) random number S_(2j). Then, the first encryption unit 110 obtains the exclusive OR of the random number z_(2j) and the plaintext block M_O[2j-1] as the ciphertext block C_O[2j] corresponding to the plaintext block M_O[2j]. Here, the random number S_(2j) corresponds to the surplus bit string described above.

[0072] The processing for the final plaintext block differs depending on whether m is an odd number or an even number. When m is an even number, the first encryption unit 110 performs the processing shown in FIG. 7. The first encryption unit 110 inputs the exclusive OR of a 128-bit (=n1) plaintext block M_O[m-1] and a 128-bit (=n1) mask value 2^(l-1)·L_1 to a random function CC_K. As a result, the first encryption unit 110 obtains a 512-bit (=n2) encryption result CC_K(2^(l-1)·L_1,M_O[m-1]). Then, the first encryption unit 110 divides the encryption result CC_K(2^(l-1)·L_1,M_O[m-1]) into a 128-bit (=n1) random number z_(m-1) and a 384-bit (=n3) random number S_(m-1), where Z=z_(m-1). Here, the random number S_(m-1) corresponds to the surplus bit string described above.

[0073] Then, the first encryption unit 110 obtains msb{|M_O[m]|}(Z) by truncating the random number Z to the bit length x (1≦x≦n1 (=128)) of the plaintext block M_O[m]. The first encryption unit 110 then obtains the exclusive OR of msb{|M_O[m]|}(Z) and the plaintext block M_O[m] as the ciphertext block C_O[m] corresponding to the plaintext block M_O[m]. Note that the number of bits of the ciphertext block C_O[m] is the same as the number of bits of the plaintext block M_O[m].

[0074] The first encryption unit 110 also performs padding such as one-zero padding on the ciphertext block C_O[m] to obtain a 128-bit (=n1) bit string pad(C_O[m]) corresponding to the ciphertext block C_O[m]. The first encryption unit 110 also inputs the exclusive OR of the bit string pad(C_O[m]) and a mask value 2^(l-1)·L_2 to a random function CC_K to obtain an encryption result CC_K(2^(l-1)·L_2,pad(C_O[m])). The first encryption unit 110 then divides the encryption result CC_K(2^(l-1)·L_2,pad(C_O[m])) into a 128-bit (=n1) random number z_m and a 384-bit (=n3) random number S_m. Then, the first encryption unit 110 obtains the exclusive OR of the random number z_m and the plaintext block M_O[m-1] as the ciphertext block C_O[m-1] corresponding to the plaintext block M_O[m-1]. Here, the random number S_m corresponds to the surplus bit string described above.

[0075] When m is an odd number, the first encryption unit 110 performs the process shown in Fig. 8. The first encryption unit 110 inputs the mask value 2^(l-1)·L_1 to a random function CC_K to obtain the encryption result CC_K(2^(l-1)·L_1). The first encryption unit 110 then divides the encryption result CC_K(2^(l-1)·L_1) into a 128-bit (=n1) random number z_m and a 384-bit (=n3) random number S_m. The first encryption unit 110 then obtains msb{|M_O[m]|}(z_m) by truncating the random number z_m to the bit length x (1≦x≦n1(=128)) of the plaintext block M_O[m]. Then, the first encryption unit 110 obtains the exclusive OR of msb{|M_O[m]|}(z_m) and the plaintext block M_O[m] as the ciphertext block C_O[m] corresponding to the plaintext block M_O[m]. Note that the number of bits of the ciphertext block C_O[m] is the same as the number of bits of the plaintext block M_O[m].

[0076] The first encryption unit 110 outputs the ciphertext blocks C_O[1],...,C_O[m] as the first ciphertext C_O to the output unit 170. At this time, the first encryption unit 110 may output C_O (=C_O[1]||||C_O[m]) in which the ciphertext blocks C_O[1],...,C_O[m] are concatenated to the output unit 170.

[0077] Furthermore, the first encryption unit 110 concatenates the random numbers S_1, S_2, . . . , S_m corresponding to the surplus bit string to obtain a random number S of 384×m bits. That is, S=S_1||S_2||. . . ||S_m. Note that strictly speaking, |S|=384×m is satisfied when |M|=512×m. The first encryption unit 110 then outputs the random number S to the second encryption unit 120. Note that the first encryption unit 110 may output the random numbers S_1, S_2, . . . , S_m to the second encryption unit 120 without concatenating them. In this case, the second encryption unit 120 may concatenate the random numbers S_1, S_2, . . . , S_m to obtain a random number S of 384×m bits (=n3×m).

[0078] Here, among the encryption results output from the random function CC_K, which is an encryption function, in encrypting the first plaintext M_O, the values ​​z_1,...,z_m are used in encrypting the first plaintext M_O. In contrast, among the encryption results output from the random function CC_K, the random numbers S_1, S_2,...,S_m (random number S) are values ​​other than those used in encrypting the first plaintext M_O.

[0079] The checksum calculation unit 130 calculates the checksum Σ based on the exclusive OR of some of the plaintext blocks M_O[i]. Specifically, the checksum calculation unit 130 calculates the checksum Σ by the exclusive OR of the even-numbered plaintext blocks M_O[2], M_O[4], .... More specifically, when m is an even number, the checksum calculation unit 130 calculates the 128-bit (=n1) checksum Σ as expressed by the following formula 5.

number

[0080] On the other hand, if m is an odd number, the checksum calculation unit 130 calculates a 128-bit (=n1) checksum Σ as expressed by the following equation 6.

number

[0081] Here, when the checksum calculation unit 130 performs one-zero padding processing on C_O[m], "pad(C_O[m])" in the formula 5 can be expressed as ozp(C_O[m]). Similarly, when the checksum calculation unit 130 performs one-zero padding processing on M_O[m], "pad(M_O[m])" in the formula 6 can be expressed as ozp(M_O[m]). The same applies to other pad(). The checksum calculation unit 130 outputs the obtained checksum Σ to the first tag generation unit 140.

[0082] The first tag generating unit 140 of the authentication tag generating unit 162 generates a first tag T_O for generating a tag for authentication. The first tag generating unit 140 generates the first tag T_O by the OTR method using the checksum Σ. Specifically, as shown in FIG. 9, the first tag generating unit 140 generates the first tag T_O (first partial tag) by a random function CC_K, which is an encryption function, using the checksum Σ and an appropriate mask value L^*. Here, the mask value L^* is obtained based on bit strings L_1 and L_2, as described later. That is, the first tag generating unit 140 generates the first tag T_O by an encryption function using a value (checksum Σ) obtained based on an exclusive OR of a part of a plurality of plaintext blocks and the mask value L^* obtained based on the bit strings L_1 and L_2 (first value).

[0083] More specifically, the first tag generation unit 140 generates a 128-bit (=n1) first tag T_O by a random function CC_K using the exclusive OR of a 128-bit (=n1) checksum Σ and a 128-bit (=n1) mask value L^*. The first tag generation unit 140 obtains the encryption result obtained by inputting the exclusive OR of the checksum Σ and the mask value L^* to the random function CC_K as the first tag T_O. The first tag generation unit 140 outputs the generated first tag T_O to the tag integration unit 160.

[0084] Here, when m is an even number and |M[m]|=n1 (=128 bits), L^*=3·2^(l-1)·L_2 may be used. When m is an even number and |M[m]|≠n1, L^*=3^2·2^(l-1)·L_2 may be used. When m is an odd number and |M[m]|=n1, L^*=3·2^(l-1)·L_1 may be used. When m is an odd number and |M[m]|≠n1, L^*=3^2·2^(l-1)·L_1 may be used. In the above example, the mask value L^* is calculated using triple arithmetic, but the method of calculating the mask value L^* is not limited to this. For example, the mask value L^* may be calculated using seven-times arithmetic.

[0085] The second encryption unit 120 encrypts the second plaintext M_C by the ChaCha20-Poly1305 method (CP method). Specifically, as shown in FIG. 10, the second encryption unit 120 encrypts the plaintext M_C by using the random number S as a key stream. As a result, the second encryption unit 120 obtains the second ciphertext C_C obtained by encrypting the second plaintext M_C. That is, the second encryption unit 120 obtains the second ciphertext C_C obtained by encrypting the second plaintext M_C by using the random number S (second random number) and the second plaintext M_C. As described above, the random numbers S (S_1, S_2, . . . ) are values ​​other than the value (random number z; first random number) used in encrypting the first plaintext M_O among the encryption results output from the random function CC_K (encryption function) in encrypting the first plaintext M_O.

[0086] More specifically, the second encryption unit 120 obtains the second ciphertext C_C by using the exclusive OR of the value (random number S) obtained by concatenating random numbers S_1, S_2, . . . , S_m (second random numbers) and the second plaintext M_C. That is, the second encryption unit 120 obtains msb{|M_C|}(S) by truncating the random number S (=S_1||S_2||. . . . ||S_m) to the number of bits of the second plaintext M_C. Then, the second encryption unit 120 obtains the exclusive OR of the msb{|M_C|}(S) and the second plaintext M_C as the second ciphertext C_C corresponding to the second plaintext M_C. The second encryption unit 120 outputs the second ciphertext C_C to the second tag generation unit 150 and the output unit 170.

[0087] The second tag generating unit 150 of the authentication tag generating unit 162 generates a second tag T_C for generating a tag for authentication. The second tag generating unit 150 generates the second tag T_C by the CP method using the second ciphertext C_C. Specifically, as shown in FIG. 10, the second tag generating unit 150 generates the second tag T_C by using bit strings L_3 and L_4 (second value) obtained by encrypting the nonce N using the random function CC_K and the second ciphertext C_C. More specifically, the second tag generating unit 150 generates the second tag T_C by a function based on a message authentication code (MAC function) using the bit strings L_3 and L_4 (second value) and the second ciphertext C_C. At this time, as described above, the second tag generating unit 150 uses the 128-bit (=n1) bit strings L_3 and L_4 as keys corresponding to the keys R and S, respectively.

[0088] The second tag generation unit 150 inputs the second ciphertext C_C, the associated data A, and the keys L_3 and L_4 to a MAC function based on Poly1305 used in the CP method. As a result, the second tag generation unit 150 obtains the 128-bit bit string output from the MAC function as the second tag T_C. If there is no associated data A, the associated data A is not input to the MAC function. The second tag generation unit 150 outputs the second tag T_C to the tag integration unit 160. In the first comparative example, the tag generation unit 76 generates the tag T by calculating the sum of the output H_R of the polynomial hash function and the key S mod(2^128), but is not limited to such a configuration. The second tag generation unit 150 obtains the 128-bit bit string output from the polynomial hash function defined by the key L_3 as the second tag T_C. 3 The tag may be generated by calculating the sum of an arbitrary group of L_1 and key L_4. This also applies to the authentication and decryption device 20 and other embodiments described later.

[0089] The authentication tag generation unit 162 generates an authentication tag T. The tag integration unit 160 integrates the first tag T_O and the second tag T_C to generate one authentication tag T. Specifically, as shown in FIG. 9, the tag integration unit 160 obtains the exclusive OR of the first tag T_O and the second tag T_C as the authentication tag T. That is, the authentication tag generation unit 162 generates the first tag T_O and the second tag T_C to generate the authentication tag T. The authentication tag generation unit 162 (tag integration unit 160) outputs the authentication tag T to the output unit 170.

[0090] The output unit 170 performs control for outputting the ciphertext C and the authentication tag T. Here, the output unit 170 may generate the ciphertext C corresponding to the plaintext M by using the first ciphertext C_O and the second ciphertext C_C as follows. That is, the output unit 170 divides the second ciphertext C_C into ciphertext blocks C_C[1], . . . , C_C[m] of 384 bits (=n3). The number of bits of the ciphertext block C_C[m] is the same as the number of bits of the plaintext block M_C[m]. In addition, the output unit 170 concatenates the ciphertext block C_O[i] of 128 bits (=n1) and the ciphertext block C_C[i] of 384 bits (=n3) for each of i=1, . . . , m to obtain the ciphertext part C[i] of 512 bits (=n2). That is, C[i]=C_O[i]||C_C[i]. The number of bits of C[m] is the same as the number of bits of M[m]. Then, the output unit 170 concatenates the ciphertext parts C[1],...,C[m] to obtain the ciphertext C. That is, C=C[1]||||C[m].

[0091] The output unit 170 may, for example, perform control to display the ciphertext C and the authentication tag T on an output device such as a display. The output unit 170 may also perform control to output the ciphertext C and the authentication tag T to an external device connected via a network. The output unit 170 may also perform control to output the nonce N and the associated data A. For example, the output unit 170 transmits (N, A, C, T) to the authentication and decryption device 20.

[0092] <Authentication and Decryption Device> FIG. 11 is a diagram showing a configuration of the authentication decryption device 20 according to the first embodiment. Also, FIG. 12 to FIG. 16 are diagrams showing an outline of an operation in the authentication decryption process executed by the authentication decryption device 20 according to the first embodiment. As shown in FIG. 11, the authentication decryption device 20 according to the first embodiment includes an input unit 200, a ciphertext splitting unit 202, and a nonce processing unit 204. Furthermore, the authentication decryption device 20 according to the first embodiment includes a first decryption unit 210, a second decryption unit 220, a checksum calculation unit 230, a first tag generation unit 240, a second tag generation unit 250, a tag integration unit 260, a verification unit 270, and an output unit 280. Also, the first tag generation unit 240, the second tag generation unit 250, and the tag integration unit 260 configure a verification tag generation unit 262. That is, the authentication decryption device 20 includes the verification tag generation unit 262.

[0093] The authentication and decryption device 20 can be realized by an information processing device such as a computer. That is, the authentication and decryption device 20 has an arithmetic device such as a CPU and a storage device such as a memory or a disk. The authentication and decryption device 20 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0094] The input unit 200 functions as an input means. The ciphertext splitting unit 202 functions as a ciphertext splitting means. The nonce processing unit 204 functions as a nonce processing means. The first decryption unit 210 functions as a first decryption means. The second decryption unit 220 functions as a second decryption means. The checksum calculation unit 230 functions as a checksum calculation means. The first tag generation unit 240 functions as a first tag generation means (third tag generation means). The second tag generation unit 250 functions as a second tag generation means (fourth tag generation means). The tag integration unit 260 functions as a tag integration means (second tag integration means). The verification tag generation unit 262 functions as a verification tag generation means. The verification unit 270 functions as a verification means. The output unit 280 functions as an output means.

[0095] The input unit 200 accepts input of the nonce N, the associated data A, the ciphertext C to be decrypted, and the authentication tag T transmitted from the authentication encryption device 10. The input unit 200 may be realized by an input device such as a keyboard. The input unit 200 may accept input of the nonce N, the associated data A, the ciphertext C, and the authentication tag T from an external device connected via a network, for example. Note that there may be cases where the associated data A does not exist, in which case the associated data A is not input.

[0096] The input unit 200 outputs the ciphertext C to the ciphertext splitting unit 202. The input unit 200 outputs the nonce N to the nonce processing unit 204. The input unit 200 also outputs the associated data A to the second tag generation unit 250. The input unit 200 also outputs the authentication tag T to the verification unit 270.

[0097] The ciphertext division unit 202 divides the ciphertext C in a manner substantially similar to the manner in which the plaintext division unit 102 divides the plaintext M. The ciphertext division unit 202 divides the ciphertext C into a first ciphertext C_O and a second ciphertext C_C at a predetermined ratio. Specifically, the ciphertext division unit 202 divides the ciphertext C into the first ciphertext C_O and the second ciphertext C_C so that |C_O|:|C_C|=128:384. That is, the ciphertext division unit 202 divides the ciphertext C into the first ciphertext C_O and the second ciphertext C_C based on the ratio between the input length n1 and the length n3 obtained by subtracting the input length n1 from the output length n2. In other words, the ciphertext splitting unit 202 splits the ciphertext C into the first ciphertext C_O and the second ciphertext C_C based on the ratio n1:n3.

[0098] More specifically, the ciphertext division unit 202 divides the ciphertext C into lengths corresponding to the output length of the encryption primitive. That is, the ciphertext division unit 202 divides the ciphertext C into ciphertext parts C[1], . . . , C[m], each of which is n2=512 bits. Note that m is the number of ciphertext parts. Note that if the bit length of the ciphertext C is not a multiple of 512, |C[m]|<512.

[0099] The ciphertext division unit 202 divides the ciphertext part C[i] into a 128-bit ciphertext block C_O[i] and a 384-bit ciphertext block C_C[i] for each of i=1,...,m. That is, the ciphertext division unit 202 divides the ciphertext part C[i] into an n1-bit ciphertext block C_O[i] and an n3-bit ciphertext block C_C[i]. As a result, the ciphertext division unit 202 obtains a first ciphertext C_O where C_O=C_O[1]||C_O[2]||···||C_O[m]. The ciphertext division unit 202 also obtains a second ciphertext C_C where C_C=C_C[1]||C_C[2]||···||C_C[m]. When |C[m]|=512, |C_O|:|C_C|=128:384. As described later, the first ciphertext C_O is processed by the OTR method with the random function CC_K as the encryption primitive. The second ciphertext C_C is processed by the ChaCha20-Poly1305 method. The ciphertext splitting unit 202 outputs the first ciphertext C_O to the first decryption unit 210. The ciphertext splitting unit 202 outputs the second ciphertext C_C to the second decryption unit 220 and the second tag generation unit 250.

[0100] If 128<|C[m]|<512, the ciphertext splitting unit 202 may split the ciphertext part C[m] into a 128-bit C_O[m] and a C_C[m] of less than 384 bits. If |C[m]|≦128, the ciphertext splitting unit 202 may split the ciphertext part C[m] into a C_O[m] of less than 128 bits and a C_C[m] of 0 bits. In other words, if |C[m]|≦128, the ciphertext splitting unit 202 may treat the ciphertext part C[m] as it is as C_O[m].

[0101] The nonce processing unit 204 processes the nonce N using the random function CC_K in a manner substantially similar to the manner in which the nonce processing unit 104 processes the nonce as shown in FIG. 5. Specifically, the nonce processing unit 204 inputs the 128-bit nonce N to the random function CC_K to obtain an output 512-bit bit string (random number). The nonce processing unit 204 also divides the 512-bit bit string into bit strings L_1, L_2, L_3, and L_4, each of which is 128 bits (=n1). The nonce processing unit 204 then outputs the bit strings L_1 and L_2 to the first decryption unit 210. The nonce processing unit 204 also outputs the bit strings L_3 and L_4 to the second tag generation unit 250. The bit strings L_1 and L_2 (first value) are used to obtain a mask value used in the decryption process of the first ciphertext C_O. The bit strings L_3 and L_4 (second value) are used as keys to generate a tag T_C corresponding to the second plaintext M_C obtained by decrypting the second ciphertext C_C. That is, the bit strings L_3 and L_4 correspond to the above-mentioned keys R and S.

[0102] The first decryption unit 210 processes the first ciphertext C_O using the random function CC_K in a manner corresponding to the manner in which the first encryption unit 110 processes the first plaintext M_O. The first decryption unit 210 decrypts the first ciphertext C_O by the OTR method using the random function CC_K. At this time, the first decryption unit 210 decrypts the ciphertext blocks C_O[1], . . . , C_O[m] into which the first ciphertext C_O is divided, using a mask value obtained based on the bit strings L_1 and L_2. That is, the first decryption unit 210 acquires the first plaintext M_O by the random function CC_K, using the mask value obtained based on the values ​​L_1 and L_2 obtained by encrypting the nonce N using the random function CC_K and each of the multiple ciphertext blocks C_O[i]. The first decryption unit 210 obtains the first plaintext M_O by using an exclusive OR between a first random number having a bit number corresponding to the input length of the encryption result output from the random function CC_K (encryption function) and the ciphertext block. Here, the first plaintext M_O corresponds to the value obtained by decrypting the first ciphertext C_O. As described above, the multiple ciphertext blocks C_O[i] are obtained by dividing the first ciphertext C_O into pieces having a length corresponding to the input length of the random function CC_K.

[0103] Specifically, as shown in FIG. 12, the first decryption unit 210 performs decryption on each pair of ciphertext block C_O[2j-1] and ciphertext block C_O[2j] using a two-round Feistel structure. Here, the ciphertext block C_O[2j-1] is an odd-numbered ciphertext block in the ciphertext blocks C_O[1], . . . , C_O[m]. Also, the ciphertext block C_O[2j] is an even-numbered ciphertext block next to the ciphertext block C_O[2j-1]. Here, j is an integer between 1 and l. Also, l=m / 2 when m is an even number, and l=(m+1) / 2 when m is an odd number. As will be described later, the first decryption unit 210 acquires the first plaintext M_O by using an exclusive OR between the first random number of the number of bits corresponding to the input length n1 among the encryption results output from the random function CC_K (encryption function) and the ciphertext block C_O[i]. The first random number corresponds to a random number z_i, which will be described later.

[0104] The first decryption unit 210 inputs the exclusive OR of the 128-bit ciphertext block C_O[1] and the 128-bit mask value L_2 to the random function CC_K. As a result, the first decryption unit 210 obtains the encryption result CC_K(L_2, C_O[1]) of 512 bits (=n2). Then, the first decryption unit 210 divides the encryption result CC_K(L_2, C_O[1]) into a 128-bit (=n1) random number z_2 and a 384-bit (=n3) random number S_2. For example, the first decryption unit 210 may set the upper 128 bits of the encryption result CC_K(L_2, C_O[1]) as the random number z_2 and the lower 384 bits as the random number S_2. Here, the random number S_2 corresponds to the surplus bit string described above.

[0105] Then, the first decryption unit 210 obtains the exclusive OR of the random number z_2 and the ciphertext block C_O[2] as the plaintext block M_O[1] corresponding to the ciphertext block C_O[1]. The first decryption unit 210 also inputs the exclusive OR of the plaintext block M_O[1] and the mask value L_1 to a random function CC_K to obtain the encryption result CC_K(L_1, M_O[1]). The first decryption unit 210 then divides the encryption result CC_K(L_1, M_O[1]) into a 128-bit (=n1) random number z_1 and a 384-bit (=n3) random number S_1. The first decryption unit 210 obtains the exclusive OR of the random number z_1 and the ciphertext block C_O[1] as the plaintext block M_O[2] corresponding to the ciphertext block C_O[2]. Here, the random number S_1 corresponds to the surplus bit string described above.

[0106] The first decryption unit 210 also inputs the exclusive OR of the 128-bit ciphertext block C_O[3] and the 128-bit mask value 2·L_2 to the random function CC_K. As a result, the first decryption unit 210 obtains the 512-bit encryption result CC_K(2·L_2, C_O[3]). The first decryption unit 210 then divides the encryption result CC_K(2·L_2, C_O[3]) into a 128-bit (=n1) random number z_4 and a 384-bit (=n3) random number S_4. Here, the random number S_4 corresponds to the surplus bit string described above.

[0107] Then, the first decryption unit 210 obtains the exclusive OR of the random number z_4 and the ciphertext block C_O[4] as the plaintext block M_O[3] corresponding to the ciphertext block C_O[3]. The first decryption unit 210 also inputs the exclusive OR of the plaintext block M_O[3] and the mask value 2·L_1 to a random function CC_K to obtain the encryption result CC_K(2·L_1, M_O[3]). The first decryption unit 210 then divides the encryption result CC_K(2·L_1, M_O[3]) into a 128-bit (=n1) random number z_3 and a 384-bit (=n3) random number S_3. Then, the first decryption unit 210 obtains the exclusive OR of the random number z_3 and the ciphertext block C_O[3] as the plaintext block M_O[4] corresponding to the ciphertext block C_O[4]. Here, the random number S_3 corresponds to the surplus bit string described above.

[0108] Similarly, the first decryption unit 210 inputs the exclusive OR of the 128-bit ciphertext block C_O[2j-1] and the 128-bit mask value 2^(j-1)·L_2 to the random function CC_K. As a result, the first decryption unit 210 obtains the 512-bit encryption result CC_K(2^(j-1)·L_2, C_O[2j-1]). Then, the first decryption unit 210 divides the encryption result CC_K(2^(j-1)·L_2, C_O[2j-1]) into a 128-bit (=n1) random number z_(2j) and a 384-bit (=n3) random number S_(2j). Here, the random number S_(2j) corresponds to the surplus bit string described above.

[0109] Then, the first decryption unit 210 obtains the exclusive OR of the random number z_(2j) and the ciphertext block C_O[2j] as the plaintext block M_O[2j-1] corresponding to the ciphertext block C_O[2j-1]. The first decryption unit 210 also inputs the exclusive OR of the plaintext block M_O[2j-1] and the mask value 2^(j-1)·L_1 to the random function CC_K to obtain the encryption result CC_K(2^(j-1)·L_1, M_O[2j-1]). The first decryption unit 210 then divides the encryption result CC_K(2^(j-1)·L_1, M_O[2j-1]) into a 128-bit (=n1) random number z_(2j-1) and a 384-bit (=n3) random number S_(2j-1). Then, the first decryption unit 210 obtains the exclusive OR of the random number z_(2j-1) and the ciphertext block C_O[2j-1] as the plaintext block M_O[2j] corresponding to the ciphertext block C_O[2j]. Here, the random number S_(2j-1) corresponds to the surplus bit string described above.

[0110] The process for the final ciphertext block differs depending on whether m is an odd number or an even number. When m is an even number, the first decryption unit 210 performs the process shown in FIG. 13. The first decryption unit 210 performs padding, such as one-zero padding, on the ciphertext block C_O[m] to obtain a 128-bit (=n1) bit string pad(C_O[m]) corresponding to the ciphertext block C_O[m]. The first decryption unit 210 also inputs the exclusive OR of the bit string pad(C_O[m]) and a mask value 2^(l-1)·L_2 to a random function CC_K to obtain the encryption result CC_K(2^(l-1)·L_2,pad(C_O[m])). Then, the first decryption unit 210 divides the encryption result CC_K(2^(l-1)·L_2,pad(C_O[m])) into a 128-bit (=n1) random number z_m and a 384-bit (=n3) random number S_m. Then, the first decryption unit 210 obtains the exclusive OR of the random number z_m and the ciphertext block C_O[m-1] as the plaintext block M_O[m-1] corresponding to the ciphertext block C_O[m-1]. Here, the random number S_m corresponds to the surplus bit string described above.

[0111] The first decryption unit 210 also inputs the exclusive OR of the 128-bit (=n1) plaintext block M_O[m-1] and the 128-bit (=n1) mask value 2^(l-1)·L_1 to the random function CC_K. As a result, the first decryption unit 210 obtains the 512-bit (=n2) encryption result CC_K(2^(l-1)·L_1, M_O[m-1]). The first decryption unit 210 then divides the encryption result CC_K(2^(l-1)·L_1, M_O[m-1]) into a 128-bit (=n1) random number z_(m-1) and a 384-bit (=n3) random number S_(m-1). Here, Z=z_(m-1). The random number S_(m-1) corresponds to the surplus bit string described above.

[0112] Then, the first decryption unit 210 obtains msb{|C_O[m]|}(Z) by truncating the random number Z to the bit length x (1≦x≦n1 (=128)) of the ciphertext block C_O[m]. Then, the first decryption unit 210 obtains the exclusive OR of msb{|C_O[m]|}(Z) and the ciphertext block C_O[m] as the plaintext block M_O[m] corresponding to the ciphertext block C_O[m].

[0113] When m is an odd number, the first decryption unit 210 performs the process shown in Fig. 14. The first decryption unit 210 inputs the mask value 2^(l-1)·L_1 to a random function CC_K to obtain the encryption result CC_K(2^(l-1)·L_1). Then, the first decryption unit 210 divides the encryption result CC_K(2^(l-1)·L_1) into a 128-bit (=n1) random number z_m and a 384-bit (=n3) random number S_m. Then, the first decryption unit 210 obtains msb{|C_O[m]|}(z_m) by truncating the random number z_m to the bit length x (1≦x≦n1(=128)) of the ciphertext block C_O[m]. Then, the first encryption unit 110 obtains the exclusive OR of msb{|C_O[m]|}(z_m) and the ciphertext block C_O[m] as the plaintext block M_O[m] corresponding to the ciphertext block C_O[m].

[0114] The first decryption unit 210 outputs the plaintext blocks M_O[1],...,M_O[m] as the first plaintext M_O to the checksum calculation unit 230 and the output unit 280. At this time, the first decryption unit 210 may output M_O (=M_O[1]||||M_O[m]), in which the plaintext blocks M_O[1],...,M_O[m] are concatenated, to the checksum calculation unit 230 and the output unit 280.

[0115] Furthermore, the first decryption unit 210 concatenates the random numbers S_1, S_2, . . . , S_m corresponding to the surplus bit string to obtain a random number S of 384×m bits. That is, S=S_1||S_2||. . . ||S_m. Note that strictly speaking, |S|=384×m is satisfied when |C|=512×m. The first decryption unit 210 then outputs the random number S to the second decryption unit 220. Note that the first decryption unit 210 may output the random numbers S_1, S_2, . . . , S_m to the second decryption unit 220 without concatenating them. In this case, the second decryption unit 220 may concatenate the random numbers S_1, S_2, . . . , S_m to obtain a random number S of 384×m bits (=n3×m).

[0116] Here, among the encryption results output from the random function CC_K, which is an encryption function, in decrypting the first ciphertext C_O, the values ​​z_1,...,z_m are used in decrypting the first ciphertext C_O. In contrast, among the encryption results output from the random function CC_K, the random numbers S_1, S_2,...,S_m (random number S) are values ​​other than those used in decrypting the first ciphertext C_O.

[0117] The checksum calculation unit 230 calculates the checksum in substantially the same manner as the above-mentioned checksum calculation unit 130. That is, the checksum calculation unit 230 calculates the checksum Σ based on the exclusive OR of a part of the multiple plaintext blocks M_O[i]. Specifically, the checksum calculation unit 230 calculates the checksum Σ by the exclusive OR of the even-numbered plaintext blocks M_O[2], M_O[4], . . . More specifically, when m is an even number, the checksum calculation unit 230 calculates the 128-bit (=n1) checksum Σ as expressed by the above formula 5. On the other hand, when m is an odd number, the checksum calculation unit 230 calculates the 128-bit (=n1) checksum Σ as expressed by the above formula 6. The checksum calculation unit 230 outputs the obtained checksum Σ to the first tag generation unit 240.

[0118] The first tag generating unit 240 of the verification tag generating unit 262 generates the verification tag T in substantially the same manner as the above-mentioned first tag generating unit 140. * The first tag T to generate * The first tag generation unit 240 generates the first tag T * Specifically, as shown in FIG. 15, the first tag generation unit 240 generates the first tag T * Here, the mask value L^* is obtained based on the bit strings L_1 and L_2 as described above. That is, the first tag generation unit 240 generates the first tag T _O (first partial tag) by an encryption function using a value (checksum Σ) obtained based on the exclusive OR of a part of the multiple plaintext blocks and the mask value L^* obtained based on the bit strings L_1 and L_2 (first value). * Generate _O.

[0119] More specifically, the first tag generation unit 240 uses the exclusive OR of the 128-bit (=n1) checksum Σ and the 128-bit (=n1) mask value L^* to generate a 128-bit (=n1) first tag T* The first tag generation unit 240 generates the first tag T * The first tag generation unit 240 obtains the generated first tag T * _O to the tag integration unit 260.

[0120] The second decryption unit 220 processes the second ciphertext C_C in a method corresponding to the method in which the second encryption unit 120 processes the second plaintext M_C. The second decryption unit 220 decrypts the second ciphertext C_C in the ChaCha20-Poly1305 method (CP method). Specifically, as shown in FIG. 16, the second decryption unit 220 decrypts the ciphertext C_C using the random number S as a key stream. In this way, the second decryption unit 220 obtains the second plaintext M_C obtained by decrypting the second ciphertext C_C. That is, the second decryption unit 220 obtains the second plaintext M_C obtained by decrypting the second ciphertext C_C using the random number S (second random number) and the second ciphertext C_C. As described above, the random number S (S_1, S_2, ...) is a value other than the value (random number z; first random number) used to decrypt the first ciphertext C_O among the encryption results output from the random function CC_K (encryption function) when decrypting the first ciphertext C_O.

[0121] More specifically, the second decryption unit 220 obtains the second plaintext M_C by using the exclusive OR of the value obtained by concatenating the random numbers S_1, S_2, . . . , S_m (second random numbers) and the second ciphertext C_C. The second decryption unit 220 obtains msb{|C_C|}(S) by truncating the random number S (=S_1||S_2||. . . . ||S_m) to the number of bits of the second ciphertext C_C. Then, the second decryption unit 220 obtains the exclusive OR of the msb{|C_C|}(S) and the second ciphertext C_C as the second plaintext M_C corresponding to the second ciphertext C_C. The second decryption unit 220 outputs the second plaintext M_C to the output unit 280.

[0122] The second tag generating unit 250 of the verification tag generating unit 262 generates the verification tag T in substantially the same manner as the above-mentioned second tag generating unit 150. * A second tag T to generate * The second tag generation unit 250 generates a second tag T * Specifically, as shown in FIG. 16, the second tag generation unit 250 generates a second tag T * More specifically, the second tag generation unit 250 generates a second tag T * At this time, as described above, the second tag generation unit 250 uses the 128-bit (=n1) bit strings L_3 and L_4 as keys corresponding to the keys R and S.

[0123] The second tag generation unit 250 inputs the second ciphertext C_C, the associated data A, and the keys L_3 and L_4 to a MAC function based on Poly1305 used in the CP method. As a result, the second tag generation unit 250 converts the 128-bit bit string output from the MAC function into the second tag T * _C. If there is no associated data A, the associated data A is not input to the MAC function. The second tag generation unit 250 obtains the second tag T * _C is output to the tag integration unit 260.

[0124] The verification tag generating unit 262 generates the verification tag T * The tag integrator 260 generates the first tag T * _O and a second tag T * _C and _C are merged to create a single verification tag T * Specifically, as shown in FIG. 15, the tag integrator 260 generates a first tag T * _O and a second tag T * _C is exclusive ORed with the verification tag T *That is, the verification tag generating unit 262 obtains the first tag T * _O and a second tag T * Generate _C and use it as a verification tag T * The verification tag generation unit 262 (tag integration unit 260) generates the verification tag T * to the verification unit 270.

[0125] The verification unit 270 uses the verification tag T generated by the tag integration unit 260. * The verification unit 270 compares the verification tag T generated by the authentication encryption device 10 to verify whether or not the information has been tampered with. Then, the verification unit 270 performs control to output information based on the verification result. * The presence or absence of tampering is verified by comparing the input authentication tag T with the authentication tag T. Then, the verification unit 270 performs control to output the verification result.

[0126] Specifically, the verification unit 270 detects an authentication tag T and a verification tag T * Then, the verification unit 270 compares the verification tag T * If the verification tag T matches the authentication tag T, the verification unit 270 determines that the authentication is successful. If the authentication is successful, the verification unit 270 performs control to output plaintext M obtained from the first plaintext M_O generated by the first decryption unit 210 and the second plaintext M_C generated by the first decryption unit 210. On the other hand, the verification unit 270 * does not match the authentication tag T, the verification unit 270 determines that the authentication has failed. If the authentication has failed, the verification unit 270 performs control to output an error message ⊥ indicating that the authentication has failed.

[0127] The output unit 280 outputs the plaintext M when the authentication is successful. Here, the output unit 280 may generate the plaintext M corresponding to the ciphertext C by using the first plaintext M_O and the second plaintext M_C as follows. That is, the output unit 280 divides the second plaintext M_C into plaintext blocks M_C[1], . . . , M_C[m] of 384 bits (=n3). The number of bits of the plaintext block M_C[m] is the same as the number of bits of the ciphertext block C_C[m]. In addition, for each of i=1, . . . , m, the output unit 280 concatenates the plaintext block M_O[i] of 128 bits (=n1) and the plaintext block M_C[i] of 384 bits (=n3) to obtain the plaintext part M[i] of 512 bits (=n2). That is, M[i]=M_O[i]||M_C[i]. The number of bits of M[m] is the same as the number of bits of C[m]. Then, the output unit 280 concatenates the plaintext parts M[1],...,M[m] to obtain the plaintext M. That is, M=M[1]||||M[m].

[0128] On the other hand, the output unit 280 outputs an error message ⊥ when the authentication fails. The output unit 280 may, for example, perform control to display information on an output device such as a display. The output unit 280 may also, for example, perform control to output information to an external device connected via a network.

[0129] <Authentication Encryption Method and Authentication Decryption Method> Next, the operation of the authenticated encryption system 1 according to the first embodiment will be described with reference to Fig. 17 and Fig. 18. Fig. 17 is a flowchart showing the authenticated encryption method executed by the authenticated encryption device 10 according to the first embodiment.

[0130] As described above, the input unit 100 inputs the nonce N, the plaintext M, and the related data A (step S100). As described above, the plaintext splitting unit 102 splits the plaintext M into the first plaintext M_O and the second plaintext M_C at a predetermined ratio (step S102). As described above, the nonce processing unit 104 processes the nonce N using the random function CC_K to obtain bit strings L_1, L_2, L_3, and L_4 (step S104).

[0131] As described above, the first encryption unit 110 obtains a first ciphertext C_O corresponding to the first plaintext M_O by the OTR method using the random function CC_K (step S110). Also, the second encryption unit 120 obtains a second ciphertext C_C corresponding to the second plaintext M_C by the CP method (step S112).

[0132] The checksum calculation unit 130 calculates the checksum Σ corresponding to the first plaintext M_O as described above (step S120). The first tag generation unit 140 of the authentication tag generation unit 162 generates the first tag T_O by the OTR method using the checksum Σ as described above (step S122). The second tag generation unit 150 of the authentication tag generation unit 162 generates the second tag T_C by the CP method using the second ciphertext C_C as described above (step S124). The authentication tag generation unit 162 generates the authentication tag T (step S126). Specifically, the tag integration unit 160 integrates the first tag T_O and the second tag T_C as described above to generate the authentication tag T. The output unit 170 performs control to output the nonce N, the associated data A, the ciphertext C, and the authentication tag T (step S130).

[0133] 18 is a flowchart showing an authentication decryption method executed by the authentication decryption device 20 according to the first embodiment. As described above, the input unit 200 inputs the nonce N, the associated data A, the ciphertext C, and the authentication tag T (step S200). As described above, the ciphertext division unit 202 divides the ciphertext C into the first ciphertext C_O and the second ciphertext C_C at a predetermined ratio (step S202). As described above, the nonce processing unit 204 processes the nonce N using the random function CC_K to obtain bit strings L_1, L_2, L_3, and L_4 (step S204).

[0134] As described above, the first decryption unit 210 obtains a first plaintext M_O corresponding to the first ciphertext C_O by the OTR method using the random function CC_K (step S210). Also, the second decryption unit 220 obtains a second plaintext M_C corresponding to the second ciphertext C_C by the CP method (step S212).

[0135] As described above, the checksum calculation unit 230 calculates the checksum Σ corresponding to the first plaintext M_O (step S220). As described above, the first tag generation unit 240 of the verification tag generation unit 262 uses the checksum Σ to generate the first tag T * _O (step S222). As described above, the second tag generation unit 250 of the verification tag generation unit 262 generates the second tag T * The verification tag generating unit 262 generates the verification tag T * Specifically, the tag integrating unit 260 generates the first tag T * _O and a second tag T * _C is integrated to create the verification tag T * Generate.

[0136] The verification unit 270 is a verification tag T * It is determined whether the verification tag T matches the authentication tag T (step S230). *If the verification tag T matches the plain text M (YES in S230), the output unit 280 determines that the authentication is successful and outputs the plain text M (step S232). * does not match the authentication tag T (NO in S230), the output unit 280 outputs an error message ⊥ indicating that the authentication has failed (step S234).

[0137] <Effects> The effects of the authentication encryption system 1 according to the first embodiment will be described below. Although the effects of the authentication encryption device 10 will be described below, the same effects can be obtained in the authentication decryption device 20. This also applies to the other embodiments.

[0138] As described above, the authentication encryption device 10 according to the first embodiment divides the plaintext M into the first plaintext M_O and the second plaintext M_C. Then, the authentication encryption device 10 obtains the first ciphertext C_O by a process corresponding to the OTR method using the random function CC_K, which is a cryptographic primitive whose output length is longer than the input length, for the first plaintext M_O. Also, the authentication encryption device 10 obtains the second ciphertext C_C corresponding to the second plaintext M_C by exclusive-ORing the second plaintext M_C and the key stream, as in the process corresponding to the CP method according to the first comparative example. As a result, the authentication encryption device 10 according to the first embodiment can reduce the calculation cost by using the random function CC_K used in the first comparative example, compared to the CP method according to the first comparative example. That is, the authentication encryption device 10 according to the first embodiment can efficiently perform the authentication encryption process by using a cryptographic primitive whose output length is longer than the input length.

[0139] Furthermore, the authentication encryption device 10 according to the first embodiment uses a random number S as a key stream used when processing the second plaintext M_C. Here, as described above, the random number S corresponds to a redundant bit string. In this way, the authentication encryption device 10 encrypts the second plaintext M_C by a process corresponding to the CP scheme using the random number S, which is a redundant bit string, as a key stream, thereby making it possible to reduce the number of times the random function CC_K is called. That is, in the first comparative example, in order to generate a key stream, it is necessary to execute a counter mode using the random function CC_K. That is, in the first comparative example, in order to generate a key stream, it is necessary to call the random function CC_K a number of times corresponding to the number of blocks m (=|M| / 512) of the plaintext M. In contrast, in the authentication encryption device 10 according to the first embodiment, since the redundant bit string is used as a key stream, it is not necessary to call the random function CC_K only to generate a key stream.

[0140] In addition, in the authentication encryption device 10 according to the first embodiment, the random function CC_K is called m times in the encryption process of the plaintext. In contrast, consider a third comparative example in which the encryption primitive used in the OTR method according to the second comparative example is simply replaced with the random function CC_K from the block cipher function E_K. That is, in the third comparative example, the entire plaintext M is encrypted by the OTR method. In addition, in the third comparative example, the above-mentioned surplus bit string (random number S) is not used. Here, the number of bits of a plaintext block processed by one two-round Feistel structure is 128×2 bits, and the number of calls of the random function CC_K in one two-round Feistel structure is two. Therefore, in the third comparative example, the number of calls of the random function CC_K in the encryption of the plaintext M is 4m times. Here, m=|M| / 512. Therefore, the number of times the random function CC_K is called in the plaintext encryption process in the authentication encryption device 10 according to the first embodiment is much smaller than the number of times the random function CC_K is called in the plaintext encryption process in the third comparative example. In this way, the authentication encryption device 10 according to the first embodiment can reduce the calculation cost compared to the third comparative example.

[0141] Moreover, the authentication encryption device 10 according to the first embodiment can reduce the calculation cost in the process in the MAC function. That is, in the CP method according to the first comparative example, the amount of data processed in the MAC function by Poly1305 is |AD|+|M| bits. In contrast, in the authentication encryption device 10 according to the first embodiment, the amount of data processed in the MAC function is |AD|+(n3 / n2)|M| bits=|AD|+(3 / 4)|M| bits. In this way, the authentication encryption device 10 according to the first embodiment can reduce the amount of data processed in the MAC function compared to the CP method according to the first comparative example. Therefore, the authentication encryption device 10 according to the first embodiment can reduce the calculation cost compared to the CP method according to the first comparative example.

[0142] In the authentication encryption device 10 according to the first embodiment, the random function CC_K is called once in the nonce processing, the random function CC_K is called m times in the plaintext encryption processing, and the random function CC_K is called once in the tag generation processing. Therefore, in the authentication encryption device 10 according to the first embodiment, the random function CC_K is called m+2 times. On the other hand, in the CP method according to the first comparative example, the random function CC_K is called once in the generation processing of the keys R and S input to the MAC function, and the random function CC_K is called m times in the generation processing of the key stream Z. Therefore, in the CP method according to the first comparative example, the random function CC_K is called m+1 times. In this way, in the authentication encryption device 10 according to the first embodiment, the number of times the random function CC_K is called is increased by only one, compared to the CP method according to the first comparative example. On the other hand, as described above, the amount of data processed by the MAC function is reduced, so that the overall calculation cost is considered to be reduced in the authentication encryption device 10 according to the first embodiment, compared to the first comparative example.

[0143] Moreover, the authentication encryption device 10 according to the first embodiment is configured to divide the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio between the input length n1 of the random function CC_K and the length n3 obtained by subtracting the input length n1 from the output length n2. That is, the authentication encryption device 10 according to the first embodiment divides the plaintext M into the first plaintext M_O and the second plaintext M_C so that |M_O|:|M_C|=128:384. With this configuration, it is possible to perform the authentication encryption process more efficiently. That is, it is possible to more reliably reduce the calculation cost compared to the first comparative example. For example, if the proportion of the number of bits of the second plaintext M_C is made larger than the above ratio, the amount of data processed by the MAC function increases compared to the first embodiment, but the number of calls to the random function CC_K may not be reduced significantly. Furthermore, if the ratio of the number of bits of the second plaintext M_C is made smaller than the above ratio, the amount of data processed by the MAC function will be reduced compared to the case of embodiment 1, but there is a risk that the number of calls to the random function CC_K will increase significantly. Therefore, considering the balance between the number of calls to the random function CC_K and the amount of data processed by the MAC function, it is possible to perform the authenticated encryption process more efficiently by dividing the plaintext M so that |M_O|:|M_C|=128:384.

[0144] As described above, the nonce processing unit 104 is configured to encrypt the nonce N using the random function CC_K to obtain the bit strings L_1, L_2, L_3, and L_4. This allows values ​​necessary for security, such as a mask value and a key, to be obtained without increasing the number of times that the cryptographic primitives are called. That is, if the bit strings L_1, L_2, L_3, and L_4 are obtained separately, the cryptographic primitives need to be called four times. Also, if the value used to obtain the mask value used in the encryption process of the first plaintext M_O and the key used to generate the second tag T_C corresponding to the second plaintext M_C are obtained separately, the cryptographic primitives need to be called two times. In contrast, the nonce processing unit 104 obtains the bit strings L_1, L_2, L_3, and L_4 by calling the random function CC_K only once. Therefore, with the above configuration, it is possible to suppress an increase in the number of times that the cryptographic primitives are called to obtain values ​​necessary for security.

[0145] <Modification of the first embodiment> A modified example of the first embodiment will be described. In the authentication encryption device 10 according to the above-mentioned first embodiment, the random function CC_K used in the first comparative example (Non-Patent Document 1) is used as a cryptographic primitive. However, the cryptographic primitive used is not limited to the random function CC_K. In other words, any cryptographic primitive in which the output length is longer than the input length may be used. This is also true for the authentication decryption device 20 according to the first embodiment. This modified example is also applicable to the other embodiments described later.

[0146] For example, the authentication encryption device 10 according to the first embodiment may perform the authentication encryption process using a cryptographic primitive used in the encryption method called "SalSa20" in Non-Patent Document 4. The authentication encryption device 10 according to the first embodiment may perform the authentication encryption process using a cryptographic primitive such as that used in the encryption method called "XSalSa20" in Non-Patent Document 5 or the encryption method called "XChaCha20" in Non-Patent Document 6. Here, the cryptographic primitive used in "XSalSa20" in Non-Patent Document 5 and "XChaCha20" in Non-Patent Document 6 is defined as "xCC". "xCC" is a cryptographic primitive with an input length of 256 bits and an output length of 512 bits.

[0147] When xCC is used, a first modified example and a second modified example are possible as described below. The first modified example corresponds to a configuration in which the random function CC_K shown in FIG. 5 to FIG. 9 is directly replaced with xCC. Therefore, |M_O|:|M_C|=256:256=1:1. Therefore, the number of bits of the plaintext block M_[i] is 256 bits. Also, the number of bits of the second plaintext M_C is 256×m bits. In this case, the calculation cost is as follows. That is, since xCC is composed of two CC_Ks, calling xCC once calls the random function CC_K twice. Therefore, the number of calls of the random function CC_K is (m+2)×2=2m+4 times. On the other hand, the amount of data processed by the MAC function is |AD|+(256 / 512)|M| bits=|AD|+(1 / 2)|M| bits.

[0148] FIG. 19 is a diagram for explaining the second modified example. In the second modified example, a nonce N that remains unchanged in the processing of one plaintext M is input to the upper 128 bits of xCC, and a 256-bit key is generated. Then, the lower 128 bits are input with a 128-bit plaintext block M[i] and a mask value 2 j·L_1 is input. This results in a ciphertext block C[i] corresponding to the plaintext block M[i]. Therefore, when calling xCC, it is not necessary to call the random function CC_K to which the nonce N is input every time. Therefore, in the second modified example, it is sufficient to call the random function CC_K only once to call xCC once. In this configuration, |M_O|:|M_C|=128:384, so the calculation cost is the same as in the case of the above-mentioned first embodiment.

[0149] (Embodiment 2) Next, the second embodiment will be described. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same symbols, and repeated explanations are omitted as necessary. Note that the system configuration according to the second embodiment is substantially similar to the system configuration of the first embodiment, so explanations will be omitted. In other words, the authentication encryption system 1 according to the second embodiment has an authentication encryption device 10A corresponding to the authentication encryption device 10, and an authentication decryption device 20A corresponding to the authentication decryption device 20.

[0150] <Authentication Encryption Device> FIG. 20 is a diagram showing a configuration of an authentication encryption device 10A according to the second embodiment. The authentication encryption device 10A according to the second embodiment includes an input unit 100, a plaintext division unit 102, and a nonce processing unit 104. Furthermore, the authentication encryption device 10A according to the second embodiment includes a first encryption unit 110, a second encryption unit 120, a checksum calculation unit 130, a first tag generation unit 140A, a second tag generation unit 150A, and an output unit 170. Furthermore, the first tag generation unit 140A and the second tag generation unit 150A constitute an authentication tag generation unit 162A. That is, the authentication encryption device 10A includes the authentication tag generation unit 162A. The components other than the first tag generation unit 140A, the second tag generation unit 150A, and the authentication tag generation unit 162A are substantially similar to those according to the first embodiment, and therefore will not be described.

[0151] 21 is a diagram showing an outline of the calculation in the authentication encryption process executed by the authentication encryption device 10A according to the second embodiment. The first tag generating unit 140A of the authentication tag generating unit 162A generates the first tag T_O in substantially the same manner as the above-mentioned first tag generating unit 140. Then, the first tag generating unit 140A outputs the first tag T_O to the second tag generating unit 150A.

[0152] The second tag generating unit 150A of the authentication tag generating unit 162A generates a tag using a MAC function by Poly1305 used in the CP method, similarly to the second tag generating unit 150. Specifically, as shown in FIG. 21, the second tag generating unit 150A generates an authentication tag T using a bit string L_3 obtained by encrypting a nonce N using a random function CC_K, a first tag T_O, and a second ciphertext C_C. More specifically, the second tag generating unit 150A generates an authentication tag T by a function (MAC function) based on a message authentication code, using the bit string L_3 (second value), the first tag T_O, and the second ciphertext C_C. At this time, the second tag generating unit 150A uses the bit string L_3 as a key corresponding to the key R, and the first tag T_O as a key corresponding to the key S.

[0153] The second tag generation unit 150A inputs the second ciphertext C_C, the associated data A, the key L_3, and the first tag T_O to a MAC function by Poly1305 used in the CP method. As a result, the second tag generation unit 150A obtains the 128-bit bit string output from the MAC function as the authentication tag T. In other words, the authentication tag generation unit 162A generates the second tag T_C output from the MAC function as the authentication tag T. Note that, if there is no associated data A, the associated data A is not input to the MAC function. The authentication tag generation unit 162A (second tag generation unit 150A) outputs the authentication tag T to the output unit 170.

[0154] <Authentication and Decryption Device> FIG. 22 is a diagram showing a configuration of an authentication decryption device 20A according to the second embodiment. The authentication decryption device 20A according to the second embodiment includes an input unit 200, a ciphertext splitting unit 202, and a nonce processing unit 204. The authentication decryption device 20A according to the second embodiment further includes a first decryption unit 210, a second decryption unit 220, a checksum calculation unit 230, a first tag generation unit 240A, a second tag generation unit 250A, a verification unit 270, and an output unit 280. The first tag generation unit 240A and the second tag generation unit 250A constitute a verification tag generation unit 262A. That is, the authentication decryption device 20A includes a verification tag generation unit 262A. The components other than the first tag generation unit 240A, the second tag generation unit 250A, and the verification tag generation unit 262A are substantially similar to those according to the first embodiment, and therefore will not be described.

[0155] The first tag generating unit 240A of the verification tag generating unit 262A generates the first tag T in substantially the same manner as the first tag generating unit 240 described above. * Then, the first tag generation unit 240A generates the first tag T * _O to second tag generation unit 250A.

[0156] The second tag generating unit 250A of the verification tag generating unit 262A generates a tag using a MAC function based on Poly1305 used in the CP method, similar to the second tag generating unit 250. Specifically, the second tag generating unit 250A generates a verification tag T in substantially the same manner as the processing of the second tag generating unit 150A. * That is, the second tag generation unit 250A generates a bit string L_3 obtained by encrypting the nonce N using the random function CC_K, and a first tag T * _O and the second ciphertext C_C to generate a verification tag T * More specifically, the second tag generation unit 250A generates a bit string L_3 (second value) and a first tag T * Using the bit string L_3 and the second ciphertext C_C, the second tag generating unit 250A generates an authentication tag T by a function based on a message authentication code (MAC function). At this time, the second tag generating unit 250A uses the bit string L_3 as a key corresponding to the key R, and generates the first tag T* _O is used as the key corresponding to key S.

[0157] The second tag generation unit 250A generates a second ciphertext C_C, associated data A, a key L_3, and a first tag T * _O into a MAC function based on Poly1305 used in the CP method. As a result, the second tag generation unit 250A converts the 128-bit bit string output from the MAC function into a verification tag T * That is, the verification tag generating unit 262A obtains the second tag T * _C to the verification tag T * If there is no associated data A, the associated data A is not input to the MAC function. * to the verification unit 270.

[0158] <Effects> The authentication encryption device 10A according to the second embodiment achieves substantially the same effects as those achieved by the authentication encryption device 10 according to the first embodiment, as described above. Furthermore, the authentication encryption device 10A according to the second embodiment is configured to input the first tag T_O, instead of the bit string L_4, to a MAC function by Poly1305 to generate the authentication tag T. Therefore, the authentication encryption device 10A according to the second embodiment does not require processing by the tag integrating unit 160. In other words, the authentication encryption device 10A according to the second embodiment does not require the calculation processing of an exclusive OR in the tag integrating unit 160.

[0159] Furthermore, even if the bit string L_4 cannot be obtained for some reason, it is possible to generate the authentication tag T by using the first tag T_O. For example, when the nonce N is processed using the above-mentioned xCC as a cryptographic primitive, there is a possibility that the value L_4 cannot be derived by calling xCC only once. Even in such a case, the authentication encryption device 10A according to the second embodiment is able to generate the authentication tag T without increasing the number of calls of the encryption function.

[0160] (Embodiment 3) Next, a description will be given of embodiment 3. Embodiment 3 shows an outline of the configuration according to the above-mentioned embodiments.

[0161] 23 is a diagram showing a configuration of an authentication encryption device 30 according to the third embodiment. The authentication encryption device 30 according to the third embodiment corresponds to the authentication encryption device according to the other embodiments described above. The authentication encryption device 30 according to the third embodiment includes a plaintext division unit 302, a first encryption unit 310, a second encryption unit 320, and an authentication tag generation unit 360.

[0162] The plaintext division unit 302 functions as a plaintext division means. The first encryption unit 310 functions as a first encryption means. The second encryption unit 320 functions as a second encryption means. The authentication tag generation unit 360 functions as an authentication tag generation means. Here, the authentication encryption device 30 according to the third embodiment uses an encryption function corresponding to an encryption primitive in which the output length n2 is longer than the input length n1. The encryption function is, for example, the random function CC_K used in the first comparative example, but is not limited to this. The same applies to the authentication decryption device 40 according to the third embodiment.

[0163] The plaintext splitting unit 302 can be realized by substantially the same function as that of the above-mentioned plaintext splitting unit 102. The plaintext splitting unit 302 splits the plaintext M into a first plaintext M_O and a second plaintext M_C at a predetermined ratio. For example, the plaintext splitting unit 302 may split the plaintext M so that |M_O|:|M_C|=(input length n1):(output length n2-input length n1).

[0164] The first encryption unit 310 may be realized by a function substantially similar to that possessed by the above-mentioned first encryption unit 110. The first encryption unit 310 obtains a plurality of ciphertext blocks by an encryption function using a mask value obtained based on a first value (L_1, L_2) and each of a plurality of plaintext blocks M_O[i], and obtains a first ciphertext C_O. The first value (L_1, L_2) is obtained by encrypting a nonce N using an encryption function. The plurality of plaintext blocks M_O[i] are obtained by dividing the first plaintext M_O into pieces having a length corresponding to the input length of the encryption function. The plurality of ciphertext blocks correspond to the plurality of plaintext blocks. The first ciphertext C_O corresponds to a value obtained by encrypting the first plaintext M_O.

[0165] The second encryption unit 320 may be realized by a function substantially similar to that possessed by the above-mentioned second encryption unit 120. The second encryption unit 320 obtains a second ciphertext C_C obtained by encrypting the second plaintext M_C, using a value S other than the value used for encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext M_O, and the second plaintext M_C. As described above, the value S (random number S) is a value other than the value (random number z) used for encrypting the first plaintext M_O among the encryption results output from the encryption function in encrypting the first plaintext M_O.

[0166] The authentication tag generation unit 360 may be realized by substantially the same function as that possessed by the above-mentioned authentication tag generation unit 162 or authentication tag generation unit 162A. The authentication tag generation unit 360 generates a first tag T_O by an encryption function using a value (checksum Σ) obtained based on the exclusive OR of a part of a plurality of plaintext blocks and a mask value obtained based on a first value. In addition, the authentication tag generation unit 360 generates a second tag T_C using a second value (L_3) obtained by encrypting a nonce using the encryption function and a second ciphertext C_C.

[0167] Also, the authentication tag generating unit 360 generates an authentication tag T. Here, the authentication tag generating unit 360 may generate the authentication tag T by integrating the first tag T_O and the second tag T_C, as in the authentication tag generating unit 162 according to the first embodiment. Also, the authentication tag generating unit 360 may generate, as the authentication tag T, the second tag T_C generated using the second ciphertext C_C and the first tag T_O, as in the authentication tag generating unit 162A according to the second embodiment.

[0168] 24 is a diagram showing a configuration of an authentication and decryption device 40 according to the third embodiment. The authentication and decryption device 40 according to the third embodiment corresponds to the authentication and encryption device according to the other embodiments described above. The authentication and decryption device 40 according to the third embodiment includes a ciphertext splitting unit 402, a first decryption unit 410, a second decryption unit 420, a verification tag generating unit 460, and a verification unit 470.

[0169] The ciphertext splitting unit 402 functions as a ciphertext splitting means. The first decryption unit 410 functions as a first decryption means. The second decryption unit 420 functions as a second decryption means. The verification tag generating unit 460 functions as a verification tag generating means. The verification unit 470 functions as a verification means.

[0170] The ciphertext splitting unit 402 can be realized by substantially the same function as that of the above-mentioned ciphertext splitting unit 202. The ciphertext splitting unit 402 splits the ciphertext C into a first ciphertext C_O and a second ciphertext C_C at a predetermined ratio. The ciphertext splitting unit 402 may split the ciphertext C so that, for example, |C_O|:|C_C|=(input length n1):(output length n2-input length n1).

[0171] The first decryption unit 410 may be realized by a function substantially similar to that possessed by the above-mentioned first decryption unit 210. The first decryption unit 410 obtains a plurality of plaintext blocks by an encryption function using a mask value obtained based on a first value (L_1, L_2) and each of the plurality of ciphertext blocks C_O[i], thereby obtaining a first plaintext M_O. The first value (L_1, L_2) is obtained by encrypting a nonce N using an encryption function. The plurality of ciphertext blocks C_O[i] are obtained by dividing the first ciphertext C_O into pieces having a length corresponding to the input length of the encryption function. The plurality of plaintext blocks correspond to the plurality of ciphertext blocks. The first plaintext M_O corresponds to a value obtained by decrypting the first ciphertext C_O.

[0172] The second decryption unit 420 may be realized by a function substantially similar to that possessed by the above-mentioned second decryption unit 220. The second decryption unit 420 obtains a second plaintext M_C obtained by decrypting the second ciphertext C_C using a value S other than the value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext C_O and the second ciphertext. As described above, the value S (random number S) is a value other than the value (random number z) used for decrypting the first ciphertext C_O among the encryption results output from the encryption function in decrypting the first ciphertext C_O.

[0173] The verification tag generating unit 460 can be realized by substantially the same function as the above-mentioned verification tag generating unit 262 or the verification tag generating unit 262A. The verification tag generating unit 460 generates a first tag T * In addition, the verification tag generating unit 460 generates a second tag T * Generate _C.

[0174] In addition, the verification tag generating unit 460 generates the verification tag T *Here, the verification tag generating unit 460 generates the first tag T * _O and a second tag T * By integrating _C, the verification tag T * Alternatively, the verification tag generating unit 460 may generate the second ciphertext C_C and the first tag T * A second tag T generated using * _C to the verification tag T * It may be generated as:

[0175] The verification unit 470 can be realized by substantially the same functions as those of the verification unit 270 described above. * By comparing this with the input authentication tag T, the presence or absence of tampering is verified, and control is performed to output the verification result.

[0176] The authentication encryption device 30 and the authentication decryption device 40 according to the third embodiment, with the above-mentioned configuration, can efficiently perform the authentication encryption process using cryptographic primitives whose output length is longer than the input length. Also, the authentication encryption method and the program executing the authentication encryption method executed by the authentication encryption device 30 can efficiently perform the authentication encryption process using cryptographic primitives whose output length is longer than the input length. Also, the authentication decryption method and the program executing the authentication decryption method executed by the authentication decryption device 40 can efficiently perform the authentication encryption process using cryptographic primitives whose output length is longer than the input length.

[0177] (Hardware configuration example) An example of the configuration of hardware resources for implementing the devices and systems according to the above-mentioned embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (authentication encryption device and authentication decryption device) may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be implemented as dedicated devices or general-purpose information processing devices.

[0178] FIG. 25 is a block diagram showing an example of a hardware configuration of a calculation processing device capable of realizing the device and system according to each embodiment. The calculation processing device 1000 has a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF 1007 (IF: Interface). Therefore, it can be said that the device according to each embodiment has the CPU 1001, the volatile storage device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may include the input device 1005 and the output device 1006. In addition, the calculation processing device 1000 can transmit and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0179] The non-volatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The non-volatile recording medium 1004 may also be a universal serial bus (USB) memory, a solid state drive, or the like. The non-volatile recording medium 1004 holds the relevant program without the need for a power supply, making it possible to carry the program. The non-volatile recording medium 1004 is not limited to the above-mentioned medium. Instead of the non-volatile recording medium 1004, the relevant program may be supplied via the communication IF 1007 and a communication network.

[0180] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0181] That is, when the CPU 1001 executes a software program (computer program: hereinafter, simply referred to as a "program") stored in the disk 1003, the CPU 1001 copies the program to the volatile storage device 1002 and executes arithmetic processing. The CPU 1001 reads data required for executing the program from the volatile storage device 1002. When display is required, the CPU 1001 displays the output result on the output device 1006. When inputting a program from the outside, the CPU 1001 acquires the program from the input device 1005. The CPU 1001 interprets and executes a program corresponding to the function (process) of each component shown in the above-mentioned FIGS. 4, 11, 20, 22, 23 to 24. The CPU 1001 executes the process described in each of the above-mentioned embodiments. In other words, the function of each component shown in the above-mentioned FIGS. 4, 11, 20, 22, 23 to 24 can be realized by the CPU 1001 executing a program stored in the disk 1003 or the volatile storage device 1002.

[0182] That is, each of the embodiments can be realized by the above-mentioned programs. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-mentioned programs are recorded.

[0183] (Modification) The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, in the above-described flowchart, the order of each process (step) can be modified as appropriate. One or more of the multiple processes (steps) may be omitted. The above-described multiple embodiments can be mutually applied. In the above-described embodiment, the plaintext M_O is the "first plaintext" and the plaintext M_C is the "second plaintext", but the present invention is not limited to such a configuration. The plaintext M_O may be the "second plaintext" and the plaintext M_C may be the "first plaintext". The same applies to the first ciphertext and the second ciphertext.

[0184] Also, the method of dividing the plaintext M into the first plaintext M_O and the second plaintext M_C is not limited to the method by the plaintext division unit 102 described above. For example, the plaintext division unit may first divide the plaintext M so that "|M_O|:|M_C|=input length n1:(output length n2-input length n1)". Then, the plaintext division unit may divide the first plaintext M_O into a number of bits corresponding to the length of the input length n1 to obtain plaintext blocks M_O[1],...,M_O[m]. Also, the plaintext division unit may divide the second plaintext M_C into a number of bits corresponding to the length of n3 (=output length n2-input length n1) to obtain plaintext blocks M_C[1],...,M_C[m]. In this case, the output unit may obtain the first ciphertext C_O by concatenating the ciphertext blocks C_O[1], . . . , C_O[m] corresponding to the plaintext blocks M_O[1], . . . , M_O[m]. The output unit may obtain the ciphertext C by concatenating the first ciphertext C_O and the second ciphertext C_C. The same applies to the ciphertext division unit and the output unit in the authentication decryption device.

[0185] In the above-described embodiment, the plaintext division unit is configured to divide the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio (128:384) between the input length n1 of the random function CC_K and the length n3 obtained by subtracting the input length n1 from the output length n2. However, the authentication encryption device according to the present embodiment is not limited to such a configuration. However, by dividing the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio between the input length n1 and the length n3 of the random function CC_K, it becomes possible to perform the authentication encryption process more efficiently, as described above. In other words, by dividing the plaintext M into the first plaintext M_O and the second plaintext M_C based on the ratio between the input length n1 and the length n3 of the random function CC_K, it becomes possible to reduce the calculation cost. This is also true for the ciphertext division unit of the authentication decryption device according to the present embodiment.

[0186] Furthermore, the method of obtaining the multiple mask values ​​used in encrypting the first plaintext M_O is not limited to the above-mentioned method, and any method that does not result in the multiple mask values ​​being the same as each other may be adopted as the method of obtaining the multiple mask values.

[0187] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0188] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0189] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) a plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks by the encryption function; a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; an authentication tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; An authentication encryption device having: (Appendix 2) the plaintext division means divides the plaintext into the first plaintext and the second plaintext based on a ratio between the input length and a length obtained by subtracting the input length from the output length; 2. An authentication encryption device as claimed in claim 1. (Appendix 3) a nonce processing means for encrypting the nonce using the encryption function to obtain the first value and the second value; 2. The authentication encryption device of claim 1, further comprising: (Appendix 4) the first encryption means obtains the first ciphertext by performing an exclusive OR between a first random number, the number of bits of which corresponds to the input length among the encryption results output from the encryption function, and the plaintext block; 2. An authentication encryption device as claimed in claim 1. (Appendix 5) the second encryption means obtains the second ciphertext by performing an exclusive OR between the second plaintext and a value obtained by concatenating a second random number other than the first random number among the encryption results output from the encryption function in the encryption process of the first plaintext; 5. The authentication encryption device according to claim 4. (Appendix 6) the authentication tag generating means generates the second tag by using the second value and the second ciphertext, according to a function of a message authentication code; 6. The authentication encryption device according to claim 5. (Appendix 7) checksum calculation means for calculating a checksum based on an exclusive OR of a portion of a plurality of said plaintext blocks; 2. The authentication encryption device of claim 1, further comprising: (Appendix 8) the authentication tag generating means generates the first tag by the encryption function using an exclusive OR of the checksum and a mask value obtained based on the first value. 8. The authentication encryption device according to claim 7. (Appendix 9) a ciphertext division means for dividing the ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; a first decryption means for obtaining a first plaintext obtained by decrypting the first ciphertext by obtaining a mask value based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and using each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a number of ciphertext blocks having a length corresponding to the input length, by using the encryption function to obtain a number of plaintext blocks corresponding to the plurality of ciphertext blocks; a second decryption means for acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; a verification tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a verification means for verifying whether or not the verification tag has been tampered with by comparing the verification tag with an input authentication tag, and for controlling output of a verification result; An authentication and decryption device having the above configuration. (Appendix 10) the ciphertext division means divides the ciphertext into the first ciphertext and the second ciphertext based on a ratio between the input length and a length obtained by subtracting the input length from the output length; 10. The authentication and decryption device according to claim 9. (Appendix 11) a nonce processing means for encrypting the nonce using the encryption function to obtain the first value and the second value; 10. The authentication and decryption device according to claim 9, further comprising: (Appendix 12) the first decryption means obtains the first plaintext by performing an exclusive OR between a first random number, the number of bits of which corresponds to the input length and which is included in the encryption result output from the encryption function, and the ciphertext block; 10. The authentication and decryption device according to claim 9. (Appendix 13) the second decryption means acquires the second plaintext by using an exclusive OR between the second ciphertext and a value obtained by concatenating a second random number other than the first random number among the encryption results output from the encryption function in the decryption process of the first ciphertext. 13. The authentication and decryption device according to claim 12. (Appendix 14) the verification tag generating means generates the second tag by using the second value and the second ciphertext, using a function based on a message authentication code; 14. The authentication and decryption device according to claim 13. (Appendix 15) checksum calculation means for calculating a checksum based on an exclusive OR of a portion of a plurality of said plaintext blocks; 10. The authentication and decryption device according to claim 9, further comprising: (Appendix 16) the verification tag generating means generates the first tag by the encryption function using an exclusive OR of the checksum and a mask value obtained based on the first value; 16. The authentication and decryption device according to claim 15. (Appendix 17) an authentication encryption device; an authentication / decryption device that communicates with the authentication / encryption device; having The authentication encryption device includes: a plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks by the encryption function; a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; an authentication tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; having The authentication and decryption device includes: a ciphertext division means for dividing the ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; a first decryption means for obtaining a first plaintext obtained by decrypting the first ciphertext by obtaining a plurality of plaintext blocks corresponding to the plurality of ciphertext blocks using the encryption function, by using a mask value obtained based on the first value obtained by encrypting the nonce using the encryption function and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a number of blocks having a length corresponding to the input length; a second decryption means for acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; a verification tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a verification means for verifying whether or not the verification tag has been tampered with by comparing the verification tag with an input authentication tag, and for controlling output of a verification result; having Authenticated cryptography system. (Appendix 18) Dividing the plaintext into a first plaintext and a second plaintext at a predetermined ratio; obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, by using the encryption function to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks; obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; Authentication encryption method. (Appendix 19) Dividing the ciphertext into a first ciphertext and a second ciphertext in a predetermined ratio; obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function; obtaining a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; By comparing the verification tag with the input authentication tag, the presence or absence of tampering is verified, and control is performed to output the verification result. Authentication decryption method. (Appendix 20) Dividing the plaintext into a first plaintext and a second plaintext in a predetermined ratio; a step of obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, by the encryption function to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks; obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext, thereby generating an authentication tag; A program that causes a computer to execute the following. (Appendix 21) splitting the ciphertext into a first ciphertext and a second ciphertext in a predetermined ratio; a step of obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function; obtaining a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a step of comparing the verification tag with an input authentication tag to verify whether or not the tag has been tampered with, and performing control to output a verification result; A program that causes a computer to execute the following. [Explanation of symbols]

[0190] 1. Authenticated Encryption System 10 Authentication Encryption Device 20 Authentication and Decryption Device 30 Authentication Encryption Device 40 Authentication and Decryption Device 100 Input section 102 Plaintext division part 104 Nonce Processing Unit 110 1st encryption section 120 2nd encryption section 130 Checksum calculation unit 140 First tag generator 150 Second Tag Generation Unit 160 Tag Integration Section 162 Authentication tag generator 170 Output section 200 Input section 202 Ciphertext division part 204 Nonce Processing Unit 210 First Decoding Unit 220 Second Decoding Unit 230 Checksum Calculation Unit 240 First Tag Generation Unit 250 Second Tag Generator 260 Tag Integration Department 262 Verification tag generator 270 Verification Department 280 Output section 302 Plaintext division part 310 1st encryption part 320 2nd encryption section 360 Authentication tag generator 402 Ciphertext division part 410 First Decoding Unit 420 Second Decoding Unit 460 Verification tag generator 470 Verification Department

Claims

1. a plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks by the encryption function; a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; an authentication tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of a plurality of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; An authentication encryption device having:

2. the plaintext division means divides the plaintext into the first plaintext and the second plaintext based on a ratio between the input length and a length obtained by subtracting the input length from the output length; 2. The authentication encryption device of claim 1.

3. a nonce processing means for encrypting the nonce using the encryption function to obtain the first value and the second value; 2. The authentication encryption device of claim 1, further comprising:

4. the first encryption means obtains the first ciphertext by performing an exclusive OR between a first random number, the number of bits of which corresponds to the input length among the encryption results output from the encryption function, and the plaintext block; 2. The authentication encryption device of claim 1.

5. the second encryption means obtains the second ciphertext by using an exclusive OR between the second plaintext and a value obtained by concatenating a second random number other than the first random number among the encryption results output from the encryption function in the encryption process of the first plaintext; 5. The authentication encryption device according to claim 4.

6. the authentication tag generating means generates the second tag by using the second value and the second ciphertext, according to a function of a message authentication code; 6. The authentication encryption device according to claim 5.

7. checksum calculation means for calculating a checksum based on an exclusive OR of a portion of a plurality of said plaintext blocks; 2. The authentication encryption device of claim 1, further comprising:

8. the authentication tag generating means generates the first tag by the encryption function using an exclusive OR of the checksum and a mask value obtained based on the first value.

8. The authentication encryption device according to claim 7.

9. a ciphertext division means for dividing the ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; a first decryption means for obtaining a first plaintext obtained by decrypting the first ciphertext by obtaining a mask value based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and using each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a number of ciphertext blocks having a length corresponding to the input length, by using the encryption function to obtain a number of plaintext blocks corresponding to the plurality of ciphertext blocks; a second decryption means for acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; a verification tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of a plurality of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a verification means for verifying whether or not the verification tag has been tampered with by comparing the verification tag with an input authentication tag, and for controlling output of a verification result; An authentication and decryption device having the above configuration.

10. the ciphertext division means divides the ciphertext into the first ciphertext and the second ciphertext based on a ratio between the input length and a length obtained by subtracting the input length from the output length; The authentication and decryption device according to claim 9.

11. a nonce processing means for encrypting the nonce using the encryption function to obtain the first value and the second value; The authentication and decryption device according to claim 9, further comprising:

12. the first decryption means obtains the first plaintext by performing an exclusive OR between a first random number, the number of bits of which corresponds to the input length and which is included in the encryption result output from the encryption function, and the ciphertext block; The authentication and decryption device according to claim 9.

13. the second decryption means acquires the second plaintext by using an exclusive OR of the second ciphertext and a value obtained by concatenating a second random number other than the first random number among the encryption results output from the encryption function in the decryption process of the first ciphertext. The authentication and decryption device according to claim 12.

14. the verification tag generating means generates the second tag by using the second value and the second ciphertext, using a function based on a message authentication code; The authentication and decryption device according to claim 13.

15. checksum calculation means for calculating a checksum based on an exclusive OR of a portion of a plurality of said plaintext blocks; The authentication and decryption device according to claim 9, further comprising:

16. the verification tag generating means generates the first tag by the encryption function using an exclusive OR of the checksum and a mask value obtained based on the first value. The authentication and decryption device according to claim 15.

17. an authentication encryption device; an authentication / decryption device that communicates with the authentication / encryption device; having The authentication encryption device includes: a plaintext division means for dividing a plaintext into a first plaintext and a second plaintext at a predetermined ratio; a first encryption means for obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks by the encryption function; a second encryption means for obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; an authentication tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of a plurality of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate an authentication tag; having The authentication and decryption device includes: a ciphertext division means for dividing the ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; a first decryption means for obtaining a first plaintext obtained by decrypting the first ciphertext by obtaining a plurality of plaintext blocks corresponding to the plurality of ciphertext blocks using the encryption function, by using a mask value obtained based on the first value obtained by encrypting the nonce using the encryption function, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a number of blocks having a length corresponding to the input length; a second decryption means for acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; a verification tag generating means for generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of a plurality of the plaintext blocks and a mask value obtained based on the first value, and for generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a verification means for verifying whether or not the verification tag has been tampered with by comparing the verification tag with an input authentication tag, and for controlling output of a verification result; having Authenticated cryptography system.

18. Dividing the plaintext into a first plaintext and a second plaintext at a predetermined ratio; obtaining a first ciphertext obtained by encrypting the first plaintext using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, and obtaining a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks using the encryption function, thereby obtaining a first ciphertext obtained by encrypting the first plaintext; obtaining a second ciphertext obtained by encrypting the second plaintext, using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext, thereby generating an authentication tag. Authentication encryption method.

19. Dividing the ciphertext into a first ciphertext and a second ciphertext at a predetermined ratio; obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to an encryption primitive having an output length longer than an input length, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function; obtaining a second plaintext obtained by decrypting the second ciphertext, using a value other than a value used for decrypting the first ciphertext among the encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of a plurality of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; By comparing the verification tag with the input authentication tag, the presence or absence of tampering is verified, and a control is performed to output the verification result. Authentication decryption method.

20. Dividing the plaintext into a first plaintext and a second plaintext in a predetermined ratio; a step of obtaining a first ciphertext obtained by encrypting the first plaintext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of plaintext blocks obtained by dividing the first plaintext into a plurality of blocks having a length corresponding to the input length, by using the encryption function to obtain a plurality of ciphertext blocks corresponding to the plurality of plaintext blocks; obtaining a second ciphertext obtained by encrypting the second plaintext, by using a value other than a value used in encrypting the first plaintext among the encryption results output from the encryption function in encrypting the first plaintext, and the second plaintext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext, thereby generating an authentication tag; A program that causes a computer to execute the following.

21. Dividing the ciphertext into a first ciphertext and a second ciphertext in a predetermined ratio; a step of obtaining a first plaintext obtained by decrypting the first ciphertext by using a mask value obtained based on a first value obtained by encrypting a nonce using an encryption function corresponding to a cryptographic primitive having an output length longer than an input length, and each of a plurality of ciphertext blocks obtained by dividing the first ciphertext into a plurality of ciphertext blocks having a length corresponding to the input length, by the encryption function; acquiring a second plaintext obtained by decrypting the second ciphertext, by using a value other than a value used for decrypting the first ciphertext among encryption results output from the encryption function in decrypting the first ciphertext, and the second ciphertext; generating a first tag by the encryption function using a value obtained based on an exclusive OR of a portion of the plaintext blocks and a mask value obtained based on the first value, and generating a second tag by using a second value obtained by encrypting the nonce using the encryption function and the second ciphertext to generate a verification tag; a step of comparing the verification tag with an input authentication tag to verify whether or not the tag has been tampered with, and performing control to output a verification result; A program that causes a computer to execute the following.

Images