Encrypting device, decrypting device, encryption system, encryption method, decryption method, and program

Abstract

To enable a falsified part to be detected when falsification has been performed on encrypted data.SOLUTION: An encrypting device comprises: blocking means for dividing the data to be encrypted into blocks of fixed length and generating a row of blocks; encryption means for encrypting, for each block, the row of blocks into which the data to be encrypted was divided and combining the encrypted blocks to generate encrypted data; and tag generation means for generating a tag for each block set into which the blocks included in the row of blocks into which the data to be encrypted was divided have been combined and combining the tag for each block set to generate a tag for the encrypted data.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an encryption device, a decryption device, a cryptosystem, an encryption method, a decryption method, and a program. Regarding. [Background technology]

[0002] An authenticated encryption technique for detecting whether or not encrypted data has been tampered with has been proposed (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2016-075765 A Summary of the Invention [Problem to be solved by the invention]

[0004] It is preferable to be able to detect not only whether encrypted data has been tampered with, but also the location of the tampering if such has occurred.

[0005] An example of an object of the present invention is to provide an encryption device, a decryption device, a cryptosystem, an encryption method, a decryption method, and a program that can solve the above-mentioned problems. [Means for solving the problem]

[0006] According to a first aspect of the present invention, an encryption device comprises a blocking means for dividing data to be encrypted into fixed-length blocks and generating a sequence of blocks, an encryption means for encrypting each block included in the sequence of blocks into which the data to be encrypted has been divided using a block cipher and combining the encrypted blocks to generate encrypted data, and a tag generation means for generating a tag for each block set formed by combining blocks included in the sequence of blocks into which the data to be encrypted has been divided, and combining the tags for each block set to generate a tag for the encrypted data.

[0007] According to a second aspect of the present invention, a decryption device comprises a blocking means for dividing data to be decrypted into fixed-length blocks and generating a sequence of blocks; a decryption means for decrypting each block included in the sequence of blocks into which the data to be decrypted has been divided using a block cipher and combining the decrypted blocks to generate decrypted data; a tag generation means for generating a tag for each block set formed by combining blocks included in the sequence of decrypted blocks and combining the tags for each block set to generate a tag for the data to be decrypted; and a verification means for detecting whether or not the data to be decrypted has been tampered with, and the location of the tampering when tampering is detected, based on the tag generated by the tag generation means and the tag generated during encryption.

[0008] According to a third aspect of the present invention, a cryptographic system includes an encryption device and a decryption device, the encryption device including: encryption-side blocking means for dividing data to be encrypted into fixed-length blocks to generate a sequence of blocks; encryption means for encrypting each block included in the sequence of blocks into which the data to be encrypted is divided using a block cipher and combining the encrypted blocks to generate encrypted data; and encryption-side tag generation means for generating a tag for each first block set, which is a block set formed by combining blocks included in the sequence of blocks into which the data to be encrypted is divided, and combining the tags for each first block set to generate a tag for the encrypted data. the decryption side blocking means for dividing data to be decrypted into fixed-length blocks to generate a sequence of blocks; the decryption means for performing decryption using a block cipher for each block included in the sequence of blocks into which the data to be decrypted has been divided, and combining the decrypted blocks to generate decrypted data; the decryption side tag generation means for generating a tag for each second block set, which is a block set formed by combining blocks included in the sequence of decrypted blocks, and combining the tags for each second block set to generate a tag for the data to be decrypted; and the verification means for detecting whether or not the data to be decrypted has been tampered with, and the location of the tampering when tampering is detected, based on the tag of the data to be decrypted and the tag of the encrypted data.

[0009] According to a fourth aspect of the present invention, an encryption method includes an encryption device dividing data to be encrypted into fixed-length blocks to generate a string of blocks, encrypting each block included in the string of blocks into which the data to be encrypted has been divided using a block cipher, combining the encrypted blocks to generate encrypted data, generating a tag for each block set formed by combining blocks included in the string of blocks into which the data to be encrypted has been divided, and combining the tags for each block set to generate a tag for the encrypted data.

[0010] According to a fifth aspect of the present invention, a decryption method includes a decryption device dividing data to be decrypted into fixed-length blocks to generate a string of blocks, decrypting each block included in the string of blocks into which the data to be decrypted has been divided using a block cipher, combining the decrypted blocks to generate decrypted data, generating a tag for each block set obtained by combining blocks included in the string of decrypted blocks, combining the tags for each block set to generate a tag for the data to be decrypted, and detecting whether or not the data to be decrypted has been tampered with, and, if tampering is detected, the location of the tampering, based on the tag of the data to be decrypted and the tag generated during encryption.

[0011] According to a sixth aspect of the present invention, a program causes a computer to perform the following operations: dividing data to be encrypted into fixed-length blocks to generate a string of blocks; encrypting each block included in the string of blocks into which the data to be encrypted is divided using a block cipher; combining the encrypted blocks to generate encrypted data; generating a tag for each block set formed by combining blocks included in the string of blocks into which the data to be encrypted is divided; and combining the tags for each block set to generate a tag for the encrypted data.

[0012] According to a seventh aspect of the present invention, a program causes a computer to perform the following operations: divide data to be decrypted into fixed-length blocks to generate a string of blocks; decrypt each block included in the string of blocks into which the data to be decrypted is divided using a block cipher and combine the decrypted blocks to generate decrypted data; generate a tag for each block set obtained by combining blocks included in the string of decrypted blocks; combine the tags for each block set to generate a tag for the data to be decrypted; and detect whether the data to be decrypted has been tampered with and, if tampering is detected, the location of the tampering based on the tag of the data to be decrypted and the tag generated during encryption. Effect of the Invention

[0013] According to the present invention, when encrypted data is tampered with, the location of the tampering can be detected. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 illustrates an example of a configuration of a cryptographic system according to at least one embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a configuration of an encryption device according to at least one embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a data flow when an encryption device according to at least one embodiment encrypts plaintext. [Figure 4] FIG. 2 illustrates an example of a data flow when an encryption device according to at least one embodiment uses an encrypted block to generate a tag. [Diagram 5] FIG. 2 is a diagram illustrating an example of a configuration of a decoding device according to at least one embodiment. [Figure 6] FIG. 2 is a diagram showing an example of a data flow when a decryption device according to at least one embodiment decrypts a ciphertext. [Figure 7]FIG. 13 illustrates another example of a configuration of an encryption device according to at least one embodiment. [Figure 8] FIG. 13 is a diagram illustrating another example of the configuration of a decoding device according to at least one embodiment. [Figure 9] FIG. 2 illustrates another example of a cryptographic system configuration according to at least one embodiment. [Figure 10] FIG. 2 is a diagram showing an example of a processing procedure in an encryption method according to at least one embodiment. [Figure 11] FIG. 2 is a diagram showing an example of a processing procedure in a decoding method according to at least one embodiment. [Figure 12] FIG. 1 is a schematic block diagram illustrating a configuration of a computer according to at least one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, in each drawing, the same or corresponding elements are appropriately assigned the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual ones. There may also be parts with different dimensional relationships and ratios between the drawings.

[0016] In the following, a letter with a tilde (~) may be written with a superscript tilde next to it. For example, a letter with a tilde next to it is written as E ~ It can also be written as: Also, a letter with a circumflex (^) may be written with a superscript circumflex next to it. For example, a letter with a circumflex T can be written as T ^ It can also be written as:

[0017] <First embodiment> 1 is a diagram showing an example of a configuration of a cryptosystem according to at least one embodiment. In the configuration shown in FIG. 1, the cryptosystem 1 includes an encryption device 10 and a decryption device 20. The cryptosystem 1 encrypts and decrypts data. Furthermore, the cryptosystem 1 detects whether or not the encrypted data has been tampered with, and if it detects tampering, it detects the location of the tampering (the position where the tampering occurred).

[0018] The encryption device 10 encrypts data to be encrypted. The encryption device 10 also generates a tag for detecting tampering with the encrypted data. The tag for detecting tampering (tag for tampering detection) is also called an authentication tag or simply a tag. In particular, the encryption device 10 divides data to be encrypted into fixed-length blocks, encrypts each block, and generates encrypted data by combining the encrypted blocks. The encryption device 10 also generates a tag for each combination of blocks, and generates a tag for the encrypted data by combining the generated tags. A block (a block into which data is divided) is also called a data block. A combination of blocks is also called a block set.

[0019] The encryption device 10 may be configured using a computer such as a personal computer (PC) or a workstation (WS), or may be configured using dedicated hardware such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0020] The decryption device 20 decrypts the encrypted data. The decryption device 20 also generates a tag using the decrypted data, and detects tampering with the encrypted data using the generated tag and the tag generated by the encryption device 10 (the tag acquired by the decryption device 20).

[0021] In particular, the decryption device 20 divides the decrypted data into fixed-length blocks, decrypts each block, and combines the decrypted blocks to generate decrypted data. The decryption device 20 also generates a detection tag for each combination of decrypted blocks, and combines the generated tags to generate a tag for the encrypted data (data to be decrypted).

[0022] In this way, the cryptosystem 1 generates a tag for a block set and performs tamper detection, thereby making it possible to detect whether or not a block included in the block set has been tampered with. In particular, the cryptosystem 1 generates a tag for each block set determined so that the block can be identified, for example, by generating a tag for each block set determined using a Combinatorial Group Testing (CGT) technique, thereby making it possible to detect whether or not a block has been tampered with on a block-by-block basis. In this way, when the cryptosystem 1 detects tampering with encrypted data, it can detect the location of the tampering on a block-by-block basis.

[0023] The decoding device 20 may be configured using a computer such as a personal computer or a workstation, or may be configured using dedicated hardware such as an ASIC or an FPGA.

[0024] In the following, an example will be described in which the cryptosystem 1 encrypts and decrypts text data. In this case, encrypted data is referred to as ciphertext, and unencrypted data (which may be decrypted data) is referred to as plaintext. However, the data that the cryptosystem 1 encrypts and decrypts is not limited to specific data, and may be various data represented as bit strings. For example, image data or audio data, or a combination of these, may be the data that the cryptosystem 1 encrypts and decrypts.

[0025] In the following, an example will be taken in which the cryptosystem 1 encrypts and decrypts a data block using a tweakable block cipher. A tweakable block cipher is a cipher that performs keyed substitution including a tweak on the input of the block cipher. By using a different tweak for each data block, encryption can be performed in the same way as when a different key is used for each data block, and in this respect, the security of the cipher can be improved. The security of the cipher here refers to the difficulty of a third party decrypting encrypted data. The block ciphers used in tweakable block ciphers are cryptographic primitives, which are the basic ciphers or algorithms used for encryption and decryption.

[0026] However, the encryption method used by the cryptographic system 1 to encrypt the data blocks is not limited to a specific one, and may be any encryption method that converts fixed-length data blocks into fixed-length data blocks. In particular, the encryption method used by the encryption system 1 to encrypt the data block is not limited to a tweakable block cipher, and the encryption system 1 may use a block cipher (cryptographic primitive) that is not configured as a tweakable block cipher to encrypt the data block as is.

[0027] Furthermore, the block cipher used as a cryptographic primitive by the cryptographic system 1 is not limited to a specific cryptographic method. For example, the cryptographic system 1 may use any one of DES (Data Encryption Standard), triple DES, or AES (Advanced Encryption Standard) as a cryptographic primitive, but is not limited to these.

[0028] 2 is a diagram showing an example of the configuration of the encryption device 10. In the configuration shown in FIG. 2, the encryption device 10 includes an encryption-side blocking unit 11, an encryption unit 12, and an encryption-side tag generating unit 13. The encryption-side blocking unit 11 divides the plaintext into fixed-length blocks to generate a sequence of blocks. The plaintext here corresponds to an example of data to be encrypted. The encryption-side blocking unit 11 corresponds to an example of a blocking means and an example of an encryption-side blocking means.

[0029] The encryption unit 12 encrypts each block included in the string of blocks generated by the encryption-side blocking unit 11 using a tweakable block cipher. The encryption unit 12 then combines the encrypted blocks to generate a ciphertext. The combination of blocks may refer to combining bit strings as blocks in the order of the blocks in the string of blocks to generate a single bit string. The ciphertext here is an example of encrypted data. The encryption unit 12 corresponds to an example of an encryption means.

[0030] The encryption-side tag generation unit 13 generates a tag for each block set that combines blocks included in the sequence of blocks generated by the encryption-side blocking unit 11. The encryption-side tag generation unit 13 then combines the tags for each block set to generate a tag for the ciphertext. Encryption-side tag generator 13 corresponds to an example of a tag generating means and an example of an encryption-side tag generating means. The block set for which encryption-side tag generator 13 generates tags corresponds to an example of a first block set.

[0031] The encryption tag generation unit 13 generates a tag for each block set and generates a tag for the ciphertext by combining the tags for each block set. By the encryption tag generation unit 13 generating a tag for each block set, the block sets become targets for detection of whether or not they have been tampered with. Therefore, by the encryption side tag generation unit 13 generating tags for block sets determined so that every block is included in at least one of the block sets, the decryption device 20 can detect that tampering has occurred and the location of the tampering, even if any position in the ciphertext (encrypted data) is tampered with.

[0032] Furthermore, the encryption-side tag generation unit 13 generates tags for a block set determined so that the decryption device 20 can identify the tampered blocks when the ciphertext is tampered with, thereby enabling the decryption device 20 to detect the tampered part on a block-by-block basis. Specifically, the block sets for which the encryption-side tag generation unit 13 generates tags may be determined so that, for any two blocks included in the same block set, there is always a block set that includes only one of the two blocks and does not include the other block. As a method for determining a block set so that a tampered block can be identified, a combination group test method may be used, but is not limited to this.

[0033] FIG. 3 is a diagram showing an example of a data flow when the encryption device 10 encrypts plaintext. In the example of FIG. 3, the encryption-side blocking unit 11 divides plaintext M into m blocks M[1] to M[m]. As described above, plaintext M corresponds to an example of data to be encrypted. m is an integer representing the number of blocks that the encryption device 10 generates by dividing plaintext M, where m≧2.

[0034] m may be a fixed value. In this case, when the data size of the plaintext to be encrypted is larger than the block length×m, the encryption-side blocking unit 11 may cut out data of a data size of the block length×m sequentially from the beginning of the plaintext to be encrypted, and treat the cut out data as plaintext M. Also, when the data size of the plaintext to be encrypted is smaller than the block length×m, the encryption-side blocking unit 11 may perform padding on the plaintext to be encrypted to make the data size equal to the block length×m. The block length here refers to the data size of one block. Both the data size and the block length may be expressed as a bit length (the number of bits in the bit string data).

[0035] Alternatively, if the encryption-side tag generation unit 13 can determine the block set when generating the tag, the encryption-side blocking unit 11 may determine the value of m when dividing the plaintext to be encrypted into blocks. In this case, the encryption-side blocking unit 11 may also perform padding as necessary.

[0036] The encryption-side blocking unit 11 outputs a string of blocks from blocks M[1] to M[m] to the encryption unit 12 and the encryption-side tag generation unit 13. The encryption unit 12 may cut out blocks in order from the beginning of the plaintext M, and output each cut-out block to the encryption unit 12 and the encryption-side tag generation unit 13. Alternatively, the encryption unit 12 may divide the plaintext M into blocks M[1] to M[m], and then output these m blocks together to the encryption unit 12 and the encryption-side tag generation unit 13.

[0037] The encryption unit 12 encrypts each of blocks M[1] to M[m] using a tweakable block cipher. The block obtained by encrypting block M[i] is also denoted as block C[i], where i is an integer such that 1≦i≦m. The encryption unit 12 generates ciphertext C by combining blocks C[1] to C[m].

[0038] The tweakable block cipher used by the cryptosystem 1 is called E ~ K N,i,j It can also be written as: Here, i is an integer that identifies m blocks M[1] to [m], or a set of t blocks for which tags are to be generated, with 1≦i≦m, and t is an integer that represents the number of tags, with 2≦t≦m. Furthermore, j is an integer such that 0≦j≦1. When encryption unit 12 performs encryption, j=0, and when encryption-side tag generation unit 13 generates a tag, j=1.

[0039] However, the values ​​of i and j are not limited to specific values ​​as long as they can provide a bit string with a different value for each block to be encrypted and for each block set for which a tag is to be generated. K represents a key used in the block cipher (a common key shared by the encryption device 10 and the decryption device 20).

[0040] N stands for Nonce (Number Used Once). Nonce N is a disposable number that has a different value each time plaintext M is encrypted. The encryption system 1 uses a numerical value based on a combination of nonce N, i, and j as a tweak. For example, the nonce N, i, and j may be represented by a bit length whose sum is equal to the block length, and the encryption system 1 may use one bit string obtained by combining the nonce N, i, and j as bit strings in this order as a tweak. This allows the encryption device 10 (encryption unit 12 and encryption-side tag generation unit 13) to use a different tweak each time encryption is performed using a tweakable block cipher, thereby improving the security of the encryption.

[0041] The encryption-side tag generator 13 generates a tag for each of t block sets each of which combines one or more blocks from blocks M[1] to M[m]. In the example of Figure 3, 0 n represents a bit string in which n bits of 0 are aligned. n represents the block length. In other words, n represents the bit length of block M[i]. Here, i is an integer such that 1≦i≦m.

[0042] A "+" in a circle ("o") represents an exclusive OR. Specifically, a "+" in a circle represents an operation that takes the exclusive OR of two bit strings bit by bit. This exclusive OR is also written as XOR. In the example of FIG. 3, the operations corresponding to the t block sets S[1] to S[t] are shown using XOR. The encryption-side tag generation unit 13 calculates an n-bit block by taking the bitwise exclusive OR for all the blocks included in each block set for each block set. Then, the encryption-side tag generation unit 13 encrypts the block calculated based on the block set S[i] using the Tweakable block cipher E ~ K N,i,1 to generate the tag T[i]. Here, i is an integer such that 1 ≦ i ≦ t.

[0043] The encryption-side tag generation unit 13 combines the tags T[1] to T[t] in that order to generate the tag T of the ciphertext C. The order of the tags T[1] to T[t] here (i.e., the order of the block sets S[1] to S[t]) corresponds to an example of a predetermined order for the block sets.

[0044] As described above for the encryption system 1, the encryption-side tag generation unit 13 may generate tags for each block set determined using the combined group testing method, but is not limited to this. When the block set is determined using the combined group testing method, t < m. Therefore, the data size of the tag T is smaller than the data size of the ciphertext C.

[0045] When the encryption device 10 and the decryption device 20 are configured as communication devices, the encryption device 10 may transmit the ciphertext C and the tag T to the decryption device 20. Alternatively, the encryption device 10 may record the ciphertext C and the tag T in a memory. The memory in this case may be an internal memory of the encryption device 10 or an external memory of the encryption device 10.

[0046] It is also assumed that the encryption device 10 and the decryption device 20 share information regarding the key K, the blocks included in each block set, and the tweak for each tweakable block cipher. For example, the nonce N, the blocks included in each block set, and the identification number (1 to t) of the block set may be made public. In the above description, the subscript i of the tag T[i] and the subscript i of the block set S[i] are examples of the identification number of the block set.

[0047] The encryption device 10 and the decryption device 20 may share the key K in advance. The order of the blocks M[1] to M[m] in the plaintext M may be used as the block identification numbers (1 to m). In the above description, the subscript i of the plaintext block M[i] and the subscript i of the ciphertext block (encrypted block) C[i] are examples of block identification numbers. Furthermore, a value may be assigned to j for each of encryption and tag generation, and it may be previously determined that j=0 for encryption (and decryption) and j=1 for tag generation.

[0048] FIG. 4 is a diagram showing an example of the data flow when the encryption device 10 generates a tag using an encrypted block. Fig. 4 is shown for comparison with Fig. 3, but this does not exclude the encryption device 10 from performing the process shown in Fig. 4. When the encryption device 10 performs the process shown in Fig. 4, the decryption device 20 can detect the tampered part when it detects that the ciphertext has been tampered with.

[0049] In the example of Fig. 4, the encryption-side blocking unit 11 divides the plaintext M into m blocks M[1] to M[m], as in the case of Fig. 3. The encryption-side blocking unit 11 outputs the sequence of blocks M[1] to M[m] to the encryption unit 12. On the other hand, in the example of FIG. 4, the encryption-side blocking unit 11 does not output the string of blocks M[1] to M[m] to the encryption-side tag generating unit 13.

[0050] The encryption unit 12 encrypts each of blocks M[1] to M[m] using the tweakable block cipher, as in the case of Fig. 3. The encryption unit 12 generates ciphertext C by combining the encrypted blocks C[1] to C[m]. In the example of FIG. 4, the encryption unit 12 outputs the string of encrypted blocks C[1] to C[m] to the encryption-side tag generation unit 13.

[0051] The encryption-side tag generation unit 13 generates a tag T of the ciphertext C using the encrypted blocks C[1] to C[m]. In this case, from the viewpoint of cryptographic security, it is conceivable to further encrypt each of the encrypted blocks C[1] to C[m] as shown in Figure 4, and also to encrypt the tag for each block set.

[0052] In the example of FIG. 4, the encryption tag generation unit 13 encrypts each of the encrypted blocks C[1] to C[m] using a tweakable block cipher. The encryption tag generation unit 13 encrypts block C[i] using the tweakable block cipher E ~ K N,i,1 Here, i is an integer such that 1≦i≦m. Hereinafter, the block obtained by encrypting block C[i] is also referred to as a doubly encrypted block, and is also denoted as D[i].

[0053] For each block set in which doubly encrypted blocks are combined, the encryption-side tag generation unit 13 calculates an n-bit block by performing a bitwise exclusive OR on all blocks included in the block set. The encryption-side tag generation unit 13 then encrypts the blocks calculated for each block set using a tweakable block cipher to generate a tag for each block set. The encryption-side tag generation unit 13 encrypts the block set S[i] using the tweakable block cipher E ~ KN,i,2 to generate a tag T[i], where i is an integer such that 1≦i≦t. The encryption-side tag generation unit 13 generates a tag T for the ciphertext C by combining tags T[1] to T[t] for each block set.

[0054] In the example of Fig. 4, the encryption-side tag generator 13 generates a tag for each block set in which doubly encrypted blocks are combined, whereas in the example of Fig. 3, the encryption-side tag generator 13 generates a tag for each block set in which plaintext blocks are combined.

[0055] Also, in the example of Fig. 4, when generating a tag for each block set, the encryption-side tag generation unit 13 performs encryption using a tweakable block cipher that uses a different tweak than when further encrypting the encrypted block. In contrast, in the example of Fig. 3, the encryption-side tag generation unit 13 does not perform processing to further encrypt the encrypted block. Therefore, in the example of Fig. 3, the concept of different tweaks does not arise when generating a tag for each block set and when further encrypting the encrypted block, as in the example of Fig. 4.

[0056] Generally, the values ​​of the tags T[1] to T[t] and the value of the tag T are different between the example in FIG. 3 and the example in FIG. Except for these points, the process in which the encryption-side tag generator 13 generates the tag T in the example of FIG. 4 is similar to the process in which the encryption-side tag generator 13 generates the tag T in the example of FIG.

[0057] In the example of Fig. 4, the encryption-side tag generation unit 13 needs to generate a tag after the encryption unit 12 encrypts a block. In contrast, in the example of Fig. 3, the process of encryption unit 12 encrypting a block and the process of encryption-side tag generation unit 13 generating a tag can be executed in parallel.

[0058] Furthermore, in the example of Fig. 4, the encryption device 10 performs encryption using the tweakable block cipher 2m+t times. From this, the order of the processing amount of the encryption device 10 in the example of Fig. 4 can be evaluated as O(2m+t). When the encryption device 10 sequentially performs repeated encryption using the tweakable block cipher, the order of the processing time of the encryption device 10 in the example of Fig. 4 can be evaluated as O(2m+t).

[0059] On the other hand, in the example of Fig. 3, the encryption device 10 performs encryption using the tweakable block cipher m+t times. From this, the order of the processing amount of the encryption device 10 in the example of Fig. 3 can be evaluated as O(m+t). When the encryption device 10 sequentially performs repeated encryption using the tweakable block cipher, the order of the processing time of the encryption device 10 in the example of Fig. 3 can be evaluated as O(m+t).

[0060] In this way, in both the example of Figure 3 and the example of Figure 4, the encryption device 10 can generate a tag T that enables the decryption device 20 to detect the location of tampering when the decryption device 20 detects that tampering has occurred with the ciphertext. Also, in the example of FIG. 3, the encryption device 10 is expected to be able to generate the ciphertext C and the tag T in a shorter processing time than in the example of FIG.

[0061] Fig. 5 is a diagram showing an example of the configuration of the decryption device 20. In the configuration shown in Fig. 3, the decryption device 20 includes a decryption-side blocking unit 21, a decryption unit 22, a decryption-side tag generation unit 23, and a verification unit 24. The decryption-side blocking unit 21 divides the ciphertext into blocks of fixed length to generate a sequence of blocks. In particular, the decryption-side blocking unit 21 divides the ciphertext into blocks of the same bit length as the bit length of the encrypted blocks generated by the encryption unit 12. The ciphertext here corresponds to an example of data to be decrypted. The data to be decrypted is data generated by the encryption unit 12, or data generated by tampering with the data generated by the encryption unit 12. The decoding-side blocking unit 21 corresponds to an example of a blocking means and an example of a decoding-side blocking means.

[0062] The decryption unit 22 performs decryption using a tweakable block cipher for each block included in the string of blocks generated by the decryption-side blocking unit 21. The decryption unit 22 decrypts the blocks using a tweakable block cipher that uses the same tweak as the tweak used for encryption by the encryption unit 12. The decryption unit 22 then combines the decrypted blocks to generate plaintext. The plaintext here corresponds to an example of decrypted data. The decoding unit 22 corresponds to an example of a decoding means.

[0063] The decryption side tag generation unit 23 generates a tag for each block set formed by combining blocks included in the sequence of blocks decrypted by the decryption unit 22. Then, the decryption side tag generation unit 23 combines the tags for each block set to generate a tag for the ciphertext. Decryption side tag generation unit 23 corresponds to an example of tag generation means and an example of decryption side tag generation means. The block set from which decryption side tag generation unit 23 generates tags corresponds to an example of a second block set.

[0064] The tag of the ciphertext generated by the decryption-side tag generation unit 23 is also referred to as the tag of the data to be decrypted. On the other hand, the tag of the ciphertext generated by the encryption-side tag generation unit 13 is also referred to as the tag of the encrypted data. By comparing the tag of the data to be decrypted with the tag of the encrypted data, it is possible to detect whether the data to be decrypted has been tampered with, and if tampering has occurred, the location of the tampering.

[0065] The decryption side tag generation unit 23 generates a tag by performing a process similar to the process of generating a tag by the encryption side tag generation unit 13. As a result, if the ciphertext has not been tampered with, the tag generated by the encryption side tag generation unit 13 will have the same value as the tag generated by the decryption side tag generation unit 23. On the other hand, if the ciphertext has been tampered with, the tag generated by the encryption side tag generation unit 13 will have a different value from the tag generated by the decryption side tag generation unit 23.

[0066] The verification unit 24 detects whether or not the ciphertext, which is the data to be decrypted, has been tampered with based on the tag of the data to be decrypted and the tag of the encrypted data, and if it detects that tampering has occurred, it detects the location of the tampering. If the data to be decrypted has not been tampered with, the tag of the data to be decrypted and the tag of the encrypted data will have the same value. On the other hand, if the data to be decrypted has been tampered with, the tag of the data to be decrypted and the tag of the encrypted data will have the same value. Therefore, the verification unit 24 can detect whether the data has been tampered with by comparing the tag of the data to be decrypted with the tag of the encrypted data.

[0067] In addition, the tag of the ciphertext is formed by combining the tags of each block set. If the data to be decrypted has been tampered with, the tag value of the block set including the block corresponding to the tampered portion will be different between the tag of the data to be decrypted and the tag of the encrypted data. This allows the verification unit 24 to detect the location of tampering in units of block sets. When the block sets are determined so that blocks can be specified, the verification unit 24 can detect the location of tampering in units of blocks.

[0068] FIG. 6 is a diagram showing an example of the flow of data when the decryption device 20 decrypts a ciphertext. 6, the ciphertext which is the data to be decrypted is denoted as C', and the blocks into which the ciphertext C' is divided are denoted as C'[1], C'[2], . . . , C'[m]. The ciphertext C' is the ciphertext C generated by the encryption device 10, or a ciphertext obtained by tampering with the ciphertext C.

[0069] Also, let M be the blocks of plaintext obtained by decrypting blocks C'[1], C'[2], . . . , C'[m]. ^ [1], M ^ [2], ,M. ^ [m] and block M ^ [1] to M ^Let [m] be the combined plaintext (decrypted plaintext) of M ^ It is written as follows. Also, Block M ^ [1] to M ^ Let S be the block set consisting of the combination of blocks contained in the sequence of blocks up to [m]. ^ [1], S ^ [2], ,S. ^ [t] and block S ^ [1] to S ^ [m] is the combined tag T ^ It is written as follows. Moreover, the tag of the ciphertext C' is represented as T'. The tag T' is the tag T generated by the encryption device 10 or a tag in which the tag T has been tampered with.

[0070] 6, the decryption-side blocking unit 21 divides the ciphertext C' into m blocks C'[1] to C'[m]. The decryption-side blocking unit 21 divides the ciphertext C', which has the same data size as the ciphertext C generated by the encryption unit 12, into blocks C'[1] to C'[m] of the same number (m) and the same block length as the blocks C[1] to C[m]. The decoding-side blocking unit 21 outputs the sequence of blocks C′[1] to C′[m] to the decoding unit 22.

[0071] The decryption unit 22 decrypts each of the blocks C'[1] to C'[m] using the tweakable block cipher to obtain a block M ^ [1] to M ^ The decryption unit 22 generates up to block M ^ Block C'[i] is decrypted using a tweakable block cipher with the same key K and Tweak(N,i,0) as those used to encrypt block M[i] corresponding to [i], where i is an integer between 1 and m.

[0072] Here, a first block corresponds to a second block if the position in the column of blocks in the data before division (or the data in which the blocks are combined) is the same for the first block and the second block. The decoding unit 22 decodes the decoded block M ^ [1] to M ^ [m] is concatenated to obtain plaintext M ^ Generate. The decoding unit 22 decodes the block M ^ [1] to M ^ The decryption unit 22 outputs the string of blocks up to [m] to the decryption tag generation unit 23. ^ to the verification unit 24.

[0073] The decryption tag generation unit 23 decrypts the block M ^ [1] to M ^ For each of t block sets in which one or more blocks from [m] are combined, a tag T ^ [1] to T ^ Then, the tag generator 23 generates the tag T ^ [1] to T ^ [t] is combined to obtain the tag T of the data to be decrypted. ^ Generate.

[0074] The decryption tag generation unit 23 performs the same process as the encryption tag generation unit 13 performs to generate the tag T from the sequence of blocks M[1] to M[m], ^ [1] to M ^ [m] blocks from tag T ^ Generate. The decryption tag generation unit 23 generates the tag T ^ to the verification unit 24.

[0075] The verification unit 24 verifies the tag T of the data to be decrypted. ^ and the tag T' of the ciphertext C', it detects whether or not the ciphertext, which is the data to be decrypted, has been tampered with, and if it detects that tampering has occurred, it detects the location of the tampering. As described above, the verification unit 24 detects the tag T ^ By comparing the encrypted text with the tag T', it is possible to detect whether the encrypted text has been tampered with, and if tampering is detected, to detect the location of the tampering.

[0076] As described above, the encryption-side blocking unit 11 divides the data to be encrypted into fixed-length blocks to generate a sequence of blocks. The encryption unit 12 encrypts each block included in the sequence of blocks into which the data to be encrypted is divided using a block cipher, and combines the encrypted blocks to generate encrypted data. The encryption-side tag generation unit 13 generates a tag for each block set formed by combining blocks included in the sequence of blocks into which the data to be encrypted is divided, and combines the tags for each block set to generate a tag for the encrypted data.

[0077] When encrypted data is tampered with, it is possible to detect which block set the tampered block is included in by using the tag generated by the encryption device 10. In this respect, the encryption device 10 can detect the tampered part when encrypted data is tampered with.

[0078] In addition, the encryption side tag generation unit 13 encrypts, for each block set, a block generated by taking the bitwise exclusive OR of all blocks contained in that block set using a block cipher, to generate a tag for each block set. According to the encryption device 10, a block cipher can be used for both data encryption and tag generation, which allows the encryption device 10 to simplify its configuration.

[0079] The block sets are determined such that every block included in the string of blocks into which the data to be encrypted is divided is included in at least one block set. According to the encryption device 10, even if any part of the data to be encrypted is tampered with, it is possible to detect that the tampering has occurred and the part where the tampering has occurred.

[0080] In addition, the block sets are determined such that for any two blocks included in the same block set, there is always a block set that includes only one of the two blocks and does not include the other block. According to the encryption device 10, if tampering has occurred, the tampered portion can be detected on a block-by-block basis.

[0081] The encryption unit 12 also encrypts blocks included in a sequence of blocks into which the data to be encrypted is divided, using a tweakable block cipher configured using a combination of a block cipher and a tweak. The encryption tag generation unit 13 encrypts a block generated by performing a bitwise exclusive OR on all blocks included in the block set, using a tweakable block cipher configured using a combination of a block cipher and a tweak. According to the encryption device 10, it is possible to encrypt data and generate tags using a tweakable block cipher. In this respect, according to the encryption device 10, it is possible to improve the security of the encryption.

[0082] Further, the decryption-side blocking unit 21 divides the data to be decrypted into blocks of fixed length to generate a sequence of blocks. The decryption unit 22 performs decryption using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided, and combines the decrypted blocks to generate decrypted data. The decryption-side tag generation unit 23 generates a tag for each block set in which blocks included in the sequence of decrypted blocks are combined, and combines the tags for each block set to generate a tag for the data to be decrypted. The verification unit 24 detects whether the data to be decrypted has been tampered with, and the location of the tampering when tampering is detected, based on the tag generated by the tag generation means and the tag generated during encryption.

[0083] According to the decryption device 20, when encrypted data is tampered with, it is possible to detect which block set contains the block that has been tampered with. In this respect, according to the decryption device 20, when encrypted data is tampered with, it is possible to detect the tampered part.

[0084] In addition, the decryption side tag generation unit 23 encrypts, for each block set, a block generated by taking the bitwise exclusive OR of all blocks contained in that block set using a block cipher, to generate a tag for each block set. According to the decryption device 20, a block cipher can be used for both data decryption and tag generation, and in this respect, the configuration of the decryption device 20 can be simplified.

[0085] Moreover, the block sets are determined such that every block included in the sequence of decoded blocks is included in at least one block set. According to the decryption device 20, even if any part of the data to be encrypted is tampered with, it is possible to detect that the tampering has occurred and the part where the tampering has occurred.

[0086] In addition, the block sets are determined such that for any two blocks included in the same block set, there is always a block set that includes only one of the two blocks and does not include the other block. According to the decryption device 20, if tampering has occurred, the tampered portion can be detected on a block-by-block basis.

[0087] The decryption unit 22 also uses a tweakable block cipher configured using a combination of a block cipher and a tweak to decrypt blocks included in a sequence of blocks into which the data to be decrypted is divided. The decryption tag generation unit 23 uses a tweakable block cipher configured using a combination of a block cipher and a tweak to encrypt a block generated by performing a bitwise exclusive OR on all blocks included in the block set.

[0088] According to the decryption device 20, it is possible to detect, by using a tag generated by using the tweakable block cipher, whether or not data encrypted by using the tweakable block cipher has been tampered with, and if tampering has occurred, the location of the tampering. In this respect, according to the decryption device 20, it is possible to improve the security of the encryption.

[0089] <Second embodiment> 7 is a diagram showing another example of the configuration of an encryption device according to at least one embodiment. In the configuration shown in FIG. 7, an encryption device 610 includes a blocking unit 611, an encryption unit 612, and a tag generation unit 613.

[0090] The blocking unit 611 divides data to be encrypted into fixed-length blocks to generate a sequence of blocks. The encryption unit 612 encrypts each block included in the sequence of blocks into which the data to be encrypted is divided using a block cipher, and combines the encrypted blocks to generate encrypted data. The tag generation unit 613 generates a tag for each block set formed by combining blocks included in the sequence of blocks into which the data to be encrypted is divided, and combines the tags for each block set to generate a tag for the encrypted data. The blocking unit 611 corresponds to an example of a blocking means, the encryption unit 612 corresponds to an example of an encryption means, and the tag generating unit 613 corresponds to an example of a tag generating means.

[0091] When encrypted data is tampered with, it is possible to detect which block set the tampered block is included in by using the tag generated by the encryption device 610. In this respect, the encryption device 610 can detect the tampered part when encrypted data is tampered with.

[0092] <Third embodiment> 8 is a diagram showing another example of the configuration of a decoding device according to at least one embodiment. In the configuration shown in FIG. 8, a decoding device 620 includes a blocking unit 621, a decoding unit 622, a tag generating unit 623, and a verifying unit 624.

[0093] The blocking unit 621 divides the data to be decrypted into blocks of fixed length to generate a sequence of blocks. The decryption unit 622 performs decryption using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided, and combines the decrypted blocks to generate decrypted data. The tag generation unit 623 generates a tag for each block set in which blocks included in the sequence of decrypted blocks are combined, and combines the tags for each block set to generate a tag for the data to be decrypted. The verification unit 624 detects whether the data to be decrypted has been tampered with, and the location of the tampering when tampering is detected, based on the tag generated by the tag generation means and the tag generated during encryption. The blocking unit 621 corresponds to an example of a blocking means. The decoding unit 622 corresponds to an example of a decoding means. The tag generating unit 623 corresponds to an example of a tag generating means. The verifying unit 624 corresponds to an example of a verifying means.

[0094] According to the decryption device 620, when encrypted data is tampered with, it is possible to detect which block set the block in which the tampering occurred. In this respect, according to the decryption device 620, when encrypted data is tampered with, it is possible to detect the tampered part.

[0095] <Fourth embodiment> Fig. 9 is a diagram showing another example of the configuration of the encryption system according to at least one embodiment. In the configuration shown in Fig. 9, the encryption system 630 includes an encryption device 640 and a decryption device 650. The encryption device 640 includes an encryption-side blocking unit 641, an encryption unit 642, and an encryption-side tag generating unit 643. The decryption device 650 includes a decryption-side blocking unit 651, a decryption unit 652, a decryption-side tag generating unit 653, and a verification unit 654.

[0096] In this configuration, the encryption-side blocking unit 641 divides the data to be encrypted into fixed-length blocks to generate a sequence of blocks. The encryption unit 642 encrypts each block included in the sequence of blocks into which the data to be encrypted is divided using a block cipher, and combines the encrypted blocks to generate encrypted data. The encryption-side tag generation unit 643 generates a tag for each first block set, which is a block set formed by combining blocks included in the sequence of blocks into which the data to be encrypted is divided, and combines the tags for each first block set to generate a tag for the encrypted data.

[0097] The decryption-side blocking unit 651 divides the data to be decrypted into blocks of fixed length to generate a sequence of blocks. The decryption unit 652 performs decryption using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided, and combines the decrypted blocks to generate decrypted data. The decryption-side tag generation unit 653 generates a tag for each second block set, which is a block set in which blocks included in the sequence of decrypted blocks are combined, and combines the tags for each second block set to generate a tag for the data to be decrypted. The verification unit 654 detects whether the data to be decrypted has been tampered with, and the location of the tampering when tampering is detected, based on the tag of the data to be decrypted and the tag of the encrypted data.

[0098] The encryption side blocking unit 641 corresponds to an example of encryption side blocking means. The encryption unit 642 corresponds to an example of encryption means. The encryption side tag generation unit 643 corresponds to an example of encryption side tag generation means. The decryption side blocking unit 651 corresponds to an example of decryption side blocking means. The decryption unit 652 corresponds to an example of decryption means. The decryption side tag generation unit 653 corresponds to an example of decryption side tag generation means. The verification unit 654 corresponds to an example of verification means.

[0099] According to the encryption system 630, when encrypted data is tampered with, it is possible to detect which block in which block set the tampering has occurred. In this respect, according to the encryption system 630, when encrypted data is tampered with, it is possible to detect the location of the tampering.

[0100] <Fifth embodiment> Fig. 10 is a diagram showing an example of a processing procedure in an encryption method according to at least one embodiment. The processing shown in Fig. 10 includes performing blocking (step S611), performing encryption for each block (step S612), generating encrypted data (step S613), generating a tag for each block set (step S614), and generating a tag for the encrypted data (step S615).

[0101] In blocking (step S611), the encryption device divides the data to be encrypted into blocks of fixed length to generate a sequence of blocks. In encrypting each block (step S612), the encryption device encrypts each block included in the sequence of blocks into which the data to be encrypted is divided, using a block cipher.

[0102] In generating encrypted data (step S613), the encryption device combines the encrypted blocks to generate encrypted data. In generating a tag for each block set (step S614), the encryption device generates a tag for each block set that combines blocks included in the string of blocks into which the data to be encrypted is divided. In generating a tag for the encrypted data (step S615), the encryption device combines the tags for each block set to generate a tag for the encrypted data.

[0103] By using the tag generated by the encryption method shown in Fig. 10, when encrypted data is tampered with, it is possible to detect which block set the tampered block is included in. In this respect, according to the encryption method shown in Fig. 10, when encrypted data is tampered with, it is possible to detect the tampered part.

[0104] Sixth embodiment Fig. 11 is a diagram showing an example of a process procedure in a decryption method according to at least one embodiment. The decryption method shown in Fig. 11 includes performing blocking (step S621), performing decryption for each block (step S622), generating decrypted data (step S623), generating a tag for each block set (step S624), generating a tag for the data to be decrypted (step S625), and detecting tampering (step S626).

[0105] In blocking (step S621), the decoding device divides the data to be decoded into blocks of fixed length to generate a sequence of blocks. In performing decryption for each block (step 622), the decryption device performs decryption using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided. In generating decoded data (step S623), the decoding device combines the decoded blocks to generate the decoded data.

[0106] In generating a tag for each block set (step S624), the decoding device generates a tag for each block set that combines blocks included in the sequence of decoded blocks. In generating a tag for the data to be decoded (step S625), the decoding device combines the tags for each block set to generate a tag for the data to be decoded. In detecting tampering (step S626), the decryption device detects whether or not the data to be decrypted has been tampered with, and if tampering is detected, the location of the tampering, based on the tag of the data to be decrypted and the tag generated during encryption.

[0107] According to the decryption method shown in Fig. 11, when encrypted data is tampered with, it is possible to detect which block set the tampered block is included in. In this respect, according to the decryption method shown in Fig. 11, when encrypted data is tampered with, it is possible to detect the tampered part.

[0108] FIG. 12 is a schematic block diagram illustrating a computer configuration according to at least one embodiment. In the configuration shown in FIG. 15, a computer 700 includes a CPU 710, a main memory device 720, an auxiliary memory device 730, an interface 740, and a non-volatile recording medium 750.

[0109] Any one or more of the encryption device 10, the decryption device 20, the encryption device 610, the decryption device 620, the encryption device 640, and the decryption device 650, or a part of them, may be implemented in the computer 700. In this case, the operation of each of the above-mentioned processing units is stored in the auxiliary storage device 730 in the form of a program. The CPU 710 reads the program from the auxiliary storage device 730, develops it in the main storage device 720, and executes the above-mentioned processing according to the program. The CPU 710 also secures a storage area corresponding to each of the above-mentioned storage units in the main storage device 720 according to the program. Communication between each device and other devices is executed by the interface 740 having a communication function and performing communication according to the control of the CPU 710. The interface 740 also has a port for the non-volatile recording medium 750, and reads information from the non-volatile recording medium 750 and writes information to the non-volatile recording medium 750.

[0110] When the encryption device 10 is implemented in a computer 700, the operations of the encryption-side blocking unit 11, the encryption unit 12, and the encryption-side tag generating unit 13 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing according to the program.

[0111] Furthermore, the CPU 710 secures a storage area in the main storage device 720 for the encryption device 10 to perform processing in accordance with the program. Communication between the encryption device 10 and other devices is performed by an interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the encryption device 10 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0112] When the decoding device 20 is implemented in a computer 700, the operations of the decoding-side blocking unit 21, the decoding unit 22, the decoding-side tag generating unit 23, and the verifying unit 24 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing according to the program.

[0113] Furthermore, the CPU 710, in accordance with the program, secures a storage area in the main storage device 720 for the decoding device 20 to perform processing. Communication between the decoding device 20 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the decoding device 20 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0114] When the encryption device 610 is implemented in the computer 700, the operations of the blocking unit 611, the encryption unit 612, and the tag generation unit 613 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing according to the program.

[0115] Furthermore, the CPU 710 secures a storage area in the main storage device 720 for the encryption device 610 to perform processing in accordance with the program. Communication between the encryption device 610 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the encryption device 610 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0116] When the decryption device 620 is implemented in the computer 700, the operations of the blocking unit 621, the decryption unit 622, the tag generation unit 623, and the verification unit 624 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing in accordance with the program.

[0117] Furthermore, the CPU 710, in accordance with the program, secures a storage area in the main storage device 720 for the decoding device 620 to perform processing. Communication between the decoding device 620 and other devices is performed by an interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the decoding device 620 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0118] When the encryption device 640 is implemented in the computer 700, the operations of the encryption-side blocking unit 641, the encryption unit 642, and the encryption-side tag generating unit 643 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing according to the program.

[0119] Furthermore, the CPU 710, in accordance with the program, secures a storage area in the main storage device 720 for the encryption device 640 to perform processing. Communication between the encryption device 640 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the encryption device 640 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0120] When the decoding device 650 is implemented in a computer 700, the operations of the decoding-side blocking unit 651, the decoding unit 652, the decoding-side tag generating unit 653, and the verifying unit 654 are stored in the form of a program in the auxiliary storage device 730. The CPU 710 reads the program from the auxiliary storage device 730, loads it in the main storage device 720, and executes the above-mentioned processing according to the program.

[0121] Furthermore, the CPU 710, in accordance with the program, secures a storage area in the main storage device 720 for the decoding device 650 to perform processing. Communication between the decoding device 650 and other devices is performed by the interface 740 having a communication function and operating under the control of the CPU 710. Interaction between the decoding device 650 and a user is performed by the interface 740 having an input device and an output device, presenting information to the user via the output device under the control of the CPU 710, and accepting user operations via the input device.

[0122] Any one or more of the above-mentioned programs may be recorded in non-volatile recording medium 750. In this case, interface 740 may read the program from non-volatile recording medium 750. Then, CPU 710 may directly execute the program read by interface 740, or may temporarily store the program in main storage device 720 or auxiliary storage device 730 and execute it.

[0123] Note that a program for executing all or part of the processing performed by the encryption device 10, the decryption device 20, the encryption device 610, the decryption device 620, the encryption device 640, and the decryption device 650 may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed to perform processing of each part. Note that the term "computer system" here includes the OS (Operating System) and hardware such as peripheral devices. Furthermore, the term "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs (Read Only Memory), and CD-ROMs (Compact Disc Read Only Memory), as well as storage devices such as hard disks built into computer systems. The above-mentioned program may be for realizing part of the above-mentioned functions, or may be capable of realizing the above-mentioned functions in combination with a program already recorded in the computer system.

[0124] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and designs that do not deviate from the gist of the present invention are also included.

[0125] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.

[0126] (Appendix 1) a blocking means for dividing data to be encrypted into blocks of a fixed length to generate a sequence of the blocks; an encryption means for encrypting each block included in a sequence of blocks into which the data to be encrypted is divided, using a block cipher, and combining the encrypted blocks to generate encrypted data; a tag generating means for generating a tag for each block set formed by combining blocks included in a sequence of blocks into which the data to be encrypted is divided, and for generating a tag for the encrypted data by combining the tags for the block sets; An encryption device comprising:

[0127] (Appendix 2) the tag generating means generates a tag for each of the block sets by encrypting a block generated by performing a bitwise exclusive OR on all of the blocks included in the block set using a block cipher; 2. The encryption device of claim 1.

[0128] (Appendix 3) the block sets are determined such that every block included in a sequence of blocks into which the data to be encrypted is divided is included in at least one block set. 3. An encryption device as defined in claim 2.

[0129] (Appendix 4) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 4. An encryption device according to claim 2 or 3.

[0130] (Appendix 5) The encryption means encrypts a block included in a sequence of blocks into which the data to be encrypted is divided, using a tweakable block cipher formed by combining the block cipher and a tweak; The tag generating means encrypts a block generated by performing a bitwise exclusive OR on all blocks included in the block set using a tweakable block cipher configured using a combination of the block cipher and a tweak. 5. An encryption device according to any one of claims 2 to 4.

[0131] (Appendix 6) a blocking means for dividing data to be decoded into blocks of a fixed length to generate a sequence of the blocks; a decryption means for decrypting each block included in the sequence of blocks into which the data to be decrypted is divided, using a block cipher, and combining the decrypted blocks to generate decrypted data; a tag generating means for generating a tag for each block set formed by combining blocks included in the string of decrypted blocks, and for generating a tag for the data to be decrypted by combining the tags for the block sets; a verification means for detecting whether or not the data to be decrypted has been tampered with, and, if tampering is detected, detecting the location of the tampering, based on the tag generated by the tag generation means and the tag generated during encryption; A decoding device comprising:

[0132] (Appendix 7) the tag generating means generates a tag for each of the block sets by encrypting a block generated by performing a bitwise exclusive OR on all of the blocks included in the block set using a block cipher; 7. A decoding device as claimed in claim 6.

[0133] (Appendix 8) The block sets are determined such that every block included in the sequence of the decoded blocks is included in at least one block set. 8. A decoding device as claimed in claim 7.

[0134] (Appendix 9) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 9. A decoding device according to claim 7 or 8.

[0135] (Appendix 10) The decryption means decrypts a block included in a sequence of blocks into which the data to be decrypted is divided, using a tweakable block cipher configured using a combination of the block cipher and a tweak; The tag generating means encrypts a block generated by performing a bitwise exclusive OR on all blocks included in the block set using a tweakable block cipher configured using a combination of the block cipher and a tweak. 10. A decoding device according to any one of claims 7 to 9.

[0136] (Appendix 11) An encryption device and a decryption device, The encryption device includes: an encryption-side blocking means for dividing data to be encrypted into fixed-length blocks to generate a sequence of blocks; an encryption means for encrypting each block included in a sequence of blocks into which the data to be encrypted is divided, using a block cipher, and combining the encrypted blocks to generate encrypted data; an encryption-side tag generating means for generating a tag for each first block set, which is a block set formed by combining blocks included in a sequence of blocks into which the data to be encrypted is divided, and combining the tags for each of the first block sets to generate a tag for the encrypted data; Equipped with The decoding device comprises: a decoding side blocking means for dividing data to be decoded into blocks of a fixed length to generate a sequence of the blocks; a decryption means for decrypting each block included in the sequence of blocks into which the data to be decrypted is divided, using a block cipher, and combining the decrypted blocks to generate decrypted data; a decryption-side tag generating means for generating a tag for each second block set, which is a block set formed by combining blocks included in the string of decrypted blocks, and combining the tags for each second block set to generate a tag for the data to be decrypted; a verification means for detecting whether or not the data to be decrypted has been tampered with and, if tampering is detected, the location of the tampering, based on a tag of the data to be decrypted and a tag of the encrypted data; Equipped with Crypto system.

[0137] (Appendix 12) the encryption side tag generation means encrypts, for each of the first block sets, a block generated by performing a bitwise exclusive OR on all of the blocks included in the block set, using a block cipher to generate a tag for each of the first block sets; the decryption side tag generation means encrypts, for each of the second block sets, a block generated by performing a bitwise exclusive OR on all of the blocks included in the block set, using a block cipher to generate a tag for each of the second block sets. 12. A cryptographic system as described in Appendix 11.

[0138] (Appendix 13) the first block sets are determined such that every block included in a sequence of blocks into which the data to be encrypted is divided is included in at least one first block set; the second block sets are determined such that any block included in the sequence of the decoded blocks is included in at least one second block set; 13. A cryptographic system as described in claim 12.

[0139] (Appendix 14) the first block set is determined such that, for any two blocks included in the same first block set, there is always a first block set that includes only one of the two blocks and does not include the other block; The second block set is determined such that, for any two blocks included in the same second block set, there is always a second block set that includes only one of the two blocks and does not include the other block. 14. A cryptosystem as described in claim 12 or 13.

[0140] (Appendix 15) The encryption means encrypts a block included in a sequence of blocks into which the data to be encrypted is divided, using a tweakable block cipher formed by combining the block cipher and a tweak; the encryption side tag generation means encrypts a block generated by performing a bitwise exclusive OR on all blocks included in the first block set using a tweakable block cipher configured by using a combination of the block cipher and a tweak; The decryption means decrypts a block included in a sequence of blocks into which the data to be decrypted is divided, using a tweakable block cipher configured using a combination of the block cipher and a tweak; the decryption side tag generation means encrypts a block generated by performing a bitwise exclusive OR on all blocks included in the second block set using a tweakable block cipher configured using a combination of the block cipher and a tweak; 15. A cryptographic system according to any one of claims 12 to 14.

[0141] (Appendix 16) The encryption device is Divide the data to be encrypted into fixed-length blocks to generate a sequence of blocks, encrypting the data to be encrypted using a block cipher for each block included in the string of blocks into which the data to be encrypted is divided; Combining the encrypted blocks to generate encrypted data; generating a tag for each block set obtained by combining blocks included in the sequence of blocks into which the data to be encrypted is divided; combining the tags for each of the block sets to generate a tag for the encrypted data; An encryption method including:

[0142] (Appendix 17) In the step of generating a tag for each block set, a block generated by performing a bitwise exclusive OR on all blocks included in each block set is encrypted using a block cipher to generate a tag for each block set. 17. The encryption method according to claim 16.

[0143] (Appendix 18) the block sets are determined such that every block included in a sequence of blocks into which the data to be encrypted is divided is included in at least one block set. 18. The encryption method according to claim 17.

[0144] (Appendix 19) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 19. The encryption method according to claim 17 or 18.

[0145] (Appendix 20) In the encryption, a tweakable block cipher configured by a combination of the block cipher and a tweak is used to encrypt a block included in a sequence of blocks into which the data to be encrypted is divided; In generating the tag for each block set, a tweakable block cipher configured by using a combination of the block cipher and a tweak is used to encrypt the generated block by performing a bitwise exclusive OR on all blocks included in the block set. 20. The encryption method of any one of appendix 17 to 19.

[0146] (Appendix 21) The decoding device Divide the data to be decrypted into fixed-length blocks to generate a sequence of blocks, decrypting the data to be decrypted using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided; combining the decrypted blocks to generate decrypted data; generating a tag for each block set formed by combining blocks included in the sequence of decrypted blocks; Combining the tags for each block set to generate a tag for the data to be decrypted; Detecting whether or not the data to be decrypted has been tampered with, and, if tampering has been detected, the location of the tampering, based on the tag of the data to be decrypted and the tag generated during encryption; A decoding method including:

[0147] (Appendix 22) In the step of generating a tag for each block set, a block generated by performing a bitwise exclusive OR on all blocks included in each block set is encrypted using a block cipher to generate a tag for each block set. 22. A decryption method as described in claim 21.

[0148] (Appendix 23) The block sets are determined such that every block included in the sequence of the decoded blocks is included in at least one block set. 23. A decryption method as described in claim 22.

[0149] (Appendix 24) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 24. The method of decryption according to claim 22 or 23.

[0150] (Appendix 25) In the decryption, a block included in a sequence of blocks into which the data to be decrypted is divided is decrypted using a tweakable block cipher configured using a combination of the block cipher and a tweak; In generating the tag for each block set, a tweakable block cipher configured by using a combination of the block cipher and a tweak is used to encrypt the generated block by performing a bitwise exclusive OR on all blocks included in the block set. 25. The decryption method according to any one of appendix 22 to 24.

[0151] (Appendix 26) On the computer, Dividing data to be encrypted into fixed-length blocks to generate a sequence of blocks; encrypting the data to be encrypted using a block cipher for each block included in a sequence of blocks into which the data to be encrypted is divided; combining the encrypted blocks to generate encrypted data; generating a tag for each block set obtained by combining blocks included in a sequence of blocks into which the data to be encrypted is divided; combining the tags for each set of blocks to generate a tag for the encrypted data; A program that executes the following.

[0152] (Appendix 27) In the step of generating a tag for each block set, a block generated by performing bitwise exclusive OR on all blocks included in the block set is encrypted using a block cipher to generate a tag for each block set. 27. The program according to claim 26.

[0153] (Appendix 28) the block sets are determined such that every block included in a sequence of blocks into which the data to be encrypted is divided is included in at least one block set. 28. The program according to claim 27.

[0154] (Appendix 29) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 29. The program according to claim 27 or 28.

[0155] (Appendix 30) In the encryption, a tweakable block cipher configured by a combination of the block cipher and a tweak is used to encrypt a block included in a sequence of blocks into which the data to be encrypted is divided; In generating the tag for each block set, a tweakable block cipher configured by using a combination of the block cipher and a tweak is used to encrypt the generated block by performing bitwise exclusive OR on all blocks included in the block set. 30. The program of any one of appendixes 27 to 29.

[0156] (Appendix 31) On the computer, Dividing data to be decrypted into blocks of fixed length to generate a sequence of blocks; performing decryption using a block cipher for each block included in the string of blocks into which the data to be decrypted is divided, and combining the decrypted blocks to generate decrypted data; generating a tag for each block set formed by combining blocks included in the sequence of decoded blocks; Combining the tags for each block set to generate a tag for the data to be decoded; Detecting whether or not the data to be decrypted has been tampered with, and, if tampering has been detected, the location of the tampering, based on a tag of the data to be decrypted and a tag generated during encryption; A program that executes the following.

[0157] (Appendix 32) In the step of generating a tag for each block set, a block generated by performing bitwise exclusive OR on all blocks included in the block set is encrypted using a block cipher to generate a tag for each block set. 32. The program according to claim 31.

[0158] (Appendix 33) The block sets are determined such that every block included in the sequence of the decoded blocks is included in at least one block set. 33. The program according to claim 32.

[0159] (Appendix 34) The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. 34. The program according to claim 32 or 33.

[0160] (Appendix 35) In the decryption, a tweakable block cipher configured by a combination of the block cipher and a tweak is used to decrypt a block included in a sequence of blocks into which the data to be decrypted is divided; In generating the tag for each block set, a tweakable block cipher configured by using a combination of the block cipher and a tweak is used to encrypt the generated block by performing bitwise exclusive OR on all blocks included in the block set. 35. The program of any one of appendices 32 to 34. [Explanation of symbols]

[0161] 1,630 Cryptosystem 10, 610, 640 encryption device 11, 641 Encryption block section 12, 612, 642 Encryption part 13, 643 Encryption tag generator 20, 620, 650 Decoding device 21, 651 Decoding side blocking unit 22, 622, 652 Decoding section 23, 653 Decoding tag generator 24, 624, 654 Verification Department Blocking Unit 611, 612 Tag generation unit 613, 623

Claims

1. a blocking means for dividing data to be encrypted into blocks of a fixed length to generate a sequence of the blocks; an encryption means for encrypting each block included in a sequence of blocks into which the data to be encrypted is divided, using a block cipher, and combining the encrypted blocks to generate encrypted data; a tag generating means for generating a tag for each block set formed by combining blocks included in a sequence of blocks into which the data to be encrypted is divided, and for generating a tag for the encrypted data by combining the tags for the block sets; An encryption device comprising:

2. the tag generating means generates a tag for each of the block sets by encrypting a block generated by performing a bitwise exclusive OR on all of the blocks included in the block set using a block cipher; The encryption device according to claim 1 .

3. the block sets are determined such that every block included in a sequence of blocks into which the data to be encrypted is divided is included in at least one block set. The encryption device according to claim 2 .

4. The block sets are determined such that, for any two blocks included in the same block set, there exists a block set that includes only one of the two blocks and does not include the other block. The encryption device according to claim 2 or 3.

5. a blocking means for dividing data to be decoded into blocks of a fixed length to generate a sequence of the blocks; a decryption means for decrypting each block included in the sequence of blocks into which the data to be decrypted is divided, using a block cipher, and combining the decrypted blocks to generate decrypted data; a tag generating means for generating a tag for each block set formed by combining blocks included in the string of decrypted blocks, and for generating a tag for the data to be decrypted by combining the tags for the block sets; a verification means for detecting whether or not the data to be decrypted has been tampered with, and, if tampering is detected, detecting the location of the tampering, based on the tag generated by the tag generation means and the tag generated during encryption; A decoding device comprising:

6. An encryption device and a decryption device, The encryption device includes: an encryption-side blocking means for dividing data to be encrypted into fixed-length blocks to generate a sequence of blocks; an encryption means for encrypting each block included in a sequence of blocks into which the data to be encrypted is divided, using a block cipher, and combining the encrypted blocks to generate encrypted data; an encryption-side tag generating means for generating a tag for each first block set, which is a block set formed by combining blocks included in a sequence of blocks into which the data to be encrypted is divided, and for generating a tag for the encrypted data by combining the tags for each of the first block sets; Equipped with The decoding device comprises: a decoding side blocking means for dividing data to be decoded into blocks of a fixed length to generate a sequence of the blocks; a decryption means for decrypting each block included in the sequence of blocks into which the data to be decrypted is divided, using a block cipher, and combining the decrypted blocks to generate decrypted data; a decryption-side tag generating means for generating a tag for each second block set, which is a block set formed by combining blocks included in the string of decrypted blocks, and for generating a tag for the data to be decrypted by combining the tags for each second block set; a verification means for detecting whether or not the data to be decrypted has been tampered with and, if tampering is detected, the location of the tampering, based on a tag of the data to be decrypted and a tag of the encrypted data; Equipped with Crypto system.

7. The encryption device is Divide the data to be encrypted into fixed-length blocks to generate a sequence of blocks, encrypting the data to be encrypted using a block cipher for each block included in the string of blocks into which the data to be encrypted is divided; Combining the encrypted blocks to generate encrypted data; generating a tag for each block set obtained by combining blocks included in the sequence of blocks into which the data to be encrypted is divided; combining the tags for each of the block sets to generate a tag for the encrypted data; An encryption method including:

8. The decoding device, Divide the data to be decrypted into fixed-length blocks to generate a sequence of blocks, decrypting the data to be decrypted using a block cipher for each block included in the sequence of blocks into which the data to be decrypted is divided; combining the decrypted blocks to generate decrypted data; generating a tag for each block set formed by combining blocks included in the sequence of decrypted blocks; Combining the tags for each block set to generate a tag for the data to be decrypted; Detecting whether or not the data to be decrypted has been tampered with, and, if tampering has been detected, the location of the tampering, based on the tag of the data to be decrypted and the tag generated during encryption; The decoding method includes:

9. On the computer, Dividing data to be encrypted into fixed-length blocks to generate a sequence of blocks; encrypting the data to be encrypted using a block cipher for each block included in a sequence of blocks into which the data to be encrypted is divided; combining the encrypted blocks to generate encrypted data; generating a tag for each block set obtained by combining blocks included in a sequence of blocks into which the data to be encrypted is divided; combining the tags for each set of blocks to generate a tag for the encrypted data; A program that executes the following.

10. On the computer, Dividing data to be decrypted into blocks of fixed length to generate a sequence of blocks; performing decryption using a block cipher for each block included in the string of blocks into which the data to be decrypted is divided, and combining the decrypted blocks to generate decrypted data; generating a tag for each block set formed by combining blocks included in the sequence of decoded blocks; Combining the tags for each block set to generate a tag for the data to be decoded; Detecting whether or not the data to be decrypted has been tampered with, and, if tampering has been detected, the location of the tampering, based on a tag of the data to be decrypted and a tag generated during encryption; A program that executes the following.

Images