Information processing device, method, and program

Abstract

To provide an information processing device capable of efficiently generating tags regardless of the number of elements and a length of each element.SOLUTION: An information processing device has linking means, link information generating means, and tag generating means. The linking means generates linked data obtained by linking each element of input data consisting of a plurality of elements. The link information generating means generates link information relating to the linking of respective elements in a plurality of message blocks obtained by dividing the linked data into a predetermined data length. The tag generating means generates a tag relating to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks through a block cipher using a message of the data length as input.SELECTED DRAWING: Figure 15

Description

[Technical field]

[0001] The present disclosure relates to an information processing device, a method, and a program. [Background technology]

[0002] There is a known technology called Message Authentication Code (MAC) that uses a secret key shared in advance to detect tampering with a message. By applying a message authentication code to a communication path, it becomes possible to detect unauthorized tampering. Message authentication code data used to detect tampering with a message is also called a tag (authentication tag, verification tag). Technologies related to message authentication codes include those disclosed in, for example, Non-Patent Document 1, Non-Patent Document 2, and Non-Patent Document 3.

[0003] Non-Patent Document 1 discloses a technique for a message authentication code that uses a vector consisting of multiple elements as input. Non-Patent Document 2 discloses a technique for implementing a tweakable block cipher (TBC) that introduces an auxiliary variable (adjustment value) called a tweak in XEX mode using a block cipher. Non-Patent Document 3 discloses a technique called LAPMAC (Lightweight Alternative to PMAC), which is an improvement of PMAC (Parallelizable MAC), a parallelizable message authentication code based on a block cipher. Non-Patent Document 4 discloses a technique for implementing a tweakable block cipher. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Phillip Rogaway and Thomas Shrimpton, "Deterministic Authenticated-Encryption: A Provable-Security Treatment of the Key-Wrap Problem," Aug 20, 2007, https: / / eprint.iacr.org / 2006 / 221 [Non-Patent Document 2] Philip Rogaway, "Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC," September 24, 2004, https: / / www.cs.ucdavis.edu / ~rogaway / papers / offsets.pdf [Non-Patent Document 3] Kazuhiko Minematsu, "A Lightweight Alternative to PMAC", SAC 2019. 10 January 2020, https: / / link.springer.com / chapter / 10.1007 / 978-3-030-38471-5_16 [Non-Patent Document 4] Christof Beierle, Jeremy Jean, Stefan Kolbl, Gregor Leander, Amir Moradi, Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim, "The SKINNY Family of Block Ciphers and its Low-Latency Variant MANTIS", Crypto 2016, https: / / eprint.iacr.org / 2016 / 660.pdf Summary of the Invention [Problem to be solved by the invention]

[0005] The technology in Non-Patent Document 1 can efficiently generate a tag for a message authentication code when the number of elements and the length of each element of input data consisting of multiple elements are restricted by specific conditions. However, the technology in Non-Patent Document 1 may not be able to efficiently generate a tag for a message authentication code depending on the number of elements and the length of each element. Therefore, it is desirable to efficiently generate a tag even if the number of elements and the length of each element are variable.

[0006] The object of the present disclosure has been made to solve such problems, and is to provide an information processing device, method, and program that are capable of efficiently generating tags regardless of the number of elements and the length of each element. [Means for solving the problem]

[0007] The information processing device according to the present disclosure includes a concatenation means for generating concatenated data by concatenating each element of input data consisting of a plurality of elements, a concatenated information generation means for generating concatenated information regarding the concatenation of the elements in each of a plurality of message blocks obtained by dividing the concatenated data into data of a predetermined data length, and a tag generation means for generating a tag related to a message authentication code using each of the plurality of message blocks and the concatenated information corresponding to each of the plurality of message blocks by a block cipher using a message of the data length as input.

[0008] The information processing method disclosed herein generates concatenated data by concatenating each element of input data consisting of a plurality of elements, generates concatenated information regarding the concatenation of the elements for each of a plurality of message blocks obtained by dividing the concatenated data into data of a predetermined data length, and generates a tag related to a message authentication code using each of the plurality of message blocks and the concatenated information corresponding to each of the plurality of message blocks using a block cipher with a message of the data length as input.

[0009] The program disclosed herein causes a computer to execute the steps of generating concatenated data by concatenating each element of input data consisting of a plurality of elements, generating concatenated information regarding the concatenation of the elements in each of a plurality of message blocks obtained by dividing the concatenated data into pieces of a predetermined data length, and generating a tag related to a message authentication code using each of the plurality of message blocks and the concatenated information corresponding to each of the plurality of message blocks by a block cipher using a message of the data length as input. Effect of the Invention

[0010] According to the present disclosure, it is possible to provide an information processing device, method, and program capable of efficiently generating tags regardless of the number of elements and the length of each element. [Brief description of the drawings]

[0011] [Figure 1] FIG. 2 is a diagram for explaining a message authentication code according to the present disclosure. [Diagram 2] FIG. 1 is a diagram for explaining CMAC. [Diagram 3] FIG. 13 is a diagram for explaining an example of a vector input MAC. [Figure 4] FIG. 1 is a diagram illustrating a configuration of an authentication system according to the present disclosure. [Diagram 5] FIG. 1 is a diagram illustrating a configuration example of a tag generation device according to the present disclosure. [Figure 6] FIG. 13 is a diagram for explaining an example of linkage information according to the present disclosure. [Figure 7] FIG. 13 is a diagram for explaining an example of linkage information according to the present disclosure. [Figure 8] FIG. 2 is a diagram illustrating an outline of the calculation of a tag generator according to the present disclosure. [Figure 9] FIG. 2 is a diagram illustrating an outline of the calculation of a tag generator according to the present disclosure. [Figure 10] FIG. 2 is a diagram illustrating an outline of the calculation of a tag generator according to the present disclosure. [Figure 11]FIG. 2 is a diagram illustrating an outline of the calculation of a tag generator according to the present disclosure. [Figure 12] 1 is a diagram illustrating a configuration example of a tag verification device according to the present disclosure. [Figure 13] 1 is a flowchart illustrating a tag generation method executed by a tag generation device according to the present disclosure. [Figure 14] 4 is a flowchart illustrating a tag verification method performed by a tag verification device according to the present disclosure. [Figure 15] FIG. 1 is a diagram illustrating a configuration of an information processing device according to the present disclosure. [Figure 16] 1 is a flowchart showing an information processing method implemented by an information processing device according to the present disclosure. [Figure 17] FIG. 1 is a block diagram illustrating an example of a hardware configuration of a computing device capable of implementing an apparatus and system according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] (Outline of the embodiment) Prior to the description of the present embodiment, an outline of the present embodiment will be described. Note that the present embodiment will be described below, but the following embodiment does not limit the invention according to the claims. Also, not all of the combinations of features described in the embodiment are necessarily essential to the solution of the invention. Also, in the following description, the indexes (English letters) used are not necessarily common throughout this specification. For example, index i may mean different things in one context and another. Also, the present embodiment will be described below using drawings, but it should be noted that each drawing used in the description of each embodiment is not only applicable to that embodiment. In other words, each drawing may be applicable to all of the embodiments.

[0013] Fig. 1 is a diagram for explaining a message authentication code according to the present disclosure. In the example of Fig. 1, a sender and a receiver share a secret key K, and a message M is communicated from the sender to the receiver. Examples of MAC include, but are not limited to, Cipher-based MAC (CMAC), Hash-based MAC (HMAC), Galois MAC (GMAC), or PMAC.

[0014] The process on the sender side will be explained. The sender executes a process represented by T=MAC(M,K). Here, MAC(M,K) is a function that outputs a tag T from an input message M with a secret key K as a parameter. Here, T is a fixed-length variable for tamper detection called a tag (authentication tag). The sender transmits a pair (M,T) of a message M and a tag T to a receiver. Here, data X (message M) to be input to MAC satisfies X∈{0,1}^*. Here, "*" indicates an arbitrary number of bits, and "{0,1}^*" indicates a set of bit sequences of arbitrary length (space of * bits). Therefore, data X to be input is an arbitrary bit sequence including an empty sequence ε. In addition, T, which is the output of MAC, satisfies T∈{0,1}^τ. Here, τ indicates a fixed-length number of bits, and "{0,1}^τ" indicates a set of bit sequences of fixed length τ (space of τ bits). Therefore, T is a bit sequence of τ bits.

[0015] Next, the processing on the receiver side will be described. The information received by the receiver side is assumed to be (M',T'). In this case, the receiver side executes MAC(M',K) as a verification process. If there is no tampering during communication, MAC(M',K)=T'=T. In this case, (M',T')=(M,T). In this case, the verification process is successful. Therefore, it is authenticated that the tag T was generated by someone who correctly knows the private key K. On the other hand, if there is tampering during communication, MAC(M',K)=T'≠T. In this case, (M',T')≠(M,T). In this case, the verification process is not successful. Therefore, it is detected that (M',T') has been tampered with.

[0016] Here, a block cipher (BC) is used to generate a tag using MAC. A block cipher performs keyed substitution of fixed-length input and output. In other words, a fixed-length encrypted result is obtained by encrypting (substituting) a fixed-length message block using a block cipher. If E_K is a cryptographic primitive (cryptographic component; encryption function) of a block cipher with key K as a parameter, M is a plaintext message, and C is a ciphertext, then E_K(M)=C.

[0017] The block cipher may be a block cipher called a Tweakable Block Cipher (TBC) that introduces a public tweaked value (auxiliary variable) called a Tweak, as described in Non-Patent Document 2. In TBC, a keyed substitution including a tweak is performed on the input of the block cipher. TBCs with different tweaks can be regarded as independent block ciphers. In other words, when the same message is processed by TBCs with different tweaks, different encryption results are obtained.

[0018] Here, if Tweak is Tw, the TBC function is expressed as the following Equation 1.

number

[0019] Fig. 2 is a diagram for explaining CMAC. Fig. 2 illustrates an outline of the calculation related to CMAC. Fig. 2 also illustrates an example in which a tag generation device 70 according to a first comparative example performs calculation by CMAC.

[0020] Here, in the CMAC illustrated in FIG. 2, the encryption function E_K is used as an encryption primitive (encryption component). Here, the encryption function E_K processes a message block with an n-bit block size. That is, the encryption function E_K takes an n-bit message block as input and outputs an n-bit encryption result. Note that n is, for example, 128 bits or 256 bits, but is not limited thereto.

[0021] The tag generation device 70 divides the message M into blocks of a predetermined length. In the example of FIG. 2, the tag generation device 70 divides the message M into message blocks M[1], M[2], M[3] that are bit sequences of n bits each. That is, M = M[1] || M[2] || M[3]. Note that M[3] is the final message block. Here, "||" indicates the concatenation of bit sequences. Also, if |x| is the bit length (bit size) of the bit sequence x, then |M[1]| = |M[2]| = n. Also, |M[3]| ≤ n.

[0022] As precomputation, the tag generation device 70 encrypts the initial value 0^n with the encryption function E_K to obtain a value L that is the encryption result. Note that 0^n indicates all zeros of n bits. Also, the tag generation device 70 encrypts the first message block M[1] with the encryption function E_K to obtain a random number S_1 as the encryption result. The tag generation device 70 encrypts the value obtained by the exclusive OR (XOR) of the random number S_1 and the second message block M[2] with the encryption function E_K to obtain a random number S_2 as the encryption result.

[0023] The tag generation device 70 performs padding processing such as one-zero padding (ozp) on the message block M[3] which is the final message block, to obtain an n-bit bit sequence pad(M[3]) corresponding to the message block M[3]. Here, when |X| = n, pad(X) = X. Also, when |X| < n, pad(X) = X || 10...0.

[0024] The tag generation device 70 encrypts the value obtained by the exclusive logical sum of the random number S_2, the bit sequence pad(M[3]), and a predetermined mask value with the encryption function E_K. The tag generation device 70 acquires the obtained encryption result as the tag T. When |M[3]| = n, the predetermined mask value is, for example, 2L. When |M[3]| < n, the predetermined mask value is, for example, 4L.

[0025] When generating a tag by CMAC, if the number of message blocks is m, the number of calls to the encryption function E_K excluding the precomputation can be m. In the case of the example in Figure 2, the number of calls to the encryption function E_K is 3. That is, the number of calls to the encryption function E_K is represented by Equation 2 below. Note that ceil() is the ceiling function.

Equation

[0026] Here, it should be noted that even when the message M is an empty sequence, one call to the encryption function E_K is required. When generating a tag by PMAC, the number of calls to the encryption function E_K excluding the precomputation can also be m. When the number of calls to the encryption function E_K excluding the precomputation is represented by Equation 2, it can be said that the MAC process is "efficient". That is, when the number of calls to the encryption function E_K corresponds to the length of the message, it can be said that the MAC process is "efficient".

[0027] Here, a MAC in which data (data structure) consisting of multiple elements is input will be described. The data consisting of multiple elements is, for example, a vector, but is not limited to this. Below, an example in which the data consisting of multiple elements is a vector will be described. A vector is a list of any bit sequence. Note that a vector may include a null sequence. For example, a vector V of V=(ε,ε,001) is a vector consisting of three elements. Also, a vector V' of V'=(001) is a vector consisting of one element. Therefore, V ≠ V'. In other words, a null sequence is also a meaningful element in a vector. Therefore, V and V' need to be distinguished as data input to the MAC.

[0028] Now consider inputting a single bit sequence corresponding to a vector into a MAC. If we consider a bit sequence that is simply a concatenation of the elements of a vector, V=(0,0) and V'=(00) cannot be distinguished. Therefore, it is generally not secure to input a bit sequence that is simply a concatenation of the elements of a vector into a MAC. Therefore, a MAC that takes a vector as input (vector-input MAC) can be realized by using the function encode(V) that uniquely encodes (converts) a vector V into a single bit sequence.

[0029] Here, V = (V[1], V[2], V[3]). An example of encode(V) is encode(V) = (V[1] || len(V[1]) || V[2] || len(V[2]) || V[3] || len(V[3])). Here, "len(X)" is a fixed-length bit sequence that indicates the length information of the bit sequence X. The bit length of len(X) is a length that can represent the maximum bit length of each element of the vector. len() has a function to distinguish elements. In other words, len() indicates the position at which the element is concatenated in a single bit sequence after concatenation. Therefore, by adding len(), different tags can be generated for multiple vectors that are different when compared element by element but whose bit sequences appear to be the same when the elements are simply concatenated.

[0030] Here, in this method, the data length input to the MAC becomes longer than the sum of the bit lengths of the elements of the original vector by |len()| × the length of the elements. That is, if M=V[1]||V[2]||V[3], then |M|<|encode(V)|. Therefore, the number of calls to the encryption function E_K may be greater than the number shown in the above formula 2. That is, the number of message blocks obtained by dividing the input message into a predetermined length increases, so the number of calls to the encryption function E_K may increase. Therefore, the MAC by this method cannot be said to be efficient. This is more noticeable when the number of elements of the vector is large and further when there are many elements that are short compared to the maximum bit length. Here, as described above, for example, CMAC realizes an "efficient" bit sequence MAC, but if an attempt is made to apply CMAC to a vector input MAC by adding this len(), the efficiency may decrease.

[0031] Fig. 3 is a diagram for explaining an example of vector input MAC. Fig. 3 illustrates an outline of an operation related to vector input MAC to which CMAC is applied. Fig. 3 also illustrates an example in which a tag generation device 80 according to a second comparative example performs an operation related to vector input MAC to which CMAC is applied. Fig. 3 also illustrates an example in which vector input MAC is realized by a method called S2V (String-to-Vector) described in Non-Patent Document 1.

[0032] The tag generating device 80 generates a tag by inputting a vector X=(X_1, X_2, X_3, X_4). Here, f_K is a function that realizes a bit sequence MAC by CMAC using a key K as a parameter. Also, f_K inputs a bit sequence {0,1}^* of an arbitrary length and outputs a bit sequence {0,1}^n of a fixed length n. Also, f_K realizes a MAC by a block cipher. That is, as illustrated in FIG. 2, f_K generates n-bit random numbers by calling an encryption function E_K for each of m blocks into which an input vector element V[k] is divided into n bits. In this case, it should be noted that the vector element V[k] corresponds to the message M in FIG. 2. Note that, when the length of the vector element V[k] is not a multiple of n, f_K inputs n-bit sequence data obtained by performing padding on the last block to the encryption function E_K.

[0033] The tag generation device 80 inputs a bit sequence X_1 of an arbitrary length to f_K to obtain an n-bit bit sequence Y_1. Similarly, the tag generation device 80 inputs a bit sequence X_2 of an arbitrary length to f_K to obtain an n-bit bit sequence Y_2. Furthermore, the tag generation device 80 inputs a bit sequence X_3 of an arbitrary length to f_K to obtain an n-bit bit sequence Y_3. The tag generation device 80 obtains a random number S_1 by exclusive ORing the bit sequence Y_1 and a value obtained by performing a doubling operation (doubling operation on the finite field GF(2^n)) on f_K(0) obtained by inputting an initial value 0^n to f_K. The tag generation device 80 obtains a random number S_2 by exclusive ORing the bit sequence Y_2 and a value obtained by performing a doubling operation on the random number S_1. The tag generation device 80 obtains a random number S_3 by performing an exclusive OR between the value obtained by doubling the random number S_2 and a bit sequence Y_3.

[0034] If the bit length of the final element X_4 is n bits or more, the tag generation device 80 obtains T, the number of bits of |X_4|, by exclusive ORing the random number S_3 and the lowest n bits of the bit sequence X_4, as shown in the left diagram of Fig. 3. If the bit length of the final element X_4 is not n bits or more, the tag generation device 80 performs padding processing on the bit sequence X_4, as shown in the right diagram of Fig. 3. The tag generation device 80 obtains T by exclusive ORing the n-bit bit sequence X_4||10^* obtained in this way and the value obtained by performing doubling on the random number S_3. The tag generation device 80 inputs T to f_K to obtain an n-bit random number Z.

[0035] Here, in the process of vector input MAC, if the number of times that the encryption function E_K is called corresponds to the total length of each element of the vector, it can be said that the process of vector input MAC is efficient. In other words, in the process of vector input MAC, if the number of times that the encryption function E_K is called corresponds to the length of the bit sequence obtained by concatenating the elements of the vector, it can be said that the tag can be generated efficiently. However, in the second comparative example, depending on the data structure of the vector, there is a possibility that the MAC process cannot be performed efficiently. In other words, in the second comparative example, depending on the data structure of the vector, there is a possibility that the tag cannot be generated efficiently.

[0036] Specifically, for example, consider a case where vector V has n-1 elements, each of which is a single bit of "0", that is, V=(0,0,...,0). In the second comparative example, as described above, when the length of an element of an input vector in f_K is not a multiple of n, padding is performed on the element so that the length becomes a multiple of n bits. Then, in f_K, encryption function E_K is called for a bit sequence having a length of a multiple of n bits obtained by padding. In this case, if the length of the bit sequence obtained by padding is n x m bits, encryption function E_K is called m times in f_K. Therefore, in the second comparative example, in the above case, padding is performed on an element of one bit of "0" in one f_K, encryption function E_K is called once, and a bit sequence of n bits is obtained. Therefore, in the second comparative example, in the above case, encryption function E_K is called for vector V n-1 times, which is the number of times corresponding to the number of elements. On the other hand, in this case, suppose that V[1]||V[2]||···||V[n-1], which is a concatenation of the elements of vector V, is processed. In this case, since the bit length of V[1]||V[2]||···||V[n-1] is n-1 bits, which is shorter than n, the encryption function E_K is called only once in f_K. Therefore, when performing MAC processing in the second comparative example on vector V, each element of which is a single bit of "0", the number of times that the encryption function E_K is called may be greater than the number of times corresponding to the total length of each element of the vector. Therefore, in the second comparative example, when the length of the elements is short, such as V=(0,0,···,0), there is a possibility that MAC processing cannot be performed efficiently.

[0037] Furthermore, in the second comparative example, if the vector includes an element of an empty sequence, it is necessary to call the encryption function E_K once for that element. However, since the bit length of an element of an empty sequence can be considered to be 0, calling the encryption function E_K once for an element of an empty sequence is not efficient. That is, in the second comparative example, if the vector includes an element of an empty sequence, the number of times that the encryption function E_K is called may be greater than the number of times corresponding to the total length of each element of the vector. Therefore, in the second comparative example, if the vector includes an element of an empty sequence, it may not be possible to perform MAC processing efficiently.

[0038] For example, when the length of all elements of a vector is a multiple of n and each element is not an empty sequence, the second comparative example can also perform efficient MAC processing. When all elements of a vector are equal in length, that is, when all elements of a vector are a predetermined fixed length, it is possible to distinguish the elements of the vector even in a bit sequence in which the elements of the vector are simply concatenated without adding the above-mentioned len(). Therefore, when the length of all elements of a vector is a fixed length, it is possible to perform safe and efficient MAC processing even if the bit sequence in which the elements of the vector are concatenated is processed by CMAC. However, in the above-mentioned comparative example, if there is no such constraint on the elements of the input vector, there is a possibility that efficient MAC processing cannot be performed.

[0039] In contrast, as described below, in this embodiment, the following configuration allows efficient MAC processing of input data consisting of multiple elements. That is, the device according to this embodiment generates concatenated data by concatenating each element of input data consisting of multiple elements. Note that "input data consisting of multiple elements" is, for example, vector data consisting of multiple elements, but is not limited to this. In the following description, a case where the input data is vector data is described as appropriate.

[0040] Moreover, the device according to the present embodiment generates concatenation information regarding the concatenation of elements in each of a plurality of message blocks obtained by dividing concatenated data into pieces of a predetermined data length. The "predetermined data length" corresponds to the input bit length (n bits) of the block cipher. The "concatenation information" indicates how elements are concatenated in the corresponding message block. For example, the concatenation information may indicate at least the concatenation positions of elements in each of a plurality of message blocks. The concatenation information may also indicate the positions and number of elements that are null sequences in each of a plurality of message blocks. The concatenation information may also indicate at least the concatenation positions of elements for each position where elements can be concatenated in each of a plurality of message blocks. The concatenation information may also indicate the positions and number of elements that are null sequences for each position where elements can be concatenated in each of a plurality of message blocks. This will be described in detail later.

[0041] Moreover, the device according to the present embodiment generates a tag related to the message authentication code by using each of the multiple message blocks and linking information corresponding to each of the multiple message blocks using a block cipher. Moreover, the device according to the present embodiment may generate a tag by using a block cipher to generate a random number corresponding to each of the multiple message blocks using the linking information corresponding to the message block. This will be described in detail later. Here, the "block cipher" may be, for example, an encryption method using the encryption function E_K described above. Moreover, the "block cipher" may be a block cipher called the Tweakable Block Cipher (TBC) described above.

[0042] With the above configuration, in this embodiment, it is possible to generate tags efficiently regardless of the number of elements of the input data and the length of each element. In other words, in this embodiment, it is possible to generate tags efficiently even if the number of elements of the input data and the length of each element are variable. That is, the concatenated data according to this embodiment and the message blocks into which it is divided do not include information for distinguishing elements such as the above-mentioned len(). Therefore, the length of the concatenated data according to this embodiment, that is, the total length of the multiple message blocks, corresponds to the total length of the bit sequence of each element of the input data. Furthermore, when the input data includes an element of an empty sequence, if the length of the element of the empty sequence is set to 0 bits, the element of the empty sequence does not contribute to the number of concatenated data according to this embodiment and the message blocks into which it is divided. These are true regardless of the number of elements of the input data and the length of each element. In other words, the above is true even if no constraints are placed on the number of elements of the input data and the length of each element.

[0043] In addition, in this embodiment, when generating a tag by block cipher using a plurality of message blocks, linking information corresponding to each of the plurality of message blocks is used. This makes it possible to generate different tags for a plurality of input data (input vectors) that are different when compared element by element but whose bit sequences appear to be identical when the elements are simply linked. For example, assume that there are two message blocks that are identical in data sequence, with the first message block being composed of one element and the second message block being composed of two elements. In this case, the linking information corresponding to the first message block is different from the linking information corresponding to the second message block. Therefore, a random number obtained by block cipher using the linking information corresponding to the first message block may be different from a random number obtained by block cipher using the linking information corresponding to the second message block. In other words, a random number obtained by block cipher using the first message block and the corresponding linking information as a parameter may be different from a random number obtained by block cipher using the second message block and the corresponding linking information as a parameter. Therefore, a tag generated by using the first message block may be different from a tag generated by using the second message block. Therefore, security in vector input MAC is guaranteed. In other words, security in vector input MAC can be ensured without including information such as len() in the message block. Note that in this embodiment, the concatenated information itself is not encrypted by the block cipher. Therefore, in this embodiment, it is possible to prevent the length of the message processed (encrypted) by the block cipher from being longer than the length of the input data.

[0044] In this way, in this embodiment, the number of calls to the block cipher can be made according to the total length of the elements of the input data without compromising security in MAC processing, regardless of the number of elements and the length of each element. In other words, in this embodiment, the number of calls to the encryption function E_K when processing a vector V having elements V[k] (k=1, , r) by MAC, excluding pre-calculation, can be made the number of calls expressed by the following formula 3.

number

[0045] Here, formula 3 corresponds to a number obtained by dividing the bit length of the bit sequence V[1]||V[2]||···||V[r], which is obtained by concatenating the elements of the vector with the length of the null sequence being 0, by n, which is the input / output bit length of the encryption function E_K. In other words, formula 3 corresponds to the number of message blocks obtained by dividing the concatenated data (V[1]||V[2]||···||V[r]) every n bits. Therefore, it can be said that the method according to this embodiment has good efficiency in processing MAC for input data consisting of multiple elements. In other words, this embodiment makes it possible to generate tags efficiently regardless of the number of elements and the length of each element.

[0046] (Embodiment 1) Hereinafter, the embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and duplicate explanations are omitted as necessary.

[0047] FIG. 4 is a diagram showing a configuration of an authentication system 1 according to the present disclosure. The authentication system 1 includes a tag generation device 10 and a tag verification device 20. The tag generation device 10 and the tag verification device 20 may be physically integrated or may be separate. When the tag generation device 10 and the tag verification device 20 are physically separate from each other, the tag generation device 10 and the tag verification device 20 are connected to each other so as to be able to communicate with each other via wire or wirelessly. In addition, components of the tag generation device 10 described later may be realized by different devices. Similarly, components of the tag verification device 20 described later may be realized by different devices. In addition, in the example of communication in FIG. 1, the tag generation device 10 corresponds to a sender, and the tag verification device 20 corresponds to a receiver. That is, communication is performed between the tag generation device 10 and the tag verification device 20.

[0048] <Tag generator> 5 is a diagram illustrating a configuration example of a tag generation device 10 according to the present disclosure. The tag generation device 10 includes an input unit 100, a linking unit 110, a division unit 120, a link information generation unit 130, a tag generation unit 140, and an output unit 150.

[0049] The tag generation device 10 can be realized by, for example, an information processing device such as a computer. That is, the tag generation device 10 has an arithmetic device such as a CPU (Central Processing Unit) and a storage device such as a memory or a disk. The tag generation device 10 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0050] The input unit 100 functions as an input means. The linking unit 110 functions as a linking means. The division unit 120 functions as a division means. The linked information generation unit 130 functions as a linked information generation means. The tag generation unit 140 functions as a tag generation means. The output unit 150 functions as an output means.

[0051] The input unit 100 accepts input data V consisting of a plurality of elements. As described above, the input data is, for example, vector data. The input vector V (input data V) is expressed, for example, as V=(V[1], V[2], . . . , V[r]). Here, r is the number of elements of the input vector. The input unit 100 may be realized, for example, by an input device such as a keyboard. The input unit 100 may accept input of the input data V from, for example, an external device connected via a network. The input unit 100 outputs the input data V to the connection unit 110 and the connection information generation unit 130.

[0052] The concatenation unit 110 generates concatenated data by concatenating each element of the input data. Specifically, the concatenation unit 110 concatenates each element (V[k] (k=1, , r)) of the input vector V to generate a message M, which is a single bit sequence. Note that the "message M" corresponds to the "concatenated data." Here, M=V[1]||V[2]||···||V[r]. The concatenation unit 110 outputs the concatenated data (message M) to the division unit 120.

[0053] The division unit 120 divides the concatenated data into pieces of a predetermined data length to obtain a plurality of message blocks. As described above, the "predetermined data length" corresponds to the input bit length (n bits) of the block cipher. Specifically, the division unit 120 divides the message M into n-bit pieces as shown in the following formula 4.

number

[0054] Here, “parse_n(M)” is a function that divides message M into n-bit blocks. Furthermore, m is the number of message blocks. Therefore, M[m] is the final message block. As a result, division unit 120 obtains multiple message blocks M[1], M[2], ..., M[m]. Division unit 120 outputs the multiple message blocks to link information generation unit 130 and tag generation unit 140.

[0055] The connection information generating unit 130 generates connection information corresponding to each of the multiple message blocks. Specifically, the connection information generating unit 130 generates the connection information D[i] (i=1, . . . , m) according to the following formula 5. Note that the connection information D[i] indicates a separation (a break) between elements in the message block M[i]. Therefore, the connection information can also be called Cut-Point Information (CPI).

number

[0056] Here, extract(L(V)) is a function for generating link information. Note that L(V) indicates length information of each element of vector V. Specifically, extract(L(V)) takes the length of each element V[k] (k=1, , r) of vector V as input, and outputs link information D[i] corresponding to each message block M[i].

[0057] More specifically, the link information generating unit 130 may extract information by performing the following process using extract(L(V)). That is, the link information generating unit 130 adds the length (number of bits) of each element V[k] of the vector V in order, starting from V[1]. The link information generating unit 130 increments the index i of the message block M[i] every time the number of added bits becomes n bits. Here, the "i-th added n bits" corresponds to the message block M[i]. The link information generating unit 130 extracts the position where the element V[k] is switched in the i-th added n bits. In other words, the link information generating unit 130 extracts the link position of the element in the i-th added n bits. The link information generating unit 130 also extracts the position and number of null sequence elements in the i-th added n bits.

[0058] For example, |V[1]|=n1, |V[2]|=0, |V[3]|=n3. Here, n1 <n、n3<n、n1+n3> n. V[2] is an element of the null sequence. In this case, the "first added n bits" corresponds to the message block M[1]. The message block M[1] corresponds to a bit sequence obtained by concatenating all n1 bits of V[1], all 0 bits of V[2], and the leading n-n1 bits of V[3]. Therefore, the linked information generating unit 130 extracts the position of the n1th bit from the beginning in the first added n bits as the position where the element is switched. In addition, the linked information generating unit 130 extracts that there is one null sequence element at the position of the n1th bit from the beginning in the first added n bits. The linked information generating unit 130 generates linked information D[1] indicating the information extracted as described above.

[0059] The link information generating unit 130 generates link information D[i] for each message block M[i] as described above. A specific example of the link information D[i] will be described later. The link information generating unit 130 outputs the generated link information to the tag generating unit 140.

[0060] Here, in this embodiment, a vector space expressing an input vector (input data consisting of a plurality of elements) may be arbitrarily defined. For example, in the vector space, the maximum number of elements and the possible bit length of each element may be specified. For example, the possible bit length of each element may be defined as {8, 16,} for a byte sequence. Alternatively, the possible bit length of each element may be defined as {32, 64, 96,} for a 32-bit word sequence. Also, in the vector space, the length of an element of an empty sequence may be set to 0. In other words, the possible bit length of each element may include 0.

[0061] 6 and 7 are diagrams for explaining examples of concatenated information according to the present disclosure. FIG. 6 illustrates a case where the bit length of the concatenated data is a multiple of n. FIG. 7 illustrates a case where the bit length of the concatenated data is not a multiple of n. In the examples of FIG. 6 and FIG. 7, a vector space is defined in which n=128, the element length μ is a multiple of 32 including 0, and the maximum number of elements is Rmax. Note that μ can be interpreted as a word size. Also, Rmax can be approximately 2^n-1.

[0062] Also, a position where an element can be concatenated in a message block M[i], that is, a position where an element separator (gap) can exist in a message block M[i], is defined as a "concatenable position". If the number of concatenable positions in one message block M[i] is ω, then ω=n / 32=4. An element separator can exist at the 32nd, 64th, 96th, and 128th bit positions in the message block M[i]. That is, the 32nd, 64th, 96th, and 128th bit positions in the message block M[i] are concatenable positions. In the message block M[i], the 32nd bit position is the first concatenable position, the 64th bit position is the second concatenable position, the 96th bit position is the third concatenable position, and the 128th bit position is the fourth concatenable position. Note that in the case where the first element is an empty sequence, an element separator can also exist at the 0th bit position in the first message block M[1] in order to represent the element of the empty sequence. That is, in the message block M[i], the 0th bit position is the 0th concatenable position.

[0063] In this case, in the input vector V = (V[1], V[2], , V[k], , V[r]), if l_k is the length of element V[k], l_k is defined as follows:

number

[0064] Furthermore, the link information D[i] corresponding to the message block M[i] is defined as in the following Equation 7.

number

[0065] Here, j is the index of the concatenable position. α_j indicates whether there is an element separator at the j-th concatenable position and the number of elements of the empty sequence present at that position. In other words, α_j indicates whether an element concatenation (separator) actually exists at the j-th concatenable position and, if there is a concatenation, the number of elements of the empty sequence present consecutively at that position. ⊥ indicates a null value. If there is no element concatenation at the j-th concatenable position, α_j=⊥. Also, if there is an element concatenation at the j-th concatenable position but no element of the empty sequence, α_j=0. Also, if there is an element concatenation at the j-th concatenable position and there are x elements of the empty sequence at that position (x is an integer equal to or greater than 1), α_j=x. Also, α_0 indicates the number of elements of the empty sequence at the beginning of the vector V. Therefore, in D[i] (i>1), α_0=⊥.

[0066] Furthermore, b is an indicator showing whether the message block M[i] corresponding to D[i] is the last message block or not. When b=0, the message block M[i] corresponding to D[i] is not the last message block, and when b=1, the message block M[i] corresponding to D[i] is the last message block. In other words, when the number of message blocks M[i] is m, if i≠m, then b=0, and if i=m, then b=1.

[0067] In the example of FIG. 6, the input vector V includes seven elements V[1], V[2], . . . , V[7]. V[1], V[2], V[5], and V[7] are null sequences. The bit length of V[3] is 32 bits, the bit length of V[4] is 96 bits, and the bit length of V[6] is 256 bits. In this case, the bit length of the concatenated data M=V[1]||V[2]||. . . ||V[7] is 384 bits (=128×3), so the concatenated data (message M) is divided into three n-bit message blocks M[1], M[2], and M[3]. In this case, the concatenated information generating unit 130 uniquely generates concatenated information D[1], D[2], and D[3] as follows.

[0068] In the message block M[1], there are two null sequence elements V[1] and V[2] at the 0th concatenable position. In addition, in the message block M[1], there is a concatenation of V[3] and V[4] at the 1st concatenable position. In addition, there is one null sequence element V[5] at the 4th concatenable position. In other words, in the message block M[1], there is a concatenation of V[4] and V[5] at the 4th concatenable position, and V[5] is an element of a null sequence. Therefore, the concatenation information generating unit 130 generates concatenation information D[1] such that D[1]=(2,0,⊥,⊥,1,0).

[0069] In the message block M[2], there are no element connections at any of the connectable positions, so the connection information generator 130 generates connection information D[2] such that D[2]=(⊥,⊥,⊥,⊥,⊥,0).

[0070] In the message block M[3], there is no concatenation of elements at the first to third concatenable positions. Also, in the message block M[3], there is one empty sequence element V[7] at the fourth concatenable position. In other words, in the message block M[3], there is a concatenation of V[6] and V[7] at the fourth concatenable position, and V[7] is an empty sequence element. And the message block M[3] is the final message block. Therefore, the concatenation information generation unit 130 generates concatenation information D[3] such that D[3] = (⊥, ⊥, ⊥, ⊥, 1, 1).

[0071] In the example of FIG. 7, the input vector V includes ten elements V[1], V[2], ···, V

[10] . And V[1], V[2], V[5], V[7], V[9] are empty sequences. Also, the bit length of V[3] is 32 bits, the bit length of V[4] is 96 bits, the bit length of V[6] is 256 bits. Also, the bit length of V[8] is 32 bits, and the bit length of V

[10] is 64 bits. In this case, since the bit length of the concatenated data M = V[1]||V[2]||···||V

[10] is 480 bits (= 128×3 + 96), the concatenated data (message M) is divided into four message blocks M[1], M[2], M[3], M[4]. And M[4] < n. In this case, the concatenation information generation unit 130 uniquely generates concatenation information D[1], D[2], D[3], D[4] as follows.

[0072] For the message blocks M[1], M[2], the concatenation information generation unit 130 generates concatenation information D[1], D[2] similar to those in FIG. 6. Also, for the message block M[3], the concatenation state is substantially the same as in the case of FIG. 6, but it is not the final message block. Therefore, the concatenation information generation unit 130 generates concatenation information D[3] such that D[3] = (⊥, ⊥, ⊥, ⊥, 1, 0).

[0073] In the message block M[4], one null sequence element V[9] exists at the first concatenable position. In other words, in the message block M[4], a concatenation of V[8] and V[9] exists at the first concatenable position, and V[9] is an element of a null sequence. In addition, in the message block M[4], no element concatenation exists at the second concatenable position. In addition, in the message block M[4], the end of the final element V

[10] exists at the third concatenable position. That is, in the message block M[4], a break in V

[10] exists at the third concatenable position. In addition, in the message block M[4], there is no bit string at the fourth concatenable position, so no concatenation exists. And the message block M[4] is the final message block. Therefore, the concatenated information generating unit 130 generates concatenated information D[4] such that D[4]=(⊥,1,⊥,0,⊥,1).

[0074] In addition, in the concatenated information D[m] corresponding to the final message block M[m], the location where a value other than ⊥ appears at the end in the order of α_1 to α_ω corresponds to the end of the bit sequence in the final message block M[m]. In addition, in the concatenated information D[3] illustrated in FIG. 6, the location where a value other than ⊥ appears at the end is α_4 (=1). Therefore, it can be determined that the end of the bit sequence in the final message block M[3] corresponds to α_4, and therefore the length of the final message block M[3] is 128 bits. In addition, in the concatenated information D[4] illustrated in FIG. 7, the location where a value other than ⊥ appears at the end is α_3 (=0). Therefore, it can be determined that the end of the bit sequence in the final message block M[4] corresponds to α_3, and therefore the length of the final message block M[4] is 96 bits.

[0075] The tag generation unit 140 generates an authentication tag T. Specifically, the tag generation unit 140 generates the tag T by using each message block M[i] and linkage information D[i] corresponding to each message block M[i] using a block cipher. More specifically, the tag generation unit 140 generates the tag T by generating a random number corresponding to each message block M[i] using the linkage information D[i] corresponding to the message block M[i] using a block cipher.

[0076] More specifically, the tag generation unit 140 may generate the tag T by encrypting each message block M[i] with a block cipher using the linking information D[i] corresponding to the message block M[i]. In this case, the tag generation unit 140 may generate the tag T by encrypting each message block M[i] with a tweakable block cipher using the linking information D[i] corresponding to the message block M[i] as a tweak. As described later, the tag generation unit 140 obtains the encryption result obtained by processing the final message block M[m] with a block cipher as the tag T. The tag generation unit 140 outputs the generated authentication tag T to the output unit 150. This will be described in detail later.

[0077] Furthermore, the tag generation unit 140 may generate the tag T by sequentially processing a plurality of message blocks M[i] using the above-mentioned CMAC technique. That is, the tag generation unit 140 may encrypt each message block M[i] using a tweakable block cipher that uses the link information D[i] corresponding to the message block M[i] as a tweak. Then, the tag generation unit 140 may generate the tag T by performing a process of adding (XORing) the obtained encryption result to the next message block M[i+1]. This will be described in detail later.

[0078] Furthermore, the tag generation unit 140 may generate the tag T by processing a plurality of message blocks M[i] in parallel using the above-mentioned PMAC technique. That is, the tag generation unit 140 may encrypt each of the message blocks M[i] in parallel using a tweakable block cipher that uses the corresponding link information D[i] and the index i of the message block M[i] as a tweak. Then, the tag generation unit 140 may generate the tag T by adding (XORing) the obtained encryption results. This will be described in detail later.

[0079] Alternatively, the tag generation unit 140 may generate the tag T by a method similar to CMAC, without using a tweakable block cipher. That is, the tag generation unit 140 may generate the tag T by encrypting each message block M[i] by a block cipher and converting the obtained encryption result by using the link information D[i] corresponding to the message block M[i]. This will be described in detail later.

[0080] The output unit 150 performs control to output the input vector V (input data V) and the tag T. The output unit 150 may perform control to display the input vector V and the tag T on an output device such as a display. The output unit 150 may also perform control to output the input vector V and the tag T to an external device connected via a network, for example. For example, the output unit 150 transmits (V, T) to the tag verification device 20.

[0081] 8 to 11 are diagrams illustrating an outline of the calculation of the tag generating unit 140 according to the present disclosure. FIG. 8 illustrates an outline of the calculation when generating a tag T by the above-mentioned CMAC technique. FIG. 8 shows an example when a tag T is generated from an input vector V consisting of three elements V[1], V[2], and V[3]. The concatenation unit 110 concatenates the elements V[1], V[2], and V[3] to generate a message M that is a single bit sequence. Here, M=V[1]||V[2]||V[3]. In addition, the division unit 120 divides the message M into four message blocks M[1], M[2], M[3], and M[4]. Note that |M[1]|=|M[2]|=|M[3]|=n, and |M[4]|≦n.

[0082] The connection information generating unit 130 generates connection information D[1], D[2], D[3], and D[4] corresponding to the message blocks M[1], M[2], M[3], and M[4], respectively, as shown in Equation 5. The connection information D[1], D[2], D[3], and D[4] are information regarding the connection of elements in the message blocks M[1], M[2], M[3], and M[4], respectively. In other words, the connection information D[1], D[2], D[3], and D[4] may indicate the division of elements in the message blocks M[1], M[2], M[3], and M[4], respectively. For example, when the length of each element of the input vector V satisfies the above-mentioned Equation 6, the connection information generating unit 130 may generate the connection information D[1], D[2], D[3], and D[4] as illustrated in FIG. 6 and FIG. 7. In this case, the link information D[1], D[2], D[3], and D[4] can be expressed by Equation 7 above.

[0083] The tag generator 140 generates a tag T by sequentially processing a plurality of message blocks M[i] using the above-mentioned CMAC technique. Specifically, the tag generator 140 processes the first message block M[1] using a TBC function E_K ~Encrypt it to obtain a random number S_1 as the encryption result. The tag generation unit 140 encrypts the value obtained by the exclusive OR of the random number S_1 and the second message block M[2] using the TBC function E_K with the concatenation information D[2] as the Tweak. ~ Encrypt it to obtain a random number S_2 as the encryption result. Similarly, the tag generation unit 140 encrypts the value obtained by the exclusive OR of the random number S_i and the (i + 1)-th message block M[i + 1] using the TBC function E_K with the concatenation information D[i + 1] as the Tweak. ~ Thereby, the tag generation unit 140 obtains a random number S_(i + 1) as the encryption result. Then, the tag generation unit 140 encrypts the value obtained by the exclusive OR of the random number S_(m - 2) and the (m - 1)-th message block M[m - 1] using the TBC function E_K with the concatenation information D[m - 1] as the Tweak. ~ Thereby, the tag generation unit 140 obtains a random number S_(m - 1) as the encryption result. In this way, the tag generation unit 140 sequentially processes each message block M[i] (i = 1, ···, m - 1).

[0084] Then, the tag generation unit 140 performs padding processing on the message block M[m], which is the final message block, to obtain an n-bit bit sequence pad(M[m]) corresponding to the message block M[m]. Here, when |M[m]| = n, pad(M[m]) = M[m]. Also, when |M[m]| < n, pad(M[m]) = M[m]||10...0. The tag generation unit 140 encrypts the value obtained by the exclusive OR of the random number S_(m - 1), the bit sequence pad(M[m]), and a predetermined mask value using the TBC function E_K with the concatenation information D[m] as the Tweak. ~ Thereby, the tag generation unit 140 obtains a random number S_m as the encryption result. The tag generation unit 140 obtains this encryption result, the random number S_m, as the tag T. Note that the "predetermined mask value" is calculated using the value L. The "predetermined mask value" may be substantially the same as that illustrated using FIG. 2.

[0085] In the example of FIG. 8, the tag generating unit 140 pre-calculates the initial value 0^n by using a TBC function E_K ~ The tag generator 140 encrypts the first message block M[1] with a TBC function E_K ~ The tag generator 140 encrypts the random number S_1 and obtains a random number S_1 as the encryption result. The tag generator 140 converts the value obtained by exclusive ORing the random number S_1 and the second message block M[2] into a TBC function E_K using the link information D[2] as a tweak. ~ The tag generating unit 140 encrypts the random number S_2 and obtains a random number S_2 as the encryption result. The tag generating unit 140 converts the value obtained by exclusive ORing the random number S_2 and the third message block M[3] into a TBC function E_K using the link information D[3] as a tweak. ~ and obtains a random number S_3 as the encryption result.

[0086] Then, the tag generator 140 performs padding on the message block M[4], which is the final message block, to obtain an n-bit bit sequence pad(M[4]) corresponding to the message block M[4]. The tag generator 140 calculates a value obtained by exclusive ORing the random number S_3, the bit sequence pad(M[4]), and a predetermined mask value (2L or 4L) using the TBC function E_K using the link information D[4] as a tweak. ~ and obtains a random number S_4 as the encryption result. The tag generation unit 140 obtains this encryption result S_4 as the tag T. Note that if the linkage information D[m] corresponding to the final message block M[m] includes information for distinguishing whether the number of bits of the final message block M[m] is n bits or not, there is no need to generate a predetermined mask value.

[0087] FIG. 9 is a diagram for explaining an example of a method for realizing the tweakable block cipher illustrated in FIG. 8 by a block cipher. FIG. 9 illustrates a method for realizing the tweakable block cipher by a block cipher (encryption function E_K) by a method substantially similar to the XEX mode described in Non-Patent Document 2. Note that the method for realizing the tweakable block cipher by a block cipher is not limited to the method illustrated in FIG. 9. Furthermore, the tweakable block cipher illustrated in FIG. 8 may be realized by a method other than the method using a block cipher. For example, the tweakable block cipher may be realized by the technique described in Non-Patent Document 4.

[0088] Specifically, when performing a process of encrypting the message block M[i] by a tweakable block cipher using the linkage information D[i] as a tweak, the tag generation unit 140 may perform the following process. That is, the tag generation unit 140 inputs a value obtained by exclusive ORing the message block M[1] and the mask value Δ corresponding to the linkage information D[1] to the encryption function E_K. As a result, the tag generation unit 140 obtains a random number S_1, which is the encryption result. Note that for i≧2, the tag generation unit 140 inputs a value obtained by exclusive ORing the mask value Δ corresponding to the message block M[i] and the linkage information D[i] and the random number S_(i-1), to the encryption function E_K. As a result, the tag generation unit 140 obtains a random number S_i, which is the encryption result.

[0089] Here, the tag generation unit 140 may generate a mask value Δ corresponding to the linked information D[i] as follows. The following formula 8 shows an example of the mask value Δ corresponding to the linked information D[i]. The tag generation unit 140 calculates the mask value Δ expressed by the following formula 8 for each D[i] in the above formula 7. In formula 8, the symbol "+" in a circle indicates exclusive OR (XOR).

number

[0090] For example, when D[1]=(2,0,⊥,⊥,1,0), the mask value Δ corresponding to D[1] is expressed by the following Equation 9.

number

[0091] For example, if D[2]=(⊥,⊥,⊥,⊥,⊥,0), the mask value Δ corresponding to D[2] is n-bit all-zero (0^n). For example, if D[3]=(⊥,⊥,⊥,⊥,1,1), the mask value Δ corresponding to D[3] is expressed by the following formula 10.

number

[0092] Furthermore, for example, when D[4]=(⊥,1,⊥,0,⊥,1), the mask value Δ corresponding to D[4] is expressed by the following Equation 11.

number

[0093] The tag generating unit 140 may calculate L_j (j=0, 1, . . . , ω, ω+1) in advance. L_j is expressed by, for example, the following formula 12.

number

[0094] Note that L_j may be calculated by encrypting an arbitrary constant that is different for each j with the encryption function E_K. For example, L_j may be obtained by encrypting the index j itself, that is, "j", with the encryption function E_K as shown in Equation 9. Alternatively, for example, L_j may be obtained by encrypting "j+N" (N is an arbitrary constant) with the encryption function E_K. Alternatively, for example, L_j may be obtained by encrypting "j*N" with the encryption function E_K.

[0095] Furthermore, the tag generating unit 140 calculates 2^(α_j)L_j for each α_j of D[i] as shown in Equation 8. Here, "2" is a generator on the finite field GF(2^n). Furthermore, "2L" is a generator multiplication on the finite field GF(2^n). Therefore, "2^(α_j)L_j" is a generator multiplication on the finite field GF(2^n). That is, "2^(α_j)L_j" corresponds to repeating the process of "2L_j" (doubling) α_j times. For example, when α_j=1, "2^(α_j)L_j" corresponds to shifting L_j, which is an n-bit bit sequence, to the left by one bit. Specifically, when the most significant bit of L_j is 0, "2^(α_j)L_j" corresponds to shifting L_j to the left by one bit. Also, when the most significant bit of L_j is 1, "2^(α_j)L_j" corresponds to a value obtained by exclusive ORing a value obtained by shifting L_j left by 1 bit with a predetermined constant cst. The constant cst is a certain n-bit value determined by the definition of GF(2^n). Such generator multiplication on the finite field GF(2^n) can be realized by a very simple process compared to one process of a block cipher. Furthermore, the calculation of the mask value Δ shown in Equation 8 can be performed sequentially from the first element of the input vector. Therefore, the calculation of the mask value Δ corresponding to the link information D[i] can be efficiently performed without excessively using the load of the computational resources. The same applies to the example of FIG. 10 described later.

[0096] Also, as described above, since "2^(α_j)L_j" is a generator multiplication on the finite field GF(2^n), if α_j is 2^n-1 or less, "2^(α_j)L_j" will be different values ​​for different α_j. Therefore, in consideration of safety, α_j only needs to be 2^n-1 or less. Here, when all elements are null sequences, α_j will be the maximum possible value. That is, the maximum value of α_j will be Rmax. Therefore, in the first embodiment, Rmax can be set to 2^n-1. In this way, in the first embodiment, the number of elements can be set to an extremely large number of 2^n-1. The same applies to the example of FIG. 10 described later.

[0097] FIG. 10 illustrates an outline of the calculation when generating the tag T by the above-mentioned PMAC method. In the example of FIG. 10, similar to the example of FIG. 8, the division unit 120 divides the message M into four message blocks M[1], M[2], M[3], and M[4]. Also, similar to the example of FIG. 8, the link information generation unit 130 generates link information D[1], D[2], D[3], and D[4] corresponding to the message blocks M[1], M[2], M[3], and M[4], respectively, as shown in Equation 5. Here, as described above, when the length of each element of the input vector V satisfies the above-mentioned Equation 6, the link information generation unit 130 may generate link information D[1], D[2], D[3], and D[4] as illustrated in FIG. 6 and FIG. 7. In this case, the link information D[1], D[2], D[3], and D[4] can be expressed by the above-mentioned Equation 7.

[0098] The tag generator 140 generates the tag T by processing multiple message blocks M[i] in parallel using the above-mentioned PMAC technique. Specifically, for i=1, . . . , m-1, the tag generator 140 processes the i-th message block M[i] using a TBC function E_K that uses the pair (i, D[i]) of link information D[i] and index “i” as a tweak. ~As a result, the tag generation unit 140 obtains a random number S_i as the encryption result. Then, the tag generation unit 140 encrypts the message block M[m-1] using a TBC function E_K ~ and obtains a random number S_(m-1) as the encryption result. In this manner, tag generation unit 140 processes each message block M[i] (i=1, . . . , m-1) in parallel.

[0099] The tag generation unit 140 also obtains a random number Z_(m-1) by exclusive ORing the initial value 0^n and the random numbers S_1,...,S_(m-1). The tag generation unit 140 also performs padding on the message block M[m], which is the final message block, to obtain an n-bit bit sequence pad(M[m]) corresponding to the message block M[m]. The tag generation unit 140 also uses the value obtained by exclusive ORing the random number Z_(m-1) and the bit sequence pad(M[m]) as a TBC function E_K that uses the pair (m,D[m]) of the link information D[m] and the index "m" as a tweak. ~ As a result, the tag generation unit 140 obtains a random number S_m as the encryption result. The tag generation unit 140 obtains the random number S_m, which is the encryption result, as the tag T.

[0100] In the example of FIG. 10, the tag generating unit 140 converts the first message block M[1] into a TBC function E_K that uses the pair (1, D[1]) of the link information D[1] and the index “1” as a tweak. ~ The tag generating unit 140 encrypts the second message block M[2] with a TBC function E_K that uses the pair (2,D[2]) of the link information D[2] and the index “2” as a tweak. ~ The tag generating unit 140 encrypts the third message block M[3] with a TBC function E_K that uses the pair (3,D[3]) of the link information D[3] and the index “3” as a tweak. ~and obtains a random number S_3 as the encryption result.

[0101] The tag generation unit 140 also obtains a random number Z_1 by exclusive ORing the initial value 0^n and a random number S_1. The tag generation unit 140 also obtains a random number Z_2 by exclusive ORing the random number Z_1 and a random number S_2. The tag generation unit 140 also obtains a random number Z_3 by exclusive ORing the random number Z_2 and a random number S_3.

[0102] The tag generator 140 also performs padding on the message block M[4], which is the final message block, to obtain an n-bit bit sequence pad(M[4]) corresponding to the message block M[4]. The tag generator 140 then performs padding on the message block M[4], which is the final message block, to obtain an n-bit bit sequence pad(M[4]). The tag generator 140 then performs padding on the n-bit bit sequence pad(M[4]) obtained by exclusive ORing the random number Z_3 and the bit sequence pad(M[4]), using the pair (4,D[4]) of the link information D[4] and the index "4" as a tweak using the TBC function E_K ~ As a result, the tag generation unit 140 obtains a random number S_4 as the encryption result. The tag generation unit 140 obtains this encryption result S_4 as the tag T.

[0103] Here, the tweakable block cipher illustrated in FIG. 10 may be realized by a method using a block cipher, such as the technique of Non-Patent Document 2. Alternatively, the tweakable block cipher illustrated in FIG. 10 may be realized by a method other than the method using a block cipher, such as the technique of Non-Patent Document 4. When the tweakable block cipher illustrated in FIG. 10 is realized by a block cipher, the tweakable block cipher may be realized by a block cipher by a method substantially similar to the XEX mode described in Non-Patent Document 2. In this case, similar to the example shown in FIG. 9, the tag generation unit 140 inputs a value obtained by exclusive ORing the message block M[i] and the mask value Δ corresponding to the pair (i, D[i]) of the link information D[i] and the index i to the encryption function E_K. As a result, the tag generation unit 140 obtains the random number S_i, which is the encryption result.

[0104] Here, the tag generation unit 140 may generate a mask value Δ corresponding to (i, D[i]) used as Tweak as shown in the following formula 13. The following formula 13 shows an example of the mask value Δ corresponding to (i, D[i]). The tag generation unit 140 calculates the mask value Δ expressed by the following formula 13 for each D[i] in the above formula 7.

number

[0105] Here, the tag generating unit 140 may calculate L_# by pre-calculation, for example, according to the following formula 14.

number

[0106] For example, when D[1]=(2,0,⊥,⊥,1,0), the mask value Δ corresponding to (1,D[1]) is expressed by the following Equation 15.

number

[0107] For example, if D[2]=(⊥,⊥,⊥,⊥,⊥,0), the mask value Δ corresponding to (2,D[2]) is 2L_#. For example, if D[3]=(⊥,⊥,⊥,⊥,1,1), the mask value Δ corresponding to D[3] is expressed by the following formula 16.

number

[0108] Furthermore, for example, when D[4]=(⊥,1,⊥,0,⊥,1), the mask value Δ corresponding to D[4] is expressed by the following Equation 17.

number

[0109] Fig. 11 illustrates an outline of a calculation when generating a tag T without using a tweakable block cipher by a method similar to the above-mentioned CMAC. Fig. 11 may use a function f substantially similar to the function described in Non-Patent Document 3. The function f linearly transforms the encryption result obtained by encrypting a message block M[i] with an encryption function E_K, using the link information D[i] as a parameter. The function f will be described later.

[0110] In the example of FIG. 11, similarly to the example of FIG. 8, the concatenation unit 110 concatenates elements V[1], V[2], and V[3] to generate a message M that is a single bit sequence. The division unit 120 divides the message M into four message blocks M[1], M[2], M[3], and M[4]. In addition, the link information generation unit 130 generates link information D[1], . . . , D[m-2] corresponding to the message blocks M[1], . . . , M[m-2], respectively, as shown in Equation 5. In the example of FIG. 11, the link information generation unit 130 generates link information D[1] and D[2] corresponding to the message blocks M[1] and M[2], respectively, as shown in Equation 5. Here, as described above, when the length of each element of the input vector V satisfies the above-mentioned Equation 6, the link information generation unit 130 may generate link information D[1] and D[2] as shown in FIG. 6 and FIG. 7. In this case, the link information D[1] and D[2] can be expressed by Equation 7 above.

[0111] Furthermore, the connection information generating unit 130 generates connection information D[m-1] corresponding to the message block M[m-1] and the final message block M[m]. That is, the connection information D[m-1] may indicate the division of elements in the message blocks M[m-1] and M[m]. In the example of FIG. 11, the connection information generating unit 130 generates connection information D[3] corresponding to the message blocks M[3] and M[4]. That is, the connection information D[3] may indicate the division of elements in the message blocks M[3] and M[4]. When the length of each element of the input vector V satisfies the above-mentioned formula 6, the connection information D[3] may include α_j for two blocks for the message blocks M[3] and M[4].

[0112] The tag generation unit 140 encrypts the first message block M[1] using the encryption function E_K to obtain a random number S_1, which is the encryption result. The tag generation unit 140 generates a random number Z_1 using a function f that takes the random number S_1 as an input and has the linkage information D[1] as a parameter. The tag generation unit 140 also encrypts a value obtained by exclusive-ORing the random number Z_1 and the second message block M[2] using the encryption function E_K to obtain a random number S_2, which is the encryption result. The tag generation unit 140 generates a random number Z_2 using a function f that takes the random number S_2 as an input and has the linkage information D[2] as a parameter.

[0113] Similarly, the tag generation unit 140 encrypts a value obtained by exclusive ORing the random number Z_(i-1) and the next message block M[i] using the encryption function E_K to obtain a random number S_i that is the encryption result. The tag generation unit 140 generates a random number Z_i using a function f that takes the random number S_i as an input and has the link information D[i] as a parameter. Then, the tag generation unit 140 encrypts a value obtained by exclusive ORing the message block M[m-1] and the random number S_(m-2) using the encryption function E_K to obtain a random number S_(m-1) that is the encryption result. The tag generation unit 140 generates a random number Z_(m-1) using a function f that takes the random number S_(m-1) as an input and has the link information D[m-1] as a parameter. In this way, the tag generation unit 140 sequentially processes each message block M[i] (i=1,...,m-1).

[0114] Then, the tag generation unit 140 performs padding on the message block M[m], which is the final message block, to obtain an n-bit bit sequence pad(M[m]) corresponding to the message block M[m]. The tag generation unit 140 encrypts a value obtained by exclusive-ORing the random number Z_(m-1) and the bit sequence pad(M[m]) using the encryption function E_K, and obtains a random number S_m as the encryption result. The tag generation unit 140 obtains the random number S_m, which is the encryption result, as the tag T.

[0115] In the example of FIG. 11, the tag generation unit 140 encrypts the first message block M[1] using the encryption function E_K to obtain a random number S_1, which is the encryption result. The tag generation unit 140 generates a random number Z_1 using a function f that takes the random number S_1 as an input and has the link information D[1] as a parameter. The tag generation unit 140 also encrypts a value obtained by exclusive-ORing the random number Z_1 and the second message block M[2] using the encryption function E_K to obtain a random number S_2, which is the encryption result. The tag generation unit 140 generates a random number Z_2 using a function f that takes the random number S_2 as an input and has the link information D[2] as a parameter. The tag generation unit 140 also encrypts a value obtained by exclusive-ORing the message block M[3] and the random number Z_2 using the encryption function E_K to obtain a random number S_3, which is the encryption result. The tag generating unit 140 receives the random number S_3 as an input and generates a random number Z_3 using a function f having the link information D[3] as a parameter.

[0116] Then, the tag generation unit 140 performs padding on the message block M[4], which is the final message block, to obtain an n-bit bit sequence pad(M[4]) corresponding to the message block M[4]. The tag generation unit 140 encrypts a value obtained by exclusive-ORing the random number Z_3 and the bit sequence pad(M[4]) using the encryption function E_K, and obtains a random number S_4 as the encryption result. The tag generation unit 140 obtains the random number S_4, which is the encryption result, as the tag T.

[0117] Here, the function f(D,S) may be a function that performs cyclic permutation (cyclic shift) on the bit sequence S by the number of bits corresponding to D. Here, the "number of bits corresponding to D[i]" is obtained by associating a predetermined integer value with each pattern of the link information D[i]. That is, link information D[i] of different patterns is associated with different integer values. For example, the link information pattern "(⊥,⊥,⊥,⊥,⊥,0)" illustrated in FIG. 7 may be mapped to the integer value "0". Also, for example, the link information pattern "(⊥,⊥,⊥,⊥,1,0)" illustrated in FIG. 7 may be mapped to the integer value "1". Also, for example, the link information pattern "(2,0,⊥,⊥,1,0)" illustrated in FIG. 7 may be mapped to the integer value "2".

[0118] Here, since the number of bits of the bit sequence S is n bits, when the bit sequence S is cyclically shifted by n bits, it returns to the original bit sequence S. Therefore, the number of bits that can be cyclically shifted on the bit sequence S is less than n. Therefore, the number of patterns of the linked information must be at most n ways. That is, each pattern of the linked information must be mapped to any of the integers 0 to n-1. In other words, it is necessary that the vector space of the input vector V (the length and number of elements of each element) is not complicated to the extent that each pattern of the linked information is mapped to any of the integers 0 to n-1. For example, if the number of elements of the null sequence is huge, the number of patterns of the linked information may exceed n, so that the method illustrated in FIG. 11 may not be adopted. On the other hand, for example, if the vector space of the input vector V is a vector space in which there are no elements of the null sequence, the length of the elements is a multiple of 32 bits, and n=128, the number of patterns of the linked information will not exceed n. Therefore, the method illustrated in FIG. 11 can be adopted.

[0119] In this way, the method illustrated in FIG. 11 has restrictions on the vector space, that is, the pattern of link information. On the other hand, the method illustrated in FIG. 11 does not require the pre-calculation (calculation of mask value and calculation of L required for the calculation) required in the methods illustrated in FIG. 8 to FIG. 10. Therefore, the method illustrated in FIG. 11 can reduce memory consumption for storing values ​​calculated by pre-calculation, compared with the methods illustrated in FIG. 8 to FIG. 10. In other words, when the configuration of the vector space of the input vector V is not complicated and therefore the number of patterns of link information is small, memory consumption can be reduced by generating tags using the method illustrated in FIG. 11.

[0120] The function f is expressed, for example, by using the following formula 18. Formula 18 corresponds to the technique disclosed in Non-Patent Document 3.

number

[0121] Here, p is a prime number less than n, and satisfies the condition that 2 is a "primitive root modulo p". In other words, p is a prime number less than n such that 2 is a primitive root modulo p. Also, msb_p(x) indicates the left p bits of bit sequence x, that is, the upper p bits of bit sequence x. Also, rot_a(x) indicates that the bit sequence x is cyclically shifted left by a bits. Also, rot_D[i](S) indicates that the bit sequence S is cyclically shifted left by an integer value corresponding to D[i]. Here, the "integer value corresponding to D[i]" is obtained by associating a predetermined integer value with each pattern of the concatenated information D[i], as described above.

[0122] Furthermore, in the function f illustrated in Equation 18, p is a prime number less than n (for example, the largest prime number less than n), and a cyclic shift is performed on the upper p bits, and the lower (np) bits are set to "0". In this case, each pattern of D[i] needs to be mapped to an integer 0 to p-1. By doing so, f(*,S) becomes AXU (Almost XOR universal). That is, f(X,S)+f(X',S) becomes an almost uniform random number for any X≠X'. Here, "+" indicates exclusive OR. Also, X corresponds to an integer associated with each pattern of the link information. When the function f satisfies such conditions, the vector input MAC illustrated in FIG. 11 becomes secure by the technology disclosed in Non-Patent Document 3.

[0123] <Tag Verification Device> 12 is a diagram illustrating a configuration of a tag verification device 20 according to the present disclosure. The tag verification device 20 includes an input unit 200, a linking unit 210, a division unit 220, a link information generation unit 230, a tag generation unit 240, and a tag verification unit 250.

[0124] The tag verification device 20 can be realized by, for example, an information processing device such as a computer. That is, the tag verification device 20 has an arithmetic device such as a CPU, and a storage device such as a memory or a disk. The tag verification device 20 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0125] The input unit 200 functions as an input means. The linking unit 210 functions as a linking means. The division unit 220 functions as a division means. The linked information generation unit 230 functions as a linked information generation means. The tag generation unit 240 functions as a tag generation means. The tag verification unit 250 functions as a tag verification means.

[0126] The input unit 200 accepts the input data V (input vector V) and the authentication tag T transmitted from the tag generation device 10. The input unit 200 may be realized by an input device such as a keyboard. The input unit 200 may accept input of the input data V and the authentication tag T from an external device connected via a network, for example. The input unit 200 outputs the input data V to the linking unit 210 and the link information generating unit 230. The input unit 200 outputs the authentication tag T to the tag verification unit 250.

[0127] The concatenation unit 210 performs substantially the same processing as the concatenation unit 110 described above. That is, the concatenation unit 210 generates concatenated data by concatenating each element of the input data (input vector V). Specifically, the concatenation unit 210 concatenates each element (V[k] (k=1, . . . , r)) of the input vector V to generate a message M (concatenated data) that is a single bit sequence. The concatenation unit 210 outputs the concatenated data (message M) to the division unit 220.

[0128] The division unit 220 performs substantially the same processing as the division unit 120 described above. That is, the division unit 220 divides the concatenated data into pieces of a predetermined data length (n bits) to obtain a plurality of message blocks. Specifically, the division unit 220 divides the message M every n bits as shown in the above-mentioned formula 4. In this way, the division unit 220 obtains a plurality of message blocks M[1], M[2], . . . , M[m]. The division unit 220 outputs the plurality of message blocks to the concatenated information generation unit 230 and the tag generation unit 240.

[0129] The link information generating unit 230 performs substantially the same process as the link information generating unit 130 described above. That is, the link information generating unit 230 generates link information (CPI) corresponding to each of a plurality of message blocks. Specifically, the link information generating unit 230 generates link information D[i] (i=1, . . . , m) corresponding to the message block M[i] according to the above-mentioned formula 5. The link information generating unit 230 may generate link information as exemplified in FIG. 6 and FIG. 7, similar to the link information generating unit 130. The link information generating unit 230 outputs the generated link information to the tag generating unit 240.

[0130] The tag generator 240 performs substantially the same process as the tag generator 140 described above to generate a verification tag T * Specifically, the tag generating unit 240 generates a tag T by using each message block M[i] and link information D[i] corresponding to each message block M[i] through a block cipher. * More specifically, the tag generating unit 240 generates a tag T by generating a random number corresponding to each message block M[i] using the link information D[i] corresponding to the message block M[i] by block encryption. * Generate.

[0131] More specifically, the tag generating unit 240 encrypts each message block M[i] by using the link information D[i] corresponding to the message block M[i] with a block cipher to generate the tag T * In this case, the tag generating unit 240 may generate a tag T by encrypting each message block M[i] by a tweakable block cipher that uses the link information D[i] corresponding to the message block M[i] as a tweak. * The tag generating unit 240 may generate a verification tag T by the method illustrated in FIGS. * The tag generating unit 240 may generate the generated verification tag T * to the tag verification unit 250.

[0132] The tag verification unit 250 verifies the tag T generated by the tag generation unit 240. * The tag verification unit 250 compares the tag T for authentication generated by the tag generation device 10 to verify whether or not it has been tampered with. Then, the tag verification unit 250 performs control to output information based on the verification result. * The presence or absence of tampering is verified by comparing the input authentication tag T with the tag verification unit 250. Then, the tag verification unit 250 performs control to output the verification result.

[0133] Specifically, the tag verification unit 250 detects an authentication tag T and a verification tag T * Then, the tag verification unit 250 compares the verification tag T * If the tag for authentication T matches the tag for authentication T, the tag verification unit 250 determines that the authentication has been successful. If the authentication has been successful, the tag verification unit 250 performs control to output the input vector V (message M). * does not match the authentication tag T, the tag verifying unit 250 determines that the authentication has failed. If the authentication has failed, the tag verifying unit 250 performs control to output an error message indicating that the authentication has failed.

[0134] <Tag generation method and tag verification method> Next, the operation of the authentication system 1 according to the present disclosure will be described with reference to Fig. 13 and Fig. 14. Fig. 13 is a flowchart showing the tag generation method executed by the tag generation device 10 according to the present disclosure.

[0135] As described above, the input unit 100 inputs a vector V (step S102). As described above, the concatenation unit 110 concatenates elements of the vector V to generate a message M (concatenated data) that is a single bit sequence (step S104). As described above, the division unit 120 divides the message M into n-bit message blocks M[i] (i=1, . . . , m) (step S106).

[0136] As described above, the link information generating unit 130 generates link information D[i] corresponding to the message block M[i] (step S108). As described above, the tag generating unit 140 generates a tag T for authentication by using each message block M[i] and the link information D[i] corresponding to each message block M[i] through block encryption (step S110). As described above, the output unit 150 outputs the vector V and the tag T (step S112).

[0137] 14 is a flowchart showing a tag verification method executed by the tag verification device 20 according to the present disclosure. As described above, the input unit 200 inputs a vector V and an authentication tag T (step S202). As described above, the concatenation unit 210 concatenates elements of the vector V to generate a message M (concatenated data) that is a single bit sequence (step S204). As described above, the division unit 220 divides the message M into n-bit message blocks M[i] (i=1, . . . , m) (step S206).

[0138] The link information generating unit 230 generates link information D[i] corresponding to the message block M[i] as described above (step S208). The tag generating unit 240 generates a verification tag T[i] by block encryption using each message block M[i] and the link information D[i] corresponding to each message block M[i] as described above. * (Step S210).

[0139] The tag verification unit 250 is a tag for verification T * It is determined whether the tag for verification T matches the tag for authentication T (step S220). * If the vector V matches the tag T for authentication (YES in S220), the tag verification unit 250 determines that the pair of the input vector V and tag T is correct (step S222). * does not match the authentication tag T (NO in S220), the tag verification unit 250 determines that the input pair of vector V and tag T is forged (step S224).

[0140] <Effects> The effects of the authentication system 1 according to the first embodiment will be described below. Although the effects of the tag generation device 10 will be described below, the same effects can be achieved in the tag verification device 20. This also applies to the other embodiments.

[0141] As described above, the tag generation device 10 according to the first embodiment concatenates elements of an input vector V (input data) consisting of a plurality of elements to generate a message M that is a single bit sequence. The tag generation device 10 also divides the message M into n-bit message blocks M[i]. The tag generation device 10 also generates concatenation information D[i] that corresponds to the message block M[i] and is information on the concatenation of elements in the message block M[i]. The tag generation device 10 then generates a tag using the message block M[i] and the corresponding concatenation information D[i] by block encryption. This allows the tag generation device 10 according to the first embodiment to efficiently generate tags without relying on the definition of a vector space. That is, the tag generation device 10 according to the first embodiment can efficiently generate tags regardless of the number of elements of the input vector V (input data) and the length of each element. Specifically, the tag generation device 10 according to the first embodiment can set the number of calls of the encryption function E_K to the number of times expressed by the above-mentioned formula 3, except for pre-calculation.

[0142] The above-mentioned method of adding len() indicating the length information of each element after each element when generating a single bit sequence by concatenating the elements of the input vector V is compared with the method according to the first embodiment. In the method of adding len(), the data length input to the MAC is longer than the sum of the bit lengths of each element of the original vector by |len()| × the number of elements. Specifically, if the length of len() corresponding to one element is c*n bits, the data length input to the MAC is longer by r*c*n bits compared to the sum of the bit lengths of each element of the input vector V. Note that c∈(0,1) and r is the number of elements. In this case, the number of message blocks processed by the block cipher is larger by the number corresponding to (r*c*n) / n=r*c (i.e., ceil(r*c)) compared to the case where a message obtained by simply concatenating each element of the input vector V is processed by the MAC. Therefore, the number of times the encryption function E_K is called is greater than the number according to the length of the message obtained by simply concatenating each element of the input vector V (the number shown in the above formula 3) by a number corresponding to r*c.

[0143] In contrast, in the tag generation device 10 according to the first embodiment, the message processed by the MAC corresponds to a simple concatenation of each element of the input vector V. That is, the tag generation device 10 according to the first embodiment divides the message obtained by simply concatenating each element of the input vector V into n bits, and processes the divided message blocks by block encryption. Therefore, in the method according to the first embodiment, the number of calls to the encryption function E_K can be reduced by the number of calls corresponding to r*c, compared to the method of adding len() as described above. And since the value of r*c increases as the number of elements r increases, the reduction effect of the method according to the first embodiment is greater as the number of elements r increases. Therefore, the method according to the first embodiment makes it possible to generate tags efficiently.

[0144] Also, the length of len() is constant regardless of the length of the elements. Therefore, in the method of adding len() as described above, when the number of elements is short, the relative length of len() with respect to that element becomes large. Thus, in the method according to Embodiment 1, the shorter the number of elements, the greater the reduction in the number of calls to the encryption function E_K for the message obtained by simply concatenating each element of the input vector V, compared to the method of adding len() as described above. Specifically, for example, assume that the input vector V is composed of n elements each with a length of 1 bit. In this case, the length of the message obtained by simply concatenating each element of the input vector V is n bits, whereas in the method of adding len() it becomes even longer by |len()|*n = c*n*n bits. In this case, in the method according to Embodiment 1, the number of calls to the encryption function E_K is 1, whereas in the method of adding len() the number of calls to the encryption function E_K increases by an additional number corresponding to c*n. That is, in the method according to Embodiment 1, the number of calls to the encryption function E_K can be made approximately 1 / (1 + c*n) compared to the method of adding len().

[0145] On the other hand, for example, assume that the input vector V is composed of n elements each with a length of n bits. In this case, the length of the message obtained by simply concatenating each element of the input vector V is n*n bits, whereas in the method of adding len() it becomes even longer by |len()|*n = c*n*n bits. In this case, in the method according to Embodiment 1, the number of calls to the encryption function E_K is n, whereas in the method of adding len() the number of calls to the encryption function E_K increases by an additional number corresponding to c*n. That is, in the method according to Embodiment 1, the number of calls to the encryption function E_K can be made approximately n / (n + c*n) compared to the method of adding len(). Here, since 1 / (1 + c*n) < n / (n + c*n), it can be said that the effect of reducing the number of calls to the encryption function E_K in the method according to Embodiment 1 is higher the more short elements there are. Therefore, in the method according to Embodiment 1, it becomes possible to efficiently generate tags.

[0146] Furthermore, in the method according to the first embodiment, the presence of an element of an empty sequence does not affect the length of a message processed by a block cipher in MAC. Therefore, in the method according to the first embodiment, the presence of an element of an empty sequence does not affect the number of calls to the encryption function E_K. In other words, in the method according to the first embodiment, even if the number of elements of an empty sequence increases, the number of calls to the encryption function E_K does not increase. In contrast, in the above-mentioned method of adding len(), a len() of a predetermined length is added to elements of an empty sequence. Therefore, it can be said that the effect of reducing the number of calls to the encryption function E_K in the method according to the first embodiment compared to the method of adding len() is higher as the number of elements of an empty sequence increases. Therefore, in the method according to the first embodiment, it is possible to generate tags efficiently.

[0147] Also, the method according to the second comparative example illustrated in FIG. 3 is compared with the method according to the first embodiment. In the method according to the second comparative example, even if the length of the elements of the vector V is extremely shorter than n bits, the encryption function E_K is called at least once. Specifically, for example, assume that the vector V has n-1 elements, each of which is a single bit of "0", that is, V=(0,0,...,0). In the second comparative example, the encryption function E_K is called once even for a single bit element. Therefore, in the method according to the second comparative example, the encryption function E_K is called n-1 times for the above vector V.

[0148] In contrast, in the method according to the first embodiment, V[1]||V[2]||···||V[n-1], which is a concatenation of elements, is processed by block cipher. Here, the bit length of V[1]||V[2]||···||V[n-1] is n-1 bits, which is shorter than n. Therefore, in the method according to the first embodiment, the encryption function E_K is called only once. Therefore, when the length of the elements is short, the method according to the first embodiment can reduce the number of calls of the encryption function E_K compared to the method according to the second comparative example. And, in the method according to the second comparative example, the shorter the length of the elements, the longer the bit length added to the elements of the vector by the padding process. Therefore, the shorter the length of the elements, the higher the reduction effect of the method according to the first embodiment compared to the method according to the second comparative example. Therefore, in the method according to the first embodiment, it is possible to generate tags efficiently.

[0149] Also, in the second comparative example, if the vector includes an element of an empty sequence, the encryption function E_K needs to be called once for that element. On the other hand, as described above, in the method according to the first embodiment, the presence of an element of an empty sequence does not affect the length of the message processed by the block cipher in the MAC. Therefore, in the method according to the first embodiment, even if the number of elements of an empty sequence increases, the number of calls to the encryption function E_K does not increase. Therefore, in the case where the vector includes an element of an empty sequence, the method according to the first embodiment can reduce the number of calls to the encryption function E_K compared to the method according to the second comparative example. And, the greater the number of elements of an empty sequence, the greater the reduction effect of the method according to the first embodiment. Therefore, in the method according to the first embodiment, it is possible to generate tags efficiently.

[0150] In the method according to the first embodiment, pre-calculation (calculation of a mask value and calculation of L required for the calculation) is required in the technique illustrated in Figs. 8 to 10. Here, in the pre-calculation, it is necessary to call the encryption function E_K when calculating L. However, the number of calls to the encryption function E_K by the pre-calculation only increases on the order of ω+O(1). In other words, the number of calls to the encryption function E_K by the pre-calculation does not depend on the number of elements, the length of the elements, and the number of message blocks. Therefore, the pre-calculation does not have a significant effect on the efficiency of tag generation.

[0151] As described above, in the method according to the first embodiment, the message block is encrypted using the link information, so if the vector is different, the encryption result is different even when the same message block is encrypted. Therefore, the method according to the first embodiment can generate tags safely. In other words, the method according to the first embodiment can achieve security (n / 2-bit security) equivalent to that of CMAC and PMAC described in the above-mentioned non-patent documents.

[0152] The concatenation information is not limited to the formats exemplified in Fig. 6 and Fig. 7. The concatenation information generating unit 130 only needs to generate the concatenation information such that the division of elements in the corresponding message block can be determined from the concatenation information. In other words, the concatenation information generating unit 130 only needs to generate the concatenation information such that an input vector (input data) can be uniquely reproduced from the concatenation information and the corresponding message block. In other words, the concatenation information generating unit 130 only needs to generate the concatenation information such that the concatenation information corresponding to the message blocks is different even when the bit sequences of the message blocks obtained by concatenating elements of different input vectors are the same.

[0153] For example, consider an input vector V where V=(00,01) and an input vector V' where V'=(0,001). In this case, the input vector V and the input vector V' are different vectors. However, the messages M obtained by concatenating the elements of the input vector V and the input vector V' are both M=(0001). Therefore, the message blocks obtained from the input vector V and the input vector V' are the same. However, the element division in the message block obtained from the input vector V is different from the element division in the message block obtained from the input vector V'. Therefore, the link information obtained from the input vector V may be different from the link information obtained from the input vector V'. By generating such link information, the method according to the first embodiment can achieve the safety of n / 2-bit security as described above.

[0154] As described above, in the methods illustrated in Fig. 8 to Fig. 10, the mask value Δ is generated by the encryption function E_K using the linkage information. Here, as described above, L_j can be calculated in advance and stored in memory. Therefore, in the first embodiment, when processing a message block, it is possible to eliminate the need to call the encryption function E_K other than calling the encryption function E_K to encrypt the message block.

[0155] Moreover, when an input vector is given, the link information generating unit 130 can generate link information uniquely corresponding to the message block obtained from the input vector. Here, from the viewpoint of shortening the MAC processing time, even if the input vector is input sequentially, it is desirable to perform the MAC processing sequentially. That is, even if the input vector is input sequentially, it is desirable to process each message block sequentially by the encryption function E_K. In this case, it is necessary to generate link information sequentially without waiting for the entire input vector to be input. Here, as described above, the link information generating unit 130 may perform a process of summing up the lengths of the elements each time the elements of the input vector are input, and extracting the position where the element is switched in the n bits each time the sum reaches n bits. By performing such a process, the link information generating unit 130 can generate link information sequentially. Therefore, the tag generating device 10 according to the first embodiment can generate tags efficiently also from the viewpoint of the MAC processing time.

[0156] (Embodiment 2) Next, a description will be given of a second embodiment. The second embodiment shows an outline of the configuration according to the first embodiment.

[0157] 15 is a diagram showing a configuration of an information processing device 30 according to the present disclosure. The information processing device 30 corresponds to the above-mentioned tag generation device 10 and tag verification device 20. The information processing device 30 has a linking unit 310, a linked information generation unit 330, and a tag generation unit 340.

[0158] The linking unit 310 functions as a linking means. The linked information generating unit 330 functions as a linked information generating means. The tag generating unit 340 functions as a tag generating means.

[0159] The linking unit 310 may be realized by substantially the same functions as the above-described linking unit 110 and linking unit 210. The link information generating unit 330 may be realized by substantially the same functions as the above-described link information generating unit 130 and link information generating unit 230. The tag generating unit 340 may be realized by substantially the same functions as the above-described tag generating unit 140 and tag generating unit 240.

[0160] Fig. 16 is a flowchart showing an information processing method realized by the information processing device 30 according to the present disclosure. Note that Fig. 16 shows a tag generating method realized by the information processing device 30 according to the present disclosure.

[0161] The concatenation unit 310 generates concatenated data by concatenating each element of the input data (step S302). The concatenation information generation unit 330 generates concatenation information corresponding to each of the multiple message blocks (step S304). Specifically, the concatenation information generation unit 330 generates concatenation information related to the concatenation of elements in each of the multiple message blocks obtained by dividing the concatenated data into pieces of a predetermined data length. The tag generation unit 340 generates a tag using the concatenation information corresponding to each of the multiple message blocks (step S306). Specifically, the tag generation unit 340 generates a tag related to a message authentication code using each of the multiple message blocks and the concatenation information corresponding to each of the multiple message blocks by block encryption. Note that the block encryption takes as input a message of a predetermined data length, which is the data length of the message block.

[0162] The information processing device 30 according to the second embodiment, being configured as described above, can achieve substantially the same effects as the tag generation device 10 and the tag verification device 20 according to the first embodiment. That is, the information processing device 30 according to the second embodiment can generate tags efficiently without depending on the definition of a vector space. That is, the information processing device 30 according to the second embodiment can generate tags efficiently regardless of the number of elements of the input vector V (input data) and the length of each element. Specifically, the information processing device 30 according to the second embodiment can set the number of calls of the block cipher (encryption function E_K) to the number expressed by the above-mentioned formula 3, excluding pre-calculation.

[0163] (Hardware configuration example) An example of the configuration of hardware resources for implementing the devices and systems according to the above-mentioned embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (authentication encryption device and authentication decryption device) may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be implemented as dedicated devices or general-purpose information processing devices.

[0164] FIG. 17 is a block diagram showing an example of a hardware configuration of a calculation processing device 1000 capable of realizing the device and system according to the present disclosure. The calculation processing device 1000 has a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF 1007 (IF: Interface). Therefore, it can be said that the device according to each embodiment has a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may include an input device 1005 and an output device 1006. In addition, the calculation processing device 1000 can transmit and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0165] The non-volatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The non-volatile recording medium 1004 may also be a universal serial bus (USB) memory, a solid state drive, or the like. The non-volatile recording medium 1004 holds the relevant program without the need for a power supply, making it possible to carry the program. The non-volatile recording medium 1004 is not limited to the above-mentioned medium. Instead of the non-volatile recording medium 1004, the relevant program may be supplied via the communication IF 1007 and a communication network.

[0166] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0167] That is, when the CPU 1001 executes a software program (computer program: hereinafter, simply referred to as a "program") stored on the disk 1003, the CPU 1001 copies the program to the volatile storage device 1002 and executes arithmetic processing. The CPU 1001 reads data required for executing the program from the volatile storage device 1002. When display is required, the CPU 1001 displays the output result on the output device 1006. When a program is input from the outside, the CPU 1001 obtains the program from the input device 1005. The CPU 1001 interprets and executes a program corresponding to the function (processing) of each component shown in the above-mentioned FIGS. 5, 12, and 15. The CPU 1001 executes the processing described in each of the above-mentioned embodiments. In other words, the function of each component shown in the above-mentioned FIGS. 5, 12, and 15 can be realized by the CPU 1001 executing a program stored on the disk 1003 or the volatile storage device 1002.

[0168] That is, each of the embodiments can be realized by the above-mentioned programs. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-mentioned programs are recorded.

[0169] (Modification) The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, in the above-described flow chart, the order of each process (step) can be modified as appropriate. Furthermore, one or more of the multiple processes (steps) may be omitted. Furthermore, the above-described multiple embodiments can be mutually applied.

[0170] In the above-described embodiment, an example is shown in which the input data processed by the MAC is vector data, but the present invention is not limited to this configuration. The input data does not have to be vector data as long as it is data consisting of multiple elements. Furthermore, the input data consisting of multiple elements does not have to include an element of an empty sequence.

[0171] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be appropriately combined with other embodiments.

[0172] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but to one or more other embodiments. As can be understood by those skilled in the art, various features or steps described with reference to any one drawing may be combined with features or steps shown in one or more other drawings to create an embodiment not explicitly shown or described, for example. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0173] The above-mentioned program includes a set of instructions (or software code) for making the computer perform one or more functions described in the embodiments when the program is loaded into the computer. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or the tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, the transitory computer-readable medium or the communication medium includes electrical, optical, acoustic, or other forms of propagating signals.

[0174] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) A concatenation means for generating concatenated data by concatenating each element of input data consisting of a plurality of elements; a link information generating means for generating link information regarding links between the elements in each of a plurality of message blocks obtained by dividing the linked data into message blocks of a predetermined data length; a tag generating means for generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks by a block cipher using a message having the data length as an input; An information processing device having the above configuration. (Appendix 2) the tag generating means generates the tag by generating random numbers corresponding to each of the plurality of message blocks using the link information corresponding to the message blocks by the block cipher. 2. An information processing device according to claim 1. (Appendix 3) the tag generating means generates the tag by encrypting each of the plurality of message blocks with the block cipher using the link information corresponding to the message block. 3. An information processing device according to claim 2. (Appendix 4) the tag generating means generates the tag by encrypting each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to each message block as a tweak. 4. The information processing device according to claim 3. (Appendix 5) the tag generation means encrypts each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to the message block as a tweak, and generates the tag by performing a process of adding the obtained encryption result to the next message block. 5. The information processing device according to claim 4. (Appendix 6) the tag generation means encrypts each of the plurality of message blocks in parallel using a tweakable block cipher that uses the link information corresponding to each message block and an index of each message block as a tweak, and generates the tag by adding up the obtained encryption results. 5. The information processing device according to claim 4. (Appendix 7) the tag generating means encrypts each of the plurality of message blocks by the block cipher, and converts the obtained encryption result using the link information corresponding to each message block, thereby generating the tag. 3. An information processing device according to claim 2. (Appendix 8) the link information generating means generates the link information such that a delimiter of the element in the message block corresponding to the link information can be determined from the link information. 2. An information processing device according to claim 1. (Appendix 9) The link information indicates at least a link position of the element in each of the plurality of message blocks. 9. The information processing device according to claim 8. (Appendix 10) The link information indicates the position and the number of the elements that are null sequences in each of the plurality of message blocks. 10. The information processing device according to claim 9. (Appendix 11) The link information indicates at least a link position of the element for each of the positions at which the element can be linked in each of the plurality of message blocks. 10. The information processing device according to claim 9. (Appendix 12) The link information indicates, for each of the positions where the elements can be linked in each of the plurality of message blocks, the positions and the number of the elements that are null sequences. 12. The information processing device according to claim 11. (Appendix 13) the link information generating means generates the link information sequentially when the input data is sequentially input. 2. An information processing device according to claim 1. (Appendix 14) Generate concatenated data by concatenating each element of the input data consisting of a plurality of elements; generating link information regarding the linkage of the elements in each of a plurality of message blocks obtained by dividing the linked data into pieces of a predetermined data length; generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks using a block cipher with a message of the data length as an input; Information processing methods. (Appendix 15) generating the tag by generating random numbers corresponding to each of the plurality of message blocks using the link information corresponding to the message blocks by the block cipher; 15. An information processing method according to claim 14. (Appendix 16) generating the tag by encrypting each of the plurality of message blocks with the block cipher using the linking information corresponding to the message block; 16. An information processing method according to claim 15. (Appendix 17) generating the tag by encrypting each of the plurality of message blocks using a tweakable block cipher that uses the link information corresponding to the message block as a tweak; 17. The information processing method according to claim 16. (Appendix 18) generating the tag by encrypting each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to the message block as a tweak, and adding the obtained encryption result to the next message block; 18. An information processing method according to claim 17. (Appendix 19) encrypting each of the plurality of message blocks in parallel using a tweakable block cipher that uses the link information corresponding to each message block and an index of each message block as a tweak, and generating the tag by adding up the obtained encryption results; 18. An information processing method according to claim 17. (Appendix 20) encrypting each of the plurality of message blocks using the block cipher, and converting the encrypted result using the linking information corresponding to the message block, thereby generating the tag. 16. An information processing method according to claim 15. (Appendix 21) generating the link information such that a delimitation of the element in the message block corresponding to the link information can be determined from the link information; 15. An information processing method according to claim 14. (Appendix 22) The link information indicates at least a link position of the element in each of the plurality of message blocks. 22. An information processing method according to claim 21. (Appendix 23) The link information indicates the position and the number of the elements that are null sequences in each of the plurality of message blocks. 23. An information processing method according to claim 22. (Appendix 24) The link information indicates at least a link position of the element for each of the positions at which the element can be linked in each of the plurality of message blocks. 23. An information processing method according to claim 22. (Appendix 25) The link information indicates, for each of the positions where the elements can be linked in each of the plurality of message blocks, the positions and the number of the elements that are null sequences. 25. An information processing method as described in Supplementary Note 24. (Appendix 26) generating the link information sequentially when the input data is sequentially input; 15. An information processing method according to claim 14. (Appendix 27) generating concatenated data by concatenating each element of input data consisting of a plurality of elements; generating link information regarding links between the elements in each of a plurality of message blocks obtained by dividing the linked data into message blocks of a predetermined data length; generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks by a block cipher using a message of the data length as an input; A program that causes a computer to execute the following. (Appendix 28) generating the tag by using the block cipher to generate random numbers corresponding to each of the plurality of message blocks by using the linking information corresponding to the message blocks; 28. The program according to claim 27, which causes a computer to execute the above steps. (Appendix 29) generating the tag by encrypting each of the message blocks with the block cipher using the linking information corresponding to the message block; 29. The program according to claim 28, which causes a computer to execute the above steps. (Appendix 30) generating the tag by encrypting each of the plurality of message blocks with a tweakable block cipher using the linking information corresponding to the message block as a tweak; 30. The program according to claim 29, which causes a computer to execute the program. (Appendix 31) generating the tag by encrypting each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to the message block as a tweak and adding the obtained encryption result to the next message block; The program according to claim 30, which causes a computer to execute the program. (Appendix 32) generating the tag by encrypting each of the plurality of message blocks in parallel using a tweakable block cipher that uses the linking information corresponding to each message block and an index of each message block as a tweak, and adding up the encrypted results obtained; The program according to claim 30, which causes a computer to execute the program. (Appendix 33) generating the tag by encrypting each of the plurality of message blocks using the block cipher and converting the encrypted result using the linking information corresponding to the message block; 29. The program according to claim 28, which causes a computer to execute the above steps. (Appendix 34) generating the linkage information such that a delimitation of the element in the message block corresponding to the linkage information can be determined from the linkage information; 28. The program according to claim 27, which causes a computer to execute the above steps. (Appendix 35) The link information indicates at least a link position of the element in each of the plurality of message blocks. 35. The program according to claim 34. (Appendix 36) The link information indicates the position and the number of the elements that are null sequences in each of the plurality of message blocks. 36. The program according to claim 35. (Appendix 37) The link information indicates at least a link position of the element for each of the positions at which the element can be linked in each of the plurality of message blocks. 36. The program according to claim 35. (Appendix 38) The link information indicates, for each of the positions where the elements can be linked in each of the plurality of message blocks, the positions and the number of the elements that are null sequences. 38. The program according to claim 37. (Appendix 39) sequentially generating the link information when the input data is sequentially input; 28. The program according to claim 27, which causes a computer to execute the above steps. [Explanation of symbols]

[0175] 1 Authentication System 10 Tag Generator 20 Tag Verification Device 30 Information processing device 70 Tag Generator 80 Tag Generator 100 Input section 110 Connection part 120 Division 130 Concatenation information generation section 140 Tag Generator 150 Output section 200 Input section 210 Connection section 220 Split section 230 Consolidated information generation section 240 Tag Generator 250 Tag Verification Department 310 Connection section 330 Concatenation information generation section 340 Tag Generator

Claims

1. A concatenation means for generating concatenated data by concatenating each element of input data consisting of a plurality of elements; a link information generating means for generating link information regarding links between the elements in each of a plurality of message blocks obtained by dividing the linked data into message blocks of a predetermined data length; a tag generating means for generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks by a block cipher using a message having the data length as an input; An information processing device having the above configuration.

2. the tag generating means generates the tag by generating random numbers corresponding to each of the plurality of message blocks using the link information corresponding to the message blocks by the block cipher. The information processing device according to claim 1 .

3. the tag generating means generates the tag by encrypting each of the plurality of message blocks with the block cipher using the link information corresponding to the message block. The information processing device according to claim 2 .

4. the tag generating means generates the tag by encrypting each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to the message block as a tweak. The information processing device according to claim 3 .

5. the tag generating means generates the tag by encrypting each of the plurality of message blocks by a tweakable block cipher using the link information corresponding to the message block as a tweak, and adding the obtained encryption result to the next message block. The information processing device according to claim 4.

6. the tag generation means encrypts each of the plurality of message blocks in parallel using a tweakable block cipher that uses the link information corresponding to each message block and an index of each message block as a tweak, and generates the tag by adding up the obtained encryption results. The information processing device according to claim 4.

7. the tag generating means encrypts each of the plurality of message blocks by the block cipher, and converts the obtained encryption result using the link information corresponding to each message block, thereby generating the tag. The information processing device according to claim 2 .

8. the link information generating means generates the link information such that a delimiter of the element in the message block corresponding to the link information can be determined from the link information. The information processing device according to claim 1 .

9. The link information indicates at least a link position of the element in each of the plurality of message blocks. The information processing device according to claim 8.

10. The link information indicates the position and the number of the elements that are null sequences in each of the plurality of message blocks. The information processing device according to claim 9.

11. The link information indicates at least a link position of the element for each of the positions at which the element can be linked in each of the plurality of message blocks. The information processing device according to claim 9.

12. The link information indicates, for each of the positions where the elements can be linked in each of the plurality of message blocks, the positions and the number of the elements that are null sequences. The information processing device according to claim 11.

13. the link information generating means generates the link information sequentially when the input data is sequentially input. The information processing device according to claim 1 .

14. Generate concatenated data by concatenating each element of the input data consisting of a plurality of elements; generating link information regarding the linkage of the elements in each of a plurality of message blocks obtained by dividing the linked data into pieces of a predetermined data length; generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks by a block cipher using a message having the data length as an input; Information processing methods.

15. generating concatenated data by concatenating each element of input data consisting of a plurality of elements; generating link information regarding links between the elements in each of a plurality of message blocks obtained by dividing the linked data into message blocks of a predetermined data length; generating a tag related to a message authentication code by using each of the plurality of message blocks and the link information corresponding to each of the plurality of message blocks by a block cipher using a message of the data length as an input; A program that causes a computer to execute the following.

Images