Authentication encryption device, authentication decryption device, authentication encryption system, method, and program

Abstract

To provide an authentication encryption device capable of ensuring high safety and inhibiting an increase in a load on a communication path.SOLUTION: An authentication encryption device includes encryption means, plain sentence processing means, cryptogram processing means, and tag generation means. The encryption means uses a tweak including a nonce and related data and a key to encrypt a plain sentence and thus generates a cryptogram having the same length as the plain sentence. The plain sentence processing means generates a first value, which is used to generate an authentication tag, from the plain sentence. The cryptogram processing means generates a second value, which is used to generate the authentication tag, from the cryptogram. The tag generation means enters the key, nonce, related data, and one or two of input values, which are associated with the first value and second value respectively, in a hash function, and thus generates a hash value having a length t as an authentication tag.SELECTED DRAWING: Figure 19

Description

Technical Field

[0001] The present disclosure relates to an authentication encryption device, an authentication decryption device, an authentication encryption system, a method, and a program.

Background Art

[0002] There is known a technique called Authenticated Encryption with Associated Data (AEAD) that simultaneously applies encryption and calculation of an authentication tag for detecting forgery to a plaintext message using a pre-shared secret key. By applying the authentication encryption AEAD to a communication channel, it becomes possible to conceal the content from eavesdropping and detect unauthorized forgery, and as a result, strong protection for the communication content is realized. Also, as a cryptographic component (primitive) capable of achieving strong security, WTBC (Wide tweakable block cipher) is known. By realizing AEAD using WTBC as a component, an authentication encryption capable of achieving strong security can be realized.

[0003] Also, as techniques related to authentication encryption, for example, the techniques disclosed in Non-Patent Document 1 and Non-Patent Document 2 are known. Non-Patent Document 1 and Non-Patent Document 2 disclose an AEAD method capable of achieving Key committing security (CMT-4 security).

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Non-Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] Simply implementing AEAD using WTBC alone may not achieve the security of CMT-4 (Key committing security). On the other hand, when applying the method of implementing AEAD using WTBC to the methods of Non-Patent Document 1 and Non-Patent Document 2, the amount of data output from the encryption side to the decryption side increases, so the load on the communication path may increase. Therefore, in the technologies of Non-Patent Document 1 and Non-Patent Document 2, if high security is to be achieved, the load on the communication path may increase.

[0006] The object of the present disclosure is to solve such problems, and to provide an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, a method and a program capable of suppressing an increase in the load on the communication path while achieving high security.

Means for Solving the Problems

[0007] The authentication encryption device according to the present disclosure includes an encryption means that encrypts a plaintext using a Tweak including a nonce and related data and a key to generate a ciphertext having the same length as the plaintext, a plaintext processing means that generates a first value used for generating an authentication tag from the plaintext, a ciphertext processing means that generates a second value used for generating the authentication tag from the ciphertext, and a tag generation means that inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag.

[0008] Further, the authentication decryption device according to the present disclosure includes a decryption means that decrypts a ciphertext using a Tweak including a nonce and related data and a key to generate a plaintext having the same length as the ciphertext, a plaintext processing means that generates a first value used for generating a verification tag from the plaintext, a ciphertext processing means that generates a second value used for generating the verification tag from the ciphertext, a tag generation means that inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, and a verification means that verifies the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t and performs control for outputting a verification result.

[0009] In addition, the authentication encryption system according to the present disclosure includes an authentication encryption device and an authentication decryption device that communicates with the authentication encryption device. The authentication encryption device uses a Tweak including a nonce and related data and a key to encrypt a plaintext to generate a ciphertext having the same length as the plaintext, and a first plaintext processing means for generating a first value used for generating an authentication tag from the plaintext, and a first ciphertext processing means for generating a second value used for generating the authentication tag from the ciphertext, and a first tag generation means for inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag. The authentication decryption device uses a Tweak including the nonce and the related data and the key to decrypt the input ciphertext to generate a plaintext having the same length as the ciphertext, and a second plaintext processing means for generating a third value used for generating a verification tag from the plaintext obtained by decryption, and a second ciphertext processing means for generating a fourth value used for generating the verification tag from the input ciphertext, and a second tag generation means for inputting the key, the nonce, the related data, and one or two input values corresponding to the third value and the fourth value into a hash function to generate the hash value of the length t as the verification tag, and verification means for verifying the presence or absence of forgery by comparing the verification tag and the input authentication tag and performing control for outputting a verification result.

[0010] In addition, the authentication encryption method according to the present disclosure uses a Tweak including a nonce and related data and a key to encrypt a plaintext to generate a ciphertext having the same length as the plaintext, generates a first value used for generating an authentication tag from the plaintext, generates a second value used for generating the authentication tag from the ciphertext, and inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag.

[0011] Also, the authentication decryption method according to the present disclosure uses a Tweak including a nonce and related data and a key to decrypt a ciphertext to generate a plaintext having the same length as the ciphertext, generates a first value used for generating a verification tag from the plaintext, generates a second value used for generating the verification tag from the ciphertext, inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, and verifies the presence or absence of forgery by comparing the verification tag with the input authentication tag of the length t, and performs control for outputting a verification result.

[0012] Also, the program according to the present disclosure causes a computer to execute steps of encrypting a plaintext using a Tweak including a nonce and related data and a key to generate a ciphertext having the same length as the plaintext, generating a first value used for generating an authentication tag from the plaintext, generating a second value used for generating the authentication tag from the ciphertext, and inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag.

[0013] In addition, the program according to the present disclosure uses a nonce and related data, a Tweak, and a key to decrypt a ciphertext to generate a plaintext having the same length as the length of the ciphertext, generate a first value used for generating a verification tag from the plaintext, generate a second value used for generating the verification tag from the ciphertext, input the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, and verify the presence or absence of forgery by comparing the verification tag with the input authentication tag of the length t, and perform control for outputting a verification result, and cause a computer to execute.

Advantages of the Invention

[0014] According to the present disclosure, it is possible to provide an authentication encryption device, an authentication decryption device, an authentication encryption system, a method, and a program that can suppress an increase in load in a communication path while realizing high security.

Brief Description of the Drawings

[0015]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Embodiments for Carrying Out the Invention

[0016] (Summary of this Embodiment) Prior to the description of this embodiment, the summary of this embodiment will be described. Note that, hereinafter, this embodiment will be described, but the following embodiments do not limit the invention according to the claims. Also, not all combinations of features described in the embodiments are essential for the solution means of the invention. Further, in the following description, the indexes (English letters) used are not necessarily common throughout this specification. Also, hereinafter, this embodiment will be described with reference to the drawings, but it should be noted that each drawing used in the description of each embodiment is not applicable only to that embodiment. That is, each drawing can be applied to all embodiments respectively.

[0017] First, the basic input and output of the authenticated encryption (AEAD) will be described. In the following description, consider the communication between Alice and Bob as two parties sharing the secret key K, and assume that a message encrypted by authenticated encryption from Alice to Bob is communicated.

[0018] Let the encryption function of the authenticated encryption be Enc and the decryption function be Dec. Also, let the plaintext to be encrypted be M, and further introduce a variable N (initial vector) called a nonce. Also, let the associated data (AD) be A. Here, the associated data A (header) is a value for which encryption is not performed but tampering detection is performed.

[0019] First, the encryption process on the Alice side will be described. After generating the nonce N, Alice executes the process represented by (C, T) = Enc_K(N, A, M). Here, Enc_K is an encryption function with the key K, which is the secret key, as a parameter, and C is the ciphertext. Also, T is a fixed-length variable for tampering detection called a tag (authentication tag). Alice transmits the set (N, A, C, T) of the nonce N, the associated data A, the ciphertext C, and the tag T to Bob.

[0020] Next, the decryption process on the Bob side will be described. Let the information received by Bob be (N’, A’, C’, T’). In this case, Bob executes Dec_K(N’, A’, C’, T’) as the decryption process. Note that Dec_K is a decryption function with the key K as a parameter. If there is tampering by a third party Eve during the communication and (N’, A’, C’, T’) ≠ (N, A, C, T), for Dec_K(N’, A’, C’, T’), an error message (error symbol ⊥) indicating that there has been tampering will be output. That is, in this case, tampering is detected. On the other hand, if there is no tampering during the communication and (N’, A’, C’, T’) = (N, A, C, T), for Dec_K(N’, A’, C’, T’), the plaintext M encrypted by Alice is correctly decrypted.

[0021] Also, in the above process, usually, it is important to prevent the nonce N from accidentally coinciding with a past value during encryption. For this purpose, on the encryption side, some state variable such as a counter is used to prevent the coincidence of nonces. That is, typically, the previously used N is stored as a state variable, and by incrementing N each time, it is realized that the nonce N does not overlap with past values.

[0022] FIG. 1 is a diagram for explaining the WTBC according to the present disclosure. FIG. 1 shows an encryption function (WTBC encryption function) by WTBC. The WTBC encryption function performs a keyed substitution that encrypts a plaintext of any length into a ciphertext of the same length as the plaintext. That is, by encrypting (substituting) a plaintext message of any length using the WTBC encryption function, an encryption result of the same length as the plaintext message is obtained. Here, WTBC uses an encryption method that introduces a publicly known adjustment value (auxiliary variable) called Tweak. That is, in WTBC, a keyed substitution including Tweak is performed on its input. And WTBCs with different Tweaks can be regarded as substitutions with different secret keys respectively.

[0023] Here, assume a situation where Tweak is fixed. Under such a situation, consider encrypting the plaintext using a block cipher with fixed-length input and output instead of WTBC. At this time, assume that after encrypting the plaintext, a part of the bit sequence of the plaintext is changed. In this case, among the multiple plaintext blocks that make up the plaintext, a certain plaintext block will be changed, and another plaintext block will not be changed. In this case, the ciphertext block obtained by encrypting the unchanged plaintext block among the changed plaintexts will be the same as the ciphertext block corresponding to the plaintext before the change. Therefore, when using a block cipher with fixed-length input and output under the situation where Tweak is fixed, there is a risk that a part of the ciphertext will be predictable to the attacker. On the contrary, when encrypting the plaintext using WTBC, even under the above situation, when even a small bit sequence (for example, a 1-bit sequence) in the bit sequence of the plaintext is changed, the influence due to the difference will spread throughout the ciphertext. Therefore, when even a small bit sequence (for example, a 1-bit sequence) in the bit sequence of the plaintext is changed, the ciphertext obtained by WTBC will be a random number that is unpredictable with respect to the plaintext before the change. Therefore, by using WTBC, higher confidentiality can be guaranteed. Therefore, it can be said that WTBC is a cryptographic component capable of realizing strong security.

[0024] Also, as shown in FIG. 1, the WTBC encryption function takes as input a key K which is a k-bit bit sequence, an arbitrary-length Tweak (Tw), and an arbitrary-length plaintext M, and outputs a ciphertext C of |M| bits. Note that |X| indicates the bit length of the bit sequence X. Therefore, in WTBC, the following Equation 1 holds.

Equation

[0025] In Equation 1, {0,1}^{k} represents the set of k-bit bit strings and corresponds to the bit string of the key K. Also, in Equation 1, the three {0,1}^{*} represent the sets of bit strings of arbitrary lengths, and in order from the left, they correspond to the bit string of the Tweak, the bit string of the plaintext, and the bit string of the ciphertext.

[0026] Also, the WTBC encryption function is represented by the following Equation 2.

Number

[0027] Also, the decryption function by WTBC (WTBC decryption function) is represented by the following Equation 3.

Number

[0028] Note that in the following description, the left side of Equation 2 (WTBC encryption function) may be denoted as "E ~ _K^Tw(M)", "E ~ K Tw (M)", or simply "E ~ ", "E ~ K ", or "E ~ _K", etc. Also, in the following description, the left side of Equation 3 (WTBC decryption function) may be denoted simply as "(E ~ ) -1 ", "(E ~ )^(-1)", "(E ~ K )^(-1)", or "(E ~ _K)^(-1)", etc.

[0029] FIG. 2 is a diagram for explaining an example of a method for realizing AEAD using WTBC according to the present disclosure as a cryptographic component. FIG. 2 shows an AEAD encryption function called the EtE (Encode-then-Encipher) method. The AEAD encryption function of the EtE method shown in FIG. 2 uses WTBC as a cryptographic component. The AEAD encryption function of the EtE method takes as input a k-bit key K, an n-bit nonce N, associated data A of arbitrary length, and a plaintext M of arbitrary length, and outputs a ciphertext C.

[0030] In the AEAD encryption function of the EtE method, the key K of the AEAD encryption function is input to the part where the key K is input in WTBC. Also, in the AEAD encryption function of the EtE method, the nonce N and the associated data A of the AEAD encryption function are input to the part where the Tweak is input in WTBC. In other words, the AEAD encryption function of the EtE method inputs the nonce N and the associated data A to WTBC as the Tweak. Further in other words, in the AEAD encryption function of the EtE method, the nonce N and the associated data A are used as the Tweak. Further in other words, in the AEAD encryption function of the EtE method, the Tweak includes the nonce N and the associated data A.

[0031] Also, the AEAD encryption function in the EtE mode encodes the input plaintext M. Then, the AEAD encryption function in the EtE mode inputs the value (bit string) obtained by encoding the plaintext M into the part where the plaintext is input in the WTBC. In the example of Figure 2, as encoding, the AEAD encryption function concatenates a predetermined bit string to the plaintext M. As illustrated in Figure 2, the AEAD encryption function may, for example, concatenate a τ-bit zero string to the plaintext M to obtain M||0^τ as the value obtained by encoding the plaintext M. Here, "||" indicates the concatenation of bit strings. In this case, in the bit string obtained by encoding, the upper |M| bits correspond to the plaintext M, and the lower τ bits correspond to the zero string. Note that the predetermined bit string (τ-bit zero string) is concatenated to the plaintext M in order to perform forgery detection of the ciphertext on the decryption side. Also, the bit length τ is predetermined according to the desired security level. Also, the predetermined bit string may not be a zero string.

[0032] Then, the AEAD encryption function in the EtE mode obtains, as the output of the AEAD encryption function, the ciphertext C obtained by encrypting the bit string obtained by the above encoding with the WTBC. In the example of Figure 2, the bit length of the ciphertext C output from the AEAD encryption function in the EtE mode is |M| + τ bits. Here, it can be said that the ciphertext C output from the AEAD encryption function in the EtE mode does not purely encrypt the plaintext M but contains a value for forgery detection in an indistinguishable manner. Then, the transmitting device (Alice) transmits (N, A, C) to the receiving device (Bob).

[0033] Also, in the receiving device (Bob), the decryption function corresponding to the AEAD encryption function of the EtE method decrypts the received ciphertext C. And in the example of FIG. 2, the decryption function obtains a data sequence of |M| + τ bits as the decryption result. Then, when the lower τ bits of the decryption result are all zero (zero string), the decryption function determines that the ciphertext has not been tampered with, and outputs the upper |M| bits of the decryption result as the plaintext M. On the other hand, when the lower τ bits of the decryption result are not all zero, the decryption function determines that the ciphertext has been tampered with and outputs an error message.

[0034] By realizing AEAD by the EtE method using WTBC as shown in FIG. 2, extremely strong security can be achieved as the security of AEAD. That is, with a general authenticated cipher, basic security such as the confidentiality ability of the plaintext and the tampering detection ability of the ciphertext and the tag can be achieved. In contrast, by realizing AEAD by the EtE method using WTBC, not only the above-mentioned basic security but also other security can be achieved. For example, by realizing AEAD by the EtE method using WTBC, security such as nonce misuse resistance and decryption misuse resistance can also be achieved. Note that nonce misuse resistance means that even if the same nonce is mistakenly reused, as long as there is a difference in the plaintext M or the associated data A, the randomness of the ciphertext output from the encryption function is not lost, so the security is ensured. Also, decryption misuse resistance means that even if a plaintext that has not been verified for tampering obtained by decrypting the ciphertext is mistakenly output, security is ensured against an attacker.

[0035] On the one hand, in the AEAD simply realized using WTBC like the above-described EtE method, it is not possible to achieve Key committing security in the technology according to the above-described non-patent document. Here, Key committing security, narrowly defined, means that decryption succeeds only when decryption is performed using the key used for encryption. In other words, Key committing security, narrowly defined, means that the probability that the encryption results (ciphertext and tag) obtained by encryption using different keys are the same is extremely low, that is, it is difficult for the encryption results to collide. Specifically, the narrow definition of Key committing security is as follows. The probability of finding an input pair (K_1, N_1, A_1, M_1), (K_2, N_2, A_2, M_2) such that Enc_{K_1}(N_1, A_1, M_1) = Enc_{K_2}(N_2, A_2, M_2) and K_1 ≠ K_2 is sufficiently small. Note that "the probability is sufficiently small" means that the probability is smaller than a predetermined probability threshold required to satisfy the desired security level (the same applies in other contexts).

[0036] Also, Key committing security, broadly defined, means that the possibility that the encryption results obtained by encryption performed using different values collide is extremely low. In other words, Key committing security, broadly defined, means that the probability that the encryption results obtained when the values input to the encryption function are different are the same (collide) is low. As a kind of the broad definition of Key committing security, there is the above-described CMT-4 security. The definition of CMT-4 security is as follows. The probability that an attacker who can choose including the secret key finds input pairs \((K_1, N_1, A_1, M_1)\) and \((K_2, N_2, A_2, M_2)\) that satisfy \(Enc_{K_1}(N_1, A_1, M_1)=Enc_{K_2}(N_2, A_2, M_2)\) and \((K_1, N_1, A_1)\neq(K_2, N_2, A_2)\) is sufficiently small.

[0037] Simply implementing AEAD using WTBC alone may not achieve a different concept of security, namely Key committing security (e.g., CMT-4 security), which can be achieved with AEAD using WTBC. In an AEAD where Key committing security is not achieved, there is a risk of an attack by an attacker in a specific situation. Therefore, an AEAD that achieves Key committing security is desired.

[0038] Figs. 3 to 6 are diagrams for explaining a method of realizing an AEAD that can achieve Key committing security according to the present disclosure. Figs. 3 to 4 are diagrams for explaining an example when the technique according to Non-Patent Document 1 is used. Further, Figs. 5 to 6 are diagrams for explaining an example when the technique according to Non-Patent Document 2 is used.

[0039] Figs. 3 to 4 are diagrams for explaining a method of realizing an AEAD that can achieve Key committing security by applying a method called CTX according to Non-Patent Document 1. Fig. 3 shows an encryption function 82 to which the CTX method according to Non-Patent Document 1 is applied. Fig. 4 shows a decryption function 84 to which the CTX method according to Non-Patent Document 1 is applied.

[0040] The encryption function 82 shown in FIG. 3 has an encryption function Enc_K and a hash function H. The encryption function Enc_K is an AEAD encryption function. The hash function H is a collision-resistant hash function. The nonce N, associated data A, and plaintext M are input to the encryption function 82. The encryption function Enc_K performs keyed permutation using the secret key K. The encryption function Enc_K takes as input the nonce N, associated data A, and plaintext M input to the encryption function 82, and outputs the ciphertext C obtained by encrypting the plaintext M and a tag T'. Here, it should be noted that the encryption function 82 according to the CTX method does not output the tag T'. The hash function H takes as input the secret key K, the nonce N and associated data A input to the encryption function 82, and the tag T', and outputs an authentication tag T. Here, since the hash function H has collision resistance, it is difficult for the output tag T to collide. The encryption function 82 outputs the set (N, A, C, T) of the nonce N, associated data A, ciphertext C, and tag T to the decryption side.

[0041] The decryption function 84 shown in FIG. 4 has a decryption function Dec_K and a hash function H. The decryption function Dec_K is an AEAD decryption function and is the decryption function corresponding to the encryption function Enk_K of the encryption function 82. The hash function H is a collision-resistant hash function and is substantially the same function as the hash function H of the encryption function 82. The nonce N, associated data A, ciphertext C, and tag T are input to the decryption function 84. The decryption function Dec_K performs keyed permutation using the secret key K. The decryption function Dec_K takes as input the nonce N, associated data A, and ciphertext C input to the decryption function 84, and outputs the plaintext M obtained by decrypting the ciphertext C and a tag T'. That is, it should be noted that the decryption function Dec_K in the decryption function 84 does not require the input of a tag to decrypt the plaintext M. Also, it should be noted that the plaintext M output from the decryption function Dec_K is an unverified plaintext for which forgery detection has not been performed. The hash function H takes as input the secret key K, the nonce N and associated data A input to the decryption function 84, and the tag T', and outputs a verification tag T*.

[0042] Also, the decryption function 84 performs forgery detection by comparing the verification tag T^* and the authentication tag T. That is, when the verification tag T^* matches the authentication tag T, i.e., when T^* = T, the decryption function 84 determines that no forgery has occurred and outputs the plaintext M. On the other hand, when the verification tag T^* does not match the authentication tag T, i.e., when T^* ≠ T, the decryption function 84 determines that forgery has occurred and outputs an error message ⊥.

[0043] Figures 5 to 6 are diagrams for explaining a method of implementing an AEAD that can achieve Key committing security by applying the methods of HtE (Hash-then-Encrypt) and RtC (MRAE (Misuse-resistant AE security)-then-Commit) according to Non-Patent Document 2. Figure 5 shows an encryption function 92 to which the HtE + RtC method according to Non-Patent Document 2 is applied. Figure 6 shows a decryption function 94 to which the HtE + RtC method according to Non-Patent Document 2 is applied.

[0044] The encryption function 92 shown in Figure 5 has a hash function H, a function F, an encryption function Enc_L’, and a hash function H’. Also, the encryption function 92 has a secret key K in advance. The hash function H and the hash function H’ are hash functions with collision resistance. The encryption function Enc_L’ is an AEAD encryption function. The function F is a function that outputs two bit strings. The nonce N, the associated data A, and the plaintext M are input to the encryption function 92. The hash function H takes the secret key K, the nonce N and the associated data A input to the encryption function 92 as inputs and outputs a bit string L. The function F takes the bit string L and the nonce N input to the encryption function 92 as inputs and outputs two bit strings P and L’. Note that the function F outputs each bit string such that the bit string P is collision-resistant and the bit string L’ is a random number. That is, the function F is a function that has collision resistance for the output bit string P and randomness for the output bit string L’.

[0045] The encryption function Enc_L’ performs a keyed substitution using the bit sequence L’ output from the function F as the secret key. The encryption function Enc_L’ takes as input the nonce N and the plaintext M input to the encryption function 92, and outputs the ciphertext C obtained by encrypting the plaintext M and the tag T. The hash function H’ takes as input the bit sequence P output from the function F and the tag T, and outputs the tag T’. The encryption function 92 outputs the set (N, A, C, T, T’) of the nonce N, the associated data A, the ciphertext C, the tag T, and the tag T’ to the decryption side.

[0046] The decryption function 94 shown in FIG. 6 has the hash function H, the function F, the decryption function Dec_L’, and the hash function H’. Also, the decryption function 94 has a secret key K in advance. The hash function H and the hash function H’ are hash functions having collision resistance, and are substantially the same functions as the hash function H and the hash function H’ of the encryption function 92, respectively. The function F is substantially the same function as the function F of the encryption function 92. The decryption function Dec_L’ is an AEAD decryption function and is the decryption function corresponding to the encryption function Enk_L’ of the encryption function 92. The nonce N, the associated data A, the ciphertext C, the tag T, and the tag T’ are input to the decryption function 94. The hash function H takes as input the secret key K, the nonce N, and the associated data A input to the decryption function 94, and outputs the bit sequence L. The function F takes as input the bit sequence L and the nonce N input to the encryption function 92, and outputs two bit sequences P and L’.

[0047] The decryption function Dec_L’ performs a keyed substitution using the bit sequence L’ output from the function F as the secret key. The decryption function Dec_L’ takes as inputs the nonce N, the ciphertext C, and the tag T input to the decryption function 94, and outputs the plaintext M or the error message ⊥. That is, the decryption function Dec_L’ outputs the plaintext M when no tampering has been done to the input values. On the other hand, the decryption function Dec_L’ outputs the error message ⊥ when tampering has been done to the input values. Note that it should be noted that the plaintext M output from the decryption function Dec_L’ is an unverified plaintext for which no tampering detection has been done using the tag output from the hash function H’. The hash function H’ takes as inputs the bit sequence P output from the function F and the tag T input to the decryption function 94, and outputs the tag T^*. The decryption function 94 performs tampering detection by comparing the tag T^* output from the hash function H’ with the tag T’ input to the decryption function 94. The decryption function 94 outputs the plaintext M, which is the decryption result, when the output of the decryption function Dec_L’ is the plaintext M and the tag T^* output from the hash function H’ matches the tag T’ input to the decryption function 94. On the other hand, the decryption function 94 outputs the error message ⊥ in other cases.

[0048] Here, consider realizing an EtE method having CMT-4 security by applying the EtE method described above with reference to FIG. 2 to the CTX method described above with reference to FIGS. 3 and 4. As shown in FIG. 4, in the CTX method, the nonce N, the associated data A, and the ciphertext C are input to the decryption function Dec_K. Here, the ciphertext C input to the decryption function Dec_K is purely the encrypted plaintext M only. Therefore, the decryption function Dec_K in the CTX method can perform decryption without inputting information for tampering detection such as a tag and obtain the plaintext M. In other words, in the CTX method, when decrypting, the plaintext M can be obtained using only a part of the information (i.e., the ciphertext C) of the information of the ciphertext C and the tag T output from the encryption function 82.

[0049] On the other hand, as described above, the encryption function of the EtE method encrypts the bit sequence obtained by encoding the plaintext M and outputs the ciphertext C. Therefore, the ciphertext C input to the decryption function of the EtE method is not simply the encrypted plaintext M alone. That is, for the AEAD decryption function of the EtE method, when obtaining the plaintext M by decryption, it is necessary to input not only the information obtained by encrypting only the pure plaintext M but also the information for detecting forgery. In other words, in the EtE method, at the time of decryption, if not all of the ciphertext C obtained by encrypting the information including the plaintext M and the bit sequence (0^τ) for forgery detection output from the AEAD encryption function is used, the plaintext M cannot be obtained. Therefore, the EtE method cannot be simply applied to the CTX method. In other words, simply replacing the encryption function Enc_K of the encryption function 82 of the CTX method with the AEAD encryption function shown in FIG. 2 and replacing the decryption function Dec_K of the decryption function 84 of the CTX method with the decryption function corresponding to the AEAD encryption function shown in FIG. 2 is not possible.

[0050] Therefore, consider transforming the output from the encryption function 82 of the CTX method into a set (N, A, C, T, T') of a nonce N, associated data A, ciphertext C, tag T, and tag T'. In this case, in the decryption function 84 of the CTX method, it also seems that the decryption function Dec_K can be transformed to perform decryption using the received ciphertext C and tag T' to obtain the plaintext M.

[0051] However, in this case, the output from the encryption function 82 of the CTX method expands. That is, as described above, in general AEAD, the data output from Alice to Bob is (N, A, C, T). Therefore, the output of the encryption function 82 expands by the length of the tag T' bits. That is, compared with the case of general AEAD, the amount of data output from the encryption function 82 increases. In other words, compared with the case of general AEAD, the amount of data output from Alice to Bob increases. This increased bit length of the tag T' may not be relatively negligible, especially when the bit length of the plaintext M to be processed is not very large. Therefore, in the method described above, there is a possibility that the load on the communication path increases.

[0052] Also, consider realizing an EtE method with CMT-4 security by applying the EtE method described above with reference to FIG. 2 to the HtE+RtC method described above with reference to FIGS. 5 and 6. As shown in FIG. 6, in the HtE+RtC method, the inputs to the decryption function Dec_L' are the nonce N, the ciphertext C, and the tag T. Therefore, consider applying the encryption function Enc_L' of the encryption function 92 shown in FIG. 5 to the AEAD encryption function of the EtE method, and applying the decryption function Dec_L' of the decryption function 94 shown in FIG. 6 to the AEAD decryption function of the EtE method. In this case, the encryption function 92 outputs the nonce N, the associated data A, the ciphertext C of |M|+τ bits output from the encryption function Enc_L', and the tag T' to the decryption side. Then, in the decryption function 94, by inputting the nonce N and the ciphertext C of |M|+τ bits to the decryption function Dec_L', the plaintext M or the error message ⊥ is output.

[0053] However, in the HtE+RtC method, the output from the encryption function 92 expands. That is, the encryption function 92 outputs not only the nonce N, associated data A, ciphertext C, and tag T’, but also the tag T. Therefore, the output of the encryption function 92 expands by the amount of the tag T. As described above, in general AEAD, the data output from Alice to Bob is (N,A,C,T). Therefore, the output of the encryption function 92 expands by the amount of the tag T. That is, the amount of data output from the encryption function 92 increases compared to the case of general AEAD. In other words, the amount of data output from Alice to Bob increases compared to the case of general AEAD. This increased bit length of the tag T is relatively non-negligible, especially when the bit length of the plaintext M being processed is not very large. Therefore, in the method described above, there is a risk of an increase in the load on the communication path. When the EtE method is applied to the HtE+RtC method, the amount of data excluding the nonce N and associated data A from the data output from the encryption function 92 is the sum of |M|+τ bits and the bit length |T’| of the tag T’. Therefore, the expansion of the output by the amount of the tag T described above corresponds to τ bits. Therefore, even when the EtE method is applied to the HtE+RtC method, there is a risk of an increase in the load on the communication path compared to general AEAD.

[0054] Therefore, if the method of realizing AEAD using WTBC is simply applied to the methods of Non-Patent Document 1 and Non-Patent Document 2, the amount of output data of the encryption function increases, so there is a possibility that the load on the communication path increases. On the other hand, in the authentication encryption system 1 according to the present disclosure, as will be described later, in AEAD using WTBC, it is possible to achieve CMT-4 security while suppressing an increase in the amount of data output from the encryption side (Alice). Here, as described above, by using WTBC, strong security can be achieved, and by achieving CMT-4 security, a different type of security from the security that WTBC can achieve can be achieved. Therefore, the authentication encryption system 1 according to the present disclosure can suppress an increase in the load on the communication path while realizing high security.

[0055] (Embodiment 1) Hereinafter, embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings are appropriately omitted and simplified. Also, in each drawing, the same elements are denoted by the same reference numerals, and duplicate explanations are omitted as necessary.

[0056] FIG. 7 is a diagram showing the configuration of the authentication encryption system 1 according to the present disclosure. The authentication encryption system 1 includes an authentication encryption device 10 and an authentication decryption device 20. The authentication encryption device 10 and the authentication decryption device 20 may be physically integrated or separate. When the authentication encryption device 10 and the authentication decryption device 20 are physically separate from each other, the authentication encryption device 10 and the authentication decryption device 20 are communicably connected via wire or wireless. Also, the components of the authentication encryption device 10 described later may be realized by different devices from each other. Similarly, the components of the authentication decryption device 20 described later may be realized by different devices from each other. Also, in the example of communication between Alice and Bob described above, the authentication encryption device 10 corresponds to Alice, and the authentication decryption device 20 corresponds to Bob. That is, communication is performed between the authentication encryption device 10 and the authentication decryption device 20.

[0057] <Authentication Encryption Device> FIG. 8 is a diagram showing the configuration of the authentication encryption device 10 according to the present disclosure. Also, FIG. 9 is a diagram showing an outline of operations in the authentication encryption process executed by the authentication encryption device 10 according to the present disclosure. As shown in FIG. 8, the authentication encryption device 10 includes an input unit 100, an encryption unit 110, a plaintext processing unit 122, a ciphertext processing unit 124, a tag generation unit 140, and an output unit 150.

[0058] The authentication encryption device 10 can be realized by an information processing device such as a computer, for example. That is, the authentication encryption device 10 has an arithmetic device such as a CPU (Central Processing Unit) and a storage device such as a memory or a disk. The authentication encryption device 10 realizes each of the above components by, for example, the arithmetic device executing a program stored in the storage device. This is the same in other embodiments described later.

[0059] The input unit 100 has a function as input means. The encryption unit 110 has a function as encryption means. The plaintext processing unit 122 has a function as plaintext processing means (first plaintext processing means). The ciphertext processing unit 124 has a function as ciphertext processing means (first ciphertext processing means). The tag generation unit 140 has a function as tag generation means. The output unit 150 has a function as output means.

[0060] The input unit 100 receives the input of the nonce N, the plaintext M to be encrypted, and the associated data A. The nonce N is an n-bit bit string. Also, the plaintext M and the associated data A are each an arbitrarily long bit string. The input unit 100 may be realized by an input device such as a keyboard, for example. The input unit 100 may receive the input of the nonce N, the plaintext M, and the associated data A from an external device connected via a network, for example.

[0061] Incidentally, the input unit 100 may generate a nonce N. In this case, the input unit 100 generates the nonce N so as not to duplicate past values. That is, the input unit 100 generates a nonce N different from the values generated in the past. Specifically, for example, the input unit 100 first generates an arbitrary fixed value. Also, the input unit 100 stores the value of the nonce generated immediately before. Then, when generating the nonce N for the second time and later, the input unit 100 outputs a value obtained by adding 1 to the stored immediately previous value. In this way, the input unit 100 may generate a nonce N different from the values generated in the past by outputting a value obtained by adding 1 to the value already output one before. Note that the input unit 100 may generate a nonce in a method different from the above example as long as it can generate a value different from the values generated in the past. Alternatively, another component such as a nonce generation unit may generate the nonce N.

[0062] The input unit 100 outputs the plaintext M to the encryption unit 110 and the plaintext processing unit 122. Also, the input unit 100 outputs the nonce N to the encryption unit 110, the tag generation unit 140, and the output unit 150. Also, the input unit 100 outputs the related data A to the encryption unit 110, the tag generation unit 140, and the output unit 150.

[0063] The encryption unit 110 encrypts the plaintext M using the WTBC encryption function E shown in FIG. 1 ~ to obtain the ciphertext C. In other words, the encryption unit 110 encrypts the plaintext M using the WTBC encryption function E shown in FIG. 1 ~ as an encryption component to obtain the ciphertext C. Specifically, as shown in FIG. 9, the encryption unit 110 inputs the nonce N, the related data A, and the key K to the WTBC encryption function E ~ , and further inputs the plaintext M to the WTBC encryption function E ~ . Then, the encryption unit 110 inputs the WTBC encryption function E ~Obtain the ciphertext C with the same bit length as the plaintext M output from []. That is, |M| = |C|. Here, the nonce N and the associated data A are used as a tweak. That is, the encryption unit 110 encrypts the plaintext M of any length using the tweak including the nonce N and the associated data A and the key K, and generates the ciphertext C with the same length as the length of the plaintext M. In other words, the encryption unit 110 encrypts the plaintext M using the nonce N and the associated data A as a tweak to generate the ciphertext C. Note that the encryption unit 110 uses the WTBC encryption function E ~ to encrypt the plaintext M, so it can encrypt a plaintext of any length, but it does not necessarily always encrypt a plaintext of any length. If there are restrictions on the length of the plaintext M input to the input unit 100 due to system constraints or the like, the encryption unit 110 may encrypt the plaintext M with the restricted length. The same applies to the decryption unit of the authentication decryption device 20 described later. The same also applies to other embodiments described later. The encryption unit 110 outputs the generated ciphertext C to the ciphertext processing unit 124 and the output unit 150.

[0064] The plaintext processing unit 122 processes the plaintext M to generate a plaintext-derived value M[1] (first value) derived from the plaintext M. Here, the plaintext-derived value M[1] is used to generate the authentication tag T in the tag generation unit 140 described later. That is, the plaintext processing unit 122 generates a plaintext-derived value M[1] (first value) used for generating the authentication tag T from the plaintext M. Specifically, the plaintext processing unit 122 generates a plaintext-derived value M[1] with a length of m (first length) from the plaintext M. The plaintext processing unit 122 may also generate a plaintext-derived value M[1] with a predetermined fixed length m (first length) from the plaintext M. More specifically, the plaintext processing unit 122 may generate the plaintext-derived value M[1] by extracting a bit sequence with a fixed length m, which is a part of the bit sequence of the plaintext M.

[0065] For example, the plaintext processing unit 122 may extract the upper m bits or the lower m bits of the bit sequence of the plaintext M, and use the extracted m-bit bit sequence as the plaintext-derived value M[1]. For example, when the WTBC decryption function (E ~ )^(-1) used in the decryption unit 210 of the authentication decryption device 20 to be described later outputs the plaintext M in order from the beginning, the plaintext processing unit 122 may use the upper m bits of the bit sequence of the plaintext M as the plaintext-derived value M[1]. On the other hand, when the WTBC decryption function (E ~ )^(-1) used in the decryption unit 210 outputs the plaintext M in order from the end, the plaintext processing unit 122 may use the lower m bits of the bit sequence of the plaintext M as the plaintext-derived value M[1]. By generating the plaintext-derived value M[1] in this way, the plaintext processing unit 122 can generate the plaintext-derived value M[1] by efficient and simple processing. Therefore, the load on the computing resources can be reduced. In this case, it is assumed that the bit length |M| of the plaintext M is longer than m. That is, |M|>m.

[0066] The ciphertext processing unit 124 processes the ciphertext C and generates a ciphertext-derived value C[1] (second value) derived from the ciphertext C. Here, the ciphertext-derived value C[1] is used to generate the authentication tag T in the tag generation unit 140 to be described later. That is, the ciphertext processing unit 124 generates a ciphertext-derived value C[1] (second value) used for generating the authentication tag T from the ciphertext C. Specifically, the ciphertext processing unit 124 generates a ciphertext-derived value C[1] of length c (second length) from the ciphertext C. Also, the ciphertext processing unit 124 may generate a ciphertext-derived value C[1] of a predetermined fixed length c (second length) from the ciphertext C. More specifically, the ciphertext processing unit 124 may generate the ciphertext-derived value C[1] by extracting a bit sequence of a fixed length c, which is a part of the bit sequence of the ciphertext C.

[0067] For example, the ciphertext processing unit 124 may extract the upper c bits or the lower c bits of the bit sequence of the ciphertext C, and use the extracted c-bit bit sequence as the ciphertext-derived value C[1]. For example, the WTBC encryption function E used in the encryption unit 110 ~From this, when the ciphertext C is output in order from the beginning, the plaintext processing unit 122 may use the upper c bits of the bit string of the ciphertext C as the ciphertext-derived value C[1]. On the other hand, the WTBC encryption function E used by the encryption unit 110 ~ From this, when the ciphertext C is output in order from the end, the plaintext processing unit 122 may use the lower c bits of the bit string of the ciphertext C as the ciphertext-derived value C[1]. By generating the ciphertext-derived value C[1] in this way, the ciphertext processing unit 124 can generate the ciphertext-derived value C[1] by an efficient and simple process. Therefore, the load on the computing resources can be reduced. In this case, it is assumed that the bit length |C| of the ciphertext C is longer than c. That is, |C| > c (that is, |M| > c).

[0068] The tag generation unit 140 generates an authentication tag T using the hash function H. Specifically, the tag generation unit 140 inputs the key K, the nonce N, the associated data A, and two input values corresponding to the plaintext-derived value M[1] and the ciphertext-derived value C[1] to the hash function H, and generates a hash value of a predetermined length t as the authentication tag T. Here, in the first embodiment, the "two input values" may be the plaintext-derived value M[1] and the ciphertext-derived value C[1] themselves. Therefore, in the first embodiment, the tag generation unit 140 inputs the key K, the nonce N, the associated data A, the plaintext-derived value M[1], and the ciphertext-derived value C[1] to the hash function H to generate the authentication tag T of length t. The tag generation unit 140 outputs the generated authentication tag T to the output unit 150.

[0069] Here, the hash function H is a function with an arbitrary input length (variable length) and a fixed output length t. The length t of the hash value can be appropriately set according to the required security level. The length t of the hash value can be set longer as the required security level is higher.

[0070] Also, the hash function H has collision resistance, similar to that in the CTX method or the HtE+RtC method described above. That is, for the hash function H, the probability that the output values collide for the input values is sufficiently small. In other words, for different inputs, the hash function H has a high probability of not generating output collisions. Therefore, the authentication tag T has collision resistance for the values input to the hash function H. Also, in CMT-4 security, the collision resistance for different input pairs of (K, N, A, M) for the authenticated cipher is considered. Considering the case where the input pairs of (K, N, A) are the same and only the plaintext M is different among these input pairs, the probability that the ciphertexts C do not collide is extremely high. Therefore, if one attempts to cause the ciphertexts C to collide, it is necessary to make the input pairs of (K, N, A) different. Therefore, it can be ensured that the inputs of the hash functions illustrated in FIG. 9 are different. Therefore, the authenticated encryption device 10 according to Embodiment 1 can achieve security such as CMT-4 security (Key committing security). Also, the hash function H is a pseudo-random function (PRF) such that a random number is output when secret information is input. Therefore, in a situation where an attacker does not know the information of the key K, the hash value can be a random number that is difficult for the attacker to predict.

[0071] Here, even if the bit length m of the plaintext-derived value M[1] input to the hash function H and the bit length c of the ciphertext-derived value C[1] input to the hash function H are long, there is no security problem. Therefore, for example, even if the plaintext-derived value M[1] is the plaintext M itself and the ciphertext-derived value C[1] is the ciphertext C itself, there is no security problem. However, even if these bit lengths m and c are long, the security does not necessarily improve. And when these bit lengths m and c are long, the amount of data processed by the hash function increases, so the efficiency of calculating the hash value (tag) decreases. Therefore, the bit length m of the plaintext-derived value M[1] and the bit length c of the ciphertext-derived value C[1] are preferably short enough to ensure security. Here, among the bit length m of the plaintext-derived value M[1], the bit length c of the ciphertext-derived value C[1], and the length t of the tag T, the smallest number is related to the security level. Therefore, in order to improve security and perform calculations efficiently, it is preferable to make the bit length m of the plaintext-derived value M[1] and the bit length c of the ciphertext-derived value C[1] equal to the length t of the tag T, that is, m = c = t.

[0072] In this case, the plaintext processing unit 122 generates a plaintext-derived value M[1] with a fixed length m equal to the length t. Also, the ciphertext processing unit 124 generates a ciphertext-derived value C[1] with a fixed length c equal to the length t. Further, if the length |M| of the plaintext M is longer than the length t, the plaintext processing unit 122 may generate the plaintext-derived value M[1] by extracting a bit sequence of length t from the bit sequence of the plaintext M. For example, the plaintext processing unit 122 may extract the upper t bits or the lower t bits from the bit sequence of the plaintext M, and use the extracted t-bit bit sequence as the plaintext-derived value M[1]. By generating the plaintext-derived value M[1] in this way, the plaintext processing unit 122 can generate the plaintext-derived value M[1] by simple processing. Therefore, it is possible to ensure security while reducing the load on the calculation resources. And as shown in FIG. 9, the plaintext-derived value M[1] of length t is input to the hash function H.

[0073] Similarly, the ciphertext processing unit 124 may generate a ciphertext-derived value C[1] by extracting a bit string of length t from the bit string of the ciphertext C. For example, the ciphertext processing unit 124 may extract the upper t bits or the lower t bits of the bit string of the ciphertext C, and use the extracted t-bit bit string as the ciphertext-derived value C[1]. By generating the ciphertext-derived value C[1] in this way, the ciphertext processing unit 124 can generate the ciphertext-derived value C[1] by simple processing. Therefore, it is possible to ensure security while reducing the load on computing resources. Then, as shown in FIG. 9, the ciphertext-derived value C[1] of length t is input to the hash function H.

[0074] The output unit 150 performs control for outputting the ciphertext C and the authentication tag T. At this time, the output unit 150 may concatenate and output the ciphertext C and the authentication tag T. The output unit 150 may perform control for displaying the ciphertext C and the authentication tag T on an output device such as a display, for example. Also, the output unit 150 may perform control to output the ciphertext C and the authentication tag T to an external device connected via a network, for example. Further, the output unit 150 may perform control to output the nonce N and the related data A. For example, the output unit 150 transmits (N, A, C, T) to the authentication and decryption device 20.

[0075] <Authentication and decryption device> FIG. 10 is a diagram showing the configuration of the authentication and decryption device 20 according to the present disclosure. Also, FIG. 11 is a diagram showing an outline of operations in the authentication and decryption process executed by the authentication and decryption device 20 according to the present disclosure. As shown in FIG. 10, the authentication and decryption device 20 includes an input unit 200, a decryption unit 210, a plaintext processing unit 222, a ciphertext processing unit 224, a tag generation unit 240, and a verification unit 250.

[0076] The authentication and decryption device 20 can be realized by an information processing device such as a computer, for example. That is, the authentication and decryption device 20 has an arithmetic device such as a CPU and a storage device such as a memory or a disk. The authentication and decryption device 20 realizes each of the above components by, for example, the arithmetic device executing a program stored in the storage device. This also applies to other embodiments described later.

[0077] The input unit 200 has a function as input means. The decryption unit 210 has a function as decryption means. The plaintext processing unit 222 has a function as plaintext processing means (second plaintext processing means). The ciphertext processing unit 224 has a function as ciphertext processing means (second ciphertext processing means). The tag generation unit 240 has a function as tag generation means. The verification unit 250 has a function as verification means.

[0078] The input unit 200 receives the input of the nonce N, the related data A, the ciphertext C to be decrypted, and the authentication tag T output from the authentication encryption device 10. The input unit 200 may be realized by an input device such as a keyboard, for example. The input unit 200 may receive the input of the nonce N, the related data A, the ciphertext C, and the authentication tag T from an external device connected via a network, for example. The input unit 200 outputs the nonce N to the decryption unit 210 and the tag generation unit 240. Further, the input unit 200 outputs the related data A to the decryption unit 210 and the tag generation unit 240. Further, the input unit 200 outputs the ciphertext C to the decryption unit 210 and the ciphertext processing unit 224. Further, the input unit 200 outputs the authentication tag T to the verification unit 250.

[0079] The decryption unit 210 performs a decryption process corresponding to the encryption process in the encryption unit 110 described above. The decryption unit 210 uses the WTBC decryption function (E ~ )^(-1) corresponding to the WTBC encryption function E shown in FIG. 1 to decrypt the ciphertext C and obtain the plaintext M. In other words, the decryption unit 210 uses the WTBC decryption function (E ~ )^(-1) corresponding to the WTBC encryption function E shown in FIG. 1 to decrypt the ciphertext C and obtain the plaintext M. ~ The decryption unit 210 uses the WTBC decryption function (E ~)^(-1) is used as a cryptographic component to decrypt the ciphertext C and obtain the plaintext M. Specifically, as shown in FIG. 11, the decryption unit 210 inputs the nonce N, the associated data A, and the key K into the WTBC decryption function (E ~ )^(-1), and further inputs the ciphertext C into the WTBC decryption function (E ~ )^(-1). Then, the decryption unit 210 obtains the plaintext M with the same bit length as the ciphertext C output from the WTBC decryption function (E ~ )^(-1). Here, the nonce N and the associated data A are used as a tweak. That is, the decryption unit 210 decrypts an arbitrary-length ciphertext C using the tweak including the nonce N and the associated data A and the key K, and generates a plaintext M with the same length as the ciphertext C. In other words, the decryption unit 210 decrypts the ciphertext C using the nonce N and the associated data A as a tweak and generates the plaintext M. The decryption unit 210 outputs the generated plaintext M to the plaintext processing unit 222 and the verification unit 250.

[0080] The plaintext processing unit 222 performs substantially the same processing on the plaintext M as the above-described plaintext processing unit 122. Therefore, if the plaintext M generated by the decryption process is the same as the plaintext M processed by the above-described plaintext processing unit 122, the plaintext processing unit 222 generates the same plaintext-derived value M[1] as the plaintext-derived value M[1] generated by the plaintext processing unit 122.

[0081] The plaintext processing unit 222 processes the plaintext M and generates a plaintext-derived value M[1] (the first value, the third value) derived from the plaintext M. Here, the plaintext-derived value M[1] is used to generate a verification tag T^* in the tag generation unit 240 described later. That is, the plaintext processing unit 222 generates a plaintext-derived value M[1] used for generating the verification tag T^* from the plaintext M. Specifically, the plaintext processing unit 222 generates a plaintext-derived value M[1] with a length of m (the first length) from the plaintext M. Also, the plaintext processing unit 222 may generate a plaintext-derived value M[1] with a predetermined fixed length m (the first length) from the plaintext M. More specifically, the plaintext processing unit 222 may generate the plaintext-derived value M[1] by extracting a bit sequence with a fixed length m, which is a part of the bit sequence of the plaintext M.

[0082] For example, in the same manner as the plaintext processing unit 122 of the authentication encryption device 10, the plaintext processing unit 222 may extract the upper m bits or the lower m bits of the bit string of the plaintext M, and use the extracted m-bit bit string as the plaintext-derived value M[1]. By generating the plaintext-derived value M[1] in this way, the plaintext processing unit 222 can generate the plaintext-derived value M[1] by efficient and simple processing. Therefore, the load on the computing resources can be reduced. In this case, it is assumed that the bit length |M| of the plaintext M is longer than m. That is, |M| > m.

[0083] The ciphertext processing unit 224 performs substantially the same processing on the ciphertext C as the above-described ciphertext processing unit 124. Therefore, if the ciphertext C input to the authentication decryption device 20 is the same as the ciphertext C processed by the above-described ciphertext processing unit 124, the ciphertext processing unit 224 generates the same ciphertext-derived value C[1] as the ciphertext-derived value C[1] generated by the ciphertext processing unit 124.

[0084] The ciphertext processing unit 224 processes the ciphertext C to generate a ciphertext-derived value C[1] (second value, fourth value) derived from the ciphertext C. Here, the ciphertext-derived value C[1] is used to generate the verification tag T^* in the tag generation unit 240 described later. That is, the ciphertext processing unit 224 generates a ciphertext-derived value C[1] used for generating the verification tag T^* from the ciphertext C. Specifically, the ciphertext processing unit 224 generates a ciphertext-derived value C[1] of length c (second length) from the ciphertext C. Further, the ciphertext processing unit 224 may generate a ciphertext-derived value C[1] of a predetermined fixed length c (second length) from the ciphertext C. More specifically, the ciphertext processing unit 224 may generate the ciphertext-derived value C[1] by extracting a bit string of a fixed length c, which is a part of the bit string of the ciphertext C.

[0085] For example, the ciphertext processing unit 224 may extract the upper c bits or the lower c bits of the bit string of the ciphertext C by the same method as the ciphertext processing unit 124 of the authentication encryption device 10, and use the extracted c-bit bit string as the ciphertext-derived value C[1]. By generating the ciphertext-derived value C[1] in this way, the ciphertext processing unit 224 can generate the ciphertext-derived value C[1] by efficient and simple processing. Therefore, the load on the computing resources can be reduced. In this case, it is assumed that the bit length |C| of the ciphertext C is longer than c. That is, |C|>c (that is, |M|>c).

[0086] The tag generation unit 240 generates the verification tag T^* using the hash function H. Specifically, the tag generation unit 240 inputs the key K, the nonce N, the associated data A, and two input values corresponding to the plaintext-derived value M[1] and the ciphertext-derived value C[1] into the hash function H, and generates a hash value of a predetermined length t as the verification tag T^*. Here, in the first embodiment, the "two input values" may be the plaintext-derived value M[1] and the ciphertext-derived value C[1] themselves. Therefore, in the first embodiment, the tag generation unit 240 inputs the key K, the nonce N, the associated data A, the plaintext-derived value M[1], and the ciphertext-derived value C[1] into the hash function H, and generates the verification tag T^* of length t. The tag generation unit 240 outputs the generated verification tag T^* to the verification unit 250.

[0087] Note that the hash function H used by the tag generation unit 240 is substantially the same as the hash function H used by the tag generation unit 140 described above. Therefore, the probability that the output value collides with the input value of the hash function H is sufficiently small. Therefore, the verification tag T^* has collision resistance with respect to the value input to the hash function H. Therefore, the authentication decryption device 20 according to the first embodiment can achieve security such as CMT-4 security (Key committing security).

[0088] Also, in the same manner as the plaintext processing unit 122, the plaintext processing unit 222 may generate a plaintext-derived value M[1] with a fixed length m being t. For example, if the length |M| of the plaintext M is longer than the length t, the plaintext processing unit 222 may generate the plaintext-derived value M[1] by extracting a bit string of length t from the bit string of the plaintext M. By generating the plaintext-derived value M[1] in this way, the plaintext processing unit 222 can generate the plaintext-derived value M[1] by simple processing. Therefore, it is possible to ensure security while reducing the load on the computing resources. Then, as shown in FIG. 11, the plaintext-derived value M[1] of length t is input to the hash function H.

[0089] Similarly, in the same manner as the ciphertext processing unit 124, the ciphertext processing unit 224 may generate a ciphertext-derived value C[1] with a fixed length c being t. For example, the ciphertext processing unit 224 may generate the ciphertext-derived value C[1] by extracting a bit string of length t from the bit string of the ciphertext C. By generating the ciphertext-derived value C[1] in this way, the ciphertext processing unit 224 can generate the ciphertext-derived value C[1] by simple processing. Therefore, it is possible to ensure security while reducing the load on the computing resources. Then, as shown in FIG. 11, the ciphertext-derived value C[1] of length t is input to the hash function H.

[0090] The verification unit 250 compares the authentication tag T generated by the authenticated encryption device 10 with the verification tag T^* generated by the tag generation unit 240 to verify the presence or absence of forgery. Then, based on the verification result, the verification unit 250 performs control for outputting information. That is, the verification unit 250 verifies the presence or absence of forgery by comparing the verification tag T^* with the input authentication tag T. Then, the verification unit 250 performs control for outputting the verification result. Note that the verification unit 250 may perform control for displaying information on an output device such as a display, for example. Also, the verification unit 250 may perform control for outputting information to an external device connected via a network, for example.

[0091] Specifically, when the authentication tag T and the verification tag T^* match, the verification unit 250 performs control to output the plaintext M generated by the decryption unit 210, assuming that the authentication is successful. On the other hand, when the authentication tag T and the verification tag T^* do not match, the verification unit 250 performs control to output an error message ⊥ indicating that the authentication tag T and the verification tag T^* do not match, assuming that the authentication has failed.

[0092] <Authentication Encryption Method and Authentication Decryption Method> Next, with reference to FIGS. 12 and 13, the operation of the authentication encryption system 1 according to the present disclosure will be described. FIG. 12 is a flowchart showing an authentication encryption method executed by the authentication encryption apparatus 10 according to the present disclosure.

[0093] As described above, the input unit 100 inputs the nonce N, the plaintext M, and the related data A (step S102). The encryption unit 110 encrypts the plaintext M as described above to obtain the ciphertext C (step S110). The plaintext processing unit 122 processes the plaintext M as described above to generate a plaintext-derived value M[1] (step S122). The ciphertext processing unit 124 processes the ciphertext C as described above to generate a ciphertext-derived value C[1] (step S124).

[0094] Next, as described above, the tag generation unit 140 generates the authentication tag T using the key K, the nonce N, the related data A, the plaintext-derived value M[1], and the ciphertext-derived value C[1] (step S140). Then, the output unit 150 outputs the nonce N, the related data A, the ciphertext C, and the authentication tag T (step S150).

[0095] FIG. 13 is a flowchart showing an authentication decryption method executed by the authentication decryption device 20 according to the present disclosure. As described above, the input unit 200 inputs the nonce N, the related data A, the ciphertext C, and the authentication tag T (step S202). The decryption unit 210 decrypts the ciphertext C to obtain the plaintext M as described above (step S210). The plaintext processing unit 222 processes the plaintext M to generate a plaintext-derived value M[1] as described above (step S222). The ciphertext processing unit 224 processes the ciphertext C to generate a ciphertext-derived value C[1] as described above (step S224).

[0096] Next, as described above, the tag generation unit 240 generates a verification tag T* using the key K, the nonce N, the related data A, the plaintext-derived value M[1], and the ciphertext-derived value C[1] (step S240). The verification unit 250 determines whether the authentication tag T and the verification tag T* match as described above (step S250). When the authentication tag T and the verification tag T* match (YES in S250), the verification unit 250 outputs the plaintext M (step S252). On the other hand, when the authentication tag T and the verification tag T* do not match (NO in S250), the verification unit 250 outputs an error message ⊥ (step S254).

[0097] <Effect> The effect of the authentication encryption system 1 according to the present disclosure will be described. As described above, the hash function H used in the authentication encryption system 1 according to the present disclosure has collision resistance. Therefore, the tag output from the hash function H has collision difficulty with respect to the data (K, N, A, M[1], C[1]) input to the hash function H. That is, the hash function H used in the authentication encryption system 1 according to the present disclosure satisfies the following conditions. The probability of finding input pairs \((K_1, N_1, A_1, M[1]_1, C[1]_1)\) and \((K_2, N_2, A_2, M[1]_2, C[1]_2)\) that satisfy \(H(K_1, N_1, A_1, M[1]_1, C[1]_1)=H(K_2, N_2, A_2, M[1]_2, C[1]_2)\) and \((K_1, N_1, A_1, M[1]_1, C[1]_1)\neq(K_2, N_2, A_2, M[1]_2, C[1]_2)\) is sufficiently small. Also, as described above, when trying to collide ciphertexts \(C\), it is necessary to make the input pairs of \((K, N, A)\) different, so it can be ensured that the inputs to the hash function are different. Therefore, the authentication encryption system 1 according to the present disclosure can achieve CMT-4 security.

[0098] Also, from the definition of the security of the hash function \(H\) described above, if even one bit in at least one bit string of the key \(K\), nonce \(N\), associated data \(A\), plaintext-derived value \(M[1]\), and ciphertext-derived value \(C[1]\) input to the hash function \(H\) is different, the tag \(T\) which is the hash value can be different. On the other hand, if all of the key \(K\), nonce \(N\), associated data \(A\), plaintext-derived value \(M[1]\), and ciphertext-derived value \(C[1]\) input to the hash function \(H\) are the same bit strings respectively, the tag which is the hash value will be the same.

[0099] And the key \(K\), nonce \(N\), associated data \(A\), and plaintext \(M\) used in the processing by the WTBC encryption function \(E\) ~ If at least one of them is different, the output ciphertext \(C\) will be different. Therefore, the randomness of the ciphertext \(C\) with respect to the key \(K\), nonce \(N\), associated data \(A\), and plaintext \(M\) can be ensured. And if the ciphertext \(C\) is different, the ciphertext-derived value \(C[1]\) will also be different. Therefore, if the ciphertext \(C\) is different, the tag \(T\) which is the output of the hash function \(H\) with the ciphertext-derived value \(C[1]\) input will also be different. Therefore, the randomness of the tag \(T\) with respect to the key \(K\), nonce \(N\), associated data \(A\), and plaintext \(M\) can be ensured. Therefore, by inputting the ciphertext-derived value \(C[1]\) to the hash function \(H\), the secrecy ability of the ciphertext \(C\) and the tag \(T\) output from the authentication encryption device 10 can be ensured.

[0100] Next, assume a case where an attacker illegally obtains the nonce N, associated data A, ciphertext C, and authentication tag T output from the authentication encryption device 10. And assume that the attacker modifies a bit sequence other than the bit sequence caused by the ciphertext-derived value C[1] in the ciphertext C to obtain a modified ciphertext C'. For example, if the ciphertext-derived value C[1] is the upper t bits of the ciphertext C, assume that the attacker modifies the bit sequence other than the upper t bits of the bit sequence of the ciphertext C. In this case, the plaintext M' obtained by inputting the ciphertext C' into the inverse WTBC decryption function (E ~ )^(-1) through the decryption process of the decryption unit 210 is different from the correct plaintext M. The plaintext M' obtained in this case is a random number with respect to the plaintext M and the ciphertext C', and is a value that is difficult for the attacker to predict. On the other hand, the attacker can query the authentication decryption device 20 and input the same ciphertext-derived value C[1] that was input to the hash function H in the authentication encryption device 10 into the hash function H on the decryption side as well. Therefore, the attacker can obtain data other than the plaintext-derived value M[1] among the data (K, N, A, M[1], C[1]) input to the hash function H on the decryption side. Therefore, if the plaintext-derived value M[1] is not input to the hash function H, the attacker can obtain a verification tag T^* with the same bit sequence as the authentication tag T output from the authentication encryption device 10 on the decryption side. Therefore, forgery detection is not performed on the decryption side. In contrast, the plaintext-derived value M[1]' obtained from the plaintext M' is different from the plaintext-derived value M[1] obtained from the legitimate plaintext M. That is, the plaintext-derived value M[1]' that the attacker can obtain is a value that is difficult for the attacker to predict. Therefore, by inputting the plaintext-derived value M[1] into the hash function H, the verification tag T^* output from the hash function H on the decryption side will not match the authentication tag T obtained by the attacker. That is, it is difficult for the attacker to predict the verification tag T^* output in the authentication decryption device 20. Therefore, forgery detection is appropriately performed. Therefore, by inputting the plaintext-derived value M[1] into the hash function H, the forgery detection ability of the ciphertext C and the tag T output from the authentication encryption device 10 can be ensured.

[0101] Also, even if the nonce N input to the WTBC encryption function E ~ is the same, if other inputs (associated data A or plaintext M) are different, the output ciphertext C will also be different. Similarly, even if the nonce N input to the hash function H is the same, if other inputs (associated data A or plaintext M) are different, the output tag T will also be different. Therefore, even if the nonce N is the same, the randomness of the ciphertext C and the tag T can be ensured. Therefore, nonce misuse resistance can be ensured. Therefore, the authentication encryption system 1 according to the present disclosure can achieve the security realizable by the above-described EtE method.

[0102] Furthermore, in the authentication encryption system 1 according to the present disclosure, what is output from the authentication encryption device 10 is the data pair (N, A, C, T). And this data pair (N, A, C, T) is the same as the data pair output from a general AEAD encryption function (Alice as described above). Therefore, the authentication encryption system 1 according to the present disclosure can suppress an increase in the amount of data output from the authentication encryption device 10. Therefore, while realizing the security such as the security realizable by the EtE method and CMT-4 security (Key committing security), an increase in the amount of data output from the authentication encryption device 10 can be suppressed. Therefore, the authentication encryption system 1 according to the present disclosure can suppress an increase in the load in the communication path while realizing high security.

[0103] (Embodiment 2) Next, Embodiment 2 will be described. For clarity of explanation, the following description and drawings are appropriately omitted and simplified. Also, in each drawing, the same elements are denoted by the same reference numerals, and redundant explanations are omitted as necessary. Note that the system configuration according to Embodiment 2 is substantially the same as the system configuration shown in FIG. 7, and thus the description thereof is omitted. That is, the authentication encryption system 1 according to Embodiment 2 includes an authentication encryption device 10A corresponding to the authentication encryption device 10 and an authentication decryption device 20A corresponding to the authentication decryption device 20.

[0104] <Authentication and Encryption Device> FIG. 14 is a diagram showing the configuration of an authentication and encryption device 10A according to the present disclosure. Further, FIG. 15 is a diagram showing an outline of operations in the authentication and encryption process executed by the authentication and encryption device 10A according to the present disclosure. As shown in FIG. 14, the authentication and encryption device 10A includes an input unit 100, an encryption unit 110, a plaintext processing unit 122, a ciphertext processing unit 124, a calculation unit 130A, a tag generation unit 140A, and an output unit 150. Since the components other than the calculation unit 130A and the tag generation unit 140A are substantially the same as those in the first embodiment, the description thereof is omitted.

[0105] As shown in FIG. 15, the encryption unit 110 inputs a nonce N, associated data A, and a key K into the WTBC encryption function E ~ and further inputs the plaintext M into the WTBC encryption function E ~ . Then, the encryption unit 110 obtains a ciphertext C having the same bit length as the plaintext M output from the WTBC encryption function E ~ . Further, the plaintext processing unit 122 outputs a plaintext-derived value M[1] (first value) generated from the plaintext M to the calculation unit 130A. Also, the ciphertext processing unit 124 outputs a ciphertext-derived value C[1] (second value) generated from the ciphertext C to the calculation unit 130A.

[0106] The calculation unit 130A has a function as a calculation means. The calculation unit 130A calculates one input value X[1] of length x (third length) that is input to the hash function H using the plaintext-derived value M[1] (first value) and the ciphertext-derived value C[1] (second value). In other words, the calculation unit 130A calculates an input value X[1] that combines the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Here, the length x (=|X[1]|) of the input value X[1] is shorter than the sum of the length |M[1]| (=m) of the plaintext-derived value M[1] and the length |C[1]| (=c) of the ciphertext-derived value C[1]. That is, x < m + c. The calculation unit 130A outputs the calculated input value X[1] to the tag generation unit 140A.

[0107] Incidentally, the method by which the calculation unit 130A calculates the input value X[1] is arbitrary. For example, the calculation unit 130A may calculate the input value X[1] with a length x equal to the length t by using the plaintext-derived value M[1] with a length t and the ciphertext-derived value C[1] with a length t. In this case, as in the example of FIG. 15, the calculation unit 130A may calculate the input value X[1] with a length t by the exclusive logical sum (XOR) of the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Alternatively, the calculation unit 130A may calculate the input value X[1] with a length t by the arithmetic addition of the plaintext-derived value M[1] with a length t and the ciphertext-derived value C[1] with a length t. Thus, when the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1] are the same as each other, the calculation unit 130A may calculate the input value X[1] so that the length x is the same as the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1].

[0108] The tag generation unit 140A has a function as a tag generation means. Similar to the tag generation unit 140, the tag generation unit 140A generates an authentication tag T with a predetermined length t by using the hash function H. Specifically, the tag generation unit 140A inputs the key K, the nonce N, the associated data A, and one input value X[1] corresponding to the plaintext-derived value M[1] and the ciphertext-derived value C[1] to the hash function H, and generates a hash value with a length t as the authentication tag T. The tag generation unit 140A outputs the generated authentication tag T to the output unit 150.

[0109] In the example shown in FIG. 15, the input value X[1] is the exclusive logical sum (XOR) of the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Here, when both the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1] are the length t, the length x of the input value X[1] is also the length t. Therefore, the tag generation unit 140A inputs the key K, the nonce N, the associated data A, and the input value X[1] with a length t that is the exclusive logical sum of the plaintext-derived value M[1] and the ciphertext-derived value C[1] to the hash function H, and generates the authentication tag T with a length t.

[0110] Here, the hash function H used in the tag generation unit 140A according to the second embodiment may be substantially the same as the hash function H used in the tag generation unit 140 according to the first embodiment. Therefore, the hash function H used in the tag generation unit 140A according to the second embodiment is a function with an arbitrary input length (variable length) and a fixed output length t. Also, the hash function H used in the tag generation unit 140A according to the second embodiment has the security that can be realized in the first embodiment as described above.

[0111] <Authentication and Decryption Device> FIG. 16 is a diagram showing the configuration of the authentication and decryption device 20A according to the present disclosure. As shown in FIG. 16, the authentication and decryption device 20A includes an input unit 200, a decryption unit 210, a plaintext processing unit 222, a ciphertext processing unit 224, a calculation unit 230A, a tag generation unit 240A, and a verification unit 250. Since the components other than the calculation unit 230A and the tag generation unit 240A are substantially the same as those according to the first embodiment, the description thereof is omitted.

[0112] As described above, the decryption unit 210 inputs the nonce N, the related data A, and the key K into the WTBC decryption function (E ~ )^(-1), and further inputs the ciphertext C into the WTBC decryption function (E ~ )^(-1). Then, the decryption unit 210 obtains the plaintext M having the same bit length as the ciphertext C output from the WTBC decryption function (E ~ )^(-1). Also, the plaintext processing unit 222 outputs the plaintext-derived value M[1] (the first value; the third value) generated from the plaintext M to the calculation unit 230A. Further, the ciphertext processing unit 124 outputs the ciphertext-derived value C[1] (the second value; the fourth value) generated from the ciphertext C to the calculation unit 230A.

[0113] The calculation unit 230A has a function as a calculation means. The calculation unit 230A calculates one input value X[1] in substantially the same manner as the above-described calculation unit 130A. Therefore, if the plaintext-derived value M[1] and the ciphertext-derived value C[1] generated by the authentication decryption device 20A are the same as those generated by the authentication encryption device 10A, the calculation unit 230A calculates the same input value X[1] as the input value X[1] calculated by the calculation unit 130A.

[0114] The calculation unit 230A calculates one input value X[1] of length x (the third length) that is input to the hash function H by using the plaintext-derived value M[1] (the first value) and the ciphertext-derived value C[1] (the second value). In other words, the calculation unit 230A calculates the input value X[1] obtained by combining the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Here, the length x (=|X[1]|) of the input value X[1] is shorter than the sum of the length |M[1]| (=m) of the plaintext-derived value M[1] and the length |C[1]| (=c) of the ciphertext-derived value C[1]. That is, x < m + c. The calculation unit 230A outputs the calculated input value X[1] to the tag generation unit 240A.

[0115] Note that, similar to the case of the calculation unit 130A, the method by which the calculation unit 230A calculates the input value X[1] is arbitrary. For example, the calculation unit 230A may calculate the input value X[1] of length x that is the same as length t by using the plaintext-derived value M[1] of length t and the ciphertext-derived value C[1] of length t. In this case, the calculation unit 230A may calculate the input value X[1] of length t by the exclusive logical sum (XOR) of the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Alternatively, the calculation unit 230A may calculate the input value X[1] of length t by the arithmetic addition of the plaintext-derived value M[1] of length t and the ciphertext-derived value C[1] of length t. Thus, when the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1] are the same as each other, the calculation unit 230A may calculate the input value X[1] such that the length x is the same as the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1].

[0116] The tag generation unit 240A has a function as a tag generation means. Similar to the tag generation unit 240, the tag generation unit 240A uses a hash function H to generate a verification tag T^* with a predetermined length t. Specifically, the tag generation unit 240A inputs a key K, a nonce N, associated data A, and one input value X[1] corresponding to the plaintext-derived value M[1] and the ciphertext-derived value C[1] into the hash function H, and generates a hash value of length t as the verification tag T^*. The tag generation unit 240A outputs the generated verification tag T^* to the verification unit 250.

[0117] Here, when the authentication encryption device 10A is in the example shown in FIG. 15, the input value X[1] input to the tag generation unit 240A is the exclusive logical sum (XOR) of the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Here, when both the length m of the plaintext-derived value M[1] and the length c of the ciphertext-derived value C[1] are length t, the length x of the input value X[1] is also length t. Therefore, the tag generation unit 240A inputs the key K, the nonce N, the associated data A, and the input value X[1] of length t that is the exclusive logical sum of the plaintext-derived value M[1] and the ciphertext-derived value C[1] into the hash function H, and generates a verification tag T^* of length t.

[0118] Here, the hash function H used in the tag generation unit 240A according to the second embodiment is substantially the same as the hash function H used in the tag generation unit 140A. Therefore, the hash function H used in the tag generation unit 240A according to the second embodiment is a function with an arbitrary-length (variable-length) input length and a fixed-length t output length. Also, the hash function H used in the tag generation unit 240A according to the second embodiment has the above-described security.

[0119] <Authentication Encryption Method and Authentication Decryption Method> Next, with reference to FIGS. 17 and 18, the operation of the authentication encryption system 1 according to the present disclosure will be described. FIG. 17 is a flowchart showing the authentication encryption method executed by the authentication encryption device 10A according to the present disclosure.

[0120] Similar to the process of S102, the input unit 100 inputs the nonce N, the plaintext M, and the related data A (step SA102). The encryption unit 110 encrypts the plaintext M in the same way as the process of S110 to obtain the ciphertext C (step SA110). The plaintext processing unit 122 processes the plaintext M in the same way as the process of S122 to generate the plaintext-derived value M[1] (step SA122). The ciphertext processing unit 124 processes the ciphertext C in the same way as the process of S124 to generate the ciphertext-derived value C[1] (step SA124).

[0121] Next, as described above, the calculation unit 130A calculates the input value X[1] that combines the plaintext-derived value M[1] and the ciphertext-derived value C[1] (step SA130). The tag generation unit 140A generates the authentication tag T using the key K, the nonce N, the related data A, and the input value X[1] as described above (step SA140). Then, the output unit 150 outputs the nonce N, the related data A, the ciphertext C, and the authentication tag T (step SA150).

[0122] FIG. 18 is a flowchart showing the authentication and decryption method executed by the authentication and decryption device 20A according to the present disclosure. The input unit 200 inputs the nonce N, the related data A, the ciphertext C, and the authentication tag T in the same way as the process of S202 (step SA202). The decryption unit 210 decrypts the ciphertext C in the same way as the process of S210 to obtain the plaintext M (step SA210). The plaintext processing unit 222 processes the plaintext M in the same way as the process of S222 to generate the plaintext-derived value M[1] (step SA222). The ciphertext processing unit 224 processes the ciphertext C in the same way as the process of S224 to generate the ciphertext-derived value C[1] (step SA224).

[0123] Next, as described above, the calculation unit 230A calculates the input value X[1] that combines the plaintext-derived value M[1] and the ciphertext-derived value C[1] (step SA230). The tag generation unit 240A generates the verification tag T^* using the key K, the nonce N, the associated data A, and the input value X[1] as described above (step SA240). The verification unit 250 determines whether the authentication tag T and the verification tag T^* match in the same manner as the process of S250 (step SA250). When the authentication tag T and the verification tag T^* match (YES in SA250), the verification unit 250 outputs the plaintext M in the same manner as the process of S252 (step SA252). On the other hand, when the authentication tag T and the verification tag T^* do not match (NO in SA250), the verification unit 250 outputs the error message ⊥ in the same manner as the process of S254 (step SA254).

[0124] <Effect> The effect of the authentication encryption system 1 according to the present disclosure will be described. The authentication encryption device 10A according to the second embodiment exhibits substantially the same effects as those of the authentication encryption device 10 according to the first embodiment described above. Similarly, the authentication decryption device 20A according to the second embodiment exhibits substantially the same effects as those of the authentication decryption device 20 according to the first embodiment described above.

[0125] Furthermore, the input value X[1] is calculated from the plaintext-derived value M[1] and the ciphertext-derived value C[1]. Therefore, if at least one of the plaintext-derived value M[1] and the ciphertext-derived value C[1] is different, the input value X[1] may also be different. Therefore, also in the second embodiment, if at least one of the plaintext M and the ciphertext C is different, the tag output from the hash function H may also be different. Therefore, even if the input value X[1] is input to the hash function H instead of the plaintext-derived value M[1] and the ciphertext-derived value C[1], the security level remains unchanged.

[0126] Then, the bit length of the input value X[1] is shorter than the sum of the length of the plaintext-derived value M[1] and the length of the ciphertext-derived value C[1]. Comparing the case of FIG. 9 and the case of FIG. 15, the amount of data input to the hash function H is reduced by t bits. Therefore, by inputting the input value X[1] to the hash function H, the amount of data processing in the hash function H is reduced. Therefore, it is possible to improve the efficiency of the processing in the hash function H without reducing the security level.

[0127] Here, in AEAD by WTBC such as the EtE method, in order to achieve the above-described strong security, more processing may be performed than in general AEAD. Therefore, in AEAD by WTBC, the processing time may be slower than in general AEAD. Therefore, as in the second embodiment, by improving the efficiency of the processing in the hash function H, it is possible to offset the slowness of the processing time in AEAD by WTBC to some extent. In particular, in AEAD by WTBC such as the EtE method, since the above-described processing time may be slow, the length of the plaintext M to be processed tends to be short. In such a case, by reducing the amount of data input to the hash function H even slightly, the effect of improving the processing efficiency can be relatively high.

[0128] (Embodiment 3) Next, Embodiment 3 will be described. Embodiment 3 shows an outline of the configuration according to the above-described embodiment.

[0129] FIG. 19 is a diagram showing the configuration of the authenticated encryption device 30 according to the present disclosure. The authenticated encryption device 30 shown in FIG. 19 corresponds to the authenticated encryption device according to the other above-described embodiments. The authenticated encryption device 30 shown in FIG. 19 includes an encryption unit 310, a plaintext processing unit 322, a ciphertext processing unit 324, and a tag generation unit 340.

[0130] The encryption unit 310 has a function as an encryption means. The plaintext processing unit 322 has a function as a plaintext processing means (first plaintext processing means). The ciphertext processing unit 324 has a function as a ciphertext processing means (first ciphertext processing means). The tag generation unit 340 has a function as a tag generation means (first tag generation means).

[0131] The encryption unit 310 can be realized by functions substantially the same as those of the encryption unit 110 described above. The encryption unit 310 encrypts the plaintext using a Tweak including a nonce and related data and a key, and generates a ciphertext having the same length as the length of the plaintext.

[0132] The plaintext processing unit 322 can be realized by functions substantially the same as those of the plaintext processing unit 122 described above. The plaintext processing unit 322 generates a first value (plaintext-derived value M[1]) used for generating an authentication tag from the plaintext. The ciphertext processing unit 324 can be realized by functions substantially the same as those of the ciphertext processing unit 124 described above. The ciphertext processing unit 324 generates a second value (ciphertext-derived value C[1]) used for generating an authentication tag from the ciphertext.

[0133] The tag generation unit 340 can be realized by functions substantially the same as those of the tag generation unit 140 or the tag generation unit 140A described above. The tag generation unit 340 inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function, and generates a hash value of a predetermined length t as an authentication tag. When the "two input values" are input into the hash function H, it corresponds to the case of the first embodiment described above. When the "one input value" is input into the hash function H, it corresponds to the case of the second embodiment described above.

[0134] FIG. 20 is a diagram showing the configuration of the authentication decryption device 40 according to the present disclosure. The authentication decryption device 40 shown in FIG. 20 corresponds to the authentication decryption device in the other embodiments described above. The authentication decryption device 40 shown in FIG. 20 includes a decryption unit 410, a plaintext processing unit 422, a ciphertext processing unit 424, a tag generation unit 440, and a verification unit 450.

[0135] The decryption unit 410 has a function as decryption means. The plaintext processing unit 422 has a function as plaintext processing means (second plaintext processing means). The ciphertext processing unit 424 has a function as ciphertext processing means (second ciphertext processing means). The tag generation unit 440 has a function as tag generation means (second tag generation means). The verification unit 450 has a function as verification means.

[0136] The decryption unit 410 can be realized by functions substantially the same as those of the decryption unit 210 described above. The decryption unit 210 decrypts a ciphertext using a Tweak including a nonce and related data and a key, and generates a plaintext having the same length as the length of the ciphertext.

[0137] The plaintext processing unit 422 can be realized by functions substantially the same as those of the plaintext processing unit 222 described above. The plaintext processing unit 422 generates a first value (plaintext-derived value M[1]) used for generating a verification tag from the plaintext. The ciphertext processing unit 424 can be realized by functions substantially the same as those of the ciphertext processing unit 224 described above. The ciphertext processing unit 424 generates a second value (ciphertext-derived value C[1]) used for generating a verification tag from the ciphertext.

[0138] The tag generation unit 440 can be realized by functions substantially the same as those of the above-described tag generation unit 240 or tag generation unit 240A. The tag generation unit 440 inputs a key, a nonce, related data, and one or two input values corresponding to the first value and the second value into a hash function, and generates a hash value of a predetermined length t as a verification tag. When the "two input values" are input to the hash function H, it corresponds to the case of the above-described Embodiment 1. When the "one input value" is input to the hash function H, it corresponds to the case of the above-described Embodiment 2.

[0139] The verification unit 450 can be realized by functions substantially the same as those of the above-described verification unit 250. The verification unit 450 verifies the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t, and performs control to output the verification result.

[0140] The authentication encryption device 30 and the authentication decryption device 40 according to the present disclosure can suppress an increase in the load on the communication path while realizing high security with the above-described configuration. Also, the authentication encryption method executed by the authentication encryption device 30 and the program for executing the authentication encryption method can suppress an increase in the load on the communication path while realizing high security. Also, the authentication decryption method executed by the authentication decryption device 40 and the program for executing the authentication decryption method can suppress an increase in the load on the communication path while realizing high security.

[0141] Note that the first value (plaintext-derived value M[1]) may be the plaintext M itself. Also, the second value (ciphertext-derived value C[1]) may be the ciphertext C itself. However, as described above, by using the plaintext-derived value M[1] as part of the plaintext and the ciphertext-derived value C[1] as part of the ciphertext, the amount of data input to the hash function H is reduced. Therefore, the processing in the hash function H is made more efficient.

[0142] (Hardware configuration example) A configuration example of hardware resources for realizing the apparatuses and systems according to the above-described embodiments using one computing device (information processing device, computer) will be described. However, the apparatuses according to the embodiments (authentication encryption device and authentication decryption device) may be realized physically or functionally using at least two computing devices. Further, the apparatuses according to the embodiments may be realized as dedicated apparatuses or may be realized using general-purpose information processing devices.

[0143] FIG. 21 is a block diagram schematically showing a hardware configuration example of a computing device capable of realizing the apparatuses and systems according to the present disclosure. The computing device 1000 includes a CPU 1001, a volatile memory device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF 1007 (IF: Interface). Therefore, it can be said that the apparatuses according to the embodiments include the CPU 1001, the volatile memory device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The computing device 1000 may be connectable to an input device 1005 and an output device 1006. The computing device 1000 may include the input device 1005 and the output device 1006. Further, the computing device 1000 can transmit and receive information to and from other computing devices and communication devices via the communication IF 1007.

[0144] The non-volatile recording medium 1004 is, for example, a computer-readable compact disc (CD) or digital versatile disc (DVD). Further, the non-volatile recording medium 1004 may be a USB (Universal Serial Bus) memory, a solid state drive (SSD), or the like. The non-volatile recording medium 1004 holds such a program without being supplied with power and enables it to be carried. Note that the non-volatile recording medium 1004 is not limited to the above-described media. Further, instead of the non-volatile recording medium 1004, such a program may be supplied via the communication IF 1007 and a communication network.

[0145] The volatile memory device 1002 is readable by a computer and can temporarily store data. The volatile memory device 1002 is a memory such as DRAM (dynamic random access memory), SRAM (static random access memory), etc.

[0146] That is, when the CPU 1001 executes a software program (computer program: hereinafter simply referred to as "program") stored in the disk 1003, it copies the program to the volatile memory device 1002 and executes arithmetic processing. The CPU 1001 reads data necessary for the execution of the program from the volatile memory device 1002. When display is required, the CPU 1001 displays the output result on the output device 1006. When a program is input from the outside, the CPU 1001 acquires the program from the input device 1005. The CPU 1001 interprets and executes a program corresponding to the functions (processes) of the respective components shown in FIGS. 8, 10, 14, 16, 19, and 20 described above. The CPU 1001 executes the processes described in the above-described embodiments. In other words, the functions of the respective components shown in FIGS. 8, 10, 14, 16, 19, and 20 described above can be realized by the CPU 1001 executing a program stored in the disk 1003 or the volatile memory device 1002.

[0147] That is, each embodiment can be considered to be achievable also by the above-described program. Furthermore, each of the above-described embodiments can be considered to be achievable also by a computer-readable non-volatile recording medium on which the above-described program is recorded.

[0148] (Modification example) Note that the present invention is not limited to the above-described embodiments, and can be appropriately modified without departing from the spirit thereof. For example, in the above-described flowchart, the order of each process (step) can be appropriately changed. Also, one or more of the plurality of processes (steps) may be omitted. For example, in FIG. 12, the process of S122 may be executed before the process of S110. Also, the process of S124 may be executed in parallel with the process of S122, or may be executed before the process of S122. Further, in FIG. 13, the process of S224 may be executed before the process of S210 or the process of S222. Also, the process of S224 may be executed in parallel with the process of S222. The same applies to other flowcharts.

[0149] As described above, the present disclosure has been described with reference to the embodiments, but the present disclosure is not limited to the above-described embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure. And each embodiment can be combined with other embodiments as appropriate.

[0150] Each drawing is merely an example for explaining one or more embodiments. Each drawing is not associated with only one specific embodiment, but may be associated with one or more other embodiments. As can be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, embodiments that are not explicitly illustrated or described. Not all of the features or steps shown in any one drawing for explaining exemplary embodiments are necessarily essential, and some features or steps may be omitted. The order of the steps described in any drawing may be changed as appropriate.

[0151] The above-described program, when loaded into a computer, includes a set of instructions (or software code) for causing the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, a computer-readable medium or a tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD), or other memory technologies, CD-ROM, digital versatile disk (DVD), Blu-ray (registered trademark) disk, or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage, or other magnetic storage devices. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, a transitory computer-readable medium or a communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0152] Some or all of the above embodiments may be described as follows, but are not limited thereto. (Appendix 1) Encryption means for encrypting plaintext using a Tweak including nonce and related data and a key to generate ciphertext of the same length as the length of the plaintext; Plaintext processing means for generating a first value used for generating an authentication tag from the plaintext; Ciphertext processing means for generating a second value used for generating the authentication tag from the ciphertext; Tag generation means for inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag; An authenticated encryption device having the above. (Appendix 2) The plaintext processing means generates the first value of a predetermined first length, The ciphertext processing means generates the second value having a predetermined second length. The authentication encryption device according to Appendix 1. (Appendix 3) The plaintext processing means generates the first value whose first length is the length t. The ciphertext processing means generates the second value whose second length is the length t. The authentication encryption device according to Appendix 2. (Appendix 4) The plaintext processing means generates the first value by extracting the bit string of the first length, which is a part of the bit string of the plaintext. The ciphertext processing means generates the second value by extracting the bit string of the second length, which is a part of the bit string of the ciphertext. The authentication encryption device according to Appendix 2. (Appendix 5) The length of the plaintext is longer than the length t. The plaintext processing means generates the first value by extracting the bit string of the length t from the bit string of the plaintext. The ciphertext processing means generates the second value by extracting the bit string of the length t from the bit string of the ciphertext. The authentication encryption device according to Appendix 4. (Appendix 6) Calculation means for calculating one input value having a third length shorter than the sum of the first length and the second length using the first value and the second value. further comprises The tag generation means inputs the key, the nonce, the related data, and one input value into the hash function, and generates the hash value of the length t as the authentication tag. The authentication encryption device according to Appendix 2. (Appendix 7) The plaintext processing means generates the first value whose first length is the length t. The ciphertext processing means generates the second value whose second length is the length t. The calculation means calculates the input value in which the third length is the length t, using the first value and the second value. The authentication encryption device according to Supplementary Note 6. (Supplementary Note 8) The calculation means calculates the input value in which the third length is the length t, by the exclusive logical sum of the first value and the second value. The authentication encryption device according to Supplementary Note 7. (Supplementary Note 9) Decryption means for decrypting a ciphertext using a Tweak including a nonce and related data and a key, and generating a plaintext having the same length as the ciphertext; Plaintext processing means for generating a first value used for generating a verification tag from the plaintext; Ciphertext processing means for generating a second value used for generating the verification tag from the ciphertext; Tag generation means for inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function, and generating a hash value of a predetermined length t as the verification tag; Verification means for verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t, and performing control for outputting a verification result; An authentication decryption device having the above. (Supplementary Note 10) The plaintext processing means generates the first value having a predetermined first length. The ciphertext processing means generates the second value having a predetermined second length. The authentication decryption device according to Supplementary Note 9. (Supplementary Note 11) The plaintext processing means generates the first value in which the first length is the length t. The ciphertext processing means generates the second value in which the second length is the length t. The authentication decryption device according to Supplementary Note 10. (Supplementary Note 12) The plaintext processing means generates the first value by extracting a bit string of the first length, which is a part of the bit string of the plaintext. The ciphertext processing means generates the second value by extracting a bit string of the second length, which is a part of the bit string of the ciphertext. The authentication and decryption device according to Supplementary Note 10. (Supplementary Note 13) The length of the plaintext is longer than the length t. The plaintext processing means generates the first value by extracting a bit string of the length t from the bit string of the plaintext. The ciphertext processing means generates the second value by extracting a bit string of the length t from the bit string of the ciphertext. The authentication and decryption device according to Supplementary Note 12. (Supplementary Note 14) Calculation means for calculating one input value of a third length shorter than the sum of the first length and the second length using the first value and the second value. further has The tag generation means inputs the key, the nonce, the related data, and one input value into the hash function, and generates a hash value of the length t as the verification tag. The authentication and decryption device according to Supplementary Note 10. (Supplementary Note 15) The plaintext processing means generates the first value whose first length is the length t. The ciphertext processing means generates the second value whose second length is the length t. The calculation means calculates the input value whose third length is the length t using the first value and the second value. The authentication and decryption device according to Supplementary Note 14. (Supplementary Note 16) The calculation means calculates the input value whose third length is the length t by the exclusive logical sum of the first value and the second value. The authentication and decryption device according to Supplementary Note 15. (Supplementary Note 17) An authentication and encryption device An authentication decryption device that communicates with the authentication encryption device, and has, The authentication encryption device, using a Tweak including a nonce and related data and a key, encryption means for encrypting a plaintext to generate a ciphertext having the same length as the plaintext, first plaintext processing means for generating a first value used for generating an authentication tag from the plaintext, first ciphertext processing means for generating a second value used for generating the authentication tag from the ciphertext, inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag first tag generation means, and has, The authentication decryption device, using a Tweak including the nonce and the related data and the key, decryption means for decrypting the input ciphertext to generate a plaintext having the same length as the ciphertext, second plaintext processing means for generating a third value used for generating a verification tag from the plaintext obtained by decryption, second ciphertext processing means for generating a fourth value used for generating the verification tag from the input ciphertext, inputting the key, the nonce, the related data, and one or two input values corresponding to the third value and the fourth value into a hash function to generate the hash value of the length t as the verification tag second tag generation means, verification means for verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag and performing control for outputting a verification result, and has, An authentication encryption system. (Appendix 18) Using a Tweak including a nonce and related data and a key, encrypting a plaintext to generate a ciphertext having the same length as the plaintext, Generate a first value used for generating an authentication tag from the plaintext, Generate a second value used for generating the authentication tag from the ciphertext, Input the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag, Authentication encryption method. (Appendix 19) Using a Tweak including a nonce and associated data and a key, decrypt the ciphertext to generate a plaintext of the same length as the ciphertext, Generate a first value used for generating a verification tag from the plaintext, Generate a second value used for generating the verification tag from the ciphertext, Input the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, Verify the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t, and perform control to output the verification result, Authentication decryption method. (Appendix 20) Using a Tweak including a nonce and associated data and a key, encrypt the plaintext to generate a ciphertext of the same length as the plaintext, Generate a first value used for generating an authentication tag from the plaintext, Generate a second value used for generating the authentication tag from the ciphertext, Input the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag, A program for causing a computer to execute. (Appendix 21) Using a tweak containing nonce and related data and a key, decrypting the ciphertext to generate a plaintext of the same length as the ciphertext, generating a first value used for generating a verification tag from the plaintext, generating a second value used for generating the verification tag from the ciphertext, inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t, and performing control to output a verification result, A program for causing a computer to execute the above.

[0153] Note that some or all of the elements (e.g., configurations and functions) described in Appendices 2 to 8 subordinate to Appendix 1 may be subordinate to Appendices 17, 18, and 20 in the same subordinate relationship as Appendices 2 to 8. Also, some or all of the elements (e.g., configurations and functions) described in Appendices 10 to 16 subordinate to Appendix 9 may be subordinate to Appendices 17, 19, and 21 in the same subordinate relationship as Appendices 10 to 16. Some or all of the elements described in any appendix may be applied to various hardware, software, recording means for recording software, systems, and methods.

Explanation of Symbols

[0154] 1 Authentication Encryption System 10, 10A Authentication Encryption Device 20, 20A Authentication Decryption Device 30 Authentication Encryption Device 40 Authentication Decryption Device 100 Input Unit 110 Encryption Unit 122 Plaintext Processing Unit 124 Ciphertext Processing Unit 130A Calculation Unit 140, 140A Tag Generation Unit 150 Output Unit 200 Input Unit 210 Decryption Unit 222 Plaintext Processing Unit 224 Ciphertext Processing Unit 230A Calculation Unit 240, 240A Tag Generation Unit 250 Verification Unit 310 Encryption Unit 322 Plaintext Processing Unit 324 Ciphertext Processing Unit 340 Tag Generation Unit 410 Decryption Unit 422 Plaintext Processing Unit 424 Ciphertext Processing Unit 440 Tag Generation Unit 450 Verification Unit

Claims

1. Encryption means that uses a tweak including nonce and related data and a key to encrypt plaintext and generate ciphertext of the same length as the plaintext; Plaintext processing means for generating a first value used for generating an authentication tag from the plaintext; Ciphertext processing means for generating a second value used for generating the authentication tag from the ciphertext; Tag generation means that inputs the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag; An authenticated encryption device having the above.

2. The plaintext processing means generates the first value of a predetermined first length; The ciphertext processing means generates the second value of a predetermined second length, The authenticated encryption device according to Claim 1.

3. The plaintext processing means generates the first value whose first length is the length t; The ciphertext processing means generates the second value whose second length is the length t, The authenticated encryption device according to Claim 2.

4. The plaintext processing means generates the first value by extracting a bit string of the first length that is a part of the bit string of the plaintext; The ciphertext processing means generates the second value by extracting a bit string of the second length that is a part of the bit string of the ciphertext, The authenticated encryption device according to Claim 2.

5. The length of the plaintext is longer than the length t; The plaintext processing means generates the first value by extracting a bit string of the length t from the bit string of the plaintext; The ciphertext processing means generates the second value by extracting a bit string of the length t from the bit string of the ciphertext, The authenticated encryption device according to Claim 4.

6. Calculation means for calculating one input value of a third length shorter than the sum of the first length and the second length using the first value and the second value; Further comprising; The tag generation means inputs the key, the nonce, the related data, and one input value into the hash function to generate a hash value of the length t as the authentication tag, The authenticated encryption device according to Claim 2.

7. The plaintext processing means generates the first value whose first length is the length t; The ciphertext processing means generates the second value whose second length is the length t, The calculating means calculates the input value whose third length is the length t by using the first value and the second value. The authentication encryption device according to claim 6.

8. The calculating means calculates the input value whose third length is the length t by exclusive OR of the first value and the second value. The authentication encryption device according to claim 7.

9. Decryption means for decrypting a ciphertext using a tweak including a nonce and related data and a key to generate a plaintext having the same length as the length of the ciphertext; Plaintext processing means for generating a first value used for generating a verification tag from the plaintext; Ciphertext processing means for generating a second value used for generating the verification tag from the ciphertext; Tag generation means for inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag; Verification means for verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t and performing control for outputting a verification result; An authentication decryption device having the above.

10. The plaintext processing means generates the first value having a predetermined first length, The ciphertext processing means generates the second value having a predetermined second length. The authentication decryption device according to claim 9.

11. The plaintext processing means generates the first value whose first length is the length t, The ciphertext processing means generates the second value whose second length is the length t. The authentication decryption device according to claim 10.

12. The plaintext processing means generates the first value by extracting a bit string of the first length, which is a part of the bit string of the plaintext, The ciphertext processing means generates the second value by extracting a bit string of the second length, which is a part of the bit string of the ciphertext. The authentication decryption device according to claim 10.

13. The length of the plaintext is longer than the length t, The plaintext processing means generates the first value by extracting the bit string of the length t from the bit string of the plaintext. The ciphertext processing means generates the second value by extracting a bit string of the length t from the bit string of the ciphertext. The authentication decryption device according to claim 12.

14. Calculation means for calculating one input value of a third length shorter than the sum of the first length and the second length using the first value and the second value. further comprising The tag generation means inputs the key, the nonce, the related data, and one input value into the hash function, and generates a hash value of the length t as the verification tag. The authentication decryption device according to claim 10.

15. The plaintext processing means generates the first value whose first length is the length t. The ciphertext processing means generates the second value whose second length is the length t. The calculation means calculates the input value whose third length is the length t using the first value and the second value. The authentication decryption device according to claim 14.

16. The calculation means calculates the input value whose third length is the length t by the exclusive OR of the first value and the second value. The authentication decryption device according to claim 15.

17. An authentication encryption device; An authentication decryption device that communicates with the authentication encryption device; comprising The authentication encryption device Encryption means for encrypting a plaintext using a tweak including a nonce and related data and a key to generate a ciphertext of the same length as the plaintext. First plaintext processing means for generating a first value used for generating an authentication tag from the plaintext. First ciphertext processing means for generating a second value used for generating the authentication tag from the ciphertext. First tag generation means for inputting the key, the nonce, the related data, one or two input values corresponding to the first value and the second value into a hash function, and generating a hash value of a predetermined length t as the authentication tag. comprising The authentication decryption device Decryption means for decrypting the input ciphertext using a tweak including the nonce and the related data and the key to generate a plaintext of the same length as the ciphertext. Second plaintext processing means for generating a third value used for generating an authentication tag from the plaintext obtained by decryption. Second ciphertext processing means for generating a fourth value used for generating the authentication tag from the input ciphertext. Second tag generation means for inputting the key, the nonce, the associated data, and one or two input values corresponding to the third value and the fourth value into a hash function to generate the hash value of length t as the verification tag; Verification means for verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag and performing control to output a verification result; having an authentication encryption system.

18. Using a tweak including a nonce and associated data and a key, encrypt a plaintext to generate a ciphertext of the same length as the plaintext, generate a first value used for generating an authentication tag from the plaintext, generate a second value used for generating the authentication tag from the ciphertext, input the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag; an authentication encryption method.

19. Using a tweak including a nonce and associated data and a key, decrypt a ciphertext to generate a plaintext of the same length as the ciphertext, generate a first value used for generating a verification tag from the plaintext, generate a second value used for generating the verification tag from the ciphertext, input the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag, verify the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t and perform control to output a verification result; an authentication decryption method.

20. A step of using a tweak including a nonce and associated data and a key to encrypt a plaintext to generate a ciphertext of the same length as the plaintext, a step of generating a first value used for generating an authentication tag from the plaintext, a step of generating a second value used for generating the authentication tag from the ciphertext, a step of inputting the key, the nonce, the associated data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the authentication tag; a program for causing a computer to execute.

21. Using a tweak including nonce and related data and a key, decrypting the ciphertext to generate a plaintext of the same length as the ciphertext; Generating a first value used for generating a verification tag from the plaintext; Generating a second value used for generating the verification tag from the ciphertext; Inputting the key, the nonce, the related data, and one or two input values corresponding to the first value and the second value into a hash function to generate a hash value of a predetermined length t as the verification tag; Verifying the presence or absence of forgery by comparing the verification tag with the input authentication tag of length t, and performing control for outputting a verification result; A program for causing a computer to execute the above.

Images