Information processing device, information processing method, and program

Abstract

This invention provides an information processing device that enables secure and high-speed cryptographic processing while suppressing the amount of memory required. [Solution] The data receiving means receives input data. The data stirring means performs stirring. The data stirring means stirs each of the multiple input data blocks, each of which the input data is divided into N bits, by repeatedly using a round function A times per round over multiple rounds, and outputs an output data block. The key scheduling means performs key scheduling in parallel with the stirring process, using a pre-generated master key to generate a round key to be input to the round function. The output means controls the output of output data composed of multiple output data blocks.

Description

[Technical Field]

[0001] This disclosure relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] A well-known technique is symmetric-key cryptography, which encrypts plaintext using a specific key and decrypts the ciphertext using the same key. Another known type of symmetric-key cryptography is block ciphers. Block ciphers divide the data to be encrypted into blocks of predetermined length and encrypt each block individually. Block ciphers encrypt blocks by repeatedly applying a function called a round function to each block. One example of a block cipher using a round function is the Feistel structure.

[0003] In relation to this technology, Patent Document 1 discloses an encryption device that encrypts plaintext or decrypts ciphertext using a block cipher with a round function. The encryption device according to Patent Document 1 generates a permutation table of a predetermined size determined according to the block cipher, in which no high-probability propagations with identical input / output differences exist. Furthermore, the encryption device according to Patent Document 1 uses the generated permutation table to perform encryption or decryption using a block cipher. Non-Patent Document 1 discloses an efficient hash function. [Prior art documents] [Patent Documents]

[0004] [Patent Document 1] International Publication No. 2022 / 254513 [Non-patent literature]

[0005] [Non-Patent Document 1] Mikkel Thorup, "High Speed ​​Hashing for Integers and Strings", May 12, 2020, https: / / arxiv.org / abs / 1504.06804 [Overview of the project] [Problems that the invention aims to solve]

[0006] The technology described in Patent Document 1 uses a round function that employs a transposition table called an S-box. With such a method, it may be difficult to properly evaluate the security against attacks such as differential decryption. Therefore, the technology described in Patent Document 1 may not be able to achieve secure cryptographic processing. Furthermore, Patent Document 1 does not disclose how the key input to the round function (round key) is generated. Therefore, it may not be possible to reduce the amount of memory required to store the round key.

[0007] The purpose of this disclosure is to solve these problems and to provide an information processing device, an information processing method, and a program that can achieve secure and high-speed cryptographic processing while suppressing the amount of memory required. [Means for solving the problem]

[0008] The information processing apparatus according to the present disclosure includes data reception means for receiving input data, and for each of a plurality of input data blocks obtained by dividing the input data into N bits (N is a multiple of 8), a round function to which a round key having a different value is input each time it is used is used A times (A is an integer greater than or equal to 1) for each round and repeatedly used over a plurality of rounds to perform a mixing process to output an output data block, data mixing means for performing the mixing process, and in parallel with the round function being repeatedly used to perform the mixing process, key schedule means for performing a key schedule process for generating the round key input to the round function using a master key generated in advance, and output means for performing control for outputting output data composed of a plurality of the output data blocks. The round function, each time it is used, takes as input an intermediate input data of n bits (n is a multiple of 2 smaller than N) composed of a first input data portion of n / 2 bits and a second input data portion of n / 2 bits, and six round key portions of n bits each, namely, a first round key portion K 1 1, a second round key portion K 1 2, a third round key portion K 1 3, a fourth round key portion K 2 1, a fifth round key portion K 2 2, a sixth round key portion K 2 3, and receives the round key thus constituted as input, and calculates the lower n-bit value of the value obtained by arithmetically adding the first input data portion and the first round key portion K 1 1, and the lower n-bit value of the value obtained by arithmetically adding the second input data portion and the second round key portion K 1 2, multiplies them arithmetically, and calculates the upper n / 2 bits of the lower n-bit value of the value obtained by arithmetically adding the lower n-bit value thus obtained and the third round key portion K 1 3 as the first output data portion, and calculates the lower n-bit value of the value obtained by arithmetically adding the first input data portion and the fourth round key portion K 2 1, and the lower n-bit value of the value obtained by arithmetically adding the second input data portion and the fifth round key portion K 2 2, multiplies them arithmetically, and the lower n-bit value of the value obtained by arithmetically adding the lower n-bit value thus obtained and the sixth round key portion K 2The system is configured to calculate the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of 3 as the second output data portion, and output intermediate output data consisting of the first output data portion and the second output data portion, wherein the master key is an n*M bit random number composed of M master key portions of n bits each (M is an integer of 4 or more), and the key scheduling means, in the key scheduling process, sets an initial setting for any of the M master key portions for each of the 6*R*A n-bit states corresponding to any of the multiple round key portions that constitute round keys for R rounds (R is an integer of 2 or more, and for any integer x of 2 or more, 6*R=M*x), for the 6 round key portions input by one use of the round function, the first round key portion K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned third round key portion K 1 Three different master key portions are assigned to the three states corresponding to each of the three, and the fourth round key portion K 2 1 and the aforementioned fifth round key portion K 2 2 and the aforementioned sixth round key portion K 2 Three different master key portions are assigned to the three states corresponding to each of the three, and for the multiple round key portions input in a single use of the round function, the first round key portion K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned fourth round key portion K 2 1 and the aforementioned fifth round key portion K 2 Two different master key portions are assigned to the four states corresponding to each of the two, and for a plurality of round key portions entered by at least two consecutive uses of the round function, two of the third round key portions K 1 3 and 2 of the aforementioned 6th round key portion K 2The initial setup condition involves assigning different master key portions to four states corresponding to each of the three states, generating round keys for R rounds from the multiple master key portions set in the initial setup condition for each of the multiple states, and after generating round keys for R rounds, updating the state values ​​to generate round keys to be used in the subsequent R rounds. The update process involves updating the second state by setting the exclusive OR of the value of one of the multiple states' first state and the values ​​of two or more predetermined second states that are different from the first state as the values ​​of each of the second states, and the first and second states are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state, and the first and second states are selected such that the positional relationship between the first and second states is a predetermined positional relationship.

[0009] The information processing method according to this disclosure receives input data, and performs a stirring process to stir each of the multiple input data blocks, each of which the input data is divided into N bits (where N is a multiple of 8), by repeatedly using a round function that is input to each round A times (where A is an integer greater than or equal to 1) over multiple rounds, and outputting an output data block. In parallel with the stirring process performed by repeatedly using the round function, a key scheduling process is performed to generate the round keys to be input to the round function using a pre-generated master key, and control is performed to output output data composed of the multiple output data blocks. Each time the round function is used, it receives n bits (where n is a multiple of 2 less than N) of input intermediate data, consisting of an n / 2 bit first input data portion and an n / 2 bit second input data portion, and six first round key portions K, each of which are n bits. 1 1. Second round key section K 12. Third round key section K 1 3. Fourth round key section K 2 1. Round 5 Key Section K 2 2. Round 6 Key Section K 2 The round key consisting of 3 is accepted as input, and the first input data portion and the first round key portion K 1 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the second round key portion K. 1 2 is arithmetically added to the value obtained, and the lower n bits of that value are arithmetically multiplied by the value obtained, and the lower n bits of the resulting value and the third round key part K 1 The first output data portion is calculated by arithmetic addition of 3 and the upper n / 2 bits of the lower n bits of the resulting value, and the first input data portion and the fourth round key portion K are used. 2 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the fifth round key portion K. 2 2 is arithmetically added, and the lower n bits of the resulting value are arithmetically multiplied by the lower n bits of the resulting value and the 6th round key part K 2 The system is configured to calculate the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of 3 as the second output data part, and output intermediate output data consisting of the first output data part and the second output data part, wherein the master key is an n*M bit random number composed of M master key parts of n bits each (M is an integer of 4 or more), and in the key scheduling process, the initial setting is set for one of the M master key parts for each of the 6*R*A n-bit states corresponding to one of the multiple round key parts that constitute round keys for R rounds (R is an integer of 2 or more, and for integer x of 2 or more, 6*R=M*x), for the 6 round key parts input in one use of the round function, the first round key part K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned third round key portion K 1 Three different master key portions are assigned to the three states corresponding to each of the three, and the fourth round key portion K 2 1 and the aforementioned fifth round key portion K2 2 and the aforementioned sixth round key portion K 2 Three different master key portions are assigned to the three states corresponding to each of the three, and for the multiple round key portions input in a single use of the round function, the first round key portion K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned fourth round key portion K 2 1 and the aforementioned fifth round key portion K 2 Two different master key portions are assigned to the four states corresponding to each of the two, and for a plurality of round key portions entered by at least two consecutive uses of the round function, two of the third round key portions K 1 3 and 2 of the aforementioned 6th round key portion K 2 The initial setup condition involves assigning different master key portions to four states corresponding to each of the three states, generating round keys for R rounds from the multiple master key portions set in the initial setup condition for each of the multiple states, and after generating round keys for R rounds, updating the state values ​​to generate round keys to be used in the subsequent R rounds. The update process involves updating the second state by setting the exclusive OR of the value of one of the multiple states' first state and the values ​​of two or more predetermined second states that are different from the first state as the values ​​of each of the second states, and the first and second states are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state, and the first and second states are selected such that the positional relationship between the first and second states is a predetermined positional relationship.

[0010] The program according to this disclosure enables a computer to implement the following functions: a function to receive input data; a function to perform a stirring process, in which each of the multiple input data blocks, in which the input data is divided into N bits (where N is a multiple of 8), is stirred by repeatedly using a round function, which is input a different round key each time it is used, A times per round (where A is an integer greater than or equal to 1), over multiple rounds, and outputting an output data block; a function to perform a key scheduling process, in parallel with the stirring process performed by repeatedly using the round function, using a pre-generated master key to generate the round key to be input to the round function; and a function to perform control for outputting output data composed of the multiple output data blocks. Each time the round function is used, it receives n bits (where n is a multiple of 2 less than N) of input intermediate data, consisting of an n / 2 bit first input data portion and an n / 2 bit second input data portion, and six first round key portions K, each of which are n bits. 1 1. Second round key section K 1 2. Third round key section K 1 3. Fourth round key section K 2 1. Round 5 Key Section K 2 2. Round 6 Key Section K 2 The round key consisting of 3 is accepted as input, and the first input data portion and the first round key portion K 1 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the second round key portion K. 1 2 is arithmetically added to the value obtained, and the lower n bits of that value are arithmetically multiplied by the value obtained, and the lower n bits of the resulting value and the third round key part K 1 The first output data portion is calculated by arithmetic addition of 3 and the upper n / 2 bits of the lower n bits of the resulting value, and the first input data portion and the fourth round key portion K are used. 2 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the fifth round key portion K. 2 2 is arithmetically added, and the lower n bits of the resulting value are arithmetically multiplied by the lower n bits of the resulting value and the 6th round key part K 2The system is configured to calculate the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of 3 as the second output data part, and output intermediate output data consisting of the first output data part and the second output data part, wherein the master key is an n*M bit random number composed of M master key parts of n bits each (M is an integer of 4 or more), and in the key scheduling process, the initial setting is set for one of the M master key parts for each of the 6*R*A n-bit states corresponding to one of the multiple round key parts that constitute round keys for R rounds (R is an integer of 2 or more, and for integer x of 2 or more, 6*R=M*x), for the 6 round key parts input in one use of the round function, the first round key part K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned third round key portion K 1 Three different master key portions are assigned to the three states corresponding to each of the three, and the fourth round key portion K 2 1 and the aforementioned fifth round key portion K 2 2 and the aforementioned sixth round key portion K 2 Three different master key portions are assigned to the three states corresponding to each of the three, and for the multiple round key portions input in a single use of the round function, the first round key portion K 1 1 and the aforementioned second round key portion K 1 2 and the aforementioned fourth round key portion K 2 1 and the aforementioned fifth round key portion K 2 Two different master key portions are assigned to the four states corresponding to each of the two, and for a plurality of round key portions entered by at least two consecutive uses of the round function, two of the third round key portions K 1 3 and 2 of the aforementioned 6th round key portion K 2The initial setup condition involves assigning different master key portions to four states corresponding to each of the three states, generating round keys for R rounds from the multiple master key portions set in the initial setup condition for each of the multiple states, and after generating round keys for R rounds, updating the state values ​​to generate round keys to be used in the subsequent R rounds. The update process involves updating the second state by setting the exclusive OR of the value of one of the multiple states' first state and the values ​​of two or more predetermined second states that are different from the first state as the values ​​of each of the second states, and the first and second states are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state, and the first and second states are selected such that the positional relationship between the first and second states is a predetermined positional relationship. [Effects of the Invention]

[0011] According to this disclosure, it is possible to provide an information processing device, an information processing method, and a program that can achieve secure and high-speed cryptographic processing while suppressing the amount of memory required. [Brief explanation of the drawing]

[0012] [Figure 1] This diagram illustrates the outline of a block cipher using a symmetric key as described in this disclosure. [Figure 2] This figure illustrates the configuration of the data stirring unit relating to this disclosure. [Figure 3] This figure illustrates the configuration of the data stirring unit relating to this disclosure. [Figure 4] This is a diagram to explain shortcut methods. [Figure 5] This diagram illustrates the structure of the round function relating to this disclosure. [Figure 6]This diagram illustrates the potential problem that the lower bits of the round key in the round function relating to this disclosure may be ignored. [Figure 7] This diagram illustrates the overview of the key scheduling process related to this disclosure. [Figure 8] This diagram illustrates the configuration of the information processing system related to this disclosure. [Figure 9] This diagram illustrates the configuration of the information processing device (encryption device) related to this disclosure. [Figure 10] This diagram illustrates the processing of the key scheduling unit related to this disclosure. [Figure 11] This diagram illustrates the initial settings for a comparative example. [Figure 12] This figure illustrates the problems with the comparative example shown in Figure 11. [Figure 13] This is a diagram illustrating the initial setup process by the initial setup unit according to the first example of this disclosure. [Figure 14] This is a diagram illustrating the initial setup process by the initial setup unit according to the first example of this disclosure. [Figure 15] This figure illustrates the round function and round key used in the second example of this disclosure. [Figure 16] This is a diagram illustrating the initial setup process by the initial setup unit according to the second example of this disclosure. [Figure 17] This figure illustrates a first assumption method for assuming a key over two rounds, relating to a third example of this disclosure. [Figure 18] This figure illustrates a second assumption method, which involves assuming a key over two rounds, relating to the third example of this disclosure. [Figure 19] This is a diagram illustrating the initial setup process by the initial setup unit according to the third example of this disclosure. [Figure 20] This is a diagram illustrating the initial setup process by the initial setup unit according to the third example of this disclosure. [Figure 21]This diagram illustrates the case in which a second state is selected contrary to the first selection criterion during the update process of this disclosure. [Figure 22] This diagram illustrates the case where a second state is selected according to a first selection criterion in relation to the update process of this disclosure. [Figure 23] This diagram illustrates the index of the second state in the first update, which was determined in advance for the first example relating to this disclosure. [Figure 24] This diagram illustrates the index of the second state in the first update, which was determined in advance for the second example relating to this disclosure. [Figure 25] This figure illustrates the index of the second state S in the first update, which was determined in advance for the third example relating to this disclosure. [Figure 26] This diagram illustrates the configuration of the information processing device (decryption device) described herein. [Figure 27] This is a flowchart showing the information processing method performed by the information processing device relating to this disclosure. [Figure 28] This is a flowchart showing the information processing method performed by the information processing device relating to this disclosure. [Figure 29] This diagram illustrates the configuration of the information processing device related to this disclosure. [Figure 30] This block diagram schematically shows an example of the hardware configuration of a computing processing unit that can implement the device and system described herein. [Modes for carrying out the invention]

[0013] (Summary of this embodiment) Prior to describing this embodiment, an overview of this embodiment will be provided. While this embodiment will be described below, it is important to note that the following embodiments do not limit the invention to the claims. Furthermore, not all combinations of features described within the embodiments are necessarily essential to the solution of the invention. Also, the indices (letters) used in the following description are not necessarily common throughout this specification. For example, index i may mean different things in one context than in another. Additionally, while this embodiment will be described using drawings, please note that each drawing used in the description of each embodiment is not applicable only to that embodiment. In other words, each drawing may be applicable to all embodiments.

[0014] Figure 1 is a diagram illustrating the outline of a block cipher using a symmetric key as described herein. Figure 1 shows the cryptographic system 70. The cryptographic system 70 includes a key scheduling unit 72 and data stirring units 74 and 76. The data stirring unit 74 performs encryption processing. The data stirring unit 76 performs decryption processing.

[0015] The key scheduling unit 72 generates round keys used by the data stirring units 74 and 76 through key scheduling processing. Specifically, the key scheduling unit 72 receives a master key MK. The key scheduling unit 72 then inputs the master key MK into a predetermined key scheduling function, and generates round keys when the key scheduling function outputs round keys. The key scheduling unit 72 then outputs the round keys to the data stirring units 74 and 76. Note that the round keys output to the data stirring units 74 and 76 are the same.

[0016] The data stirring units 74 and 76 perform a stirring process by stirring a predetermined N-bit input data block by repeatedly using a round function (F function) multiple times, and outputting an output data block. N is a multiple of 8. Here, a different round key is input to the round function each time the round function is used. The data stirring units 74 and 76 perform the stirring process by repeatedly using the round function multiple times across multiple rounds, using the round function A times (A is an integer) in each round. The stirring process corresponds to randomizing the data. The round function is a predetermined nonlinear function. A "round" corresponds to the unit of repetition of the stirring process using the round function. The round function may be used once or multiple times in one round. In the case of stirring using a Feistel structure, a "round" corresponds to the number of repetitions of the round function in the Feistel structure. In the data stirring unit 74, the stirring process corresponds to encryption, the input data block is a plaintext block, and the output data block is a ciphertext block. Furthermore, in the data stirring unit 76, the stirring process corresponds to the decryption process, the input data block is a ciphertext block, and the output data block is a plaintext block.

[0017] The data stirring unit 74 encrypts the plaintext P and outputs ciphertext C. The data stirring unit 74 uses a round function to which the round key obtained from the key scheduling unit 72 is input, and performs encryption processing on each N-bit plaintext block of a predetermined length, and outputs an N-bit ciphertext block of a predetermined length.

[0018] The data stirring unit 76 decrypts the ciphertext C and outputs the plaintext P. The data stirring unit 76 uses a round function to which the round key obtained from the key scheduling unit 72 is input, and performs encryption processing on each N-bit ciphertext block of a predetermined length, and outputs an N-bit plaintext block of a predetermined length.

[0019] Furthermore, examples of block cipher data mixing section structures include the Feistel structure and the SPN (Substitution Permutation Network) structure. Here, the Feistel structure is often adopted because it has the advantage of being able to share the same components between encryption and decryption processing. Therefore, the data mixing sections 74 and 76 are assumed to have a Feistel structure.

[0020] Figures 2 and 3 illustrate the configuration of the data stirring unit according to this disclosure. Figures 2 and 3 show an example in which the data stirring unit 74 performs stirring (encryption) using a Feistel structure. For example, in the example in Figure 2, N=64 and in the example in Figure 3, N=128, but the value of N is not limited to 64 or 128.

[0021] Figure 2 illustrates an m-stage Feistel structure with an N-bit plaintext block P as input, using the round function F once per round. In other words, Figure 2 illustrates an m-round Feistel structure. Also, A=1.

[0022] The plaintext block P is divided into two plaintext block portions, P0 and P1, each consisting of N / 2 bits. The data stirring unit 74, in the first round, uses the round key RK. 1 The plaintext block portion P1 is input to the round function F, and the exclusive OR (XOR) of the encrypted result obtained with the plaintext block portion P0 is calculated, resulting in the intermediate data Z 1 The data is obtained. Note that the intermediate data Z is a random number. In the second round, the data stirring unit 74 sets the round key RK. 2 Intermediate data Z is input to the round function F. 1 The encrypted result obtained by inputting the result is calculated as the exclusive OR of the plaintext block portion P1, and the intermediate data Z is obtained. 2 Obtain it.

[0023] Similarly, in the following rounds, the data stirring unit 74 uses the round key RK in the r-th round. rThe intermediate data Z is input to the round function F that has been input r-1 The encryption result obtained by inputting the intermediate data Z r-2 Calculate the exclusive OR of the intermediate data Z r and obtain the intermediate data Z. Then, in the m-th round, the data scrambling unit 74 uses the round key RK m The intermediate data Z is input to the round function F that has been input m-1 Calculate the exclusive OR of the encryption result obtained by inputting the intermediate data Z m-2 and the intermediate data Z m and obtain the intermediate data Z. The data scrambling unit 74 outputs the intermediate data Z m as the ciphertext block part C0. Also, the data scrambling unit 74 outputs the intermediate data Z m-1 as the ciphertext block part C1. Then, the data scrambling unit 74 outputs an N-bit ciphertext block C that is the concatenation of the ciphertext block part C0 and the ciphertext block part C1.

[0024] Expressing the above in an equation, it becomes as follows. The plaintext block P is divided into N / 2-bit data x0 0 (plaintext block part P0) and x1 0 (plaintext block part P1). The processing in the r-th round (r = 1, 2, ···, m - 1) is expressed as the following equation (1). x0 r = x1 r-1 x1 r = F(RK r , x1 r-1 )(+) x0 r-1 ···(1) Note that “(+)” represents the exclusive OR (exclusive OR bit by bit), corresponding to the operation of the symbol with a + drawn inside the circle in FIG. 2.

[0025] Also, in the final round (m-th round), the cross (intersection) of the left and right data is not performed. Therefore, the data x0 m (ciphertext block part C0) and x1 m (ciphertext block part C1) are expressed as the following equation (2). x0m =F(RK m ,x1 m-1 )(+)x0 m-1 x1 m =x1 m-1 ...(2)

[0026] Figure 3 illustrates an m-stage Feistel structure that takes an N-bit plaintext block P as input and uses the round function F twice for each round. Therefore, A=2. The Feistel structure illustrated in Figure 3 is called a generalized Feistel structure.

[0027] The plaintext block P is divided into plaintext block portions P0, P1, P2, and P3, each of which is N / 4 bits. The data stirring unit 74, in the first round, uses the round key RK. R 1 The plaintext block portion P1 is input to the right-hand round function F, and the exclusive OR of the encrypted result obtained with the plaintext block portion P0 is calculated to obtain the intermediate data Z0. 1 The data is obtained. Note that the intermediate data Z is a random number. Also, in the first round, the data stirring unit 74 sets the round key RK. L 1 The plaintext block portion P3 is input to the left-hand round function F, and the exclusive OR of the encrypted result obtained with the plaintext block portion P2 is calculated to obtain the intermediate data Z2. 1 The data stirring unit 74 obtains the round key RK in the second round. R 2 The intermediate data Z2 is entered into the round function F on the right. 1 The encrypted result obtained by inputting the result and the plaintext block portion P1 are used to calculate the exclusive OR of the intermediate data Z0. 2 The data stirring unit 74 acquires the round key RK in the second round. L 2 The intermediate data Z0 is input to the left-hand round function F. 1 The encrypted result obtained by inputting the result and the plaintext block portion P3 are used to calculate the exclusive OR of the result, which is then used to obtain the intermediate data Z2.2 Obtain it.

[0028] Similarly, in the following rounds, the data stirring unit 74 uses the round key RK in the r-th round. R r The intermediate data Z2 is entered into the round function F on the right. r-1 The encrypted result obtained by inputting and intermediate data Z2 r-2 Calculate the exclusive OR with the intermediate data Z0 r The data stirring unit 74 obtains the round key RK in the r-th round. L r The intermediate data Z0 is input to the left-hand round function F. r-1 The encrypted result obtained by inputting and intermediate data Z0 r-2 Calculate the exclusive OR with the intermediate data Z2 r Obtain it.

[0029] Then, the data stirring unit 74, in the mth round, round key RK R m The intermediate data Z2 is entered into the round function F on the right. m-1 The encrypted result obtained by inputting and intermediate data Z2 m-2 Calculate the exclusive OR with the intermediate data Z0 m The data stirring unit 74 obtains the round key RK in the mth round. L m The intermediate data Z0 is input to the left-hand round function F. m-1 The encrypted result obtained by inputting and intermediate data Z0 m-2 Calculate the exclusive OR with the intermediate data Z2 m The data stirring unit 74 obtains intermediate data Z0 m The data stirring unit 74 outputs the ciphertext block portion C0. m-1 The data stirring unit 74 outputs the ciphertext block portion C1. Also, the intermediate data Z2 m The data stirring unit 74 outputs the ciphertext block portion C2. m-1The data is output as ciphertext block portion C3. The data stirring unit 74 then outputs an N-bit ciphertext block C, which is formed by concatenating ciphertext block portions C0, C1, C2, and C3.

[0030] The above can be expressed as an equation as follows: Plaintext block P is N / 4 bits of data x0 0 (Plain text block portion P0), x1 0 (Plain text block portion P1), x2 0 (Plain text block portion P2) and x3 0 The text is divided into (plaintext block P3). The processing of round r (r=1,2,···,m-1) is expressed by equation (3) below. x0 r =x1 r-1 x1 r =F(RK L r , x3 r-1 )(+)x2 r-1 x2 r =x3 r-1 x3 r =F(RK R r ,x1 r-1 )(+)x0 r-1 ...(3)

[0031] Furthermore, in the final round (m-th round), the left and right crossover of the data is not performed. Therefore, data x0 m (Ciphertext block portion C0), x1 m (Ciphertext block C1), x2 m (Ciphertext block portion C2) and x3 m The ciphertext block portion C3 is represented by the following equation (4). x0 m =F(RK R m ,x1 m-1 )(+)x0 m-1 x1 m =x1 m-1 x2 m =F(RK L m , x3 m-1 )(+)x2 m-1 x3 m =x3 m-1 ...(4)

[0032] Furthermore, if the data stirring unit 74 is configured as shown in Figure 2, the data stirring unit 76 processes the Feistel structure in Figure 2 from bottom to top to decrypt the plaintext block P from the ciphertext block C. In other words, the data stirring unit 76 processes the Feistel structure in Figure 2 by working backward from the mth round to the 1st round to decrypt the plaintext block P from the ciphertext block C.

[0033] The ciphertext block C is divided into two ciphertext block parts, C0 and C1, each consisting of N / 2 bits. The data mixing unit 76 generates the round key RK in the mth round. m The ciphertext block C1 is input to the round function F, and the exclusive OR of the encrypted result obtained with the ciphertext block portion C0 is calculated to obtain the intermediate data Z. m-2 The data stirring unit 76 obtains the round key RK in the m-1 round. m-1 Intermediate data Z is input to the round function F. m-2 The encrypted result obtained by inputting the result is calculated as the exclusive OR of the ciphertext block portion C1, and the intermediate data Z is obtained. m-3 The data stirring unit 76 obtains the round key RK in the r-th round. Similarly, the data stirring unit 76 obtains the round key RK in the r-th round. r Intermediate data Z is input to the round function F. r-1 The encrypted result obtained by inputting and intermediate data Z r Calculate the exclusive OR with the intermediate data Z r-2 The data stirring unit 76 then obtains the round key RK in the first round. 1 Intermediate data Z is input to the round function F. 0 The encrypted result obtained by inputting and intermediate data Z 1Calculate the exclusive OR with the intermediate data Z -1 The data stirring unit 76 obtains intermediate data Z -1 This is output as plaintext block P0. The data stirring unit 76 also outputs intermediate data Z 0 This is output as plaintext block P1. Then, the data stirring unit 76 outputs an N-bit plaintext block P, which is formed by concatenating plaintext block portion P0 and plaintext block portion P1.

[0034] Furthermore, if the data stirring unit 74 is configured as shown in Figure 3, the data stirring unit 76 processes the Feistel structure in Figure 3 from bottom to top to decrypt the plaintext block P from the ciphertext block C. In other words, the data stirring unit 76 processes the Feistel structure in Figure 3 by working backward from the mth round to the 1st round to decrypt the plaintext block P from the ciphertext block C.

[0035] The ciphertext block C is divided into three ciphertext block parts, C0, C1, C2, and C3, each of which is N / 4 bits. The data stirring unit 76 uses the round key RK in the mth round. R m The ciphertext block portion C1 is input to the round function F on the right, and the exclusive OR of the encrypted result obtained with the ciphertext block portion C0 is calculated to obtain the intermediate data Z2. m-2 The data stirring unit 74 obtains the round key RK in the mth round. L m The ciphertext block portion C3 is input to the left-hand round function F, and the exclusive OR of the encrypted result obtained with the ciphertext block portion C2 is calculated to obtain the intermediate data Z0. m-2 The data stirring unit 76 obtains the round key RK in the m-1 round. R m-1 The intermediate data Z2 is entered into the round function F on the right. m-2 The encrypted result obtained by inputting the result and the ciphertext block portion C3 are used to calculate the exclusive OR of the result, which is then used to obtain the intermediate data Z2. m-3The data stirring unit 74 obtains the round key RK in the m-1 round. L m-1 The intermediate data Z0 is input to the left-hand round function F. m-2 The encrypted result obtained by inputting the result and the ciphertext block portion C1 are used to calculate the intermediate data Z0. m-3 Obtain it.

[0036] Similarly, in the following rounds, the data stirring unit 76 uses the round key RK in the r-th round. R r The intermediate data Z2 is entered into the round function F on the right. r-1 The encrypted result obtained by inputting and intermediate data Z0 r Calculate the exclusive OR with the intermediate data Z2 r-2 The data stirring unit 76 obtains the round key RK in the r-th round. L r The intermediate data Z0 is input to the left-hand round function F. r-1 The encrypted result obtained by inputting and intermediate data Z2 r Calculate the exclusive OR with the intermediate data Z0 r-2 The data stirring unit 76 then obtains the round key RK in the first round. R 1 The intermediate data Z2 is entered into the round function F on the right. 0 The encrypted result obtained by inputting and intermediate data Z0 1 Calculate the exclusive OR with the intermediate data Z2 -1 The data stirring unit 76 acquires the round key RK in the first round. L 1 The intermediate data Z0 is input to the left-hand round function F. 0 The encrypted result obtained by inputting and intermediate data Z2 1 Calculate the exclusive OR with the intermediate data Z0 -1 The data stirring unit 76 obtains intermediate data Z2 -1 The data is output as plain text block P0. The data stirring unit 76 also outputs intermediate data Z2 0The data is output as plain text block P1. The data stirring unit 76 also outputs intermediate data Z0 -1 The data is output as plain text block P2. The data stirring unit 76 also outputs intermediate data Z0 0 This is output as plaintext block P3. Then, the data stirring unit 76 outputs an N-bit plaintext block P, which is formed by concatenating plaintext block portions P0, P1, P2, and P3.

[0037] From a security standpoint, as mentioned above, the round function F needs to be input with a different round key value each time it is used. Therefore, in the key scheduling process, it is necessary to generate a round key with a different value each time the round function F is used. There are two implementation methods for the key scheduling process: "pre-generation" and "on-the-fly". "Pre-generation" is an implementation method in which the key scheduling process is executed before the stirring process (encryption or decryption process) is performed, and all the necessary round keys are loaded into memory. On the other hand, "on-the-fly" is an implementation method in which the necessary round keys are generated each time in parallel with the execution of the stirring process. In the case of "pre-generation", the processing related to the round keys while the stirring process is being performed is limited to referencing the round keys loaded into memory. Therefore, the impact on the stirring process time is small, but it consumes memory resources to store all the round keys. For this reason, problems may arise when implementing pre-generation key scheduling in embedded microcontrollers with limited memory resources. On the other hand, with the "on-the-fly" approach, it is not necessary to store all round keys in memory resources, so memory resource consumption is low. However, since key scheduling is performed in parallel with the agitation process, a long key scheduling time can affect the agitation time. Therefore, with the "on-the-fly" approach, key scheduling needs to be executed quickly by simplifying its configuration while considering security.

[0038] Here, the security in the encryption process (key schedule process and mixing process) will be described. For the encryption process to ensure security, it is required to be resistant to attacks (decryption) from an attacker. As general decryption methods for block ciphers, there are the brute-force method and the shortcut method. The brute-force method is an attack method that tries all possible master keys (secret keys) to find the correct secret key, and it serves as the baseline for the security of the encryption process. Here, in the brute-force method, if the number of bits of the secret key is n, then n searches are required. Therefore, if the number of bits of the secret key is long enough, brute-force search in realistic time becomes impossible. Such security due to the sufficient length of the number of bits of the secret key is called computational security.

[0039] Figure 4 is a diagram for explaining the shortcut method. The shortcut method is an attack method that utilizes the correlation of data due to the internal structure of the cipher and obtains the key (round key) with a smaller computational amount than the brute-force method. There are, for example, the linear decryption method and the differential decryption method in the shortcut method. Here, let the number of rounds in the encryption process be m, and the number of rounds in which a significant correlation holds be m1 (m1 < m). Also, assume that the attacker can obtain a plurality of pairs of plaintext P and ciphertext C. At this time, the attacker assumes (estimates) the round keys for m - m1 rounds. The attacker uses a plurality of pairs of plaintext P and ciphertext C, calculates the intermediate data X after m1 rounds with the assumed round keys, and determines whether the assumed key is correct based on whether the obtained intermediate data X satisfies the assumed correlation. When the intermediate data X satisfies the assumed correlation, the attacker can regard the assumed round key as a candidate for the correct round key. In the case of the linear decryption method, "satisfying the correlation (having a correlation)" may mean, for example, that the exclusive logical sum of a certain bit of the plaintext and a certain bit of the intermediate data X, or the exclusive logical sum of a plurality of intermediate data is often 0 or 1, but it is not limited to this. Also, in the case of the differential decryption method, "satisfying the correlation (having a correlation)" may mean, for example, that when a pair of plaintexts with a specific difference value is given, the probability of the appearance of a specific difference value as the difference of the intermediate data X is high, but it is not limited to this.

[0040] Shortcut methods are efficient attacks when the probability of correlation is high and when the assumed amount of round keys assumed at one time (the amount of bits assumed for the entire round key) is small. Therefore, to improve security against shortcut methods, it is effective to increase the strength of the components that make up the data agitation section (the round function and the components that make up the round function) and to increase the number of rounds m. This can suppress the establishment of correlation (the occurrence of agitation bias). In addition, in the key scheduling process, it is important to generate round keys in such a way that the assumed amount of keys at the time of decryption is large.

[0041] As mentioned above, Patent Document 1 uses a round function that employs a transposition table called an S-box. In this technology, the calculation result is obtained by referring to the transposition table during encryption processing, which enables relatively fast implementation. However, when implementing tables such as transposition tables, memory resources are consumed to store the tables, so the calculation size of the S-box needs to be limited to, for example, 8 bits or less.

[0042] For example, when constructing a 128-bit block cipher using a Feistel structure, the round function F needs to be configured as a 64-bit input / output. However, as mentioned above, implementing a 64-bit S-box is impossible from a memory usage standpoint. Therefore, there is a technique that employs a method of arranging multiple 8-bit S-boxes in a grid and using a diffusion layer to mix their results.

[0043] On the other hand, this method makes it difficult to evaluate security indicators such as the exact differential probability and linear probability as round function F. Therefore, security is evaluated heuristically by calculating the differential probability and linear probability using the method for finding the active S-box. Security indicators include, for example, the maximum differential probability (MDP) and the maximum linear probability (MLP). For MDP, for example, if the number of input block bits is N, the MDP of the entire encryption is 1 / 2 N The encryption may be secure if the following conditions are met. On the other hand, if the MDP is large, it means that the probability of a certain difference occurring is extremely high, which may indicate a bias in the agitation. Here, it is possible to reduce the overall MDP of the encryption by increasing the number of rounds, regardless of the MDP of the round function F. On the other hand, the smaller the MDP of the round function F, the smaller the overall MDP of the encryption becomes in fewer rounds. In other words, the smaller the MDP of the round function F, the smaller the MDP that is secure against differential attacks can be achieved in fewer rounds.

[0044] If K is the round key input to the round function F, and the input data is X, X' (where X ≠ X'), then the MDP of the round function F is expressed by the following equation (5). δ represents the difference between the output data Y when input data X is input to the round function F and the output data Y' when input data X' is input to the round function F. {x} represents the probability of x occurring.

number

[0045] On the other hand, as mentioned above, the above methods make it difficult to rigorously evaluate the security indicators, and therefore difficult to rigorously evaluate the security of shortcut methods. For example, the ARX (Addition-RotateShift-XOR) method is a block cipher design method for general software. This method can be implemented efficiently because it can directly utilize the addition, shift, and exclusive OR instructions executed in general software. However, this method has the problem that it is difficult to rigorously evaluate shortcut methods such as differential ciphers and linear ciphers because it is difficult to determine the MDP and MLP.

[0046] Here, the universal hash (UH) function, which is studied in the field of theoretical computer science, can be used to solve the above problem because it can guarantee a small difference probability. An example of a universal hash is the technology disclosed in Non-Patent Literature 1. The method described in Non-Patent Literature 1 is an efficient method using arithmetic multiplication. Furthermore, Non-Patent Literature 1 shows that security evaluation indicators such as difference probability and linear probability can be strictly evaluated. The inventors of this disclosure have found that by applying the method described in Non-Patent Literature 1, it is possible to construct a cryptographic component (round function F) that has the best security evaluation indicators such as difference probability and linear probability, as shown below.

[0047] Figure 5 illustrates the configuration of the round function F according to this disclosure. In the example in Figure 5, the number of bits n of the input intermediate data X and output intermediate data Y of the round function F is set to 32, but n is not limited to 32. The number of input and output bits n of the round function F can be any multiple of 2 that is less than the number of bits N of the input data block.

[0048] The round function F shown in Figure 5 uses a 192-bit round key RK to perform operations on 32-bit input intermediate data X and outputs 32-bit output intermediate data Y. Each time the round function F is used, a different round key RK is input to it. In other words, each time the round function F is used, it takes n-bit input intermediate data X and the round key RK (described later) as input, performs the operations (described later), and outputs n-bit output intermediate data Y.

[0049] The round key RK is RK=K 2 3||K 2 2||K 2 1||K 1 3||K 1 2||K 1 It is represented as 1. Note that "||" is a linking symbol. Here, K 2 3,K 2 2,K 2 1,K 1 3,K 1 2,K 1 1 is the round key portion that constitutes the round key RK. 2 3,K 2 2,K 2 1,K 1 3,K 1 2,K 1 Each 1 has n bits. Therefore, the round key RK consists of six n-bit round key parts, and the first round key part K. 1 1. Second round key section K 1 2. Third round key section K 1 3. Fourth round key section K 2 1. Round 5 Key Section K 2 2. Round 6 Key Section K 2 It consists of 3. Therefore, the number of bits in the round key RK is n*6. When n=32, the number of bits in the round key RK is 192 bits.

[0050] Also, the input intermediate data X is X = X L ||X R It is expressed as follows. Note that X L and XR Each bit is 16 bits. In other words, the input intermediate data X is the first input data portion X of n / 2 bits. L and the n / 2 bit second input data portion X R It is composed of the following. Also, the output intermediate data Y is Y=Y L ||Y R It is expressed as follows. Note that Y L and Y R Each bit is 16 bits. In other words, the output intermediate data Y is the first output data portion Y of n / 2 bits. L and the n / 2 bit second output data portion Y R It is composed of and .

[0051] Furthermore, the round function F performs the following calculation. In the example in Figure 5, n=32. The round function F performs the following calculation on the first input data portion X L and the first round key part K 1 The lower n bits of the value obtained by arithmetic addition of 1 and the second input data part X R and the second round key part K 1 The lower n bits of the value obtained by arithmetic addition of 2 are arithmetic multiplied together. The round function F is the lower n bits of the value obtained by the above arithmetic multiplication and the third round key part K. 1 The first output data part Y is obtained by arithmetic addition of 3 and the value obtained by taking the upper n / 2 bits of the lower n bits of the result. L It is calculated as follows.

[0052] In other words, the round function F performs the operation shown in equation (6) below. Y L =(( Christmas L +K 1 1) × (X R +K 1 2))+K 1 3>> n / 2 ...(6)

[0053] Note that "+" indicates arithmetic addition and corresponds to the operation of the symbol with a + inside a square in Figure 5. However, if the number of bits (digits) of the value obtained in arithmetic addition exceeds n bits, bits n+1 and above (overflow bits) are ignored, and only the lowest n bits are extracted. Similarly, "×" indicates arithmetic multiplication and corresponds to the operation of the symbol with an × inside a square in Figure 5. However, if the number of bits (digits) of the value obtained in arithmetic multiplication exceeds n bits, bits n+1 and above (overflow bits) are ignored, and only the lowest n bits are extracted. Also, "y>>z" indicates the upper z bits of y.

[0054] Furthermore, the round function F is the first input data portion X L and the fourth round key part K 2 The lower n bits of the value obtained by arithmetic addition of 1 and the second input data part X R and the 5th round key part K 2 The value of the lower n bits of the result obtained by arithmetic addition of 2 is arithmetic multiplied by 2. The round function F is the value of the lower n bits of the result obtained by the above arithmetic multiplication and the 6th round key part K. 2 The second output data part Y is obtained by arithmetic addition of 3 and the value obtained by taking the upper n / 2 bits of the lower n bits of the result. R It is calculated as follows.

[0055] In other words, the round function F performs the operation shown in equation (7) below. Y R =(( Christmas L +K 2 1) × (X R +K 2 2))+K 2 3>> n / 2 ...(7)

[0056] Furthermore, the round function F is the first output data portion Y L and the second output data portion Y R The two are concatenated to obtain n-bit output intermediate data Y. Then, the round function F outputs the output intermediate data Y.

[0057] As described above, the round function F shown in Figure 5 is an efficient method using arithmetic multiplication that can be executed with general software. Therefore, it enables high-speed cryptographic processing (stirring). Furthermore, the round function F shown in Figure 5 is the cryptographic component (round function F) that has the best security evaluation indicators, such as differential probability and linear probability. Therefore, by performing stirring processing using the round function F shown in Figure 5, it is possible to more reliably guarantee resistance to shortcut methods compared to round functions constructed by combining S-box and diffusion layers.

[0058] In typical block ciphers, the size of the round key input to the round function is often equal to the size of the input intermediate data. In contrast, the size of the round key RK used in the round function F shown in Figure 5 is n*6. Therefore, the round function F shown in Figure 5 uses a round key RK that is 6 times the size of the input intermediate data n. Consequently, in the round function F shown in Figure 5, the size of the round key RK is longer than the size of the input intermediate data X. Therefore, when constructing a block cipher using the round function F shown in Figure 5 and considering its implementation on a low-end microcontroller, it is necessary to devise a method for generating the round key RK. This is because low-end microcontrollers are devices with small memory capacity. Furthermore, to apply the round function F shown in Figure 5 to a device with small memory capacity, it is difficult to employ a method of pre-calculating the round key RK and storing it in memory. Therefore, it is desirable to generate the round key RK on-the-fly, in parallel with the stirring process. As mentioned above, the round function F shown in Figure 5 is computationally efficient, and therefore has a fast computation speed. Consequently, in order to apply the round function F shown in Figure 5 to a device with a small memory capacity, a key scheduling process is required that efficiently and quickly generates a secure round key RK.

[0059] Here, as shown in equations (6) and (7) above, in the round function F shown in Figure 5, the first output data portion Y L and second output data portion Y R This is the value of the upper n / 2 bits of the calculation result. In other words, the first output data part Y L and second output data portion Y R This value is the result of the calculation with the lower bits ignored. Therefore, it is necessary to consider the problem that an attacker may be able to ignore the lower bits of the round key RK when estimating (assuming) the round key RK.

[0060] Figure 6 illustrates the potential problem in the round function relating to this disclosure where the lower bits of the round key may be ignored. Figure 6 shows the agreement rate between the value of "y>>n / 2" when the lower bits of K are set to 0 and the value of "y>>n / 2" when the lower bits of the bit sequence of K are not set to 0 for equation (8) below. x+K=y>>n / 2 ...(8)

[0061] In equation (8), "+" indicates arithmetic addition. Also, equation (8) is the same as equation (6) above, with "+K 1 The part "3>> n / 2" and the part "+K" in equation (7). 2 This corresponds to the part "3>> n / 2". Also, in equation (8), K represents the round key portion, and the third round key portion K 1 3 or 6th round key portion K 2 This corresponds to 3. Also, x is the value that is arithmetically added with K. Also, the number of bits for K and x is n. Furthermore, "y>>n / 2" indicates the upper n / 2 bits of the value of y obtained by x+K. Therefore, "y>>n / 2" is the output data portion (first output data portion Y) L or second output data portion Y RThis corresponds to ). Figure 6 shows the agreement rate between the value of "y>>n / 2" when the lower 1 to 16 bits of the bit sequence of K are set to 0, and the value of "y>>n / 2" when the lower bits of the bit sequence of K are not set to 0, for x and K with bit numbers n of 16, 18, 20, and 32.

[0062] As shown by arrow A1 in Figure 6, when the size n of the data x and K being arithmetically added is 32, the value of "y>>n / 2" when ignoring the lower 10 bits of K matches the value of "y>>n / 2" when the lower 10 bits of K are not ignored with a probability of 99% or higher. In other words, even if the lower 10 bits of K are ignored, the resulting output data portion matches the correct output data portion with a probability of 99%. Also, as shown by arrow A2 in Figure 6, when the size n of the data x and K being arithmetically added is 32, the value of "y>>n / 2" when ignoring the lower 13 bits of K matches the value of "y>>n / 2" when the lower 10 bits of K are not ignored with a probability of 90% or higher. In other words, even if the lower 13 bits of K are ignored, the resulting output data portion matches the correct output data portion with a probability of 90%.

[0063] Thus, in the round function F shown in Figure 5, when an attacker estimates the round key RK, the third round key portion K is used in the later calculations of the operation shown in Figure 5. 1 3 and 6th round key section K 2 It is possible to ignore the lower bits of each of the 3s. Furthermore, as will be discussed later, the first round key portion K used in the preceding operation of the operation in Figure 5 1 1. Second round key section K 1 2. Fourth round key section K 2 Rounds 1 and 5, key section K 2Even if the value of 2 is duplicated, an attacker can reduce the estimated value of the round key (RK). Therefore, there is a risk that an attacker may be able to estimate the key with less computational effort when estimating the round key (RK). For this reason, it is necessary to generate keys using key scheduling to prevent an attacker from reducing the estimated value (assumed value) of the key when estimating the round key. In other words, it is necessary to generate keys using key scheduling to discourage attackers from efficiently estimating keys.

[0064] Figure 7 is a diagram illustrating the overview of the key scheduling process relating to this disclosure. The master key MK is a random number provided externally in advance. The master key MK may be a random number generated by, for example, a random number generator.

[0065] State S is a data storage area for holding data. State S can be implemented using memory resources. The value set in State S is provided to the data stirring unit as a round key RK. The round key RK provided to the data stirring unit is input to the round function F during the stirring process. The value set in State S is updated by the update process. This updates the value of the round key RK. Therefore, a different round key RK is input to the round function F each time the round function F is used. In other words, the round key RK input to the round function F when the round function F is used for the i-th time may be different from the round key RK input to the round function F when the round function F is used for the j-th time (j≠i).

[0066] In the key scheduling process, the master key MK is first set (stored) in state S. That is, state S is initially set to the value of the master key MK. In other words, in the initial key scheduling process, the master key MK is set in state S, thereby setting the round key RK for the first round. Then, in the update process, the value of state S is updated. As a result, a different round key RK for each round is input to the round function F. Furthermore, because the key scheduling process is performed in parallel with the agitation process, it becomes unnecessary to pre-store all of the round keys RK used throughout the agitation process in memory. That is, as the agitation process progresses through rounds, a round key RK to be input to the round function F is generated each time. Also, because the key scheduling process is performed in parallel with the agitation process, the update process needs to be executed efficiently in order to suppress the impact on the processing time of the agitation process. In the key scheduling process of this disclosure, as described later, the initial setup and update processes are executed safely and efficiently. Therefore, this disclosure makes it possible to achieve safe and high-speed cryptographic processing while suppressing the amount of memory required.

[0067] (Embodiment 1) The embodiments will be described below with reference to the drawings. For clarity of explanation, the following descriptions and drawings have been omitted and simplified as appropriate. In addition, the same elements are denoted by the same reference numerals in each drawing, and redundant explanations have been omitted where necessary.

[0068] Figure 8 is a diagram illustrating the configuration of the information processing system 1 according to this disclosure. The information processing system 1 includes a master key providing device 2 and information processing devices 100 and 200. The master key providing device 2, the information processing device 100 and the information processing device 200 may be physically integrated or separate. If the master key providing device 2, the information processing device 100 and the information processing device 200 are physically separate from each other, they are connected to each other via a wired or wireless communication network. Furthermore, the components of the information processing device 100, which will be described later, may be implemented by separate devices. Similarly, the components of each of the information processing devices 200, which will be described later, may be implemented by separate devices.

[0069] The master key provider 2 may have computer functionality. The master key provider 2 also has random number generation functionality. The master key provider 2 generates a master key in advance before the stirring process is performed. The master key provider 2 provides the master key MK to the information processing device 100 and the information processing device 200 by transmitting the generated master key. The master key provider 2 provides the information processing device 100 and the information processing device 200 with the same value of master key MK. Here, the master key MK provided by the master key provider 2 is an n*M bit random number composed of M master key parts of n bits each (M is an integer of 4 or greater). The value of M is, for example, 4 or 8, but is not limited to these. Also, as mentioned above, n is the number of bits of the input intermediate data input to the round function F described above using Figure 5. The value of n is, for example, 32, but is not limited to this.

[0070] The information processing device 100 may also have computer functionality. The information processing device 100 functions as an encryption device that performs encryption processing. The information processing device 100 performs stirring (encryption processing) using the round function F shown in Figure 5. The information processing device 100 also performs key scheduling processing using the master key MK that has been pre-generated by the master key providing device 2. Furthermore, the information processing device 100 can be implemented using a low-end device with limited memory resources. Details of the information processing device 100 will be described later.

[0071] The information processing device 200 may also have computer functionality. The information processing device 200 functions as a decryption device that performs decryption processing. The information processing device 200 performs stirring (decryption processing) using the round function F shown in Figure 5. The information processing device 200 also performs key scheduling processing using the master key MK that has been pre-generated by the master key providing device 2. Furthermore, the information processing device 200 can be implemented using a low-end device with limited memory resources. Details of the information processing device 200 will be described later.

[0072] <Encryption device> Figure 9 is a diagram illustrating the configuration of the information processing device 100 (encryption device) according to this disclosure. As shown in Figure 9, the information processing device 100 includes a data receiving unit 102, a data splitting unit 104, a master key acquisition unit 106, a data stirring unit 110, a key scheduling unit 120, and an output unit 130. The key scheduling unit 120 also includes an initial setting unit 122 and an update processing unit 124.

[0073] The information processing device 100 can be implemented by a computing device such as a computer. In other words, the information processing device 100 has an arithmetic unit such as a CPU (Central Processing Unit) and a storage device such as memory or a disk. The information processing device 100 implements each of the above components by, for example, having the arithmetic unit execute a program stored in the storage device. This is also true in other embodiments described later.

[0074] The data reception unit 102 functions as a data reception means. The data division unit 104 functions as a data division means (division means). The master key acquisition unit 106 functions as a master key acquisition means. The data stirring unit 110 functions as a data stirring means. The key scheduling unit 120 functions as a key scheduling means. The initial setting unit 122 functions as an initial setting means. The update processing unit 124 functions as an update processing means. The output unit 130 functions as an output means.

[0075] The data reception unit 102 receives input data. Specifically, the data reception unit 102 receives plaintext to be encrypted as input data. The data reception unit 102 may receive plaintext input from, for example, an external device connected via a network. The data reception unit 102 outputs the plaintext input data to the data splitting unit 104.

[0076] The data partitioning unit 104 divides the input data into N bits to generate multiple N-bit input data blocks. In other words, the data partitioning unit 104 divides the plaintext input data into N bits to generate multiple N-bit plaintext blocks. Here, N corresponds to the size of the plaintext block in the encryption process (stirring process) in the data stirring unit 110. If the encryption process is performed using the Feistel structure illustrated in Figure 2, the data partitioning unit 104 may divide the plaintext into 64-bit plaintext blocks. Alternatively, if the encryption process is performed using the generalized Feistel structure illustrated in Figure 3, the data partitioning unit 104 may divide the plaintext into 128-bit plaintext blocks. The same applies to the data partitioning unit 204 of the information processing device 200, which will be described later. The data partitioning unit 104 outputs the plaintext blocks, which are the input data blocks, to the data stirring unit 110.

[0077] The master key acquisition unit 106 acquires (receives) the master key MK, which is a random number, from the master key supply device 2. The master key acquisition unit 106 outputs the acquired master key MK to the key scheduling unit 120.

[0078] The data stirring unit 110 corresponds to the data stirring unit 74 shown in Figure 1. The data stirring unit 110 performs stirring processing by stirring each of the multiple N-bit input data blocks using the round function F shown in Figure 5, and outputting an N-bit output data block. Specifically, the data stirring unit 110 stirs the input data blocks by repeatedly using the round function F, using it A times per round, over multiple rounds. In other words, the data stirring unit 110 encrypts the plaintext blocks by repeatedly using the round function F, using it A times per round, over multiple rounds. As a result, the data stirring unit 110 generates a ciphertext block, which is the output data block. The data stirring unit 110 outputs the ciphertext block, which is the output data block, to the output unit 130.

[0079] More specifically, the data stirring unit 110 performs stirring using a Feistel structure, for example, as illustrated in Figure 2 or Figure 3. When the data stirring unit 110 performs stirring (encryption) using the Feistel structure illustrated in Figure 2, the value of A is 1. In other words, the data stirring unit 110 uses the round function F once per round. When the data stirring unit 110 performs stirring (encryption) using the generalized Feistel structure illustrated in Figure 3, the value of A is 2. In other words, the data stirring unit 110 uses the round function F twice per round. The data stirring unit 110 may also use the round function F three or more times per round. These same principles apply to the data stirring unit 210 of the information processing device 200, which will be described later.

[0080] Furthermore, the data stirring unit 110 performs stirring using the round key RK generated by the key scheduling process executed by the key scheduling unit 120, which will be described later. Similar to the processing of the data stirring unit 74 described above, the data stirring unit 110 repeatedly uses the round function F, into which a different round key RK is input for each round, from the first round to the final round, the mth round, to perform stirring.

[0081] The key scheduling unit 120 corresponds to the key scheduling unit 72 shown in Figure 1. The key scheduling unit 120 performs key scheduling processing, generating the round key RK to be input to the round function F using a pre-generated master key MK, in parallel with the repeated use of the round function F for the stirring process. The key scheduling unit 120 generates the round key RK to be input to the round function F from the first round to the final round, round m. The key scheduling unit 120 then outputs the round key RK to be input to the round function F used in the rounds executed in the stirring process to the data stirring unit 110. More details will be described later.

[0082] The initialization unit 122 performs initialization by setting one of the M master key parts that constitute the master key MK to each of the multiple states S, each of which is n bits. Here, each of the multiple states S corresponds to one of the multiple round key parts that constitute the round key RK. And each of the multiple states S corresponds to one of the multiple round key parts that constitute the round key RK for R rounds (R is an integer greater than or equal to 2). Here, as described above with reference to Figure 5, six round key parts are used in one use of the round function F. As described above, the six round key parts are the first round key part K 1 1. Second round key section K 1 2. Third round key section K 1 3. Fourth round key section K 2 1. Round 5 Key Section K 2 2. Round 6 Key Section K 2It consists of 3. Therefore, if the round function F is used A times in one round, the number of states S will be 6*R*A. Accordingly, the initialization unit 122 performs initialization by setting one of the M master key parts for the 6*R*A states. The relationship between R and M is 6*R=M*x, where x is an integer greater than or equal to 2.

[0083] Specifically, the initial setup unit 122 assigns each of the six round key portions input in a single use of the round function F to one of several states, based on the following initial setup conditions. That is, as the first initial setup condition, the initial setup unit 122 sets the first round key portion K 1 1 and 2nd round key part K 1 2 and 3rd round key part K 1 Three different master key portions are assigned to the three states S corresponding to each of the three. In addition, as a second initial setting condition, the initial setting unit 122 sets the fourth round key portion K 2 1 and 5th round key part K 2 2 and the 6th round key part K 2 Three different master key portions are assigned to the three corresponding states S. By assigning each master key portion to each state S in this way, it is possible to suppress the reduction of the amount of assumptions an attacker makes when assuming (estimating) the round key RK. More details will be provided later.

[0084] Furthermore, the initial setup unit 122 assigns each of the multiple master key portions to one of several states based on the following initial setup conditions for the multiple round key portions input by a single use of the round function F. That is, as a third initial setup condition, the initial setup unit 122 sets the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2Four different master key portions are assigned to each of the four corresponding states S. By assigning each master key portion to each state S in this way, it is possible to suppress the reduction of the amount of assumptions an attacker makes when assuming (estimating) the round key RK. More details will be provided later.

[0085] Furthermore, the initial setup unit 122 assigns each of the multiple master key portions to one of the multiple states S, based on the following initial setup conditions, for multiple round key portions input by at least two consecutive uses of the round function F. That is, as a fourth initial setup condition, the initial setup unit 122 assigns two third round key portions K 1 3 and 2 sixth round key parts K 2 Four different master key portions are assigned to each of the four corresponding states S. By assigning each master key portion to each state S in this way, multiple master key portions can be evenly distributed across multiple states S. This suppresses bias in the round key. Therefore, it is difficult for an attacker to easily deduce the round key. More details will be provided later.

[0086] Furthermore, the initial setup unit 122 performs the initial setup for all 6*R*A states under the following initial setup conditions. That is, as a fifth initial setup condition, the initial setup unit 122 performs the initial setup for all 6*R*A states such that the number of master key portions allocated to each of the M master key portions is the same. This ensures that the master key portions are evenly allocated across all states. Furthermore, as a sixth initial setup condition, the initial setup unit 122 sets the third round key portion K of each of the M master key portions. 1 3 and 6th round key section K 2 Initial settings are performed so that the number assigned to the corresponding state S is the same for both 3 and 3. This ensures that for R rounds, the third round key portion K 1 3 and 6th round key section K 2The master key portion is evenly distributed among the states S corresponding to 3. Furthermore, as a seventh initial setting condition, the initial setting unit 122 determines the first round key portion K of each of the M master key portions. 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 Initial settings are performed so that the number of values ​​assigned to the corresponding state S is the same for both 2 and 2. This ensures that for R rounds, the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 The master key portion is evenly distributed across the corresponding states S. This initial setup suppresses bias in the master key portion used as the round key. Therefore, it is difficult for an attacker to easily deduce the round key. Further details will be provided later.

[0087] Furthermore, for each of the multiple states S, the key scheduling unit 120 generates multiple master key portions set according to the initial setup conditions described above as round keys RK for R rounds. The key scheduling unit 120 then outputs the generated round keys RK to the data stirring unit 110. The data stirring unit 110 then performs stirring processing using the round keys RK.

[0088] The update processing unit 124 updates the round key RK to generate the round key RK to be used in subsequent rounds. The update processing unit 124 updates the round key by updating the value of state S. The update processing generates round key RK for R rounds, and then updates the value of state S to generate the round key RK to be used in the following R rounds. Then, each time the value of state S is updated, the update processing unit 124 outputs data indicating the value set in state S as the round key RK to the data stirring unit 110. In other words, the update processing unit 124 outputs the round key RK to be input into the round function F for the round executed in the stirring process to the data stirring unit 110. To put it another way, the update processing unit 124 outputs the round key RK for each round to the data stirring unit 110 in accordance with the order in which the rounds progress in the data stirring unit 110.

[0089] The update processing unit 124 performs the update process of multiple states S using update conditions that include at least the following conditions. Specifically, the update processing unit 124 sets the value of each of the second states by taking the exclusive OR operation between the value of one of the multiple states S, a first state (reference state), and the values ​​of two or more predetermined T second states (updated states) that are different from the first state. In this way, the update processing unit 124 updates the second states. At that time, the first and second states are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state. Furthermore, the first and second states are selected such that the positional relationship between the first and second states is a predetermined positional relationship. By performing the update process in this manner, a cryptographic algorithm that is evaluated as having good security can be realized. Note that the larger the "predetermined number T" corresponding to the number of second states that are exclusively ORed with the first state, the more the values ​​of the states S are updated. Therefore, as the round key RK is randomized (shuffled), the likelihood of improved security increases. Details about the update process will be described later.

[0090] The output unit 130 controls the output of output data consisting of multiple output data blocks output by the data stirring unit 110. The output unit 130 processes the output of ciphertext consisting of multiple ciphertext blocks as output data. The output unit 130 may also process the output of ciphertext in which multiple ciphertext blocks are concatenated. The output unit 130 may, for example, control the output of the ciphertext to an output device such as a display. The output unit 130 may also control the output of the ciphertext to an external device connected via a network, for example. For example, the output unit 130 may process the output of the ciphertext to an information processing device 200.

[0091] Figure 10 is a diagram illustrating the processing of the key scheduling unit 120 according to this disclosure. Figure 10 can be said to represent the key scheduling function according to this disclosure. The key scheduling function takes the master key MK as input as an initial value and outputs the round keys RK to be used in the first to R rounds. Furthermore, the key scheduling function takes the round keys RK generated in the previous key scheduling process, which have already been output, as input and outputs the round keys RK to be used in subsequent rounds through an update process on the input round keys RK.

[0092] Figure 10 illustrates the key scheduling function when A=1 and R=2. In other words, Figure 10 shows the case where the round function F is used once in one round, and 12 (=6*2*1) states S store one of the values ​​of the 12 round key parts that constitute the round key RK for two rounds. For example, Figure 10 shows the case where the data stirring unit 110 performs stirring using the Feistel structure illustrated in Figure 2.

[0093] Here, each of the multiple states S is S i If expressed as such, the 12 states S are S0, ..., S 11 This can be expressed as (i=0,1,···,11). Note that each state S iIt may hold n bits (e.g., 32 bits) of data. Also, 12 states S0,...,S 11 S0, ..., S5 are round keys RK used in the rth round. r This corresponds to RK. However, r is an odd number, and r = 1, 3, 5, 7, ... That is, RK r This can be expressed as =S5||S4||S3||S2||S1||S0. Specifically, state S0 is the first round key portion K used in the rth round. 1 It corresponds to 1. In other words, state S0 is the first round key portion K used in the rth round. 1 The value 1 is stored. This is also true for other states S, which will be discussed later. In addition, state S1 is the second round key portion K used in the rth round. 1 Corresponds to 2. Also, state S2 is the third round key portion K used in the rth round. 1 It corresponds to 3. Also, state S3 is the 4th round key portion K used in the rth round. 2 It corresponds to 1. Also, state S4 is the 5th round key portion K used in the rth round. 2 Corresponds to 2. Also, state S5 is the 6th round key portion K used in the rth round. 2 Corresponds to 3.

[0094] Also, there are 12 states S0,...,S 11 S6,...,S 11 This is the round key RK used in the r+1th round. r+1 This corresponds to RK. r+1 =S 11 ||S 10 This is represented as ||S9||S8||S7||S6. Specifically, state S6 is the first round key portion K used in the r+1th round. 1 It corresponds to 1. Also, state S7 is the second round key portion K used in the r+1th round. 1 This corresponds to 2. Also, state S8 is the third round key portion K used in the r+1th round. 1It corresponds to 3. Also, state S9 is the fourth round key portion K used in the r+1th round. 2 Corresponds to 1. Also, state S 10 This is the 5th round key portion K used in the r+1th round. 2 Corresponds to 2. Also, state S 11 This is the 6th round key portion K used in the r+1th round. 2 Corresponds to 3.

[0095] The initial setup unit 122 sets 12 states S0,...,S based on the initial setup conditions described above. 11 Each of these is set to one of the multiple master key parts that make up the master key MK. This results in 12 states S0,...,S 11 Each of these stores a value corresponding to one of several master key portions. This generates six round key portions used in the first round and six round key portions used in the second round. In other words, the initial setup unit 122 generates the six round key portions used in the first round from the values ​​(master key portions) set in the six states S0, ..., S5. For example, the initial setup unit 122 sets the value set in state S0 to the first round key portion K used in the first round. 1 It is generated as 1. This is the same for the other states. Also, the initial setup unit 122 generates 6 states S6,...,S 11 The value set (master key portion) is used to generate six round key portions to be used in the second round. For example, the initial setup unit 122 uses the value set in state S6 to generate the first round key portion K used in the second round. 1 It is generated as 1. This is also true for other states. States S0,...,S 11 An example of setting multiple master key components will be discussed later.

[0096] Furthermore, the update processing unit 124 sets 12 states S0,...,S to satisfy the update conditions described above. 11The value of is updated. This generates the round key RK to be used in the third round and beyond. The update processing unit 124 updates the first state S in the first update process. j The value of and the second state S of 2 or more j-k1 ,S j-k2 The exclusive OR of the values ​​of ,··· is calculated, and the resulting value is used in the second state S j-k1 ,S j-k2 , .... to be stored. In other words, the second state is S j-k1 =S j-k1 XOR S j ,S j-k2 =S j-k2 XOR S j ...and so on, it is updated. This results in two or more second states S j-k1 ,S j-k2 The values ​​of ,··· are updated. The number of second states S corresponds to the predetermined number T mentioned above. The predetermined number T and an example of the position of the second state in the first update process will be described later.

[0097] Then, in the next update process, the update processing unit 124 changes the first state S j and the second state S j-k1 ,S j-k2 The index (subscript) j of ,··· is decremented and the same calculation is performed. That is, the update processing unit 124 performs the first state S j-1 The value of and the second state S of 2 or more j-k1-1 ,S j-k2-1 The exclusive OR of the values ​​of ,··· is calculated, and the resulting value is used in the second state S j-k1-1 ,S j-k2-1 Store in ,···. This will result in the second state S j-k1-1 ,S j-k2-1 The value of ,··· is updated. Thereafter, the update processing unit 124 performs the same processing, so that each state S i The value is updated.

[0098] Furthermore, during the update process, as index j is decremented, the positions of the first state and the second state slide in the same direction relative to each other. Also, the first state S in the first update j The values ​​of k1 and k2, and the number of second states (a predetermined number T), are predetermined, as will be described later. Therefore, the first and second states are selected such that their relative positions are predetermined. Note that when the positions of the first and second states reach the position of the initial state S0, the next decrement will return them to the last state S 11 The update process proceeds in a way that returns it to its original value. In other words, once the index is decremented to 0, it returns to 11 and is decremented again.

[0099] Note that in the example in Figure 10, the first state S in the first update process j State S 11 That is, 12 states S0,...,S 11 This is the final state. Also, the second state S j-k1 The index k1 is the first state S j The position and the second state S j-k1 This corresponds to the difference from the position of the second state S. j-k2 The index k2 is the first state S j The position and the second state S j-k2 It corresponds to the difference from the position. For example, if k1=1 and k2=7, the second state in the first update process is S 10 ,S4. At this time, in the first update process, state S 10 The value of is S 10 and S 11 The value of state S4 is updated to the exclusive OR value of S4 and S 11 The value is updated to the exclusive OR of the given value.

[0100] Then, as the update process progresses, the first state S jThe index j is decremented by one each time, and when j becomes 0, it returns to 11. That is, j = 11, 10, ..., 0, 11, ... Therefore, in the 12 states illustrated in Figure 10, the first state S j The position changes as the update process progresses. 11 Slide one position to the right from there. Similarly, as the update process progresses, in the 12 states illustrated in Figure 10, the position of the second state is S 10 , Starting from S4, each slides one position to the right. Therefore, in the second update process, the value of state S9 is S9 and S 10 The value of state S3 is updated to the exclusive OR value of S3 and S. Similarly, the value of state S3 is updated to the exclusive OR value of S3 and S 10 The value is updated to the exclusive OR of the given value.

[0101] Note that the correspondence between each state and each round key portion is not limited to the example above. In other words, each round key portion that makes up the round key RK used in a single round may correspond to any state among multiple states. For example, RK r It may also be =S0||S1||S2||S3||S4||S5. In this case, state S5 is the first round key portion K used in the rth round. 1 It corresponds to 1. Also, state S4 is the second round key portion K used in the rth round. 1 Corresponds to 2. Also, state S3 is the third round key portion K used in the rth round. 1 It corresponds to 3. Also, state S2 is the 4th round key portion K used in the rth round. 2 It corresponds to 1. Also, state S1 is the 5th round key portion K used in the rth round. 2 This corresponds to 2. Also, state S0 is the 6th round key portion K used in the rth round. 2 This corresponds to 3. r+1 The same applies to the case described below.

[0102] Also, there are 12 states S0,...,S11 S6,...,S 11 However, the round key RK is used in the rth round. r It may also correspond to S0,...,S5 being the round key RK used in the r+1th round. r+1 It may also be possible to respond to this. In other words, RK r =S 11 ||S 10 ||S9||S8||S7||S6, RK r+1 =S5||S4||S3||S2||S1||S0 may also be acceptable.

[0103] Note that Figure 10 illustrates the key scheduling function when A=1 and R=2, but the value of A is not limited to 1, and the value of R is not limited to 2. For example, when A=1 and R=3, the number of states is 18 (=6*3*1). Also, when the data stirring unit 110 performs stirring using the generalized Feistel structure illustrated in Figure 3, the round function F is used twice in one round. That is, A=2. Therefore, when R=2, the number of states is 24 (=6*2*2). Also, when R=3, the number of states is 36 (=6*3*2). Furthermore, the data stirring unit 110 may perform stirring using the round function F three or more times in one round. In this case, for example, when A=3 and R=3, the number of states is 54 (=6*3*3). Furthermore, since a large number of states will consume more memory resources, it is desirable to avoid having too many states in order to control memory usage.

[0104] <Initial settings for the comparative example> Figure 11 illustrates the initial settings for a comparative example. The example in Figure 11 shows the case where the configuration of state S is the same as the configuration shown in Figure 10. That is, Figure 11 shows the case where A=1 and R=2. Also, Figure 11 shows an example where the master key MK is composed of four master key parts, each of n bits. That is, M=4. In this case, the master key MK is represented as MK=MK3||MK2||MK1||MK0. When n=32, the number of bits in the master key MK is 128 bits.

[0105] In the example in Figure 11, the master key portion with the smallest index is simply set repeatedly, starting with the state S with the smallest index. In other words, the value of each state is S i =MK0, S i+1 =MK1, S i+2 =MK2, S i+3 It is set as =MK3 (where i=0,4,8). Note that the numerical values ​​in the master key MK shown in Figure 11 are the master key portion MK k This corresponds to the index k of (k=0,1,2,3). For example, "0" corresponds to the master key portion MK0. This is also true for other diagrams.

[0106] Furthermore, in the master key MK shown in Figure 11, the portion enclosed by the thick solid line represents the master key portion set to state S corresponding to the round key RK used in the first round. The portion enclosed by the thick dashed line represents the master key portion set to state S corresponding to the round key RK used in the second round. The same applies to Figure 13, which will be discussed later.

[0107] In the example in Figure 11, the first round key portion K used in the first round is set in the initial configuration. 1 A value of 1 is set as the value of the master key portion MK0. Similarly, the second round key portion K used in the first round 1 The value 2 is set to the value of the master key part MK1. Also, the third round key part K used in the first round1 The value 3 is set to the value of the master key part MK2. The fourth round key part K is used in the first round. 2 A value of 1 is set as the value of the master key portion MK3. Similarly, the fifth round key portion K used in the first round 2 The value 2 is set as the value of the master key part MK0. Also, the 6th round key part K used in the first round 2 The value 3 is set as the value for the master key portion MK1.

[0108] Furthermore, in the example shown in Figure 11, the first round key portion K used in the second round is set in the initial settings. 1 A value of 1 is set as the value of the master key portion MK2. Similarly, the second round key portion K used in the second round 1 The value 2 is set to the value of the master key part MK3. Also, the third round key part K used in the second round 1 The value 3 is set to the value of the master key part MK0. The fourth round key part K is used in the second round. 2 A value of 1 is set as the value of the master key portion MK1. Similarly, the fifth round key portion K used in the second round 2 The value 2 is set to the value of the master key part MK2. Also, the 6th round key part K is used in the second round. 2 The value 3 is set as the value for the master key portion MK3.

[0109] Figure 12 is a diagram illustrating the problems with the comparative example shown in Figure 11. Figure 12 shows the round function F shown in Figure 5 and the master key portions set in each round key portion used in the round function F used in the first round in the initial settings exemplified in Figure 11. When an attacker estimates the round key RK used in the first round, the attacker will estimate the values ​​of the master key portions set in each round key portion.

[0110] As described above using Figure 6, when an attacker estimates the round key RK, the attacker estimates the third round key portion K used in the subsequent calculations of the round function F. 1 3 and 6th round key section K 2 Regarding point 3, there is a possibility that the lower bits of the n bits can be ignored during estimation. On the other hand, the first round key portion K used in the preceding operation of the round function F 1 1. Second round key section K 1 2. Fourth round key section K 2 Rounds 1 and 5, key section K 2 Regarding point 2, the attacker may need to estimate the entire n bits. In other words, the attacker may need to estimate the n*4 bit value for the preceding operation.

[0111] Here, the key part K of the 6th round 2 The master key portion MK1, set to 3, is used in the second round key portion K used in the preceding calculation. 1 It is also set to 2. Therefore, the attacker has the second round key portion K 1 Since we need to estimate the entire n bits of 2, we cannot ignore the lower bits of the master key portion MK1. On the other hand, the third round key portion K 1 The master key portion MK2, set to 3, is not set in any of the round key portions used in the preceding calculation. Therefore, the attacker can ignore the lower bits of the n bits of the master key portion MK2.

[0112] Furthermore, in the preceding calculation, the master key portion MK0 is the first round key portion K 1 Rounds 1 and 5, key section K 2 It is set to 2. In other words, in the preceding calculation, the master key portion MK0 is used redundantly across multiple round key portions. Therefore, the first round key portion K used in the preceding calculation 1 1. Second round key section K 1 2. Fourth round key section K 2 Rounds 1 and 5, key section K 2Regarding point 2, the attacker only needs to estimate three values ​​for the master key portion: MK0, MK1, and MK3. Therefore, the attacker only needs to estimate n*3 bits for the preceding calculation. Consequently, in the initial settings of the comparative example illustrated in Figure 11, the estimated amount (assumed amount) of the master key MK that the attacker estimates may be reduced. Therefore, the comparative example shown in Figure 11 may have reduced security.

[0113] <Initial settings for the first example> Figures 13 and 14 are diagrams illustrating the initial setup process by the initial setup unit 122 according to a first example of the present disclosure. In the first example, the configuration of state S is the same as that shown in Figure 10, similar to the example in Figure 11. That is, in the first example, A=1 and R=2. Also, in the first example, the number of bits N in the input data block is N=2*n. For example, if n=32, then N=64. Therefore, the data stirring unit 110 performs stirring processing for each of the multiple input data blocks in which the input data is divided into 2*n bits, using the round function F once for each round.

[0114] In the first example, as in Figure 11, the master key MK is composed of four master key parts, each of n bits. That is, M=4. Therefore, the master key MK is an n*4 bit random number. In this case, the master key MK is expressed as MK=MK3||MK2||MK1||MK0. When n=32, the number of bits in the master key MK is 128. The initial setting unit 122 of the key scheduling unit 120 performs an initial setup, setting one of the four master key parts for each of the 12 n-bit states S corresponding to each round key part of the round keys for two rounds. The key scheduling unit 120 also generates the multiple master key parts set in the initial setup conditions as the round keys RK for two rounds for each of the multiple states S. As will be described later, the update processing unit 124 of the key scheduling unit 120 performs an update process to generate the round keys to be used in the following two rounds by updating the value of the state S after generating the round keys for two rounds.

[0115] Figure 13 shows that in the first example, the four master key parts MK0, MK1, MK2, MK3 are divided into 12 states S0, ..., S 11 This shows an example of how to set it up. Figure 14 shows the master key portion corresponding to the round key portion used in the round function F used in the first round, when state S is set as shown in Figure 13. Note that Figures 13 and 14 illustrate the state in which each master key portion is assigned to each state S, but this state is only an example. The method of assigning each master key portion to each state S is arbitrary as long as the initial setting conditions described above and below are met. This is also true for the other examples described below.

[0116] In the examples in Figures 13 and 14, the initial setup unit 122 assigns the master key portion MK2 to state S0. The initial setup unit 122 assigns the master key portion MK1 to state S1. The initial setup unit 122 assigns the master key portion MK0 to state S2. The initial setup unit 122 also assigns the master key portion MK3 to state S3. The initial setup unit 122 assigns the master key portion MK0 to state S4. The initial setup unit 122 assigns the master key portion MK1 to state S5. The initial setup unit 122 also assigns the master key portion MK0 to state S6. The initial setup unit 122 assigns the master key portion MK3 to state S7. The initial setup unit 122 assigns the master key portion MK2 to state S8. The initial setup unit 122 also assigns the master key portion MK1 to state S9. The initial setup unit 122 assigns the master key portion MK3 to state S 10 The master key portion MK2 is assigned to this. The initial setting section 122 is state S 11 Assign the master key portion MK3 to it.

[0117] In the first example, the initial setup unit 122 sets 12 states S0,...,S 11 Initial setup is performed to set one of the four master key portions MK0, MK1, MK2, and MK3 to the following initial setup conditions. The initial setup unit 122 assigns each master key portion to each state S so as to satisfy the first initial setup condition described above. That is, the initial setup unit 122 assigns different master key portions to the three states S0, S1, and S2. This corresponds to the round key portion used within the dashed frame indicated by arrow B1 in Figure 14. The initial setup unit 122 also assigns different master key portions to the three states S6, S7, and S8. Here, in the examples of Figures 13 and 14, states S0, S1, and S2 are assigned different master key portions MK2, MK1, and MK0, respectively. Also, states S6, S7, and S8 are assigned different master key portions MK0, MK3, and MK2, respectively. Therefore, the examples of Figures 13 and 14 satisfy the first initial setup condition. Here, the attacker is Y on the left side of the round function F LTo calculate this, the attacker must infer the three round key portions used in the left-hand operation of the round function F shown in Figures 5 and 14. In this case, the attacker must infer all three master key portions for the left-hand side of the round function F shown in Figures 5 and 14. Therefore, it is possible to suppress the attacker from reducing the amount of assumptions when assuming (estimating) the round key RK.

[0118] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the second initial setup condition described above. That is, the initial setup unit 122 assigns different master key portions to the three states S3, S4, and S5. This corresponds to the round key portion used within the dashed frame indicated by arrow B2 in Figure 14. Also, the initial setup unit 122 assigns different master key portions to the three states S9, S 10 ,S 11 Different master key portions are assigned to each state. In the example shown in Figures 13 and 14, states S3, S4, and S5 are assigned different master key portions MK3, MK0, and MK1, respectively. Also, states S9, S 10 ,S 11 Each of these is assigned a different master key portion, MK1, MK2, and MK3. Therefore, the examples in Figures 13 and 14 satisfy the second initial setup condition. Here, the attacker controls the right side of the round function F Y R To calculate this, the attacker must infer the three round key portions used in the right-hand operation of the round function F shown in Figures 5 and 14. In this case, the attacker must infer all three master key portions for the right-hand side of the round function F shown in Figures 5 and 14. Therefore, it is possible to suppress the attacker from reducing the amount of assumptions when assuming (estimating) the round key RK.

[0119] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the third initial setup condition described above. That is, the initial setup unit 122 assigns different master key portions to the four states S0, S1, S3, S4. This corresponds to the round key portion used in the preceding calculation within the dotted line frame indicated by arrow B3 in Figure 14. Also, the initial setup unit 122 assigns different master key portions to the four states S6, S7, S9, S 10 Different master key portions are assigned to each state. In the example in Figures 13 and 14, states S0, S1, S3, and S4 are assigned different master key portions MK2, MK1, MK3, and MK0, respectively. Also, states S6, S7, S9, S 10 Each of these is assigned a different master key portion, MK0, MK3, MK1, and MK2. Therefore, the examples in Figures 13 and 14 satisfy the third initial setting condition. Thus, an attacker must estimate all four master key portions used in the preceding calculation of the round function F shown in Figures 5 and 14. Therefore, it is possible to suppress an attacker from reducing the amount of assumptions when assuming (estimating) the round key RK.

[0120] Furthermore, since the third initial setting condition is met, the master key portions MK0 and MK1 used in the subsequent calculations of the round function F used in the first round will also be used in the preceding calculations of the round function F. Note that the subsequent calculations of the round function F correspond to the area within the dotted frame indicated by arrow B4 in Figure 14. In this case, the attacker cannot ignore the lower bits of the master key portions MK0 and MK1. Similarly, the master key portions MK2 and MK3 used in the subsequent calculations of the round function F used in the second round will also be used in the preceding calculations of the round function F. Therefore, the attacker cannot ignore the lower bits of the master key portions MK2 and MK3. Thus, it is possible to suppress the attacker from reducing the assumed amount when assuming (estimating) the round key RK.

[0121] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the fourth initial setup condition described above. That is, the initial setup unit 122 assigns four states S2, S5, S8, S 11 Assign different master key portions to each. Here, in the examples of Figures 13 and 14, states S2, S5, S8, S 11 Each of these is assigned a different master key portion, MK0, MK1, MK2, and MK3. Therefore, the examples in Figures 13 and 14 satisfy the fourth initial setup condition. Thus, it is possible to deter an attacker from easily estimating the round key.

[0122] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the fifth initial setup condition described above. That is, the initial setup unit 122 performs the initial setup so that the number of times each of the four master key portions is assigned is the same across all 12 states. In the example shown in Figures 13 and 14, each of the four master key portions MK0, MK1, MK2, and MK3 is assigned to three states S across all 12 states. Therefore, the example shown in Figures 13 and 14 satisfies the fifth initial setup condition. As a result, the master key portions are evenly distributed across all states. Consequently, it is possible to suppress an attacker from easily estimating the round key.

[0123] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the sixth initial setup condition described above. That is, the initial setup unit 122 assigns each of the four master key portions to the third round key portion K 1 3 and 6th round key section K 2 Initialization is performed so that the number of states S corresponding to 3 is the same. In other words, the initialization unit 122 sets the states S2, S5, S8, S for each of the four master key parts. 11Initial settings are performed so that the number assigned to each is the same. Here, in the examples in Figures 13 and 14, the four master key parts MK0, MK1, MK2, and MK3 are in states S2, S5, S8, S 11 It is assigned to one of the states S. Therefore, the examples in Figures 13 and 14 satisfy the sixth initial setting condition. This suppresses bias in the master key portion used as the round key portion. Therefore, it can be suppressed for attackers to easily deduce the round key.

[0124] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the seventh initial setup condition described above. That is, the initial setup unit 122 assigns each of the four master key portions to the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 Initialization is performed so that the number of states S corresponding to 2 is the same. In other words, the initialization unit 122 sets the states S0, S1, S3, S4, S6, S7, S9, S for each of the four master key parts. 10 Initial settings are performed so that the number assigned to each is the same. Here, in the examples in Figures 13 and 14, each of the four master key parts MK0, MK1, MK2, and MK3 is in state S0, S1, S3, S4, S6, S7, S9, S 10 It is assigned to two of the states S. Therefore, the examples in Figures 13 and 14 satisfy the seventh initial setting condition. This suppresses bias in the master key portion used as the round key portion. Therefore, it can be suppressed for attackers to easily deduce the round key.

[0125] <Example 2> Next, let's describe the second example. In the second example, the round function F is used twice in one round. Also, in the second example, each of the multiple states S corresponds to one of the round key parts that make up the round key RK for two rounds. That is, A=2 and R=2. Therefore, in the second example, the number of states S is 6*R*A=24. Also, in the second example, the number of bits N in the input data block is N=4*n. For example, if n=32, then N=128. Therefore, the data stirring unit 110 performs stirring processing on each of the multiple input data blocks in which the input data is divided into 4*n bits, using the round function F twice for each round.

[0126] Also, similar to the first example, in the second example, the master key MK is composed of four master key parts, each of n bits. That is, M=4. Therefore, the master key MK is an n*4 bit random number. In this case, the master key MK is expressed as MK=MK3||MK2||MK1||MK0. The initial setting unit 122 of the key scheduling unit 120 performs an initial setup, setting one of the four master key parts for each of the 24 n-bit states S corresponding to each round key part of the round keys for two rounds. The key scheduling unit 120 also generates the multiple master key parts set according to the initial setup conditions described above as the round keys RK for two rounds for each of the multiple states S. Furthermore, as will be described later, the update processing unit 124 of the key scheduling unit 120 performs an update process to generate the round keys to be used in the following two rounds by updating the value of the state S after generating the round keys for two rounds.

[0127] Figure 15 illustrates the round function F and round key RK used in a second example of this disclosure. In the second example, the data stirring unit 110 performs stirring by, for example, the generalized Feistel structure illustrated in Figure 3. In the second example, 24 states S are used for the round key RK used in the rth round. R r RKL r The round key RK used in the r+1th round. R r+1 RK L r+1 It maintains the following: where r is an odd number, r = 1, 3, 5, 7, ... This is also true in the third example described later.

[0128] Here, each of the multiple states S is S i If expressed as such, the 24 states S are S0, ..., S 23 (i=0,1,···,23) is represented as follows. Note that each state S i This holds n bits (for example, 32 bits) of data. In the following example, the round function F used for the first time in a given round is defined as the right-hand round function F of that round. Similarly, the round function F used for the second time in a given round is defined as the left-hand round function F of that round. However, the order in which the left and right round functions F are used can be reversed. These points also apply to the third example described later.

[0129] Also, there are 24 states S0,...,S 23 Of these, S0, ..., S5 are the round keys RK used in the right-hand round function F of the r-th round. R r This corresponds to the round key RK used in the first round using the round function F in the r-th round. R r This corresponds to RK. R r This is expressed as =S5||S4||S3||S2||S1||S0. Specifically, state S0 is the first round key portion K used in the right-hand round function F of the r-th round. 1 This corresponds to 1. In other words, state S0 is the first round key portion K used in the right-hand round function F of the r-th round. 1It stores a value of 1. This is also true for other states. Furthermore, state S1 is used in the second round key portion K of the right-hand round function F of the r-th round. 1 This corresponds to 2. Also, state S2 is the third round key part K used in the right-hand round function F of the r-th round. 1 This corresponds to 3. Also, state S3 is the fourth round key part K used in the right-hand round function F of the r-th round. 2 It corresponds to 1. Also, state S4 is the 5th round key part K used in the right-hand round function F of the r-th round. 2 This corresponds to 2. Also, state S5 is the 6th round key part K used in the right-hand round function F of the r-th round. 2 This corresponds to point 3. The same applies to the third example, which will be discussed later.

[0130] Also, there are 24 states S0,...,S 23 S6,...,S 11 This is the round key RK used in the left-hand round function F of the r-th round. L r This corresponds to S6,...,S 11 This is the round key RK used in the second round function F in the r-th round. L r This corresponds to RK. L r =S 11 ||S 10 This is represented as ||S9||S8||S7||S6. Specifically, state S6 is the first round key portion K used in the left-hand round function F of the r-th round. 1 It corresponds to 1. Also, state S7 is the second round key part K used in the left-hand round function F of the r-th round. 1 This corresponds to 2. Also, state S8 is the third round key part K used in the left-hand round function F of the r-th round. 1 This corresponds to 3. Also, state S9 is the fourth round key part K used in the left-hand round function F of the r-th round. 2Corresponds to 1. Also, state S 10 This is the fifth round key portion K used in the left-hand round function F of the r-th round. 2 Corresponds to 2. Also, state S 11 This is the sixth round key portion K used in the left-hand round function F of the r-th round. 2 This corresponds to point 3. The same applies to the third example, which will be discussed later.

[0131] Also, there are 24 states S0,...,S 23 S 12 ,···,S 17 This is the round key RK used in the right-hand round function F of the r+1th round. R r+1 This corresponds to S. In other words, 12 ,···,S 17 This is the round key RK used in the first round function F in the r+1th round. R r+1 This corresponds to RK. R r+1 =S 17 ||S 16 ||S 15 ||S 14 ||S 13 ||S 12 It is expressed as follows: Specifically, state S 12 This is the first round key portion K used in the right-hand round function F of the r+1th round. 1 Corresponds to 1. Also, state S 13 This is the second round key portion K used in the right-hand round function F of the r+1th round. 1 Corresponds to 2. Also, state S 14 This is the third round key portion K used in the right-hand round function F of the r+1th round. 1 Corresponds to 3. Also, state S 15 This is the fourth round key portion K used in the right-hand round function F of the r+1th round. 2 Corresponds to 1. Also, state S 16 This is the fifth round key portion K used in the right-hand round function F of the r+1th round.2 Corresponds to 2. Also, state S 17 This is the sixth round key portion K used in the right-hand round function F of the r+1th round. 2 This corresponds to point 3. The same applies to the third example, which will be discussed later.

[0132] Also, there are 24 states S0,...,S 23 S 18 ,···,S 23 This is the round key RK used in the left-hand round function F of the r+1th round. L r+1 This corresponds to S. In other words, 18 ,···,S 23 This is the round key RK used in the second round function F in the r+1th round. L r+1 This corresponds to RK. L r+1 =S 23 ||S 22 ||S 21 ||S 20 ||S 19 ||S 18 It is expressed as follows: Specifically, state S 18 This is the first round key portion K used in the left-hand round function F of the r+1th round. 1 Corresponds to 1. Also, state S 19 This is the second round key portion K used in the left-hand round function F of the r+1th round. 1 Corresponds to 2. Also, state S 20 This is the third round key portion K used in the left-hand round function F of the r+1th round. 1 Corresponds to 3. Also, state S 21 This is the fourth round key portion K used in the left-hand round function F of the r+1th round. 2 Corresponds to 1. Also, state S 22 This is the fifth round key portion K used in the left-hand round function F of the r+1th round. 2 Corresponds to 2. Also, state S 23This is the sixth round key portion K used in the left-hand round function F of the r+1th round. 2 This corresponds to point 3. The same applies to the third example, which will be discussed later.

[0133] Note that the correspondence between each state and each round key is not limited to the example above. For example, S0,...,S5 are round keys RK used in the left-hand round function F of the r-th round. L r It may also be compatible with S6,...,S 11 This is the round key RK used in the right-hand round function F of the r-th round. R r It may also be compatible with S. 12 ,···,S 17 This is the round key RK used in the left-hand round function F of the r+1th round. L r+1 It may also be possible to respond to this. In this case, S 18 ,···,S 23 This is the round key RK used in the right-hand round function F of the r+1th round. R r+1 This may also be the case. The same applies to the third example described later.

[0134] The initial setup unit 122 sets 24 states S0,...,S based on the initial setup conditions described above. 23 Each of these is set to one of the multiple master key parts that make up the master key MK. This results in 24 states S0,...,S 23 Each of these stores a value corresponding to one of several master key portions. This generates 12 round key portions used in the first round and 12 round key portions used in the second round. In other words, the initialization unit 122 generates the values ​​(master key portions) set in the 6 states S0,...,S5 as 6 round key portions used in the right-hand round function F of the first round. The initialization unit 122 also generates the values ​​(master key portions) set in the 6 states S6,...,S 11The value set (master key portion) is generated as the six round key portions used in the left-hand round function F of the first round. The initial setup unit 122 also generates six states S 12 ,···,S 17 The value set (master key portion) is generated as six round key portions used in the right-hand round function F of the second round. In addition, the initial setup unit 122 generates six states S 18 ,···,S 23 The value set (master key portion) is generated as the six round key portions used in the left-hand round function F of the second round. These are the same in the third example described later. State S0,···,S 23 An example of setting multiple master key components will be discussed later.

[0135] Furthermore, the update processing unit 124 sets 24 states S0,...,S to satisfy the update conditions described above. 23 The value of is updated. This generates the round key RK to be used in the third round and beyond. Similar to the example shown in Figure 10, the update processing unit 124 updates the first state S in the first update process. j The value of and the second state S of 2 or more j-k1 ,S j-k2 The exclusive OR of the values ​​of ,··· is calculated, and the resulting value is used in the second state S j-k1 ,S j-k2 Store in ,···. This will result in 2 or more second states S j-k1 ,S j-k2 The values ​​of ,... are updated. The same applies to the third example described later.

[0136] Then, in the next update process, the update processing unit 124 changes the first state S j and the second state S j-k1 ,S j-k2 The index (subscript) j of ,··· is decremented and the same calculation is performed. That is, the update processing unit 124 performs the first state S j-1 The value of and the second state S of 2 or more j-k1-1 ,Sj-k2-1 The exclusive OR of the values ​​of ,··· is calculated, and the resulting value is used in the second state S j-k1-1 ,S j-k2-1 Store in ,···. This will result in the second state S j-k1-1 ,S j-k2-1 The value of ,··· is updated. Thereafter, the update processing unit 124 performs the same processing, so that each state S i The value is updated. The same applies to the third example, which will be discussed later.

[0137] Furthermore, during the update process, as index j is decremented, the positions of the first state and the second state slide in the same direction relative to each other. Also, the first state S in the first update j The values ​​of k1 and k2, and the number of second states, are predetermined, as will be described later. Therefore, the first and second states are selected such that their relative positions are predetermined. Note that when the positions of the first and second states reach the position of the initial state S0, the next decrement will return to the last state S 23 The update process proceeds in a way that returns to the previous value. In other words, once the index is decremented to 0, it returns to 23 and is decremented again. These same principles apply to the third example described later.

[0138] In the second example, in an example similar to the one in Figure 10, the first state S in the first update process j State S 23 , in other words, 24 states S0,...,S 23 This is the final state. Also, similar to the example in Figure 10, the second state S j-k1 The index k1 is the first state S j The position and the second state S j-k1 This corresponds to the difference from the position of the second state S. j-k2 The index k2 is the first state S j The position and the second state S j-k2This corresponds to the difference in position. The same applies to the third example described later.

[0139] Then, as in the example in Figure 10, as the update process progresses, the first state S j The index j is decremented by one each time, and when j becomes 0, it returns to 23. That is, j = 23, 22, ..., 0, 23, ... Therefore, in the 24 states, the first state S j The position changes as the update process progresses. 23 Slide one position to the right from there. Similarly, as the update process progresses, in the 24 states, the position of the second state is S j-k1 ,S j-k2 Each element slides one position to the right. The same applies to the third example, which will be discussed later. Further details about the update process will be provided later.

[0140] <Initial settings for the second example> Figure 16 is a diagram illustrating the initial setup process by the initial setup unit 122 according to a second example of the present disclosure. In the second example, Figure 16 shows that the four master key parts MK0, MK1, MK2, MK3 are set to 24 states S0,...,S 23 This illustrates how to configure it. Figure 16 shows an example of each master key part being assigned to each state S, but this state is for illustrative purposes only.

[0141] In the example shown in Figure 16, as in the example described above, four round keys RK are used in two rounds. R r RK L r RK R r+1 RK L r+1 State S i Using this, it can be expressed as follows: RK R r =S5||S4||S3||S2||S1||S0 RK Lr =S 11 ||S 10 ||S9||S8||S7||S6 RK R r+1 =S 17 ||S 16 ||S 15 ||S 14 ||S 13 ||S 12 RK L r+1 =S 23 ||S 22 ||S 21 ||S 20 ||S 19 ||S 18

[0142] Furthermore, in the master key MK shown in Figure 16, the portion enclosed by the thick solid line represents the master key portion set in state S corresponding to the round key RK used in the right-hand round function F of the first round. The portion enclosed by the thick dashed line represents the master key portion set in state S corresponding to the round key RK used in the left-hand round function F of the first round. The portion enclosed by the thick dotted line represents the master key portion set in state S corresponding to the round key RK used in the right-hand round function F of the second round. The portion enclosed by the thick dotted line represents the master key portion set in state S corresponding to the round key RK used in the left-hand round function F of the second round. This is also true in the third example described later.

[0143] In the example in Figure 16, the initial setup unit 122 assigns the master key portion MK2 to state S0. The initial setup unit 122 assigns the master key portion MK1 to state S1. The initial setup unit 122 assigns the master key portion MK0 to state S2. The initial setup unit 122 also assigns the master key portion MK3 to state S3. The initial setup unit 122 assigns the master key portion MK0 to state S4. The initial setup unit 122 assigns the master key portion MK2 to state S5. The initial setup unit 122 also assigns the master key portion MK3 to state S6. The initial setup unit 122 assigns the master key portion MK2 to state S7. The initial setup unit 122 assigns the master key portion MK1 to state S8. The initial setup unit 122 also assigns the master key portion MK0 to state S9. The initial setup unit 122 assigns the master key portion MK0 to state S 10 The master key portion MK1 is assigned to this. The initial setting section 122 is state S 11 Assign the master key portion MK3 to it.

[0144] Furthermore, in the example in Figure 16, the initial setting unit 122 is in state S 12 The master key portion MK0 is assigned to this. The initial setting section 122 is state S 13 The master key portion MK3 is assigned to this. The initial setting section 122 is state S 14 The master key portion MK2 is assigned to it. Also, the initial setting section 122 is state S 15 The master key portion MK1 is assigned to this. The initial setting section 122 is state S 16 The master key portion MK2 is assigned to this. The initial setting section 122 is state S 17 The master key portion MK0 is assigned to it. Also, the initial setting section 122 is state S 18 The master key portion MK1 is assigned to this. The initial setting section 122 is state S 19 The master key portion MK0 is assigned to this. The initial setting section 122 is state S 20 The master key portion MK3 is assigned to it. Also, the initial setting section 122 is state S 21 The master key portion MK2 is assigned to this. The initial setting section 122 is state S 22The master key portion MK3 is assigned to this. The initial setting section 122 is state S 23 Assign the master key portion MK1 to it.

[0145] In the second example, the initial setup unit 122 sets 24 states S0,...,S 23 Initial setup is performed to set one of the four master key parts MK0, MK1, MK2, and MK3 to the following initial setup conditions. The initial setup unit 122 assigns each master key part to each state S so as to satisfy the first initial setup condition described above. That is, the initial setup unit 122 assigns different master key parts to the three states S0, S1, and S2. Also, the initial setup unit 122 assigns different master key parts to the three states S6, S7, and S8. Also, the initial setup unit 122 assigns different master key parts to the three states S 12 ,S 13 ,S 14 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 18 ,S 19 ,S 20 Different master key portions are assigned to each state. In the example in Figure 16, states S0, S1, and S2 are assigned different master key portions MK2, MK1, and MK0, respectively. Also, states S6, S7, and S8 are assigned different master key portions MK3, MK2, and MK1, respectively. 12 ,S 13 ,S 14 Each of them is assigned a different master key portion, MK0, MK3, and MK2. Also, state S 18 ,S 19 ,S 20 Each of these is assigned a different master key portion, MK1, MK0, and MK3. Therefore, the example in Figure 16 satisfies the first initial setup condition. Here, the attacker controls the left side of the round function F Y LTo calculate this, one must infer the three round key portions used in the left-hand operation of the round function F shown in Figure 5. In this case, the attacker needs to estimate all three master key portions for the left-hand side of the round function F shown in Figure 5. Therefore, it is possible to suppress the reduction of assumptions when the attacker assumes (estimates) the round key RK.

[0146] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the second initial setup conditions described above. That is, the initial setup unit 122 assigns different master key portions to the three states S3, S4, and S5. Also, the initial setup unit 122 assigns different master key portions to the three states S9, S 10 ,S 11 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 15 ,S 16 ,S 17 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 21 ,S 22 ,S 23 Different master key portions are assigned to each state. In the example in Figure 16, states S3, S4, and S5 are assigned different master key portions MK3, MK0, and MK2, respectively. Also, states S9, S 10 ,S 11 Each of them is assigned a different master key portion, MK0, MK1, and MK3. Also, state S 15 ,S 16 ,S 17 Each of them is assigned a different master key portion, MK1, MK2, and MK0. Also, state S 21 ,S 22 ,S 23 Each of these is assigned a different master key portion, MK2, MK3, and MK1. Therefore, the example in Figure 16 satisfies the second initial setup condition. Here, the attacker controls the right side of the round function F Y RTo calculate this, one must infer the three round key portions used in the right-hand operation of the round function F shown in Figure 5. In this case, the attacker needs to estimate all three master key portions for the right-hand side of the round function F shown in Figure 5. Therefore, it is possible to suppress the reduction of the assumptions made when the attacker assumes (estimates) the round key RK.

[0147] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the third initial setup condition described above. That is, the initial setup unit 122 assigns different master key portions to the four states S0, S1, S3, S4. Also, the initial setup unit 122 assigns different master key portions to the four states S6, S7, S9, S 10 Different master key portions are assigned to each. In addition, the initial setup unit 122 has four states S 12 ,S 13 ,S 15 ,S 16 Different master key portions are assigned to each. In addition, the initial setup unit 122 has four states S 18 ,S 19 ,S 21 ,S 22 Different master key portions are assigned to each state. In the example in Figure 16, states S0, S1, S3, and S4 are assigned different master key portions MK2, MK1, MK3, and MK0, respectively. Also, states S6, S7, S9, S 10 Each of them is assigned a different master key portion, MK3, MK2, MK0, and MK1. Also, state S 12 ,S 13 ,S 15 ,S 16 Each of them is assigned a different master key portion, MK0, MK3, MK1, and MK2. Also, state S 18 ,S 19 ,S 21 ,S 22Each of these is assigned a different master key portion, MK1, MK0, MK2, and MK3. Therefore, the example in Figure 16 satisfies the third initial setting condition. Thus, the attacker must estimate all four master key portions used in the preceding calculation of the round function F shown in Figure 5. Therefore, it is possible to suppress the attacker from reducing the amount of assumptions when assuming (estimating) the round key RK.

[0148] Furthermore, since the third initial condition is met, the master key portions MK0 and MK2 used in the subsequent calculation of the right-hand round function F in the first round will also be used in the preceding calculation of the round function F. Therefore, the attacker cannot ignore the lower bits of the master key portions MK0 and MK2. Similarly, the master key portions MK1 and MK3 used in the subsequent calculation of the left-hand round function F in the first round will also be used in the preceding calculation of the round function F. Therefore, the attacker cannot ignore the lower bits of the master key portions MK1 and MK3. Also, the master key portions MK2 and MK0 used in the subsequent calculation of the right-hand round function F in the second round will also be used in the preceding calculation of the round function F. Therefore, the attacker cannot ignore the lower bits of the master key portions MK2 and MK0. Also, the master key portions MK3 and MK1 used in the subsequent calculation of the left-hand round function F in the second round will also be used in the preceding calculation of the round function F. Therefore, the attacker cannot ignore the lower bits of the master key portions MK3 and MK1. Therefore, it is possible to deter attackers from reducing the amount of assumptions they make when assuming (estimating) the round key RK.

[0149] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the fourth initial setup condition described above. That is, the initial setup unit 122 assigns four states S2, S5, S8, S 11 Different master key portions are assigned to each. In addition, the initial setting unit 122 has four states S8,S 11 ,S 14 ,S17 Different master key portions are assigned to each. In addition, the initial setup unit 122 has four states S 14 ,S 17 ,S 20 ,S 23 Assign different master key portions to each. Here, in the example in Figure 16, states S2, S5, S8, S 11 Each of these is assigned a different master key portion, MK0, MK2, MK1, and MK3. Also, states S8, S 11 ,S 14 ,S 17 Each of them is assigned a different master key portion, MK1, MK3, MK2, and MK0. Also, state S 14 ,S 17 ,S 20 ,S 23 Each of these is assigned a different master key portion, MK2, MK0, MK3, and MK1. Therefore, the example in Figure 16 satisfies the fourth initial setup condition. Thus, it is possible to deter an attacker from easily estimating the round key.

[0150] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the fifth initial setup condition described above. That is, the initial setup unit 122 performs the initial setup so that the number of times each of the four master key portions is assigned is the same across all 24 states. In the example in Figure 16, each of the four master key portions MK0, MK1, MK2, and MK3 is assigned to six states S across all 24 states. Therefore, the example in Figure 16 satisfies the fifth initial setup condition. As a result, the master key portions are evenly distributed across all states. Consequently, it is possible to suppress an attacker from easily estimating the round key.

[0151] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the sixth initial setup condition described above. That is, the initial setup unit 122 assigns each of the four master key portions to the third round key portion K 1 3 and 6th round key section K2 Initialization is performed so that the number of states S corresponding to 3 is the same. In other words, the initialization unit 122 sets the states S2, S5, S8, S for each of the four master key parts. 11 ,S 14 ,S 17 ,S 20 ,S 23 Initial settings are performed so that the number assigned to each is the same. Here, in the example in Figure 16, the four master key parts MK0, MK1, MK2, and MK3 are in states S2, S5, S8, S 11 ,S 14 ,S 17 ,S 20 ,S 23 It is assigned to two of the states S. Therefore, the example in Figure 16 satisfies the sixth initial setting condition. This suppresses bias in the master key portion used as the round key portion. Thus, it can be suppressed for attackers to easily deduce the round key.

[0152] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the seventh initial setup condition described above. That is, the initial setup unit 122 assigns each of the four master key portions to the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 Initialization is performed so that the number of states S corresponding to 2 is the same. In other words, the initialization unit 122 sets the states S0, S1, S3, S4, S6, S7, S9, S for each of the four master key parts. 10 ,S 12 ,S 13 ,S 15 ,S 16 ,S 18 ,S 19 ,S 21 ,S 22Initial settings are performed so that the number assigned to each is the same. Here, in the example in Figure 16, the four master key parts MK0, MK1, MK2, and MK3 are in states S0, S1, S3, S4, S6, S7, S9, S 10 ,S 12 ,S 13 ,S 15 ,S 16 ,S 18 ,S 19 ,S 21 ,S 22 It is assigned to four of the states S. Therefore, the example in Figure 16 satisfies the seventh initial setting condition. This suppresses bias in the master key portion used as the round key portion. Thus, it can be made more difficult for an attacker to easily deduce the round key.

[0153] <Third example> Next, we will describe the third example. Similar to the second example, in the third example, the round function F is used twice in one round. Also, similar to the second example, in the third example, each of the multiple states S corresponds to one of the round key parts that make up the round key RK for two rounds. That is, A=2 and R=2. Therefore, in the third example, the number of states S is 6*R*A=24. Also, similar to the second example, in the third example, the number of bits N in the input data block is N=4*n. For example, if n=32, then N=128. Therefore, the data stirring unit 110 performs stirring processing on each of the multiple input data blocks, in which the input data is divided into 4*n bits, by using the round function F twice for each round.

[0154] Furthermore, similar to the second example, in the third example, the data stirring unit 110 may perform the stirring process using, for example, the generalized Feistel structure illustrated in Figure 3, as illustrated in Figure 15. Also, similar to the second example, in the third example, 24 states S0,...,S 23 Of these, S0, ..., S5 are the round keys RK used in the right-hand round function F of the r-th round. R rIt corresponds to the 24 states S0,...,S 23 S6,...,S 11 This is the round key RK used in the left-hand round function F of the r-th round. L r It corresponds to the 24 states S0,...,S 23 S 12 ,···,S 17 This is the round key RK used in the right-hand round function F of the r+1th round. R r+1 It corresponds to the 24 states S0,...,S 23 S 18 ,···,S 23 This is the round key RK used in the left-hand round function F of the r+1th round. L r+1 It corresponds to.

[0155] Furthermore, unlike the first and second examples, in the third example, the master key MK consists of eight master key parts, each of n bits long. That is, M=8. Therefore, the master key MK is an n*8 bit random number. For example, when n=32, the number of bits in the master key MK is 256 bits. In this case, the master key MK can be expressed as MK=MK7||MK6||MK5||MK4||MK3||MK2||MK1||MK0. In this way, by increasing the length of the master key MK, it becomes more difficult to search for the key using exhaustive search methods, thus increasing the strength of the encryption.

[0156] Furthermore, the initial setup unit 122 of the key scheduling unit 120 performs an initial setup, setting one of eight master key portions for each of the 24 n-bit states S corresponding to each round key portion of the two rounds of round keys. The key scheduling unit 120 also generates the multiple master key portions set in the initial setup conditions as the two rounds of round keys RK for each of the multiple states S. As will be described later, the update processing unit 124 of the key scheduling unit 120 performs an update process to generate the round keys to be used in the following two rounds by updating the values ​​of the states S after generating the two rounds of round keys.

[0157] Similar to the second example, the initial setup unit 122 sets 24 states S0,...,S based on the initial setup conditions described above. 23 Each of these is set to one of the multiple master key parts that make up the master key MK. In the third example, the initial setup unit 122 sets one of the multiple master key parts for each of the 24 states with further initial setup conditions that take into account the case where the attacker assumes the key for two rounds, as will be described later. This results in 24 states S0,...,S 23 Each of these stores a value corresponding to one of several master key portions. This also generates 12 round key portions used in the first round and 12 round key portions used in the second round.

[0158] Also, similar to the second example, the update processing unit 124 sets 24 states S0,...,S to satisfy the update conditions described above. 23 The value is updated. This generates the round key RK used in the third round and beyond.

[0159] <Initial settings for the third example> As mentioned above, the number of bits in the round key RK used in one use of the round function F is n*6. In contrast, in the third example, the number of bits in the master key MK is n*8. That is, the number of bits in the round key RK is less than the number of bits in the master key MK. Therefore, even if we brute-force assume the round key RK using a brute-force search, the amount of assumption will be less than the amount of assumption when we brute-force assume the master key MK using a brute-force search. Thus, an attack that brute-forces the assumption of the master key MK using a brute-force search may be a viable attack. Therefore, since the amount of assumptions that can be freely assumed for the key varies depending on the attack method, it is necessary to consider other attack methods. Here, we consider the case where the attacker assumes the key for two rounds.

[0160] Figure 17 illustrates a first assumption technique relating to a third example of this disclosure, which assumes a key over two rounds. The first assumption technique is a method by which an attacker who has obtained a ciphertext block estimates the round key by calculating the value of the intermediate data by working backward through the rounds. Arrow F0 indicates the round key RK. n The input round function F is shown. Arrow F1 indicates the round key RK. n+1 The input round function F is shown. Arrow F2 indicates the round key RK. n+2 The input round function F is shown. Arrow F3 indicates the round key RK. n+3 The input round function F is shown. An attacker who has obtained ciphertext block portions C0, C1, C2, and C3 uses these ciphertext block portions to calculate the intermediate data by going back two rounds, as shown by arrow D1.

[0161] The intermediate data value v1 at the location indicated by arrow D2 is given by v1 = F(RK n ,F(RK n+3 This is expressed as C0) XOR C3) XOR C2. To calculate this value v1, it is necessary to find the value of the path shown by the dashed line in Figure 17. Therefore, to calculate this value v1, the round key RK is input to the round function F shown by arrow F0. n Then, the round key RK is input to arrow F3.n+3 It is necessary to assume that. Similarly, the intermediate data value v2 at the location indicated by arrow D3 is given by v2 = F(RK n+1 ,F(RK n+2 This is expressed as C2) XOR C1) XOR C0. Therefore, to calculate this value v2, the round key RK is input to the round function F indicated by arrow F1. n+1 Then, the round key RK is input to arrow F2. n+2 We need to assume that...

[0162] Therefore, in the first assumed method, it is necessary to assume that for two rounds, the round keys input to two round functions F are in a diagonal positional relationship, such as the pair of arrows F0 and F3, and the pair of arrows F1 and F2. Here, as mentioned above, the lower bits of the two round key portions used in the subsequent operations of the round function F can be ignored by the attacker. Therefore, it is desirable that the master key portion set in these round key portions is set in the four round key portions used in the preceding operations of the round function F. As mentioned above, the two round key portions used in the subsequent operations are the third round key portion K 1 3. Round 6 Key Section K 2 The answer is 3. Furthermore, the four round key portions used in the preceding calculation are the first round key portion K. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 The answer is 2. In the third example, taking the first assumed method into consideration, the master key portion set for the round key portion used in the later operation is set for the four round key portions used in the earlier operation across two round functions F.

[0163] Therefore, the initial setup unit 122 initializes the master key portion assigned to each of the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F0, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F3. Similarly, the initial setup unit 122 initializes the master key portion assigned to each of the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F3, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F0.

[0164] Furthermore, the initial setup unit 122 performs initial setup so that each of the master key portions assigned to the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F1 is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F2. Similarly, the initial setup unit 122 performs initial setup so that each of the master key portions assigned to the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F2 is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F1.

[0165] Figure 18 is a diagram illustrating a second assumption method, which assumes a key for two rounds, relating to the third example of this disclosure. The second assumption method corresponds to the shortcut method described above. Figure 18 corresponds to the differential decryption method. On the other hand, it should be noted that the linear decryption method can also be assumed to correspond to the method in Figure 18. The second assumption method is a method in which an attacker who has obtained multiple pairs of plaintext blocks and ciphertext blocks estimates the round key by calculating the value of the intermediate data. The attacker uses the plaintext and ciphertext blocks to calculate the intermediate data X at a point two rounds back from the final round, as indicated by arrow D4. The attacker then derives through cryptographic analysis (diff analysis) the event that "the difference ΔX of the intermediate data X calculated using a specific set of plaintext blocks with a difference value can be expected to be (0, Δb, 0, 0) with a significant probability."

[0166] In Figure 18, the paths shown with solid lines are those where the difference ΔX of the intermediate data X is 0 (i.e., no difference appears) when the difference ΔX is (0, Δb, 0, 0). The paths shown with dashed lines are those where the difference Δb is when the difference ΔX of the intermediate data X is (0, Δb, 0, 0). The paths shown with dashed lines are those where some difference appears (i.e., the difference is Δ(≠0)) when the difference ΔX of the intermediate data X is (0, Δb, 0, 0).

[0167] The attacker assumes round keys to be input to the round function F indicated by arrow F1 and round keys to be input to the round function F indicated by arrow F3. The attacker then calculates the difference ΔX of the intermediate data X using a set of ciphertext blocks such that the difference (ΔC0, ΔC1, ΔC2, ΔC3) of the ciphertext block portion is (Δ, Δb, 0, Δ). The attacker can then consider the assumed round key when the difference ΔX is (0, Δb, 0, 0) as a candidate for the correct round key. Specifically, suppose the difference between two values ​​is Δb. In this case, if these two values ​​are input to the round function F indicated by arrow F1, and the difference between the two obtained values ​​matches the difference Δ corresponding to ΔC0, then the difference at the location indicated by arrow D5 becomes 0. Therefore, the attacker estimates the round key to be input to the round function F indicated by arrow F1 in such a way that this result is obtained.

[0168] Furthermore, let's assume that the difference between two values ​​is the difference Δ corresponding to the difference ΔC0. In this case, if these two values ​​are input into the round function F indicated by arrow F3, and the difference between the obtained values ​​matches the difference Δ corresponding to ΔC3, then the difference at the location indicated by arrow D6 becomes 0. Therefore, the attacker estimates the round key to be input into the round function F indicated by arrow F3 in such a way as to produce this result. Note that depending on the structure of the difference ΔX of the intermediate data X, this assumption method may also be applied to assume the round key to be input into the round function F indicated by arrow F0 and the round key to be input into the round function F indicated by arrow F2.

[0169] Therefore, the second assumption method requires assuming that for two rounds, the round keys input to two vertically related round functions F are the pair of arrows F0 and F2, and the pair of arrows F1 and F3. Here, as mentioned above, the lower bits of the two round key portions used in the subsequent operations of the round function F can be ignored. Therefore, it is desirable that the master key portion set in these round key portions be set in the four round key portions used in the preceding operations of the round function F. Then, in the third example, taking the second assumption method into consideration, the master key portion set in the round key portion used in the subsequent operations of the round function F is set in the four round key portions used in the preceding operations across the two round functions F.

[0170] Therefore, the initial setup unit 122 initializes the master key portion assigned to each of the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F0, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F2. Similarly, the initial setup unit 122 initializes the master key portion assigned to each of the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F2, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F0.

[0171] Furthermore, the initial setup unit 122 initializes the master key portion, which is assigned to the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F1, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F3. Similarly, the initial setup unit 122 initializes the master key portion, which is assigned to the two states corresponding to the two round key portions used in the subsequent calculation of the round function F indicated by arrow F3, so that it is assigned to one of the four states corresponding to the four round key portions used in the preceding calculation of the round function F indicated by arrow F1.

[0172] Therefore, in the third example, taking into account the first and second assumption methods described above, the initial setup unit 122 performs the initial setup with the following further initial setup conditions (initial setup conditions 8 to 11). This makes it possible to suppress the reduction of the amount of assumptions the attacker makes when assuming the round key RK, even if the attacker uses the first and second assumption methods described above.

[0173] As the eighth initial setting condition, the initial setting unit 122 sets the third round key portion K used in the first round function F in the r-th round. 1 3. Round 6 Key Section K 2 For each of the two master key portions assigned to the two states corresponding to 3, the following initial settings are performed: The initial setting unit 122 sets each of these master key portions to the first round key portion K used in the first round function F in the r+1th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2Each of the 2s is assigned to one of the four corresponding states. Furthermore, the initialization unit 122 assigns each of these master key parts to the first round key part K used in the use of the second round function F in the r+1th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Assign each of the 2 values ​​to one of the four corresponding states.

[0174] As the ninth initial setting condition, the initial setting unit 122 sets the third round key portion K used in the use of the second round function F in the r-th round. 1 3. Round 6 Key Section K 2 For each of the two master key portions assigned to the two states corresponding to 3, the following initial settings are performed: The initial setting unit 122 sets each of these master key portions to the first round key portion K used in the first round function F in the r+1th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Each of the 2s is assigned to one of the four corresponding states. Furthermore, the initialization unit 122 assigns each of these master key parts to the first round key part K used in the use of the second round function F in the r+1th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Assign each of the 2 values ​​to one of the four corresponding states.

[0175] As a tenth initial setting condition, the initial setting unit 122 sets the third round key portion K used in the use of the first round function F in the r+1th round. 1 3. Round 6 Key Section K 2For each of the two master key portions assigned to the two states corresponding to 3, the following initial settings are performed. The initial setting unit 122 sets each of these master key portions to the first round key portion K used in the first round function F in the r-th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Each of the 2s is assigned to one of the four corresponding states. Furthermore, the initialization unit 122 assigns each of these master key parts to the first round key part K used in the use of the second round function in the r-th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Assign each of the 2 values ​​to one of the four corresponding states.

[0176] As the 11th initial setting condition, the initial setting unit 122 sets the third round key portion K used in the use of the second round function F in the r+1th round. 1 3. Round 6 Key Section K 2 For each of the two master key portions assigned to the two states corresponding to 3, the following initial settings are performed. The initial setting unit 122 sets each of these master key portions to the first round key portion K used in the first round function F in the r-th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2 Each of the 2s is assigned to one of the four corresponding states. Furthermore, the initialization unit 122 assigns each of these master key parts to the first round key part K used in the second round function F in the r-th round. 1 1. Second round key section K 1 2. Fourth round key section K 2 1. Round 5 Key Section K 2Assign it to any one of the four states corresponding to 2 respectively.

[0177] FIGS. 19 and 20 are diagrams for explaining the initial setting process by the initial setting unit 122 according to the third example of the present disclosure. FIGS. 19 and 20 illustrate, in the third example, how to set eight master key portions MK0, MK1, MK2, MK3, MK4, MK5, MK6, MK7 to 24 states S0, ···, S 23 Although FIGS. 19 and 20 illustrate a state in which each master key portion is assigned to each state S, this state is merely an illustration.

[0178] Here, similar to the example of FIG. 16, in FIGS. 19 and 20, the four round keys RK R r , RK L r , RK R r+1 , RK L r+1 used in two rounds are represented as follows using the state S i . RK R r = S5||S4||S3||S2||S1||S0 RK L r = S 11 ||S 10 ||S9||S8||S7||S6 RK R r+1 = S 17 ||S 16 ||S 15 ||S 14 ||S 13 ||S 12 RK L r+1 = S 23 ||S 22 ||S 21 ||S 20 ||S 19 ||S 18

[0179] In the examples of FIGS. 19 and 20, the initial setting unit 122 assigns the master key portion MK2 to state S0. The initial setting unit 122 assigns the master key portion MK3 to state S1. The initial setting unit 122 assigns the master key portion MK0 to state S2. Also, the initial setting unit 122 assigns the master key portion MK6 to state S3. The initial setting unit 122 assigns the master key portion MK7 to state S4. The initial setting unit 122 assigns the master key portion MK4 to state S5. Also, the initial setting unit 122 assigns the master key portion MK2 to state S6. The initial setting unit 122 assigns the master key portion MK3 to state S7. The initial setting unit 122 assigns the master key portion MK1 to state S8. Also, the initial setting unit 122 assigns the master key portion MK6 to state S9. The initial setting unit 122 assigns the master key portion MK7 to state S 10 and assigns the master key portion MK7 to state S 11 and assigns the master key portion MK5 to state S

[0180] Also, in the examples of FIGS. 19 and 20, the initial setting unit 122 assigns the master key portion MK0 to state S 12 and assigns the master key portion MK1 to state S 13 and assigns the master key portion MK1 to state S 14 and assigns the master key portion MK2 to state S 15 and assigns the master key portion MK4 to state S 16 and assigns the master key portion MK5 to state S 17 and assigns the master key portion MK6 to state S 18 and assigns the master key portion MK0 to state S 19 and assigns the master key portion MK1 to state S 20 and assigns the master key portion MK3 to state S 21 and assigns the master key portion MK4 to state S22 The master key portion MK5 is assigned to this. The initial setting section 122 is state S 23 Assign the master key portion MK7 to it.

[0181] Furthermore, arrows E1 and E2 shown in Figure 19 indicate the relationship between two round functions F in an oblique positional relationship relating to the first assumed method. Specifically, arrow E1 represents the round key RK in Figure 15. R r The input round function F and the round key RK L r+1 This shows the relationship with the round function F to which the input is given. Also, arrow E2 in Figure 15 represents the round key RK L r The input round function F and the round key RK R r+1 This shows the relationship with the round function F to which the input is taken.

[0182] Furthermore, arrows E3 and E4 shown in Figure 20 indicate the relationship between two round functions F in a vertical positional relationship relating to the second assumed method. Specifically, arrow E3 represents the round key RK in Figure 15. R r The input round function F and the round key RK R r+1 This shows the relationship with the input round function F. Also, arrow E4 in Figure 15 represents the round key RK. L r The input round function F and the round key RK L r+1 This shows the relationship with the round function F to which the input is taken.

[0183] In the third example, the initial setup unit 122 sets 24 states S0,...,S 23Initial setup is performed to set one of the eight master key parts MK0, MK1, MK2, MK3, MK4, MK5, MK6, MK7 to the following initial setup conditions. The initial setup unit 122 assigns each master key part to each state S so as to satisfy the first initial setup condition described above. That is, the initial setup unit 122 assigns different master key parts to the three states S0, S1, S2. Also, the initial setup unit 122 assigns different master key parts to the three states S6, S7, S8. Also, the initial setup unit 122 assigns different master key parts to the three states S 12 ,S 13 ,S 14 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 18 ,S 19 ,S 20 Different master key portions are assigned to each state. In the examples in Figures 19 and 20, states S0, S1, and S2 are assigned different master key portions MK2, MK3, and MK0, respectively. Also, states S6, S7, and S8 are assigned different master key portions MK2, MK3, and MK1, respectively. 12 ,S 13 ,S 14 Each of them is assigned a different master key portion, MK0, MK1, and MK2. Also, state S 18 ,S 19 ,S 20 Each of these is assigned a different master key portion, MK0, MK1, and MK3. Therefore, the examples in Figures 19 and 20 satisfy the first initial setup condition. Here, the attacker controls the left side of the round function F Y L To calculate this, one must infer the three round key portions used in the left-hand operation of the round function F shown in Figure 5. In this case, the attacker needs to estimate all three master key portions for the left-hand side of the round function F shown in Figure 5. Therefore, it is possible to suppress the reduction of assumptions when the attacker assumes (estimates) the round key RK.

[0184] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the second initial setup conditions described above. That is, the initial setup unit 122 assigns different master key portions to the three states S3, S4, and S5. Also, the initial setup unit 122 assigns different master key portions to the three states S9, S 10 ,S 11 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 15 ,S 16 ,S 17 Different master key portions are assigned to each. In addition, the initial setup unit 122 has three states S 21 ,S 22 ,S 23 Different master key portions are assigned to each state. In the examples in Figures 19 and 20, states S3, S4, and S5 are assigned different master key portions MK6, MK7, and MK4, respectively. Also, states S9, S 10 ,S 11 Each of them is assigned a different master key portion, MK6, MK7, and MK5. Also, state S 15 ,S 16 ,S 17 Each of them is assigned a different master key portion, MK4, MK5, and MK6. Also, state S 21 ,S 22 ,S 23 Each of these is assigned a different master key portion, MK4, MK5, and MK7. Therefore, the examples in Figures 19 and 20 satisfy the second initial setup condition. Here, the attacker controls the right side of the round function F Y R To calculate this, one must infer the three round key portions used in the right-hand operation of the round function F shown in Figure 5. In this case, the attacker needs to estimate all three master key portions for the right-hand side of the round function F shown in Figure 5. Therefore, it is possible to suppress the reduction of the assumptions made when the attacker assumes (estimates) the round key RK.

[0185] Further, the initial setting unit 122 assigns each master key portion to each state S so as to satisfy the above-described third initial setting condition. That is, the initial setting unit 122 assigns mutually different master key portions to the four states S0, S1, S3, S4. Further, the initial setting unit 122 assigns mutually different master key portions to the four states S6, S7, S9, S 10 and assigns mutually different master key portions to the four states S 12 , S 13 , S[[ID=?]] 15 , S 16 and assigns mutually different master key portions to the four states S 18 , S 19 , S 21 , S 22 and assigns mutually different master key portions to the four states S 10 Here, in the examples of FIGS. 19 and 20, mutually different master key portions MK2, MK3, MK6, MK7 are respectively assigned to the states S0, S1, S3, S4. Further, mutually different master key portions MK2, MK3, MK6, MK7 are respectively assigned to the states S6, S7, S9, S 12 , S 13 , S 15 , S 16 and mutually different master key portions MK0, MK1, MK4, MK5 are respectively assigned to the states S 18 , S 19 , S 21 , S 22 and mutually different master key portions MK0, MK1, MK4, MK5 are respectively assigned to the states S

[0186] Therefore, the examples of FIGS. 19 and 20 satisfy the third initial setting condition. Therefore, the attacker needs to estimate all four master key portions used in the operation before the round function F shown in FIG. 5. Therefore, it is possible to suppress the reduction of the amount of assumptions when the attacker assumes (estimates) the round key RK. It seems there is a missing number in the original text for one of the tags (). I've left it as it is in the translation. Also, I've replaced the unknown '?' in the tag [[ID=?]] with a '?'. If this was a known tag number, it should be corrected for a more accurate translation.Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the fourth initial setup condition described above. That is, the initial setup unit 122 assigns eight states S2, S5, S8, S 11 ,S 14 ,S 17 ,S 20 ,S 23 Assign different master key portions to each. Here, in the examples of Figures 19 and 20, states S2, S5, S8, S 11 ,S 14 ,S 17 ,S 20 ,S 23 Each of these is assigned a different master key portion: MK0, MK4, MK1, MK5, MK2, MK6, MK3, and MK7. Therefore, the examples in Figures 19 and 20 satisfy the fourth initial setup condition. Thus, it is possible to deter an attacker from easily estimating the round key.

[0187] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the fifth initial setup condition described above. That is, the initial setup unit 122 performs the initial setup so that the number of times each of the eight master key portions is assigned is the same across all 24 states. In the examples of Figures 19 and 20, each of the eight master key portions MK0, MK1, MK2, MK3, MK4, MK5, MK6, and MK7 is assigned to three states S across all 24 states. Therefore, the examples of Figures 19 and 20 satisfy the fifth initial setup condition. As a result, the master key portions are evenly distributed across all states. Consequently, it is possible to suppress an attacker from easily estimating the round key.

[0188] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in order to satisfy the sixth initial setup condition described above. That is, the initial setup unit 122 assigns each of the eight master key portions to the third round key portion K 1 3 and 6th round key section K 2Initialization is performed so that the number of states S corresponding to 3 is the same. In other words, the initialization unit 122 sets the states S2, S5, S8, S for each of the eight master key parts. 11 ,S 14 ,S 17 ,S 20 ,S 23 Initial settings are performed so that the number assigned to each is the same. Here, in the examples of Figures 19 and 20, each of the eight master key parts MK0, MK1, MK2, MK3, MK4, MK5, MK6, MK7 is in state S2, S5, S8, S 11 ,S 14 ,S 17 ,S 20 ,S 23 It is assigned to one of the states S. Therefore, the examples in Figures 19 and 20 satisfy the sixth initial setting condition. This suppresses bias in the master key portion used as the round key portion. Therefore, it can be suppressed for attackers to easily deduce the round key.

[0189] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in such a way as to satisfy the seventh initial setup condition described above. That is, the initial setup unit 122 assigns each of the eight master key portions to the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 Initialization is performed so that the number of states S corresponding to 2 is the same. In other words, the initialization unit 122 sets the states S0, S1, S3, S4, S6, S7, S9, S for each of the eight master key parts. 10 ,S 12 ,S 13 ,S 15 ,S 16 ,S 18 ,S 19 ,S 21 ,S 22Initial settings are performed so that the number assigned to each is the same. Here, in the examples of Figures 19 and 20, each of the eight master key parts MK0, MK1, MK2, MK3, MK4, MK5, MK6, MK7 is in state S0, S1, S3, S4, S6, S7, S9, S 10 ,S 12 ,S 13 ,S 15 ,S 16 ,S 18 ,S 19 ,S 21 ,S 22 It is assigned to two of the states S. Therefore, the examples in Figures 19 and 20 satisfy the seventh initial setting condition. This suppresses bias in the master key portion used as the round key portion. Therefore, it can be suppressed for attackers to easily deduce the round key.

[0190] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in relation to the relationship of arrow E3 and arrow E1 described above, in order to satisfy the eighth initial setup condition described above. That is, the initial setup unit 122 assigns each of the two master key portions to states S2 and S5 to state S 12 ,S 13 ,S 15 ,S 16 Either of the above, and state S 18 ,S 19 ,S 21 ,S 22 It is assigned to one of the following. Here, in the examples of Figures 19 and 20, the master key portion MK0 and MK4 are assigned to states S2 and S5, respectively. And the master key portion MK0 is assigned to state S 12 ,S 13 ,S 15 ,S 16 State S 12 Assigned to state S 18 ,S 19 ,S 21 ,S 22 State S 18 It is assigned to. Also, the master key part MK4 is state S 12 ,S13 ,S 15 ,S 16 State S 15 Assigned to state S 18 ,S 19 ,S 21 ,S 22 State S 21 It is assigned to. Therefore, the examples in Figures 19 and 20 satisfy the eighth initial setting condition. Thus, it is possible to suppress the reduction of the assumption amount when an attacker assumes (estimates) the round key RK.

[0191] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in relation to the relationship of arrow E2 and arrow E4 described above, in order to satisfy the ninth initial setup condition described above. That is, the initial setup unit 122 assigns each master key portion to states S8, S 11 Each of the two master key parts assigned to State S 12 ,S 13 ,S 15 ,S 16 Either of the above, and state S 18 ,S 19 ,S 21 ,S 22 Assign to one of the following. Here, in the examples of Figures 19 and 20, states S8, S 11 Each is assigned a master key portion, MK1 and MK5, respectively. And master key portion MK1 is state S 12 ,S 13 ,S 15 ,S 16 State S 13 Assigned to state S 18 ,S 19 ,S 21 ,S 22 State S 19 It is assigned to. Also, the master key part MK5 is state S 12 ,S 13 ,S 15 ,S 16 State S 16 Assigned to state S 18 ,S 19 ,S21 ,S 22 State S 22 It is assigned to. Therefore, the examples in Figures 19 and 20 satisfy the ninth initial setting condition. Thus, it is possible to suppress attackers from reducing the amount of assumptions when assuming (estimating) the round key RK.

[0192] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in relation to the relationship of arrow E3 and arrow E2 described above, in order to satisfy the tenth initial setup condition described above. That is, the initial setup unit 122 assigns each master key portion to each state S 14 ,S 17 Each of the two master key portions assigned to it is one of states S0, S1, S3, S4, and states S6, S7, S9, S 10 Assign to one of the following. Here, in the examples of Figures 19 and 20, state S 14 ,S 17 Each is assigned a master key portion MK2 and MK6, respectively. Master key portion MK2 is assigned to state S0 out of states S0, S1, S3, S4, and states S6, S7, S9, S 10 It is assigned to state S6. Also, the master key portion MK6 is assigned to state S3 among states S0, S1, S3, S4, and states S6, S7, S9, S 10 It is assigned to state S7. Therefore, the examples in Figures 19 and 20 satisfy the tenth initial setting condition. Thus, it is possible to suppress the reduction of the assumption amount when an attacker assumes (estimates) the round key RK.

[0193] Furthermore, the initial setup unit 122 assigns each master key portion to each state S in relation to the relationship of arrow E1 and arrow E4 described above, in order to satisfy the 11th initial setup condition described above. That is, the initial setup unit 122 assigns each master key portion to each state S 20 ,S 23 Each of the two master key portions assigned to it is one of states S0, S1, S3, S4, and states S6, S7, S9, S 10Assign to one of the following. Here, in the examples of Figures 19 and 20, state S 20 ,S 23 Each is assigned a master key portion MK3 and MK7, respectively. Master key portion MK3 is assigned to state S1 out of states S0, S1, S3, S4, and states S6, S7, S9, S 10 It is assigned to state S7. Also, the master key portion MK7 is assigned to state S4 among states S0, S1, S3, S4, and states S6, S7, S9, S 10 State S 10 It is assigned to. Therefore, the examples in Figures 19 and 20 satisfy the 11th initial setting condition. Thus, it is possible to suppress the reduction of the assumption amount when an attacker assumes (estimates) the round key RK.

[0194] <Update process> Next, the update process will be described. As described above using Figure 10, the update processing unit 124 sets the value of each of the second states by performing the exclusive OR operation between the value of one of the multiple states S (a first state) and the values ​​of two or more predetermined T second states that are different from the first state. In this way, the update processing unit 124 updates the second states. As described above, the round function F shown in Figure 5, which is used in the stirring process according to this disclosure, is capable of performing high-speed cryptographic processing (stirring process). Therefore, if the update process, which is executed in parallel with the stirring process, is slow, the advantage of performing the stirring process at high speed may be lost. Thus, it is required to execute the update process efficiently and at high speed. Furthermore, the update process described using Figure 10 is a relatively efficient process because it uses relatively simple operations such as exclusive OR.

[0195] As mentioned above, increasing the number of predetermined values ​​T will accelerate the updating of the state S value. Therefore, the randomization (steaming) of the round key RK will increase, which is likely to improve security. On the other hand, increasing the number of predetermined values ​​T will increase the number of exclusive OR operations performed, which will slow down the key scheduling process. Therefore, it is necessary to predetermine the number of predetermined values ​​T in order to perform the key scheduling process efficiently while considering security. Furthermore, as will be discussed later, the position of the second state in the first update (i.e., the values ​​of k1 and k2 shown in Figure 10) must be pre-selected with security in mind.

[0196] As the first selection criterion for the position of the second state in the first update, it is necessary that the second state be selected such that the master key portion set in the second state is not the same as the master key portion set in the first state. Now, suppose the master key portion set in the second state is the same as the master key portion set in the first state. In this case, if an exclusive OR operation is performed on the value of the first state and the value of the second state, the resulting value will be all zero, that is, all n bits will be 0. In other words, the same master key portions cancel each other out, and the key value becomes zero. As a result, the value of the round key portion corresponding to the second state becomes all zero. In this case, the round key portion will not exist in the mixing process using the round function F, and there is a possibility that the input intermediate data will not be mixed properly. Therefore, safety may be compromised. Accordingly, with each master key portion set in each state S by the initial setup performed under the above conditions, it is necessary that the position of the second state in the first update be selected in advance such that the value of the second state and the value of the first state are not the same.

[0197] Figure 21 is a diagram illustrating the case in which a second state is selected contrary to the first selection criterion in the update process of this disclosure. Figure 21 shows the case in which the state set by the initial settings illustrated in Figure 13 is updated. Also in Figure 21, in the first update process, state S is set as the first state. 11 In Figure 21, the predetermined number T is set to T=2. Also in Figure 21, in the first update process, states S1 and S7 are selected as the second states.

[0198] In the example shown in Figure 21, during the first update process, state S 11 The exclusive OR of state S7 is calculated. Here, state S 11 Both state S7 and state S7 have the master key portion MK3 set. Therefore, the result of the exclusive OR is all zeros, and the value of state S7 is updated to all zeros. Also, in the first update process, state S 11 The exclusive OR of state S1 is calculated. The result of this exclusive OR is "1^3", so the value of state S1 is updated to "1^3". Here, "^" indicates exclusive OR (XOR). Also, "x^y" is the master key part MK x Value and Master Key Part MK y This shows the exclusive OR operation with the value of [the specified value].

[0199] Furthermore, in the second update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index i of the first update operation. Therefore, in the second update operation, the first state becomes state S. 10 This is the result. Furthermore, the second states are states S0 and S6.

[0200] Therefore, in the second update process, state S 10The exclusive OR of state S6 is calculated. The result of this exclusive OR is "0^2", so the value of state S6 is updated to "0^2". Also, in the second update process, state S 10 The exclusive OR of state S0 is calculated. Here, state S 10 Both the state and state S0 are set to the master key portion MK2. Therefore, the result of the exclusive OR is all zeros, and the value of state S0 is updated to all zeros.

[0201] As shown in the example in Figure 21, there exists a state S where the values ​​become all zero due to the update process. Therefore, since the values ​​of the round key portion become all zero, security may be compromised as described above.

[0202] Figure 22 illustrates the case in which a second state is selected according to a first selection criterion in the update process of this disclosure. Similar to the example in Figure 21, Figure 22 shows the case where the state set by the initial settings illustrated in Figure 13 is updated. Furthermore, in Figure 22, in the first update process, state S is set as the first state. 11 This is selected. Also, in Figure 22, the predetermined number T is set to T=2. Also, in Figure 22, in the first update process, the second state is state S4 and state S 10 This option is selected.

[0203] In the example shown in Figure 22, during the first update process, state S 11 The exclusive OR of state S4 is calculated. The result of this exclusive OR is "0^3", so the value of state S4 is updated to "0^3". Also, in the first update process, state S 11 and state S 10 The exclusive OR of is calculated. The result of this exclusive OR is "2^3", so state S 10The value of is updated to "2^3". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 3rd and 4th rounds.

[0204] Furthermore, in the second update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index i of the first update operation. Therefore, in the second update operation, the first state becomes state S. 10 This is the result. Furthermore, the second state consists of state S3 and state S9.

[0205] Therefore, in the second update process, state S 10 The exclusive OR of state S3 is calculated. The result of this exclusive OR is "3^2^3", which is "2", so the value of state S3 is updated to "2". Also, in the second update process, state S 10 The exclusive OR of state S9 is calculated. The result of this exclusive OR is "1^2^3", so the value of state S9 is updated to "1^2^3". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 5th and 6th rounds.

[0206] Furthermore, in the third update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index i in the second update process. Therefore, in the third update process, the first state becomes state S9. The second state becomes state S2 and state S8.

[0207] Therefore, in the third update process, the exclusive OR of state S9 and state S2 is calculated. The result of this exclusive OR is "0^1^2^3", so the value of state S2 is updated to "0^1^2^3". Also in the third update process, the exclusive OR of state S9 and state S8 is calculated. The result of this exclusive OR is "1^2^3^2", or "1^3", so the value of state S8 is updated to "1^3". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 7th and 8th rounds.

[0208] Furthermore, in the fourth update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index i in the third update operation. Therefore, in the fourth update operation, the first state becomes state S8. Also, the second state becomes state S1 and state S7.

[0209] Therefore, in the fourth update process, the exclusive OR of state S8 and state S1 is calculated. The result of this exclusive OR is "1^1^3", or "3", so the value of state S2 is updated to "3". Also in the fourth update process, the exclusive OR of state S8 and state S7 is calculated. The result of this exclusive OR is "3^1^3", or "1", so the value of state S7 is updated to "1". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 9th and 10th rounds.

[0210] Furthermore, in the fifth update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index i in the fourth update operation. Therefore, in the fifth update operation, the first state becomes state S7. Also, the second state becomes state S0 and state S6.

[0211] Therefore, in the fifth update process, the exclusive OR of state S7 and state S0 is calculated. The result of this exclusive OR is "2^1", so the value of state S0 is updated to "2^1". Also in the fifth update process, the exclusive OR of state S7 and state S6 is calculated. The result of this exclusive OR is "0^1", so the value of state S6 is updated to "0^1". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 11th and 12th rounds.

[0212] Furthermore, in the sixth update process, each state S that is subject to the exclusive OR operation is processed. i The index i is decremented by one from the index in the 5th update process. Here, as mentioned above, when the index of state S0 is decremented by one, state S 11 Therefore, in the 6th update process, the first state becomes state S6. Also, the second state becomes state S 11 And the state becomes S5.

[0213] Therefore, in the sixth update process, state S6 and state S 11 The exclusive OR of is calculated. The result of this exclusive OR is "3^0^1", so state S 11 The value of is updated to "3^0^1". Also, in the 6th update process, the exclusive OR of state S6 and state S5 is calculated. The result of this exclusive OR is "1^0^1", or "0", so the value of state S5 is updated to "0". The update processing unit 124 then outputs the value of state S at this time to the data stirring unit 110 as the round key RK for the 13th and 14th rounds.

[0214] Thus, in the example in Figure 22, there is no state S whose values ​​become all zero due to the update process. Therefore, the example in Figure 22 is safer than the case in Figure 21.

[0215] Furthermore, a second selection criterion for the position of the second state in the first update is that the position of the second state is selected in a way that increases resistance to cube attacks. Here, a cube attack is a type of algebraic attack in which each of the multiple bits of the ciphertext is represented by a Boolean polynomial using each bit of the plaintext and each bit of the secret key, and the key is obtained by solving these multiple Boolean polynomials as a system of equations. Specifically, the attacker focuses on a specific set of bits of the plaintext that correspond to the "cube". Then, by taking the sum of the above multiple Boolean polynomials given sets of plaintext that give all patterns of (0,1) to these multiple bits, a low-degree formula is derived. By using this low-degree formula, the attacker can efficiently decrypt the data. In other words, when each bit of the ciphertext is represented by the above Boolean polynomial, if the maximum degree of the Boolean polynomial is low, the data can be easily decrypted by an attacker's cube attack.

[0216] Therefore, in cryptographic processing, it is desirable to maximize the maximum degree of the Boolean polynomial when each bit of the ciphertext is represented by the above Boolean polynomial. Here, from the perspective of cube attacks, it is desirable that all bits of the secret key influence the Boolean polynomial. Therefore, it is desirable to represent the state in which the bits of the plaintext and the bits of the key have been mixed by the shuffling process with the Boolean polynomial. Therefore, the update process of the key scheduling process needs to be configured to be highly resistant to cube attacks. Specifically, the derived Boolean polynomial may vary depending on the number and position of the second state that is subject to the exclusive OR operation with the first state in the key scheduling update process.

[0217] Here, in order to improve the efficiency of the update process, we consider setting the first state in the first update process to a predetermined state among multiple states. In the examples in Figures 10, 21, and 22, the first state in the first update process is set to the final state (S in the first example). 11 In the second and third examples, S 23) is stated. In this case, by appropriately determining the position and number of second states in the first update process, the update process can be configured to increase resistance to cube attacks. In this disclosure, the second states in the first update process are selected in advance such that the maximum degree is large when each bit of the N-bit ciphertext block is represented by a Boolean polynomial of each bit of the N-bit plaintext block and each bit of the master key. That is, before the cryptographic processing, a predetermined number T and the position of the second states in the first update process are selected by a pre-calculation relating to the evaluation of resistance to cube attacks, as described below.

[0218] Here, deriving an exact Boolean polynomial using all the bits of the plaintext block is difficult from a computational standpoint. Therefore, in this disclosure, the bits of the plaintext block used in the above Boolean polynomial are limited to four consecutive bits. Then, by varying a predetermined number T and the position of the second state in the first update process, all the bits constituting the ciphertext block are represented by a Boolean polynomial using a total of 5 bits: the 4 bits of the plaintext and the 1 bit of the master key. Then, for various patterns of the predetermined number T and the position of the second state in the first update process, it is searched by pre-computation whether a 5th-order term, which combines the 4 bits of the plaintext block and the 1 bit of the master key, appears in all the bits of the ciphertext block. Alternatively, it may be searched whether a 6th-order term, which combines the 4 bits of the plaintext and any 2 bits of the master key, appears in all the bits of the ciphertext.

[0219] Here, let's focus on four consecutive bits p0 to p3, each being 1 bit, out of the N bits in the plaintext block. Also, if N=64, then each bit in the ciphertext block is c0 to c 63 It is expressed as follows. Also, the 5th order term, which combines the 4 bits of the plaintext block and the 1 bit of the master key, is p0p1p2p3k x (However, x = 0, ..., 127) is expressed as follows. Then, for all bits of the ciphertext block, p0p1p2p3k xWe search to see if it appears or not. Generally, as the number of rounds increases, the Boolean polynomial becomes more complex. Therefore, as the number of rounds increases, in a given round, all terms of the 5th order term will appear in the Boolean polynomial of all bits in the ciphertext block, as shown in equation (9) below. c0=…+p0p1p2p3k0+…+p0p1p2p3k1+…+p0p1p2p3k 127 +… ... c 63 =…+p0p1p2p3k0+…+p0p1p2p3k1+…+p0p1p2p3k 127 +… ...(9)

[0220] For various predetermined numbers T, the position of the second state in the first update process is varied to find the minimum number of rounds in which all quintic terms appear in the Boolean polynomial of all bits of the ciphertext block, as shown in equation (9) above. The position of the second state that minimizes the minimum number of rounds is then determined as the position of the second state in the first update process, which is used in the actual update process, as it is evaluated as having good resistance to cube attacks. In this way, the position of the second state in the first update process is determined in advance by pre-calculation. This makes it possible to determine the position of the second state in the first update in a way that improves the evaluation of resistance to cube attacks. Examples of the positions of the second state in the first update process determined in advance by the above pre-calculation will be described later using Figures 23 to 25.

[0221] <Update process for the first example> The update process for the first example described above will now be explained. In the first example, the round function F is used once in one round. Also, in the first example, there are 12 states S. That is, each state S corresponds to one of the multiple round key parts that make up the round key RK for two rounds. Also, in the first example, N = 2 * n. Also, in the first example, the master key MK is composed of four master key parts.

[0222] Therefore, in the first example, the update processing unit 124 generates round keys for two rounds in the update process, and then updates the value of state S to generate round keys to be used in the following two rounds. In addition, in the first update, the update processing unit 124 updates the first state S among the multiple states. j The value of and a second state S of a predetermined number T greater than or equal to 2. k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. Here, j and k are integer indices from 0 to 11, and k ≠ j.

[0223] Furthermore, in subsequent updates, the update processing unit 124 will process the first state S from the previous update. j The index j and the second state S of a predetermined number T k The index k of each element is decremented by the same amount. Then, the update processing unit 124 determines the first state S after the decrement. j The value and a predetermined number of second states S k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. However, once the index has been decremented to 0, it will return to 11 and be decremented again.

[0224] Furthermore, the update processing unit 124 changes the first state S in the first update process to the final state, i.e., state S. 11 Alternatively, the update processing unit 124 may decrement the index of the state subject to the exclusive OR operation by 1 in the second and subsequent updates. In this case, the update processing unit 124, in the first update, the first state S j (State S 11 The value of ) and the first state S j Two or more predetermined second states S of a specified number T that are different from the first state. kThe exclusive OR of each of the values ​​is set as the value of the second state. This causes the update processing unit 124 to update the second state. In this case, for subsequent updates, the update processing unit 124 sets the first state S from the previous update. j The index j and the second state S of a predetermined number T k The index k is decremented by 1. Then, the update processing unit 124 changes the first state S j The value of the second state S of a predetermined number T k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state.

[0225] Figure 23 illustrates the index of the second state S in the first update, which has been determined in advance for the first example relating to this disclosure. The numbers illustrated in Figure 23 are indices indicating the position of the second state in the first update, which has been determined by the above-described pre-calculation to give a high evaluation of resistance to the cube attack described above for the first example. Figure 23 illustrates the index of the second state in the first update for each case where the predetermined number T is 2, 3, 4, 5, and 6, for which the above-described pre-calculation resulted in a good evaluation of resistance to the cube attack.

[0226] In the first update, the update processing unit 124 processes each state S of the predetermined number T of indices k shown in Figure 23. k The second state is selected. The update processing unit 124 then selects a predetermined number T of the selected second states S k The respective values ​​and the first state S 11 The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state. Then, in the second and subsequent updates, the update processing unit 124 sets a predetermined number T of second states S k The respective indexes and the first state S j The index is decremented by 1. Then, the update processing unit 124 determines the second state S of a predetermined number T after the decrement.k The respective values ​​and the first state S j The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state.

[0227] In the update process for the example in Figure 23, when the predetermined number T is set to 2, the update processing unit 124 performs the first update in the first state S j State S 11 And two predetermined second states S k The following two states S k It shall be one of the following: State S8, S9 State S4,S 10 State S6,S 10 States S0, S4 States S0, S5 States S0, S6

[0228] Then, the update processing unit 124 processes the first state S j The value of and two predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, suppose that when a predetermined number T=2, states S8 and S9 are selected as the second state in the first update. In this case, in the first update, the update processing unit 124 calculates S8 = S8XOR S 11 The calculation is performed and the value of state S8 is updated. Similarly, in the first update, the update processing unit 124 calculates S9 = S9XOR S 11 Perform the calculation and update the value of state S9. This is also done for the other two pairs of second states S.

[0229] Furthermore, in the second update, the update processing unit 124 performs an exclusive OR operation on states S8, S9 and state S, which were the targets of the exclusive OR operation in the first update. 11The index of the index is decremented by one. Then, in the second update, the update processing unit 124 calculates S7 = S7XOR S 10 The calculation is performed and the value of state S7 is updated. Similarly, in the second update, the update processing unit 124 calculates S8 = S8XOR S 10 The calculation is performed to update the value of state S8. Similarly, in the third and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR in the previous update by one, calculates the exclusive OR of the decremented states, and updates the values ​​of the two second states S. This is also the case for other predetermined numbers T.

[0230] In the update process for the example in Figure 23, when the predetermined number T is set to 3, the update processing unit 124 performs the first update in the first state S j State S 11 And three predetermined second states S k The following three states S k It shall be one of the following: State S2, S6, S 10 State S2, S4, S 10 State S1, S5, S 10 State S2, S5, S 10 States S0, S6, S 10 State S4, S6, S 10

[0231] Then, the update processing unit 124 processes the first state S j The value of and three predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=3, the second state in the first update will be states S2, S6, S 10Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S2 = S2XOR S 11 The calculation is performed and the value of state S2 is updated. Similarly, in the first update, the update processing unit 124 calculates S6 = S6XOR S 11 The calculation is performed and the value of state S6 is updated. Similarly, in the first update, the update processing unit 124 performs S 10 =S 10 XOR S 11 Perform the calculation and state S 10 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the three second states S.

[0232] In the update process for the example in Figure 23, when the predetermined number T is set to 4, the update processing unit 124 performs the first update in the first state S j State S 11 And four predetermined second states S k The following four states S k It shall be one of the following: State S2, S6, S8, S 10 States S4, S6, S8, S9 State S2, S4, S5, S 10 States S0, S2, S5, S6 States S0, S1, S8, S9 States S0, S2, S8, S9 State S0, S4, S5, S 10 State S1, S2, S6, S 10 State S0, S4, S6, S 10 State S1, S5, S6, S 10 State S0, S5, S8, S 10 State S1, S5, S8, S10 State S1, S6, S8, S 10

[0233] Then, the update processing unit 124 processes the first state S j The value of and four predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, when a predetermined number T=4, the second state in the first update is states S2, S6, S8, S 10 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S2 = S2XOR S 11 The calculation is performed and the value of state S2 is updated. Similarly, in the first update, the update processing unit 124 calculates S6 = S6XOR S 11 The calculation is performed and the value of state S6 is updated. Similarly, in the first update, the update processing unit 124 calculates S8 = S8XOR S 11 The calculation is performed and the value of state S8 is updated. Similarly, in the first update, the update processing unit 124 performs S 10 =S 10 XOR S 11 Perform the calculation and state S 10 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the four second states S.

[0234] In the update process for the example in Figure 23, when the predetermined number T is set to 5, the update processing unit 124 performs the first update in the first state S j State S 11 And five predetermined second states S k The following five states S k It shall be one of the following: States S0, S4, S5, S8, S9 States S0, S4, S6, S8, S9 State S0, S2, S6, S8, S 10 State S2, S4, S6, S8, S 10 States S0, S1, S2, S4, S6 State S1, S4, S5, S8, S 10 State S1, S2, S4, S6, S 10 State S0, S2, S5, S8, S 10 State S2, S4, S5, S8, S 10 State S1, S4, S6, S8, S 10

[0235] Then, the update processing unit 124 processes the first state S j The value of and five predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=5, suppose states S0, S4, S5, S8, and S9 are selected as the second state in the first update. In this case, in the first update, the update processing unit 124 calculates S0 = S0 XOR S 11 The calculation is performed and the value of state S0 is updated. Similarly, in the first update, the update processing unit 124 calculates S4 = S4XOR S 11 The calculation is performed and the value of state S4 is updated. Similarly, in the first update, the update processing unit 124 calculates S5 = S5XOR S 11 The calculation is performed and the value of state S5 is updated. Similarly, in the first update, the update processing unit 124 calculates S8 = S8XOR S 11 The calculation is performed and the value of state S8 is updated. Similarly, in the first update, the update processing unit 124 calculates S9 = S9XOR S 11The calculation is performed to update the value of state S9. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the five second states S.

[0236] In the update process for the example in Figure 23, when the predetermined number T is set to 6, the update processing unit 124 performs the first update in the first state S j State S 11 And six predetermined second states S k The following six states S k It shall be one of the following: States S0, S1, S4, S6, S8, S9 States S0, S1, S4, S5, S8, S9 State S0, S2, S4, S6, S8, S 10 State S2, S4, S5, S6, S8, S 10

[0237] Then, the update processing unit 124 processes the first state S j The value of and six predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=6, suppose states S0, S1, S4, S6, S8, and S9 are selected as the second state in the first update. In this case, in the first update, the update processing unit 124 calculates S0 = S0 XOR S 11 The calculation is performed and the value of state S0 is updated. Similarly, in the first update, the update processing unit 124 calculates S1 = S1XOR S 11 The calculation is performed and the value of state S1 is updated. Similarly, in the first update, the update processing unit 124 calculates S4 = S4XOR S 11 The calculation is performed and the value of state S4 is updated. Similarly, in the first update, the update processing unit 124 calculates S6 = S6XOR S 11The calculation is performed and the value of state S6 is updated. Similarly, in the first update, the update processing unit 124 calculates S8 = S8XOR S 11 The calculation is performed and the value of state S8 is updated. Similarly, in the first update, the update processing unit 124 calculates S9 = S9XOR S 11 The calculation is performed to update the value of state S9. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the six second states S.

[0238] <Update process for the second example> The update process for the second example described above will now be explained. In the second example, the round function F is used twice in one round. Also, in the second example, there are 24 states S. That is, each state S corresponds to one of the multiple round key parts that make up the round key RK for two rounds. Also, in the second example, N = 4 * n. Also, in the second example, the master key MK is composed of four master key parts.

[0239] Therefore, in the second example, the update processing unit 124 generates round keys for two rounds in the update process and then updates the value of state S, thereby enabling the subsequent two rounds It generates a round key to be used in the round. In addition, the update processing unit 124, in the first update, sets the first state S of the multiple states. j The value of and a second state S of a predetermined number T greater than or equal to 2. k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. Here, j and k are integer indices from 0 to 23, and k ≠ j.

[0240] Furthermore, in subsequent updates, the update processing unit 124 will process the first state S from the previous update. j The index j and the second state S of a predetermined number T kThe index k of each element is decremented by the same amount. Then, the update processing unit 124 determines the first state S after the decrement. j The value and a predetermined number of second states S k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. However, once the index has been decremented to 0, it returns to 23 and is decremented again.

[0241] Furthermore, the update processing unit 124 changes the first state S in the first update process to the final state, i.e., state S. 23 Alternatively, the update processing unit 124 may decrement the index of the state subject to the exclusive OR operation by 1 in the second and subsequent updates. In this case, the update processing unit 124, in the first update, the first state S j (State S 23 The value of ) and the first state S j Two or more predetermined second states S of a specified number T that are different from the first state. k The second state is updated by setting the exclusive OR of each of the values ​​as the value of the second state. In this case, the update processing unit 124, in the second and subsequent updates, sets the first state S from the previous update. j The index j and the second state S of a predetermined number T k The index k is decremented by 1. Then, the update processing unit 124 changes the first state S j The value of the second state S of a predetermined number T k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state.

[0242] Figure 24 illustrates the index of the second state S in the first update, which has been determined in advance for the second example relating to this disclosure. The numbers illustrated in Figure 24 are indices indicating the position of the second state in the first update, which has been determined by the above-described pre-calculation to give a high evaluation of resistance to the cube attack described above for the second example. Figure 24 illustrates the index of the second state in the first update for each case where the predetermined number T is 4, 5, 6, 7, and 8, for which the above-described pre-calculation resulted in a good evaluation of resistance to the cube attack.

[0243] In the first update, the update processing unit 124 processes each state S of the predetermined number T of indices k shown in Figure 24. k The second state is selected. The update processing unit 124 then selects a predetermined number T of the selected second states S k The respective values ​​and the first state S 23 The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state. Then, in the second and subsequent updates, the update processing unit 124 sets a predetermined number T of second states S k The respective indexes and the first state S j The index is decremented by 1. Then, the update processing unit 124 determines the second state S of a predetermined number T after the decrement. k The respective values ​​and the first state S j The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state.

[0244] In the update process for the example in Figure 24, when the predetermined number T is set to 4, the update processing unit 124 performs the first update on the first state S j State S 23 And four predetermined second states S k The following four states S k It shall be one of the following: State S4,S 13 ,S 20,S 22 State S6,S 12 ,S 17 ,S 22 State S2,S 13 ,S 20 ,S 22 State S5,S 13 ,S 20 ,S 22 State S6,S 16 ,S 20 ,S 22 State S 14 ,S 17 ,S 20 ,S 22 State S3,S 12 ,S 17 ,S 22

[0245] Then, the update processing unit 124 processes the first state S j The value of and four predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=4, the second state in the first update is state S4,S 13 ,S 20 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S4 = S4XOR S 23 The calculation is performed and the value of state S4 is updated. Similarly, in the first update, the update processing unit 124 performs S 13 =S 13 XOR S 23 Perform the calculation and state S 13 The value of is updated. Similarly, in the first update, the update processing unit 124 updates S 20 =S 20 XOR S 23 Perform the calculation and state S 20 The value of is updated. Similarly, in the first update, the update processing unit 124 updates S 22 =S22 XOR S 23 Perform the calculation and state S 22 The value of is updated. This is also true for the other four sets of second states S.

[0246] Furthermore, in the second update, the update processing unit 124 performs an exclusive OR operation on states S4, S, which were the targets of the exclusive OR operation in the first update. 13 ,S 20 ,S 22 and state S 23 The index of the index is decremented by one. Then, in the second update, the update processing unit 124 calculates S3 = S3XOR S 22 The calculation is performed and the value of state S3 is updated. Similarly, in the second update, the update processing unit 124 performs S 12 =S 12 XOR S 22 Perform the calculation and state S 12 The value of is updated. Similarly, in the second update, the update processing unit 124 updates S 19 =S 19 XOR S 22 Perform the calculation and state S 19 The value of is updated. Similarly, in the second update, the update processing unit 124 updates S 21 =S 21 XOR S 22 Perform the calculation and state S 21 The value is updated. Similarly, in the third and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the four second states S. This is also the case for other predetermined numbers T.

[0247] In the update process for the example in Figure 24, when the predetermined number T is set to 5, the update processing unit 124 performs the first update in the first state S j State S 23 And five predetermined second states S k The following five states Sk It shall be one of the following: State S3, S5, S9, S 17 ,S 22 State S3, S6, S 12 ,S 17 ,S 22 State S3, S6, S 12 ,S 21 ,S 22 State S3, S5, S 12 ,S 17 ,S 22

[0248] Then, the update processing unit 124 processes the first state S j The value of and five predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=5, the second state in the first update will be states S3, S5, S9, S 17 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S3 = S3XOR S 23 The calculation is performed and the value of state S3 is updated. Similarly, in the first update, the update processing unit 124 calculates S5 = S5XOR S 23 The calculation is performed and the value of state S5 is updated. Similarly, in the first update, the update processing unit 124 calculates S9 = S9XOR S 23 The calculation is performed and the value of state S9 is updated. Similarly, in the first update, the update processing unit 124 performs S 17 =S 17 XOR S 23 Perform the calculation and state S 17 The value of is updated. Similarly, in the first update, the update processing unit 124 updates S 22 =S 22 XOR S 23 Perform the calculation and state S 22The value is updated. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the five second states S.

[0249] In the update process for the example in Figure 24, when the predetermined number T is set to 6, the update processing unit 124 performs the first update on the first state S j State S 23 And six predetermined second states S k The following six states S k It shall be one of the following: State S0, S3, S6, S 13 ,S 17 ,S 19 State S0, S2, S3, S6, S 17 ,S 22 State S3, S5, S6, S 12 ,S 17 ,S 22 State S3, S5, S9, S 12 ,S 17 ,S 22 State S3, S6, S9, S 12 ,S 17 ,S 22 State S3, S7, S9, S 12 ,S 17 ,S 22 State S3, S6, S 14 ,S 16 ,S 17 ,S 22 State S2, S3, S6, S9, S 20 ,S 22 State S2, S3, S6, S 11 ,S 20 ,S 22 State S0, S5, S6, S 12 ,S 20,S 22 State S2, S6, S9, S 13 ,S 20 ,S 22 State S5, S7, S 12 ,S 13 ,S 20 ,S 22 State S0, S3, S6, S 16 ,S 20 ,S 22 State S6, S9, S 11 ,S 16 ,S 20 ,S 22 State S5, S6, S 12 ,S 16 ,S 20 ,S 22 State S6, S9, S 12 ,S 16 ,S 20 ,S 22 State S5,S 12 ,S 13 ,S 16 ,S 20 ,S 22

[0250] Then, the update processing unit 124 processes the first state S j The value of and six predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=6, the second state in the first update will be states S0, S3, S6, S 13 ,S 17 ,S 19 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S0 = S0XOR S 23 The calculation is performed and the value of state S0 is updated. The update processing unit 124 updates states S3, S6, S 13 ,S 17 ,S 19Similarly, the exclusive OR is calculated for states S3, S6, S 13 ,S 17 ,S 19 The value is updated. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the six second states S.

[0251] In the update process for the example in Figure 24, when the predetermined number T is set to 7, the update processing unit 124 performs the first update in the first state S j State S 23 The seven predetermined second states S k The following seven states S k It shall be one of the following: State S0, S2, S3, S4, S6, S 11 ,S 13 State S0, S2, S3, S5, S6, S 11 ,S 13 State S3, S4, S5, S6, S 11 ,S 12 ,S 17 State S0, S2, S3, S6, S 11 ,S 13 ,S 17 State S0, S3, S4, S5, S6, S 13 ,S 19 State S3, S4, S5, S 11 ,S 12 ,S 13 ,S 19 State S0, S3, S4, S6, S 13 ,S 17 ,S 19 State S0, S3, S5, S6, S 13 ,S 17 ,S 19 State S0, S3, S6, S 13,S 14 ,S 17 ,S 19 State S0, S3, S4, S6, S 11 ,S 12 ,S 20 State S3, S4, S5, S6, S 11 ,S 19 ,S 20 State S0, S2, S3, S5, S7, S 17 ,S 22 State S0, S2, S3, S5, S9, S 17 ,S 22 State S0, S2, S4, S5, S9, S 17 ,S 22 State S0, S2, S3, S6, S9, S 17 ,S 22 State S0, S2, S3, S5, S 12 ,S 17 ,S 22 State S0, S2, S4, S5, S 12 ,S 17 ,S 22 State S0, S2, S3, S6, S 12 ,S 17 ,S 22 State S0, S2, S3, S 11 ,S 13 ,S 17 ,S 22 State S3, S5, S6, S 11 ,S 13 ,S 17 ,S 22 State S0, S5, S7, S 11 ,S 13 ,S 17 ,S 22 State S3, S6, S9, S 12 ,S 13 ,S 17 ,S 22 State S0, S5, S 12 ,S 14 ,S 16 ,S 17 ,S 22 State S3, S5, S 12 ,S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S5, S6, S9, S 20 ,S 22 State S0, S2, S5, S6, S 11 ,S 20 ,S 22 States S2, S3, S6, S9, S 11 ,S 20 ,S 22 State S0, S5, S6, S9, S 11 ,S 20 ,S 22 State S0, S5, S7, S9, S 11 ,S 20 ,S 22 State S0, S2, S4, S6, S 12 ,S 20 ,S 22 State S0, S2, S5, S6, S 12 ,S 20 ,S 22 State S0, S2, S4, S7, S 12 ,S 20 ,S 22 State S0, S2, S5, S7, S 12 ,S 20 ,S 22 State S0, S4, S5, S9, S 12 ,S 20 ,S 22 State S0, S5, S6, S9, S 12 ,S 20 ,S 22 States S2, S3, S6, S9, S 13 ,S 20 ,S 22 State S0, S5, S6, S9, S 13 ,S 20 ,S 22 State S0, S5, S7, S9, S 13 ,S 20 ,S 22 State S4, S5, S9, S 11 ,S 13 ,S 20 ,S 22 State S5, S7, S9, S 11 ,S 13 ,S 20 ,S 22 State S0, S2, S5, S 12 ,S 13 ,S 20 ,S 22 State S2, S3, S5, S 12 ,S 13 ,S 20 ,S 22 State S0, S4, S5, S 12 ,S 13 ,S 20 ,S 22 State S4, S5, S7, S 12 ,S 13 ,S 20 ,S 22 State S0, S3, S6, S 12 ,S 16 ,S 20 ,S 22 State S0, S5, S6, S 12 ,S 16 ,S 20 ,S 22 States S0, S3, S7, S 12 ,S 16 ,S 20 ,S 22 State S0, S5, S7, S12 ,S 16 ,S 20 ,S 22 State S0, S4, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S5, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S9, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S2, S5, S 14 ,S 17 ,S 20 ,S 22 State S0, S3, S5, S 14 ,S 17 ,S 20 ,S 22 States S0, S6, S 11 ,S 14 ,S 17 ,S 20 ,S 22 States S0, S7, S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S4, S7, S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S2, S4, S5, S7, S 12 ,S 21 ,S 22 States S0, S3, S5, S9, S 16 ,S 21 ,S 22 State S0, S3, S6, S 11 ,S16 ,S 21 ,S 22 State S0, S4, S6, S 13 ,S 16 ,S 21 ,S 22 States S0, S3, S7, S 13 ,S 16 ,S 21 ,S 22 State S3, S6, S 11 ,S 13 ,S 16 ,S 21 ,S 22 States S0, S7, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S3, S9, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S3, S9, S 14 ,S 16 ,S 21 ,S 22 State S3, S6, S9, S 11 ,S 19 ,S 21 ,S 22 State S3, S5, S6, S 12 ,S 19 ,S 21 ,S 22 State S3, S7, S 11 ,S 13 ,S 19 ,S 21 ,S 22 State S3, S6, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S3, S4, S6, S7, S9, S 11 State S4, S5, S9, S 12 ,S 13 ,S 20 ,S 22 State S0, S4, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S3, S5, S9, S 12 ,S 19 ,S 21 ,S 22

[0252] Then, the update processing unit 124 processes the first state S j The value of and seven predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=7, the second state in the first update is states S0, S2, S3, S4, S6, S 11 ,S 13 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S0 = S0XOR S 23 The update processing unit 124 performs the calculation and updates the value of state S0. 11 ,S 13 Similarly, the exclusive OR is calculated for states S2, S3, S4, S6, S 11 ,S 13 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the seven second states S.

[0253] In the update process for the example in Figure 24, when the predetermined number T is set to 8, the update processing unit 124 performs the first update in the first state S j State S 23 And eight predetermined second states Sk The following eight states S k It shall be one of the following: State S0, S2, S5, S7, S 12 ,S 13 ,S 20 ,S 22 State S0, S2, S5, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S3, S6, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S2, S3, S4, S6, S7, S9, S 11 State S0, S3, S4, S5, S6, S7, S9, S 11 State S0, S3, S4, S6, S7, S9, S 11 ,S 12 State S0, S2, S3, S5, S 11 ,S 12 ,S 13 ,S 14 State S0, S3, S5, S 11 ,S 12 ,S 13 ,S 14 ,S 19 State S3, S4, S5, S 11 ,S 12 ,S 13 ,S 14 ,S 19 State S0, S3, S5, S6, S7, S 13 ,S 17 ,S 19 State S0, S3, S4, S6, S 13 ,S 14 ,S 17 ,S 19 State S0, S3, S5, S6, S7, S11 ,S 12 ,S 20 State S3, S4, S5, S6, S7, S 11 ,S 12 ,S 20 State S3, S4, S5, S6, S9, S 11 ,S 20 ,S 21 State S0, S6, S9, S 11 ,S 12 ,S 13 ,S 20 ,S 21 States S0, S3, S5, S9, S 11 ,S 17 ,S 20 ,S 21 State S0, S5, S9, S 11 ,S 13 ,S 19 ,S 20 ,S 21 State S0, S2, S4, S5, S6, S9, S 17 ,S 22 State S0, S2, S3, S5, S9, S 12 ,S 17 ,S 22 State S0, S2, S4, S5, S9, S 12 ,S 17 ,S 22 State S0, S2, S3, S6, S9, S 12 ,S 17 ,S 22 State S0, S2, S4, S6, S9, S 12 ,S 17 ,S 22 State S0, S2, S3, S6, S 11 ,S 13 ,S 17 ,S 22 State S4, S5, S7, S9, S 11 ,S 13 ,S17 ,S 22 State S0, S2, S6, S9, S 12 ,S 13 ,S 17 ,S 22 State S0, S2, S3, S5, S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S4, S5, S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S3, S6, S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S4, S6, S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S4, S7, S 14 ,S 16 ,S 17 ,S 22 State S3, S5, S9, S 11 ,S 14 ,S 16 ,S 17 ,S 22 State S3, S7, S9, S 11 ,S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S3, S 12 ,S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S5, S 12 ,S 14 ,S 16 ,S 17 ,S 22 State S0, S2, S5, S6, S9, S 11,S 20 ,S 22 State S0, S2, S4, S7, S9, S 11 ,S 20 ,S 22 State S0, S2, S5, S7, S9, S 11 ,S 20 ,S 22 State S0, S2, S5, S7, S9, S 13 ,S 20 ,S 22 State S0, S4, S5, S9, S 11 ,S 13 ,S 20 ,S 22 State S0, S5, S7, S9, S 11 ,S 13 ,S 20 ,S 22 State S0, S4, S5, S7, S 12 ,S 13 ,S 20 ,S 22 State S0, S4, S5, S9, S 12 ,S 13 ,S 20 ,S 22 State S0, S5, S6, S9, S 12 ,S 13 ,S 20 ,S 22 State S0, S4, S5, S6, S9, S 16 ,S 20 ,S 22 States S0, S3, S7, S9, S 11 ,S 16 ,S 20 ,S 22 State S0, S5, S7, S9, S 11 ,S 16 ,S 20 ,S 22 State S0, S5, S6, S9, S 12 ,S16 ,S 20 ,S 22 State S0, S2, S4, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S4, S5, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S2, S6, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S5, S6, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S5, S7, S 12 ,S 13 ,S 16 ,S 20 ,S 22 State S0, S3, S5, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S4, S5, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S5, S6, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S3, S9, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S0, S2, S3, S5, S 14 ,S 17 ,S20 ,S 22 State S0, S2, S4, S7, S 14 ,S 17 ,S 20 ,S 22 State S0, S2, S5, S 11 ,S 14 ,S 17 ,S 20 ,S 22 State S0, S3, S5, S 11 ,S 14 ,S 17 ,S 20 ,S 22 State S0, S3, S6, S 11 ,S 14 ,S 17 ,S 20 ,S 22 State S4, S7, S9, S 11 ,S 14 ,S 17 ,S 20 ,S 22 State S0, S2, S5, S 11 ,S 16 ,S 17 ,S 20 ,S 22 State S0, S3, S9, S 11 ,S 16 ,S 17 ,S 20 ,S 22 State S0, S5, S7, S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S4, S5, S7, S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S0, S6, S9, S 13 ,S 16 ,S 17 ,S 20 ,S22 State S5, S6, S9, S 13 ,S 16 ,S 17 ,S 20 ,S 22 States S0, S7, S9, S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S5, S6, S 12 ,S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S5, S9, S 12 ,S 13 ,S 16 ,S 17 ,S 20 ,S 22 State S0, S3, S9, S 14 ,S 17 ,S 19 ,S 20 ,S 22 State S4, S5, S9, S 14 ,S 17 ,S 19 ,S 20 ,S 22 State S0, S3, S5, S6, S9, S 16 ,S 21 ,S 22 State S0, S4, S5, S7, S 13 ,S 16 ,S 21 ,S 22 State S0, S3, S5, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S3, S6, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S4, S6, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S3, S9, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S4, S9, S 11 ,S 13 ,S 16 ,S 21 ,S 22 State S0, S3, S5, S6, S 11 ,S 19 ,S 21 ,S 22 States S0, S3, S5, S9, S 11 ,S 19 ,S 21 ,S 22 State S0, S3, S6, S9, S 11 ,S 19 ,S 21 ,S 22 State S0, S3, S5, S6, S 12 ,S 19 ,S 21 ,S 22 State S0, S3, S5, S7, S 12 ,S 19 ,S 21 ,S 22 State S0, S3, S6, S9, S 12 ,S 19 ,S 21 ,S 22 State S0, S3, S6, S9, S 13 ,S 19 ,S 21 ,S 22 State S0, S4, S6, S 11 ,S 13 ,S 19 ,S 21 ,S22 States S0, S3, S7, S 11 ,S 13 ,S 19 ,S 21 ,S 22 State S3, S5, S9, S 11 ,S 13 ,S 19 ,S 21 ,S 22 State S3, S6, S9, S 11 ,S 13 ,S 19 ,S 21 ,S 22 State S0, S4, S6, S9, S 14 ,S 19 ,S 21 ,S 22 States S3, S5, S7, S9, S 14 ,S 19 ,S 21 ,S 22 State S0, S2, S5, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S2, S6, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S4, S6, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S3, S5, S6, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S3, S5, S7, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S4, S9, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S2, S5, S9, S 12 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S4, S9, S 13 ,S 16 ,S 19 ,S 21 ,S 22 States S0, S7, S9, S 13 ,S 16 ,S 19 ,S 21 ,S 22 State S4, S7, S9, S 13 ,S 16 ,S 19 ,S 21 ,S 22 State S0, S9, S 11 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22 State S2, S5, S 12 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22 State S3, S5, S 12 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22 State S3, S6, S 12 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22 States S0, S7, S 12 ,S 14 ,S 16,S 19 ,S 21 ,S 22 State S3, S7, S 12 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22 State S4, S7, S 12 ,S 14 ,S 16 ,S 19 ,S 21 ,S 22

[0254] Then, the update processing unit 124 processes the first state S j The value of and eight predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=8, the second state in the first update will be states S0, S2, S5, S7, S 12 ,S 13 ,S 20 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S0 = S0XOR S 23 The calculation is performed and the value of state S0 is updated. The update processing unit 124 updates states S2, S5, S7, S 12 ,S 13 ,S 20 ,S 22 Similarly, the exclusive OR is calculated for states S2, S5, S7, S 12 ,S 13 ,S 20 ,S 22 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the eight second states S.

[0255] <Update process related to the third example> The update process for the third example described above will now be explained. In the third example, the round function F is used twice in one round. Also, in the third example, there are 24 states S. That is, each state S corresponds to multiple round key parts that make up the round key RK for two rounds. Also, in the third example, N = 4 * n. Also, in the third example, the master key MK is composed of 8 master key parts.

[0256] Therefore, in the third example, the update processing unit 124 generates round keys for two rounds in the update process, and then updates the value of state S to generate round keys to be used in the following two rounds. In addition, in the first update, the update processing unit 124 updates the first state S among the multiple states. j The value of and a second state S of a predetermined number T greater than or equal to 2. k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. Here, j and k are integer indices from 0 to 23, and k ≠ j.

[0257] Furthermore, in subsequent updates, the update processing unit 124 will process the first state S from the previous update. j The index j and the second state S of a predetermined number T k The index k of each element is decremented by the same amount. Then, the update processing unit 124 determines the first state S after the decrement. j The value and a predetermined number of second states S k The second state is updated by setting the exclusive OR of each value of the second state as the respective values ​​of the second state. However, once the index has been decremented to 0, it returns to 23 and is decremented again.

[0258] Furthermore, the update processing unit 124 changes the first state S in the first update process to the final state, i.e., state S. 23Alternatively, the update processing unit 124 may decrement the index of the state to be subjected to the exclusive OR operation by 1 in the second and subsequent updates. In this case, the update processing unit 124 will, in the first update, perform the first state S j (State S 23 The value of ) and the first state S j Two or more predetermined second states S of a specified number T that are different from the first state. k The exclusive OR of each of the values ​​is set as the value of the second state. This causes the update processing unit 124 to update the second state. In this case, for subsequent updates, the update processing unit 124 sets the first state S from the previous update. j The index j and the second state S of a predetermined number T k The index k is decremented by 1. Then, the update processing unit 124 changes the first state S j The value of and a predetermined number T of second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state.

[0259] Figure 25 illustrates the index of the second state S in the first update, which has been determined in advance for the third example relating to this disclosure. The numbers illustrated in Figure 25 are indices indicating the position of the second state in the first update for the third example, which has been determined by the above-described pre-calculation to give a high evaluation of resistance to the cube attack described above. Figure 25 illustrates the index of the second state in the first update for each case where the predetermined number T is 4, 5, 6, 7, and 8, for which the above-described pre-calculation resulted in a good evaluation of resistance to the cube attack.

[0260] In the first update, the update processing unit 124 processes each state S of the predetermined number T of indices k shown in Figure 25. k The second state is selected. The update processing unit 124 then selects a predetermined number T of the selected second states S k The respective values ​​and the first state S23 The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state. Then, in the second and subsequent updates, the update processing unit 124 sets a predetermined number T of second states S k The respective indexes and the first state S j The index is decremented by 1. Then, the update processing unit 124 determines the second state S of a predetermined number T after the decrement. k The respective values ​​and the first state S j The second state is updated by setting the exclusive OR of the values ​​of the second state as the respective values ​​of the second state.

[0261] In the update process for the example in Figure 25, when the predetermined number T is set to 4, the update processing unit 124 performs the first update in the first state S j State S 23 And four predetermined second states S k The following four states S k Let's assume that. State S3, S9, S 14 ,S 22

[0262] Then, the update processing unit 124 processes the first state S j The value of and four predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=4, in the first update, the update processing unit 124 calculates S3 = S3XOR S 23 The calculation is performed and the value of state S3 is updated. Similarly, in the first update, the update processing unit 124 calculates S9 = S9XOR S 23 The calculation is performed and the value of state S9 is updated. Similarly, in the first update, the update processing unit 124 performs S 14 =S 14 XOR S 23 Perform the calculation and state S 14 The value of is updated. Similarly, in the first update, the update processing unit 124 updates S22 =S 22 XOR S 23 Perform the calculation and state S 22 Update the value.

[0263] Furthermore, in the second update, the update processing unit 124 performs an exclusive OR operation on states S3, S9, S, which were the targets of the exclusive OR operation in the first update. 14 ,S 22 and state S 23 The index of the index is decremented by one. Then, in the second update, the update processing unit 124 calculates S2 = S2XOR S 23 The calculation is performed and the value of state S2 is updated. Similarly, in the second update, the update processing unit 124 calculates S8 = S8XOR S 23 The calculation is performed and the value of state S8 is updated. Similarly, in the second update, the update processing unit 124 performs S 13 =S 13 XOR S 23 Perform the calculation and state S 13 The value of is updated. Similarly, in the second update, the update processing unit 124 updates S 21 =S 21 XOR S 23 Perform the calculation and state S 21 The value is updated. Similarly, in the third and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation on the decremented states, and updates the values ​​of the four second states S. This is also the case for other predetermined numbers T.

[0264] In the update process for the example in Figure 25, when the predetermined number T is set to 5, the update processing unit 124 performs the first update in the first state S j State S 23 And five predetermined second states S k The following five states S k Let's assume that. State S2, S5, S8, S 13 ,S 22

[0265] Then, the update processing unit 124 processes the first state S j The value of and five predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=5, in the first update, the update processing unit 124 calculates S2=S2XOR S 23 The calculation is performed and the value of state S2 is updated. Similarly, in the first update, the update processing unit 124 calculates S5 = S5XOR S 23 The calculation is performed and the value of state S5 is updated. Similarly, in the first update, the update processing unit 124 calculates S8 = S8XOR S 23 The calculation is performed and the value of state S8 is updated. Similarly, in the first update, the update processing unit 124 performs S 13 =S 13 XOR S 23 Perform the calculation and state S 13 The value of is updated. Similarly, in the first update, the update processing unit 124 updates S 22 =S 22 XOR S 23 Perform the calculation and state S 22 The value is updated. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the five second states S.

[0266] In the update process for the example in Figure 25, when the predetermined number T is set to 6, the update processing unit 124 performs the first update in the first state S j State S 23 And six predetermined second states S k The following six states S k It shall be one of the following: States S1, S3, S6, S9, S 13 ,S 22 State S2, S5, S6, S9, S 13 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 22 State S1, S3, S8, S 11 ,S 14 ,S 22 State S2, S5, S9, S 12 ,S 14 ,S 22 State S2, S5, S8, S 13 ,S 14 ,S 22 State S2, S5, S6, S9, S 15 ,S 22 State S2, S5, S8, S 12 ,S 15 ,S 22 State S2, S5, S9, S 12 ,S 15 ,S 22 State S2, S5, S7, S 13 ,S 15 ,S 22 State S1, S5, S8, S 13 ,S 15 ,S 22 State S2, S5, S8, S 13 ,S 15 ,S 22 State S2, S5, S9, S 14 ,S 15 ,S 22 State S2, S5, S6, S 13 ,S 16 ,S 22 State S2, S6, S9, S 13 ,S 16 ,S 22 State S2, S5, S9, S 14 ,S 16 ,S22 State S3, S6, S9, S 14 ,S 16 ,S 22 State S2, S5, S8, S 13 ,S 17 ,S 22 State S2, S5, S8, S 14 ,S 17 ,S 22 State S2, S6, S9, S 14 ,S 17 ,S 22 State S3, S9, S 12 ,S 14 ,S 17 ,S 22 State S2, S5, S9, S 13 ,S 18 ,S 22 State S1, S6, S9, S 13 ,S 18 ,S 22 State S2, S5, S9, S 14 ,S 18 ,S 22 State S1, S8, S 11 ,S 14 ,S 18 ,S 22 State S2, S5, S7, S 15 ,S 18 ,S 22 State S2, S5, S9, S 15 ,S 18 ,S 22 State S2, S6, S9, S 15 ,S 18 ,S 22 State S2, S8, S 11 ,S 15 ,S 18 ,S 22 State S2, S9, S 14 ,S17 ,S 18 ,S 22 State S3, S9, S 14 ,S 17 ,S 18 ,S 22 State S2, S6, S8, S 13 ,S 19 ,S 22 State S2, S5, S9, S 13 ,S 19 ,S 22 State S3, S6, S9, S 13 ,S 19 ,S 22 State S1, S8, S 11 ,S 13 ,S 19 ,S 22 State S2, S8, S 11 ,S 13 ,S 19 ,S 22 State S1, S3, S8, S 14 ,S 19 ,S 22 State S1, S5, S8, S 14 ,S 19 ,S 22 State S2, S5, S8, S 14 ,S 19 ,S 22 State S3, S6, S8, S 14 ,S 19 ,S 22 State S2, S5, S9, S 14 ,S 19 ,S 22 State S3, S6, S9, S 15 ,S 19 ,S 22 State S2, S8, S 11 ,S 15 ,S 19 ,S 22 State S3, S8, S 11 ,S 15 ,S 19 ,S 22 State S3, S7, S 13 ,S 15 ,S 19 ,S 22 State S2, S6, S9, S 16 ,S 19 ,S 22 State S2, S8, S 11 ,S 16 ,S 19 ,S 22 State S3, S7, S 13 ,S 16 ,S 19 ,S 22 State S2, S8, S 14 ,S 16 ,S 19 ,S 22 State S1, S7, S 14 ,S 17 ,S 19 ,S 22 State S1, S8, S 14 ,S 17 ,S 19 ,S 22 State S2, S8, S 14 ,S 17 ,S 19 ,S 22 State S3, S8, S 14 ,S 17 ,S 19 ,S 22 State S2, S5, S7, S 13 ,S 20 ,S 22 State S2, S5, S8, S 13 ,S 20 ,S 22 State S2, S5, S9, S 13 ,S 20,S 22 State S1, S6, S9, S 13 ,S 20 ,S 22 State S3, S6, S9, S 13 ,S 20 ,S 22 State S2, S7, S9, S 13 ,S 20 ,S 22 State S2, S8, S 11 ,S 14 ,S 20 ,S 22 State S2, S9, S 12 ,S 14 ,S 20 ,S 22 State S3, S9, S 12 ,S 14 ,S 20 ,S 22 State S2, S7, S9, S 15 ,S 20 ,S 22 State S3, S7, S9, S 15 ,S 20 ,S 22 State S3, S7, S9, S 16 ,S 20 ,S 22 State S2, S7, S 11 ,S 16 ,S 20 ,S 22 State S3, S6, S 14 ,S 17 ,S 20 ,S 22 State S3, S7, S 14 ,S 17 ,S 20 ,S 22 State S2, S7, S 13 ,S 18 ,S 20 ,S22

[0267] Then, the update processing unit 124 processes the first state S j The value of and six predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=6, the second state in the first update is states S1, S3, S6, S9, S 13 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S1 = S1XOR S 23 The calculation is performed and the value of state S1 is updated. The update processing unit 124 updates states S3, S6, S9, S 13 ,S 22 Similarly, the exclusive OR is calculated for states S3, S6, S9, S 13 ,S 22 The value is updated. In subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the six second states S.

[0268] In the update process for the example in Figure 25, when the predetermined number T is set to 7, the update processing unit 124 performs the first update in the first state S j State S 23 The seven predetermined second states S k The following seven states S k It shall be one of the following: State S2, S5, S8, S9, S 13 ,S 18 ,S 22 State S1, S6, S9, S 13 ,S 16 ,S 19 ,S 22 State S2, S6, S9, S 13 ,S 16 ,S20 ,S 22

[0269] Then, the update processing unit 124 processes the first state S j The value of and seven predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=7, the second state in the first update will be states S2, S5, S8, S9, S 13 ,S 18 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S2 = S2XOR S 23 The calculation is performed and the value of state S2 is updated. The update processing unit 124 updates states S5, S8, S9, S 13 ,S 18 ,S 22 Similarly, the exclusive OR is calculated for states S5, S8, S9, S 13 ,S 18 ,S 22 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the seven second states S.

[0270] In the update process for the example in Figure 25, when the predetermined number T is set to 8, the update processing unit 124 performs the first update in the first state S j State S 23 And eight predetermined second states S k The following eight states S k It shall be one of the following: State S2, S3, S5, S6, S9, S 13 ,S 15 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 14 ,S15 ,S 22 State S2, S5, S6, S9, S 12 ,S 13 ,S 16 ,S 22 State S0, S2, S5, S6, S9, S 13 ,S 17 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 14 ,S 17 ,S 22 State S2, S3, S5, S6, S7, S 13 ,S 18 ,S 22 State S2, S3, S5, S8, S 11 ,S 13 ,S 18 ,S 22 State S1, S3, S6, S8, S 11 ,S 13 ,S 18 ,S 22 State S2, S3, S6, S8, S 11 ,S 13 ,S 18 ,S 22 State S2, S5, S6, S8, S 11 ,S 13 ,S 18 ,S 22 State S2, S5, S6, S9, S 12 ,S 13 ,S 18 ,S 22 State S1, S3, S6, S8, S 11 ,S 14 ,S 18 ,S 22 State S2, S3, S5, S7, S 12 ,S 14 ,S 18 ,S 22 State S1, S6, S8, S 11 ,S 13 ,S 14 ,S 18 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 14 ,S 18 ,S 22 State S2, S5, S9, S 12 ,S 13 ,S 14 ,S 18 ,S 22 State S1, S3, S6, S8, S 11 ,S 15 ,S 18 ,S 22 State S2, S5, S7, S9, S 13 ,S 15 ,S 18 ,S 22 State S2, S5, S8, S9, S 13 ,S 15 ,S 18 ,S 22 State S2, S5, S8, S 11 ,S 13 ,S 15 ,S 18 ,S 22 State S3, S6, S8, S 11 ,S 13 ,S 15 ,S 18 ,S 22 State S2, S5, S9, S 12 ,S 13 ,S 15 ,S 18 ,S 22 State S2, S5, S8, S 13 ,S 14 ,S 15 ,S 18 ,S 22 State S2, S5, S9, S 13 ,S14 ,S 15 ,S 18 ,S 22 State S3, S5, S9, S 13 ,S 14 ,S 15 ,S 18 ,S 22 State S3, S6, S8, S 12 ,S 14 ,S 17 ,S 18 ,S 22 State S2, S3, S5, S7, S8, S 13 ,S 19 ,S 22 State S2, S3, S5, S8, S 11 ,S 13 ,S 19 ,S 22 State S1, S2, S6, S8, S 11 ,S 13 ,S 19 ,S 22 State S0, S3, S6, S8, S 11 ,S 13 ,S 19 ,S 22 State S2, S3, S6, S8, S 11 ,S 13 ,S 19 ,S 22 State S3, S5, S6, S8, S 11 ,S 13 ,S 19 ,S 22 States S1, S3, S6, S9, S 12 ,S 13 ,S 19 ,S 22 State S0, S3, S6, S8, S 11 ,S 14 ,S 19 ,S 22 State S2, S5, S9, S 12 ,S 13,S 14 ,S 19 ,S 22 State S1, S3, S6, S8, S 11 ,S 15 ,S 19 ,S 22 State S2, S3, S6, S8, S 11 ,S 15 ,S 19 ,S 22 State S3, S5, S6, S8, S 11 ,S 15 ,S 19 ,S 22 State S2, S3, S6, S8, S 13 ,S 15 ,S 19 ,S 22 State S2, S5, S6, S8, S 13 ,S 15 ,S 19 ,S 22 State S2, S5, S7, S8, S 13 ,S 15 ,S 19 ,S 22 State S3, S5, S6, S9, S 13 ,S 15 ,S 19 ,S 22 State S2, S5, S7, S9, S 13 ,S 15 ,S 19 ,S 22 State S1, S3, S8, S 11 ,S 13 ,S 15 ,S 19 ,S 22 State S3, S5, S8, S 11 ,S 13 ,S 15 ,S 19 ,S 22 State S1, S6, S8, S 11 ,S13 ,S 15 ,S 19 ,S 22 State S2, S5, S7, S 12 ,S 13 ,S 15 ,S 19 ,S 22 State S2, S5, S8, S 12 ,S 14 ,S 15 ,S 19 ,S 22 State S2, S5, S6, S8, S 13 ,S 16 ,S 19 ,S 22 States S1, S3, S6, S9, S 13 ,S 16 ,S 19 ,S 22 State S1, S2, S8, S 11 ,S 13 ,S 16 ,S 19 ,S 22 State S2, S6, S8, S 11 ,S 13 ,S 16 ,S 19 ,S 22 State S3, S6, S8, S 11 ,S 13 ,S 16 ,S 19 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 16 ,S 19 ,S 22 State S1, S3, S6, S8, S 14 ,S 16 ,S 19 ,S 22 State S2, S3, S6, S8, S 14 ,S 16 ,S 19 ,S22 State S0, S2, S5, S9, S 14 ,S 16 ,S 19 ,S 22 States S1, S3, S6, S9, S 14 ,S 16 ,S 19 ,S 22 State S3, S5, S6, S9, S 14 ,S 16 ,S 19 ,S 22 States S0, S3, S7, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S1, S2, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S1, S3, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S2, S3, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S2, S5, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S1, S6, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S2, S6, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S1, S7, S8, S 11 ,S 14 ,S 16 ,S 19 ,S 22 State S2, S3, S7, S 12 ,S 14 ,S 16 ,S 19 ,S 22 State S2, S5, S8, S 12 ,S 14 ,S 16 ,S 19 ,S 22 State S1, S8, S 11 ,S 13 ,S 14 ,S 16 ,S 19 ,S 22 State S3, S5, S8, S 11 ,S 15 ,S 16 ,S 19 ,S 22 State S2, S6, S8, S 11 ,S 15 ,S 16 ,S 19 ,S 22 State S2, S3, S5, S7, S 13 ,S 17 ,S 19 ,S 22 State S2, S5, S7, S8, S 13 ,S 17 ,S 19 ,S 22 State S3, S5, S6, S9, S 13 ,S 17 ,S 19 ,S 22 State S2, S5, S8, S9, S 13 ,S 17 ,S 19 ,S 22 State S3, S6, S9, S 12 ,S14 ,S 17 ,S 19 ,S 22 States S2, S3, S6, S9, S 13 ,S 18 ,S 19 ,S 22 State S2, S6, S8, S 11 ,S 13 ,S 18 ,S 19 ,S 22 State S2, S5, S9, S 12 ,S 14 ,S 18 ,S 19 ,S 22 State S2, S3, S5, S6, S9, S 13 ,S 20 ,S 22 State S2, S3, S5, S8, S 11 ,S 13 ,S 20 ,S 22 State S2, S3, S6, S8, S 11 ,S 13 ,S 20 ,S 22 States S2, S3, S6, S9, S 11 ,S 13 ,S 20 ,S 22 State S0, S3, S6, S9, S 12 ,S 13 ,S 20 ,S 22 States S1, S3, S6, S9, S 12 ,S 13 ,S 20 ,S 22 State S1, S3, S6, S8, S 11 ,S 14 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 13,S 14 ,S 20 ,S 22 State S3, S5, S6, S9, S 12 ,S 15 ,S 20 ,S 22 State S2, S5, S7, S9, S 12 ,S 15 ,S 20 ,S 22 State S1, S3, S6, S8, S 13 ,S 15 ,S 20 ,S 22 State S2, S5, S6, S8, S 13 ,S 15 ,S 20 ,S 22 State S2, S5, S7, S8, S 13 ,S 15 ,S 20 ,S 22 State S0, S2, S5, S9, S 13 ,S 15 ,S 20 ,S 22 States S1, S2, S5, S9, S 13 ,S 15 ,S 20 ,S 22 States S2, S3, S6, S9, S 13 ,S 15 ,S 20 ,S 22 State S2, S5, S6, S9, S 13 ,S 15 ,S 20 ,S 22 State S3, S5, S6, S9, S 13 ,S 15 ,S 20 ,S 22 States S0, S3, S7, S9, S 13 ,S 15 ,S 20 ,S22 States S1, S3, S7, S9, S 13 ,S 15 ,S 20 ,S 22 State S2, S5, S8, S9, S 13 ,S 15 ,S 20 ,S 22 State S2, S5, S8, S 11 ,S 13 ,S 15 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 13 ,S 15 ,S 20 ,S 22 State S3, S7, S9, S 12 ,S 13 ,S 15 ,S 20 ,S 22 State S2, S3, S6, S8, S 14 ,S 15 ,S 20 ,S 22 State S2, S5, S6, S8, S 14 ,S 15 ,S 20 ,S 22 States S1, S3, S6, S9, S 14 ,S 15 ,S 20 ,S 22 State S3, S5, S6, S9, S 14 ,S 15 ,S 20 ,S 22 State S2, S5, S8, S9, S 14 ,S 15 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 14 ,S 15 ,S20 ,S 22 State S3, S6, S9, S 13 ,S 14 ,S 15 ,S 20 ,S 22 States S1, S3, S6, S9, S 12 ,S 16 ,S 20 ,S 22 State S2, S5, S8, S9, S 12 ,S 16 ,S 20 ,S 22 State S0, S1, S6, S9, S 13 ,S 16 ,S 20 ,S 22 State S0, S3, S6, S9, S 13 ,S 16 ,S 20 ,S 22 States S1, S3, S6, S9, S 13 ,S 16 ,S 20 ,S 22 State S2, S5, S6, S9, S 13 ,S 16 ,S 20 ,S 22 State S3, S5, S6, S9, S 13 ,S 16 ,S 20 ,S 22 States S1, S5, S7, S9, S 13 ,S 16 ,S 20 ,S 22 State S2, S5, S7, S9, S 13 ,S 16 ,S 20 ,S 22 State S2, S5, S8, S9, S 13 ,S 16 ,S 20 ,S22 State S1, S6, S8, S 11 ,S 13 ,S 16 ,S 20 ,S 22 State S1, S6, S9, S 11 ,S 13 ,S 16 ,S 20 ,S 22 State S2, S6, S9, S 11 ,S 13 ,S 16 ,S 20 ,S 22 State S1, S6, S9, S 12 ,S 13 ,S 16 ,S 20 ,S 22 States S1, S3, S6, S9, S 14 ,S 16 ,S 20 ,S 22 States S2, S3, S6, S9, S 14 ,S 16 ,S 20 ,S 22 State S3, S5, S6, S9, S 14 ,S 16 ,S 20 ,S 22 States S1, S3, S7, S9, S 14 ,S 16 ,S 20 ,S 22 State S2, S3, S7, S9, S 14 ,S 16 ,S 20 ,S 22 States S1, S3, S8, S9, S 14 ,S 16 ,S 20 ,S 22 State S3, S5, S8, S9, S 14 ,S 16 ,S20 ,S 22 State S1, S3, S8, S 11 ,S 14 ,S 16 ,S 20 ,S 22 State S2, S3, S8, S 11 ,S 14 ,S 16 ,S 20 ,S 22 State S2, S5, S8, S 11 ,S 14 ,S 16 ,S 20 ,S 22 State S1, S7, S8, S 11 ,S 14 ,S 16 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 14 ,S 16 ,S 20 ,S 22 State S2, S5, S8, S 12 ,S 15 ,S 16 ,S 20 ,S 22 State S2, S5, S9, S 12 ,S 15 ,S 16 ,S 20 ,S 22 State S1, S6, S9, S 13 ,S 15 ,S 16 ,S 20 ,S 22 State S2, S5, S7, S8, S 13 ,S 17 ,S 20 ,S 22 States S1, S3, S6, S9, S 13 ,S 17 ,S 20 ,S 22 States S2, S3, S6, S9, S 13 ,S 17 ,S 20 ,S 22 State S3, S6, S9, S 11 ,S 13 ,S 17 ,S 20 ,S 22 State S2, S5, S8, S 12 ,S 13 ,S 17 ,S 20 ,S 22 State S2, S5, S7, S 12 ,S 14 ,S 17 ,S 20 ,S 22 State S2, S5, S8, S 12 ,S 14 ,S 17 ,S 20 ,S 22 State S3, S6, S8, S 12 ,S 14 ,S 17 ,S 20 ,S 22 State S0, S3, S9, S 12 ,S 14 ,S 17 ,S 20 ,S 22 States S1, S3, S9, S 12 ,S 14 ,S 17 ,S 20 ,S 22 State S2, S5, S8, S 13 ,S 14 ,S 17 ,S 20 ,S 22 State S2, S5, S7, S 12 ,S 15 ,S 17 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 15 ,S 17 ,S 20 ,S 22 State S3, S7, S9, S 13 ,S 15 ,S 17 ,S 20 ,S 22 State S3, S8, S 11 ,S 14 ,S 15 ,S 17 ,S 20 ,S 22 State S0, S2, S5, S9, S 13 ,S 18 ,S 20 ,S 22 State S0, S3, S6, S9, S 13 ,S 18 ,S 20 ,S 22 States S2, S3, S6, S9, S 13 ,S 18 ,S 20 ,S 22 State S2, S5, S7, S9, S 13 ,S 18 ,S 20 ,S 22 State S2, S6, S8, S 11 ,S 13 ,S 18 ,S 20 ,S 22 State S3, S6, S9, S 12 ,S 13 ,S 18 ,S 20 ,S 22 State S2, S5, S7, S 12 ,S 14 ,S 18 ,S 20 ,S 22 State S1, S6, S9, S 13 ,S15 ,S 18 ,S 20 ,S 22 State S2, S6, S9, S 13 ,S 15 ,S 18 ,S 20 ,S 22 State S3, S6, S9, S 13 ,S 15 ,S 18 ,S 20 ,S 22 State S1, S7, S9, S 13 ,S 15 ,S 18 ,S 20 ,S 22 State S3, S6, S9, S 14 ,S 15 ,S 18 ,S 20 ,S 22 State S2, S5, S7, S 13 ,S 16 ,S 18 ,S 20 ,S 22 State S3, S8, S 11 ,S 14 ,S 16 ,S 18 ,S 20 ,S 22 State S1, S6, S9, S 13 ,S 17 ,S 18 ,S 20 ,S 22 State S3, S6, S9, S 13 ,S 17 ,S 18 ,S 20 ,S 22 State S3, S7, S 12 ,S 14 ,S 17 ,S 18 ,S 20 ,S 22 State S2, S3, S6, S8, S 13 ,S 15 ,S 21 ,S 22 State S3, S6, S8, S 11 ,S 13 ,S 15 ,S 21 ,S 22 State S3, S6, S8, S 12 ,S 15 ,S 19 ,S 21 ,S 22 State S3, S6, S8, S 14 ,S 15 ,S 19 ,S 21 ,S 22 State S2, S5, S9, S 12 ,S 14 ,S 18 ,S 20 ,S 22 State S3, S6, S9, S 13 ,S 14 ,S 18 ,S 20 ,S 22 States S2, S3, S6, S9, S 15 ,S 18 ,S 20 ,S 22 State S2, S6, S8, S 11 ,S 15 ,S 18 ,S 20 ,S 22 State S2, S5, S7, S 13 ,S 15 ,S 18 ,S 20 ,S 22 State S2, S5, S9, S 13 ,S 15 ,S 18 ,S 20 ,S 22

[0271] Then, the update processing unit 124 processes the first state S j The value of and eight predetermined second states S k The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. For example, if a predetermined number T=8, the second state in the first update will be states S2, S3, S5, S6, S9, S 13 ,S 15 ,S 22 Let's assume that this is selected. In this case, during the first update, the update processing unit 124 calculates S2 = S2XOR S 23 The calculation is performed and the value of state S2 is updated. The update processing unit 124 updates states S3, S5, S6, S9, S 13 ,S 15 ,S 22 Similarly, the exclusive OR is calculated for states S3, S5, S6, S9, S 13 ,S 15 ,S 22 The value is updated. In the second and subsequent updates, the update processing unit 124 decrements the index of each state S that was subject to the exclusive OR operation in the previous update by one, calculates the exclusive OR operation for the decremented states, and updates the values ​​of the eight second states S.

[0272] <Decryption device> Figure 26 is a diagram illustrating the configuration of an information processing device 200 (decryption device) according to this disclosure. As shown in Figure 26, the information processing device 200 includes a data receiving unit 202, a data splitting unit 204, a master key acquisition unit 206, a data stirring unit 210, a key scheduling unit 220, and an output unit 230. The key scheduling unit 220 also includes an initial setting unit 222 and an update processing unit 224.

[0273] The information processing device 200 can be implemented by a computing device such as a computer. In other words, the information processing device 200 has an arithmetic unit such as a CPU (Central Processing Unit) and a storage device such as memory or a disk. The information processing device 200 implements each of the above components by, for example, having the arithmetic unit execute a program stored in the storage device. This is also true in other embodiments described later.

[0274] The data reception unit 202 functions as a data reception means. The data division unit 204 functions as a data division means (division means). The master key acquisition unit 206 functions as a master key acquisition means. The data stirring unit 210 functions as a data stirring means. The key scheduling unit 220 functions as a key scheduling means. The initial setting unit 222 functions as an initial setting means. The update processing unit 224 functions as an update processing means. The output unit 230 functions as an output means.

[0275] The data receiving unit 202 receives input data. Specifically, the data receiving unit 202 receives ciphertext to be decrypted as input data. The data receiving unit 202 receives input ciphertext output from the information processing device 100 (encryption device). The data receiving unit 202 may be implemented by an input device such as a keyboard. The data receiving unit 202 may also receive input ciphertext from an external device connected via a network, for example. The data receiving unit 202 outputs the ciphertext, which is the input data, to the data splitting unit 204.

[0276] The data partitioning unit 204 partitions the ciphertext input data in substantially the same way that the data partitioning unit 104 partitions the plaintext. The data partitioning unit 204 partitions the input data into N bits to generate multiple N-bit input data blocks. In other words, the data partitioning unit 204 partitions the ciphertext input data into N bits to generate multiple N-bit ciphertext blocks. The data partitioning unit 204 outputs the ciphertext blocks, which are the input data blocks, to the data stirring unit 210.

[0277] The master key acquisition unit 206 acquires (receives) the master key MK from the master key supply device 2. Here, the master key acquisition unit 206 acquires the same master key MK as the master key acquisition unit 206 acquired as described above. The master key acquisition unit 206 outputs the acquired master key MK to the key scheduling unit 220.

[0278] The data stirring unit 210 corresponds to the data stirring unit 76 shown in Figure 1. The data stirring unit 210 processes ciphertext blocks in a manner corresponding to the method used by the data stirring unit 110 to process plaintext blocks and generate ciphertext blocks. Similar to the data stirring unit 110, the data stirring unit 210 performs stirring by stirring each of the multiple N-bit input data blocks using the round function F shown in Figure 5, and outputting an N-bit output data block. Specifically, the data stirring unit 210 stirs the input data blocks by repeatedly using the round function F, using it A times per round, over multiple rounds. In other words, the data stirring unit 210 decrypts the ciphertext blocks by repeatedly using the round function F, using it A times per round, over multiple rounds. As a result, the data stirring unit 210 generates plaintext blocks, which are output data blocks. The data stirring unit 210 outputs the plaintext blocks, which are output data blocks, to the output unit 230.

[0279] More specifically, similar to the data stirring unit 110, the data stirring unit 210 performs stirring using a Feistel structure, for example, as illustrated in Figure 2 or Figure 3. When the data stirring unit 110 performs stirring using the Feistel structure illustrated in Figure 2, the data stirring unit 210 also performs stirring (decoding) using the Feistel structure illustrated in Figure 2. In this case, the value of A is 1. Also, when the data stirring unit 110 performs stirring using the generalized Feistel structure illustrated in Figure 3, the data stirring unit 210 also performs stirring (decoding) using the generalized Feistel structure illustrated in Figure 3. In this case, the value of A is 2.

[0280] Furthermore, the data stirring unit 210 performs stirring using the round key RK generated by the key scheduling process executed by the key scheduling unit 220, which will be described later. Similar to the processing of the data stirring unit 76 described above, the data stirring unit 210 performs stirring by repeatedly using the round function F, into which a different round key RK is input for each round, from the final round (round m) to the first round. In other words, the data stirring unit 210 performs stirring by tracing back the Feistel structure used by the data stirring unit 110 from the final round (round m) to the first round.

[0281] The key scheduling unit 220 corresponds to the key scheduling unit 72 shown in Figure 1. The key scheduling unit 220 performs substantially the same processing as the key scheduling unit 120. That is, the key scheduling unit 220 performs key scheduling processing to generate the round key RK to be input to the round function F, using a pre-generated master key MK, in parallel with the stirring process performed by repeatedly using the round function F. Here, as described above, in the stirring process on the decryption side, the stirring process is performed by going back from the final round, the m-th round, to the 1st round. Therefore, the key scheduling unit 220 outputs the round keys RK from the m-th round to the 1st round to the data stirring unit 210 in reverse order. Before the stirring process, the key scheduling unit 220 uses the same key scheduling function used by the key scheduling unit 120 to perform update processing all at once up to the final round, the m-th round, to generate the round key RK corresponding to the final round. Furthermore, the key scheduling unit 220 uses the round key RK corresponding to the final round and the inverse function of the key scheduling function described above to generate round keys RK from the mth round to the 1st round in reverse. More details will be described later.

[0282] The initial setup unit 222 performs substantially the same processing as the initial setup unit 122 described above. That is, the initial setup unit 222 performs initial setup by setting one of the M master key parts that constitute the master key MK to each of the multiple states S, each of which is n bits. Here, the number of states S processed by the initial setup unit 222 is the same as the number of states S processed by the initial setup unit 122. The initial setup unit 222 then performs the same initial setup as the initial setup performed by the initial setup unit 122. That is, the initial setup unit 222 sets one of the M master key parts that constitute the master key MK to each of the multiple states S, just as the initial setup unit 122 sets M master key parts to the multiple states S. Therefore, the initial setup unit 222 performs initial setup to satisfy the initial setup conditions described above. The specific operation of the initial setup unit 222 is substantially the same as the operation of the initial setup unit 122, so a detailed explanation of the initial setup unit 222 is omitted.

[0283] The key scheduling unit 220 generates multiple master key portions set according to the initial setup conditions described above for each of the multiple states S, as round keys RK for R rounds. Unlike the key scheduling unit 120, the key scheduling unit 220 does not output the generated round keys RK to the data stirring unit 210 at this stage. As described above, the key scheduling unit 220 generates round keys RK up to the final round through the update processing performed by the update processing unit 224, which will be described later. Then, in parallel with the stirring process in the data stirring unit 210, the key scheduling unit 220 outputs the round keys RK to the data stirring unit 210, working backward from the round key RK of the final round to the round key RK of the first round. As a result, the data stirring unit 210 performs the stirring process using the round keys RK.

[0284] The update processing unit 224 performs substantially the same processing as the update processing unit 124 described above before the data stirring process (decoding process) of the data stirring unit 210. As a result, the update processing unit 224 generates round keys RK up to the final round. Furthermore, in parallel with the stirring process, the update processing unit 224 generates round keys RK by working backward from the round key RK of the final round to the round key RK of the first round. Then, the update processing unit 224 outputs the round keys RK that should be input to the round function F for the rounds executed in the stirring process to the data stirring unit 210.

[0285] Specifically, the update processing unit 224 updates the round key by updating the value of state S using an update process that is substantially the same as the update processing performed by the update processing unit 124. The update processing unit 224 also performs update processing using update conditions that are substantially the same as those used by the update processing unit 124. For convenience, this update processing, which is substantially the same as the update processing performed by the update processing unit 124, will be referred to as the "first update processing." In other words, in the first update processing, the update processing unit 224 updates the value of state S from the first round to the final round, round m.

[0286] Unlike the update processing unit 124, the update processing unit 224 does not output the round key RK set in state S to the data stirring unit 210 each time the value of state S is updated during the first update process. Before the stirring process (decoding process), the update processing unit 224 updates the value of state S from the 1st round to the mth round all at once during the first update process. Here, each time the value of state S is updated, a value indicating the round key RK of each round is set in state S. However, during the first update process, the update processing unit 224 does not output the values ​​corresponding to the round key RK of intermediate rounds to the data stirring unit 210, and continues updating state S until the final round. As a result, when the first update process is completed, multiple states S will have the round key RK values ​​corresponding to the final round set. Specifically, when the first update process is completed, multiple states S may have values ​​corresponding to the round key RK from the m-(R-1)th round to the mth round set. For example, if R=2, when the first update process is completed, multiple states S may be set to values ​​corresponding to the round key RK from round m-1 to round m.

[0287] As described above, in the first update process, the round key RK for each round is generated in the order from round 1 to round m. In the decryption process, the stirring process is performed in reverse order from round m to round 1. Therefore, the order of rounds in the decryption process is the reverse of the order of rounds in the first update process. If all the round keys RK for each round from round 1 to round m were stored in memory, it would consume memory resources equal to the data size of m round keys RK. Therefore, in order to suppress the consumption of memory resources, it is preferable not to keep all the round keys RK for each round from round 1 to round m in memory. Then, in the second update process described later, the update processing unit 224 outputs the round keys RK from round m to round 1 to the data stirring unit 210 in reverse order using "on-the-fly".

[0288] Once the first update process is complete, the update processing unit 224 performs a second update process, updating the value of state S by going back from round m to round 1. Specifically, in the second update process, the update processing unit 224 updates the value of state S by performing the reverse process of the first update process. The update processing unit 224 then outputs the value of state S corresponding to the round key RK of each round to the data stirring unit 210, in the order from round m to round 1. This allows the update processing unit 224 to output the round key RK of each round to the data stirring unit 210 in accordance with the order in which the rounds progress in the data stirring unit 210.

[0289] More specifically, in the second update process, the update processing unit 224 calculates the exclusive OR of the pairs of the first state, which was subjected to exclusive OR in the first update process, and a predetermined number T of second states, from the mth round to the 1st round. Then, the update processing unit 224 updates the second state by setting the calculated value as the value of the second state. Here, assume that in the first update process, the round key RK from the m-(R-1)th round to the mth round was generated by the Bth update of state S. Note that m = R*(B+1). In the first update, the update processing unit 224 calculates the exclusive OR of the first state S that was subjected to exclusive OR in the Bth update of the first update process. j and a predetermined number T of second states S k The exclusive OR of the two is calculated. Then, the update processing unit 224 assigns the calculated values ​​of a predetermined number T to the second state S of a predetermined number T. k By setting this value, the second state is updated. This updated second state S k The value of is the second state S immediately before the Bth update in the first update process. k It matches the value of [this value].

[0290] Then, the update processing unit 224 performs an exclusive OR operation on the state S iThe index i is incremented by the same number of decrements as in the first update operation. In the example above, the update processing unit 224 performs an exclusive OR operation on the first state S j and a predetermined number T of second states S k The index is incremented by 1. At this point, the first state S after incrementing is j and a predetermined number T of second states S k This refers to the first state S that was subjected to the exclusive OR operation in the B-1th update in the first update process. j and a predetermined number T of second states S k This matches. Then, the update processing unit 224 determines the first state S after incrementing. j and a predetermined number T of second states S k The exclusive OR is calculated for each of the following. Then, the update processing unit 224 assigns the calculated values ​​of a predetermined number T to the second state S of the predetermined number T. k The second state is updated by setting the value to . Thereafter, the update processing unit 224 updates the value of state S by repeating the same process up to the first round. This update of the value of state S in the second update process corresponds to reproducing the update of the value of state S in the first update process by going back from the mth round to the first round. Then, in the second update process, the first state S is set in multiple states S j The position and the second state S k The position of will slide one position to the left as the update process progresses. i The index i is the final state S (S in the example above). 11 or S 23 If the index has been incremented up to 0, then in the next increment, index i will return to 0.

[0291] The second update process will be explained using Figure 22. For the sake of explanation, we will assume that the final round key RK was generated in the sixth update of the first update process. The second update process corresponds to changing the direction of the downward arrow in Figure 22 to an upward arrow.

[0292] At this time, in the first update process of the second update process, the first state becomes state S6. Also, the second state becomes state S 11 And state S5. And state S6 and state S 11 The exclusive OR of is calculated. The result of this exclusive OR is "3^0^1^0^1", which is "3", so state S 11 The value of is updated to "3". Also, the exclusive OR of state S6 and state S5 is calculated. The result of this exclusive OR is "0^0^1", which is "1", so the value of state S5 is updated to "1". The value of state S at this time corresponds to the value of state S after the 5th update in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0293] Furthermore, in the second update process of the second update process, each state S that is subject to exclusive OR is processed. i The index i is incremented by one from the index i of the first update in the second update process. Therefore, in the second update in the second update process, the first state becomes state S7. The second state becomes state S0 and state S6.

[0294] Therefore, in the second update process of the second update process, the exclusive OR of state S7 and state S0 is calculated. The result of this exclusive OR is "2^1^1", or "2", so the value of state S0 is updated to "2". Also, the exclusive OR of state S7 and state S6 is calculated. The result of this exclusive OR is "0^1^1", or "0", so the value of state S6 is updated to "0". The value of state S at this time corresponds to the value of state S after the fourth update in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0295] Furthermore, in the third update process of the second update process, each state S that is subject to exclusive OR is processed. i The index i is incremented by one from the index i of the second update process in the second update process. Therefore, in the third update process in the second update process, the first state becomes state S8. The second state becomes state S1 and state S7.

[0296] Therefore, in the third update process of the second update process, the exclusive OR of state S8 and state S1 is calculated. The result of this exclusive OR is "3^1^3", or "1", so the value of state S2 is updated to "1". Also, the exclusive OR of state S8 and state S7 is calculated. The result of this exclusive OR is "1^1^3", or "3", so the value of state S7 is updated to "3". The value of state S at this time corresponds to the value of state S after the third update in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0297] Furthermore, in the fourth update process of the second update process, each state S that is subject to exclusive OR is processed. i The index i is incremented by one from the index i of the third update in the second update process. Therefore, in the fourth update in the second update process, the first state becomes state S9. The second state becomes state S2 and state S8.

[0298] Therefore, in the fourth update process of the second update process, the exclusive OR of state S9 and state S2 is calculated. The result of this exclusive OR is "0^1^2^3^1^2^3", which is "0", so the value of state S2 is updated to "0". Also, the exclusive OR of state S9 and state S8 is calculated. The result of this exclusive OR is "1^3^1^2^3", which is "2", so the value of state S8 is updated to "2". The value of state S at this time corresponds to the value of state S after the second update in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0299] Furthermore, in the fifth update operation of the second update process, each state S that is subject to exclusive OR is processed. i The index i is incremented by one from the index i of the fourth update in the second update process. Therefore, in the fifth update in the second update process, the first state becomes state S. 10 This is the result. Furthermore, the second state consists of state S3 and state S9.

[0300] Therefore, in the fifth update process in the second update process, state S 10 The exclusive OR of state S3 is calculated. The result of this exclusive OR is "2^2^3", which is "3", so the value of state S3 is updated to "3". Also, state S 10 The exclusive OR of state S and state S9 is calculated. The result of this exclusive OR is "1^2^3^2^3", which is "1", so the value of state S9 is updated to "1". The value of state S at this time corresponds to the value of state S after the first update in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0301] Furthermore, in the sixth update operation of the second update operation, each state S that is subject to exclusive OR is processed. iThe index i is incremented by one from the index i of the fifth update in the second update process. Therefore, in the sixth update in the second update process, the first state becomes state S. 11 This is the result. Also, the second state is state S4 and state S 10 This is the result.

[0302] Therefore, in the sixth update process in the second update process, state S 11 The exclusive OR of state S4 is calculated. The result of this exclusive OR is "0^3^3", or "0", so the value of state S4 is updated to "0". Also, state S 11 and state S 10 The exclusive OR of is calculated. The result of this exclusive OR is "2^3^3", which is "2", so state S 10 The value of is updated to "2". Note that the value of state S at this time corresponds to the value of state S after the initial setting in the first update process. The update processing unit 224 then outputs the value of state S at this time to the data stirring unit 210.

[0303] The output unit 230 controls the output of output data consisting of multiple output data blocks output by the data stirring unit 210. The output unit 230 processes the plaintext consisting of multiple plaintext blocks to output as output data. The output unit 230 may also process the output of plaintext in which multiple plaintext blocks are concatenated. The output unit 230 may, for example, control the output device to display the plaintext on an output device such as a display. The output unit 230 may also control the output of plaintext to an external device connected via a network, for example.

[0304] <Information Processing Methods> Next, the operation of the information processing system 1 according to Embodiment 1 will be described using Figures 27 and 28. Figure 27 is a flowchart showing the information processing method executed by the information processing device 100 according to this disclosure. The information processing method shown in Figure 27 corresponds to the encryption method executed by the information processing device 100, which is an encryption device.

[0305] As described above, the data reception unit 102 receives the plaintext P to be encrypted as input data (step S100). As described above, the data division unit 104 divides the input plaintext data to generate multiple N-bit plaintext blocks (step S102). The processes S104 to S120 described later are performed for each of the multiple plaintext blocks.

[0306] As described above, the master key acquisition unit 106 acquires the master key MK from the master key providing device 2 (step S104). The key scheduling unit 120 generates the round key RK through initial settings (step S110). Specifically, as described above, the initial setting unit 122 of the key scheduling unit 120 performs initial settings by setting one of the M master key parts that make up the master key MK to each of the multiple states S, each corresponding to one of the round key parts. As a result, the value of the master key MK is set in multiple states S. In addition, as a result, the value of the round key RK to be used from the 1st round to the Rth round is set in the states S.

[0307] As described above, the data stirring unit 110 performs a stirring process, which is an encryption process, for each plaintext block, which is the input data block data (step S112). Specifically, the data stirring unit 110 uses the round key RK generated in the S110 process to perform a stirring process for the round corresponding to the round key RK. Also, as described above, the data stirring unit 110 performs the stirring process sequentially from the first round to the final round, the mth round.

[0308] The information processing device 100 determines whether the processing of the mth round, which is the final round in the stirring process, has been performed (step S114). In other words, the information processing device 100 determines whether r=m. The processing in S114 may be performed, for example, by the data stirring unit 110.

[0309] If the processing of the mth round, which is the final round, has not been performed (NO in S114), the key scheduling unit 120 generates a round key RK to be used in subsequent rounds through an update process (step S120). Specifically, the update processing unit 124 of the key scheduling unit 120 updates the values ​​of multiple states S, each corresponding to one of the round key parts, as described above. This generates the round key RK corresponding to the next round.

[0310] Then, for the next round, the data stirring unit 110 performs a stirring process, which is an encryption process, for each plaintext block that is the input data block data, as described above (S112). Specifically, the data stirring unit 110 uses the round key RK generated in the process of S120 to perform a stirring process for the round corresponding to the said round key RK.

[0311] On the other hand, if the processing of the mth round, which is the final round, is executed (YES in S114), the stirring process is considered to have finished up to the final round. Therefore, a ciphertext block is output from the data stirring unit 110. The output unit 130 then outputs ciphertext C as output data (step S130). Specifically, the output unit 130 outputs ciphertext C, which is a concatenation of the multiple ciphertext blocks output from the data stirring unit 110.

[0312] Figure 28 is a flowchart showing an information processing method performed by the information processing device 200 according to this disclosure. The information processing method shown in Figure 28 corresponds to a decoding method performed by the information processing device 200, which is a decoding device.

[0313] As described above, the data reception unit 202 receives the ciphertext C to be decrypted as input data (step S200). As described above, the data division unit 204 divides the input data, the ciphertext, to generate multiple N-bit ciphertext blocks (step S202). The processing S204 to S220, described later, is performed for each of the multiple ciphertext blocks.

[0314] As described above, the master key acquisition unit 206 acquires the master key MK from the master key providing device 2 (step S204). The key scheduling unit 220 generates the round key RK corresponding to the final round (step S210). Specifically, as described above, the initial setting unit 222 of the key scheduling unit 220 performs initial settings by setting one of the M master key parts that make up the master key MK to each of the multiple states S, each corresponding to one of the round key parts. Then, as described above, the update processing unit 224 of the key scheduling unit 220 updates the states S up to the final round by the first update process. This generates the round key RK for the final round. Specifically, the value of the round key RK used from round m-(R-1) to round m is set in state S.

[0315] As described above, the data stirring unit 210 performs a stirring process, which is a decryption process, for each of the ciphertext blocks that are input data block data (step S212). Specifically, the data stirring unit 210 performs the stirring process by working backward from the final round, round m, to round 1. The data stirring unit 210 also uses the round key RK generated in the process of S210 to perform a stirring process for the round corresponding to the said round key RK.

[0316] The information processing device 100 determines whether the first round of processing in the stirring process has been performed (step S214). In other words, the information processing device 100 determines whether r=1 or not. The processing in S214 may be performed, for example, by the data stirring unit 210.

[0317] If the processing of the first round has not been performed (NO in S214), the key scheduling unit 220 generates a round key RK through an update process (step S220). Specifically, the update processing unit 224 of the key scheduling unit 220 updates the values ​​of multiple states S, each corresponding to one of the round key parts, as described above. This generates a round key RK corresponding to the previous round.

[0318] Then, the data stirring unit 210 performs a stirring process, which is a decryption process, for each of the ciphertext blocks that are input data block data for the previous round, as described above (S212). Specifically, the data stirring unit 210 uses the round key RK generated in the process of S220 to perform a stirring process for the round corresponding to the said round key RK.

[0319] On the other hand, if the first round is executed (YES in S214), the stirring process is considered complete up to the first round. Therefore, a plaintext block is output from the data stirring unit 210. The output unit 230 then outputs plaintext P as output data (step S230). Specifically, the output unit 230 outputs plaintext P, which is a concatenation of the multiple plaintext blocks output from the data stirring unit 210.

[0320] <Effects> The effects of the information processing system 1 according to Embodiment 1 will be described below. The effects of the information processing device 100 will be described below, but similar effects can be achieved with the information processing device 200. This is also true for other embodiments.

[0321] As described above, the information processing device 100 according to Embodiment 1 performs a stirring process using the round function F shown in Figure 5. Here, the round function F shown in Figure 5 is an efficient cryptographic component that uses arithmetic multiplication. Therefore, high-speed cryptographic processing can be achieved. Furthermore, the round function F shown in Figure 5 is a cryptographic component that has the best security evaluation indicators, such as differential probability and linear probability. Therefore, secure cryptographic processing can be achieved. In addition, the information processing device 100 according to Embodiment 1 performs key scheduling processing in parallel with the stirring process. Therefore, the consumption of memory resources can be suppressed. Furthermore, in the key scheduling processing, the information processing device 100 according to Embodiment 1 performs initial settings on the state S to satisfy the initial setting conditions described above, and updates the state S to satisfy the update conditions described above. Therefore, secure key scheduling can be achieved. As a result, the information processing device 100 according to Embodiment 1 can achieve secure and high-speed cryptographic processing while suppressing the amount of memory required.

[0322] (Embodiment 2) Next, Embodiment 2 will be described. Embodiment 2 shows an overview of the configuration according to the embodiment described above.

[0323] Figure 29 is a diagram illustrating the configuration of the information processing device 300 according to this disclosure. The information processing device 300 corresponds to the information processing device 100 and information processing device 200 described above. The information processing device 300 includes a data receiving unit 302, a data stirring unit 310, a key scheduling unit 320, and an output unit 330.

[0324] The data receiving unit 302 functions as a data receiving means. The data stirring unit 310 functions as a data stirring means. The key scheduling unit 320 functions as a key scheduling means. The output unit 330 functions as an output means.

[0325] The data receiving unit 302 is implemented by functions substantially the same as those of the data receiving unit 102 or data receiving unit 202 described above. The data receiving unit 302 receives input data, which is either plaintext or ciphertext.

[0326] The data stirring unit 310 is implemented by a function substantially similar to that of the data stirring unit 110 or data stirring unit 210 described above. The data stirring unit 310 performs stirring processing on each of the multiple input data blocks, each of which the input data is divided into N bits, using a round function to which a different round key value is input each time it is used. Specifically, the data stirring unit 310 stirs each of the input data blocks by repeatedly using the round function over multiple rounds, using it A times per round. As a result, the data stirring unit 310 outputs an output data block. N is a multiple of 8, and A is an integer greater than or equal to 1. The input data block is either a plaintext block or a ciphertext block. The stirring process is either an encryption process or a decryption process. The output data block is either a ciphertext block or a plaintext block.

[0327] The key scheduling unit 320 is implemented by functions substantially the same as those of the key scheduling unit 120 or key scheduling unit 220 described above. In parallel with the repeated use of the round function to perform the stirring process, the key scheduling unit 320 performs a key scheduling process to generate a round key to be input to the round function using a pre-generated master key. The master key is an n*M bit random number composed of M master key parts, each of n bits (where M is an integer greater than or equal to 4). Also, n is a multiple of 2 less than N.

[0328] Here, the round function used by the data stirring unit 310 is configured to perform the following processing each time it is used. That is, the round function accepts n-bit input intermediate data and a round key consisting of six round key portions, each of n bits, as input. The input intermediate data consists of an n / 2-bit first input data portion and an n / 2-bit second input data portion. The six round key portions consist of the first round key portion K 1 1. Second round key section K 1 2. Third round key section K 1 3. Key section K of the 4th round 2 1. Round 5 Key Section K 2 2. Key part of the 6th round K 2 The answer is 3.

[0329] Furthermore, the round function consists of the first input data portion and the first round key portion K. 1 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the second round key portion K. 1 The value of the lower n bits of the result obtained by arithmetic addition of 2 is arithmetic multiplied by 2. Then, the round function is the value of the lower n bits of the obtained value and the third round key part K. 1 The upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of 3 are calculated as the first output data portion. This operation corresponds to equation (6) above.

[0330] Furthermore, the round function consists of the first input data portion and the fourth round key portion K. 2 The lower n bits of the value obtained by arithmetic addition of 1, the second input data portion, and the fifth round key portion K. 2 The lower n bits of the value obtained by arithmetic addition of 2 are arithmetic multiplied together. Then, the round function is calculated by multiplying the lower n bits of the obtained value by the 6th round key part K. 2 The upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of 3 are calculated as the second output data portion. This operation corresponds to equation (7) above. The round function then outputs intermediate output data consisting of the first output data portion and the second output data portion.

[0331] Furthermore, the key scheduling unit 320 performs the following processing in the key scheduling process. The key scheduling unit 320 performs an initial setup to set one of M master key parts for each of 6*R*A n-bit states, under the following initial setup conditions. Note that each of the 6*R*A states corresponds to one of the multiple round key parts that constitute the round key for R rounds. Also, R is an integer greater than or equal to 2, and for any integer x greater than or equal to 2, 6*R=M*x holds.

[0332] The key scheduling unit 320, as an initial setting condition, assigns the master key portion to the six round key portions entered in one use of the round function as follows: That is, the key scheduling unit 320 assigns the first round key portion K 1 1 and 2nd round key part K 1 2 and 3rd round key part K 1 Three different master key portions are assigned to the three states corresponding to each of the three. The key scheduling unit 320 also assigns the fourth round key portion K 2 1 and 5th round key part K 2 2 and the 6th round key part K 2 Three different master key components are assigned to the three states corresponding to each of the three.

[0333] Furthermore, the key scheduling unit 320 assigns the master key portion to the multiple round key portions input in a single use of the round function as an initial setting condition, as follows: That is, the key scheduling unit 320 assigns the first round key portion K 1 1 and 2nd round key part K 1 2 and 4th round key part K 2 1 and 5th round key part K 2 Assign different master key portions to the four states corresponding to each of the two.

[0334] Furthermore, the key scheduling unit 320 assigns a master key portion to multiple round key portions that are input by using the round function at least twice consecutively, as an initial setting condition, as follows: That is, the key scheduling unit 320 assigns a master key portion to two third round key portions K 1 3 and 2 sixth round key parts K 2 Assign different master key portions to the four states corresponding to each of the three.

[0335] Furthermore, the key scheduling unit 320 generates multiple master key portions set in the initial setup conditions as round keys for R rounds for each of the multiple states. After generating round keys for R rounds, the key scheduling unit 320 updates the state values ​​to generate round keys to be used in the subsequent R rounds, using update conditions that include at least the following: The key scheduling unit 320 sets the value of each second state as the exclusive OR of the value of one of the multiple states (a first state) and the values ​​of two or more predetermined second states that are different from the first state. In this way, the key scheduling unit 320 updates the second states. The first and second states are selected so that the master key portions set in the second states are not the same as the master key portions set in the first states. The first and second states are also selected so that their positional relationship is predetermined.

[0336] The output unit 330 is implemented by functions substantially similar to those of the output unit 130 or output unit 230 described above. The output unit 330 controls the output of output data composed of multiple output data blocks. The output data is either ciphertext or plaintext.

[0337] The information processing device 300 according to Embodiment 2 achieves substantially the same effects as the information processing device 100 according to Embodiment 1, etc., through the configuration described above. In other words, the information processing device 3...

Claims

1. A data receiving means for receiving input data, A data stirring means that stirs each of the multiple input data blocks, each of which the input data is divided into N bits (where N is a multiple of 8), by repeatedly using a round function, which is input with a different round key each time it is used, A times per round (where A is an integer of 1 or more), over multiple rounds, and outputs an output data block. In parallel with the repeated use of the aforementioned round function to perform the stirring process, a key scheduling means performs a key scheduling process to generate the round key to be input to the round function using a pre-generated master key, Output means for controlling the output of output data composed of multiple output data blocks, It has, The aforementioned round function is used each time, An input intermediate data of n bits (n is a multiple of 2 smaller than N) composed of a first input data part of n / 2 bits and a second input data part of n / 2 bits, and six round key parts of n bits each, namely the first round key part K １ １ , the second round key part K １ ２ , the third round key part K １ ３ , the fourth round key part K ２ １ , the fifth round key part K ２ ２ , the sixth round key part K ２ ３ accepts as input the round key composed of the above, First input data portion and first round key portion K １ １ The lower n bits of the value obtained by arithmetic addition of and the second input data portion and the second round key portion K １ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by arithmetic, and the lower n bits of the obtained value and the third round key part K １ ３ The first output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , First input data portion and fourth round key portion K ２ １ The lower n bits of the value obtained by arithmetic addition of and , the second input data portion and the fifth round key portion K ２ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by and the lower n bits of the obtained value and the 6th round key part K ２ ３ The second output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , It consists of a first output data section and a second output data section, and outputs intermediate output data. It is configured in such a way, The aforementioned master key is an n*M bit random number composed of M master key parts, each of which is n bits (where M is an integer greater than or equal to 4). The key scheduling means, in the key scheduling process, Initial settings for setting one of the M master key parts for each of the 6 * R * A n-bit states corresponding to one of the multiple round key parts that constitute the round key for R rounds (where R is an integer greater than or equal to 2, and 6 * R = M * x for any integer x greater than or equal to 2), For the six round key portions input by one use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned third round key portion K １ ３ Three different master key portions are assigned to the three states corresponding to each of them, and the fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ and the aforementioned sixth round key portion K ２ ３ Three different master key portions are assigned to the three states corresponding to each of them. Regarding the multiple round key portions input by a single use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ Each of the four states corresponding to each of these is assigned a different master key portion. For a plurality of round key portions input by at least two consecutive uses of the round function, two of the third round key portions K １ ３ and two of the aforementioned sixth round key parts K ２ ３ Four different master key portions are assigned to the four states corresponding to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for R rounds. After generating round keys for R rounds, the update process generates round keys to be used in the subsequent R rounds by updating the value of the state. The second state is updated by setting the value of each of the second states as the exclusive OR of the value of one of the multiple first states and the values ​​of two or more predetermined second states that are different from the first state. The first state and the second state are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state. The first state and the second state are selected such that their positional relationship is predetermined. The update condition must include at least the following conditions: Information processing device.

2. The aforementioned initial conditions apply to the entire set of 6 * R * A states. The number of master key parts assigned to each of the M master keys is the same. Each of the M master key portions, the third round key portion K １ ３ and the aforementioned sixth round key portion K ２ ３ The number of states assigned to the corresponding states becomes the same for both. Each of the M master key portions, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ The number of states assigned to the corresponding states is the same for both. This includes the following conditions: The information processing apparatus according to claim 1.

3. The data stirring means performs the stirring process for each of the multiple input data blocks, in which the input data is divided into 2*n bits, by using the round function once per round. The aforementioned master key is an n*4 bit random number composed of four master key parts, each of which is n bits. The aforementioned key scheduling means is The initial setup is performed by setting one of the four master key portions for each of the 12 n-bit states corresponding to each round key portion of the round key for two rounds. For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. After generating round keys for two rounds, the update process is performed to generate round keys to be used in the following two rounds by updating the value of the state. The information processing apparatus according to claim 2.

4. The twelve said states S ０ , ···, S １１ Among them, S ０ , ···, S ５ are respectively the first-round key parts K １ １ used in the r-th (r is odd) round, the second-round key part K １ ２ used in the r-th (r is odd) round, the third-round key part K １ ３ used in the r-th (r is odd) round, the fourth-round key part K ２ １ used in the r-th (r is odd) round, the fifth-round key part K ２ ２ used in the r-th (r is odd) round, the sixth-round key part K ２ ３ and respectively correspond to S ６ , ···, S １１ are respectively the first-round key parts K １ １ used in the (r + 1)-th round, the second-round key part K １ ２ used in the (r + 1)-th round, the third-round key part K １ ３ used in the (r + 1)-th round, the fourth-round key part K ２ １ used in the (r + 1)-th round, the fifth-round key part K ２ ２ used in the (r + 1)-th round, the sixth-round key part K ２ ３ and respectively correspond to, The aforementioned key scheduling means is 12 states S ０ , ..., S １１ The initial setting for this is to set one of the four master key portions. Three states S ０ , S １ , S ２ are assigned with the mutually different master key parts, and three states S ３ , S ４ , S ５ are assigned with the mutually different master key parts, and three states S ６ , S ７ , S ８ are assigned with the mutually different master key parts, and three states S ９ , S １０ , S １１ are assigned with the mutually different master key parts, 4 states S ０ , S １ , S ３ , S ４ The four states S are assigned different master key portions to each other. ６ , S ７ , S ９ , S １０ Assign different master key portions to each of them, 4 states S ２ , S ５ , S ８ , S １１ Assign different master key portions to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. In the update process, which generates round keys for two rounds and then updates the value of the state to generate round keys to be used in the following two rounds, In the first update, the first state S of the multiple states ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each value of the second state with each of the values ​​of (j, k are integer indices from 0 to 11, where k ≠ j), In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k of each is decremented by the same number (however, once the index is decremented to 0, it returns to 11 and is decremented again), and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 3.

5. The key scheduling means, in the update process, In the first update, the first state S ｊ State S １１ And the first state S ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each of the values ​​as the value of the second state. In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k is decremented by 1, and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 4.

6. The aforementioned key scheduling means is In the update process described above, if the predetermined number is set to 2, then in the first update, the first state S ｊ State S １１ The two predetermined second states S ｋ of, State S ８ , S ９ , State S ４ , S １０ , State S ６ , S １０ , State S ０ , S ４ , State S ０ , S ５ , and State S ０ , S ６ , The first state S is one of the following: ｊ The value of and two predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 3, then in the first update, the first state S ｊ State S １１ The three predetermined second states S ｋ of, State S ２ , S ６ , S １０ , State S ２ , S ４ , S １０ , State S １ , S ５ , S １０ , State S ２ , S ５ , S １０ , State S ０ , S ６ , S １０ , and State S ４ , S ６ , S １０ , The first state S is one of the following: ｊ The value of and three predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 4, then in the first update, the first state S ｊ State S １１ The four predetermined second states S ｋ of, State S ２ , S ６ , S ８ , S １０ , State S ４ , S ６ , S ８ , S ９ , State S ２ , S ４ , S ５ , S １０ , State S ０ , S ２ , S ５ , S ６ , State S ０ , S １ , S ８ , S ９ , State S ０ , S ２ , S ８ , S ９ , State S ０ , S ４ , S ５ , S １０ , State S １ , S ２ , S ６ , S １０ , State S ０ , S ４ , S ６ , S １０ , State S １ , S ５ , S ６ , S １０ , State S ０ , S ５ , S ８ , S １０ , State S １ , S ５ , S ８ , S １０ , and State S １ , S ６ , S ８ , S １０ , The first state S is one of the following: ｊ The value of and four predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 5, then in the first update, the first state S ｊ State S １１ The five predetermined second states S ｋ of, State S ０ , S ４ , S ５ , S ８ , S ９ , State S ０ , S ４ , S ６ , S ８ , S ９ , State S ０ , S ２ , S ６ , S ８ , S １０ , State S ２ , S ４ , S ６ , S ８ , S １０ , State S ０ , S １ , S ２ , S ４ , S ６ , State S １ , S ４ , S ５ , S ８ , S １０ , State S １ , S ２ , S ４ , S ６ , S １０ , State S ０ , S ２ , S ５ , S ８ , S １０ , State S ２ , S ４ , S ５ , S ８ , S １０ , and State S １ , S ４ , S ６ , S ８ , S １０ , The first state S is one of the following: ｊ The value of and five predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 6, then in the first update, the first state S ｊ State S １１ The six predetermined second states S ｋ of, State S ０ , S １ , S ４ , S ６ , S ８ , S ９ , State S ０ , S １ , S ４ , S ５ , S ８ , S ９ , State S ０ , S ２ , S ４ , S ６ , S ８ , S １０ , and State S ２ , S ４ , S ５ , S ６ , S ８ , S １０ , The first state S is one of the following: ｊ The value of and six predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 5.

7. The data stirring means performs the stirring process for each of the multiple input data blocks, in which the input data is divided into 4*n bits, by using the round function twice for each round. The aforementioned master key is an n*4 bit random number composed of four master key parts, each of which is n bits. The aforementioned key scheduling means is The initial setup is performed by setting one of the four master key portions for each of the 24 n-bit states corresponding to each round key portion of the round key for two rounds. For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. After generating round keys for two rounds, the update process is performed to generate round keys to be used in the following two rounds by updating the value of the state. The information processing apparatus according to claim 2.

8. 24 states S ０ , ..., S ２３ Of these, S ０ , ..., S ５ These are the first round key portion K used in the first use of the round function in the rth round (where r is odd). １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S ６ , ..., S １１ These are the first round key portion K used in the second use of the round function in the r-th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S １２ , ..., S １７ These are the first round key portion K used in the first use of the round function in the r+1th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S １８ , ..., S ２３ These are the first round key portion K used in the second use of the round function in the r+1th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, The aforementioned key scheduling means is 24 states S ０ , ..., S ２３ The initial setting for this is to set one of the four master key portions. 3 states S ０ , S １ , S ２ Assigning different master key portions to each of the three states S ３ , S ４ , S ５ Assigning different master key portions to each of the three states S ６ , S ７ , S ８ Assigning different master key portions to each of the three states S ９ , S １０ , S １１ Assigning different master key portions to each of the three states S １２ , S １３ , S １４ Assigning different master key portions to each of the three states S １５ , S １６ , S １７ Assigning different master key portions to each of the three states S １８ , S １９ , S ２０ Assigning different master key portions to each of the three states S ２１ , S ２２ , S ２３ Assign different master key portions to each of them, 4 states S ０ , S １ , S ３ , S ４ The four states S are assigned different master key portions to each other. ６ , S ７ , S ９ , S １０ The four states S are assigned different master key portions to each other. １２ , S １３ , S １５ , S １６ The four states S are assigned different master key portions to each other. １８ , S １９ , S ２１ , S ２２ Assign different master key portions to each of them, 4 states S ２ , S ５ , S ８ , S １１ The four states S are assigned different master key portions to each other. １４ , S １７ , S ２０ , S ２３ Assign different master key portions to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. In the update process, which generates round keys for two rounds and then updates the value of the state to generate round keys to be used in the following two rounds, In the first update, the first state S of the multiple states ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each value of the second state with each of the values ​​of (j, k are integer indices from 0 to 23, where k ≠ j), In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k of each is decremented by the same amount (however, once the index is decremented to 0, it returns to 23 and is decremented again), and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 7.

9. The key scheduling means, in the update process, In the first update, the first state S ｊ State S ２３ And the first state S ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k is decremented by 1, and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 8.

10. The aforementioned key scheduling means is In the update process described above, if the predetermined number is set to 4, then in the first update, the first state S ｊ State S ２３ The four predetermined second states S ｋ of, State S ４ , S １３ , S ２０ , S ２２ , State S ６ , S １２ , S １７ , S ２２ , State S ２ , S １３ , S ２０ , S ２２ , State S ５ , S １３ , S ２０ , S ２２ , State S ６ , S １６ , S ２０ , S ２２ , State S １４ , S １７ , S ２０ , S ２２ , and State S ３ , S １２ , S １７ , S ２２ , The first state S is one of the following: ｊ The value of and four predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 5, then in the first update, the first state S ｊ State S ２３ The five predetermined second states S ｋ of, State S ３ , S ５ , S ９ , S １７ , S ２２ , State S ３ , S ６ , S １２ , S １７ , S ２２ , State S ３ , S ６ , S １２ , S ２１ , S ２２ , and State S ３ , S ５ , S １２ , S １７ , S ２２ , The first state S is one of the following: ｊ The value of and five predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 6, then in the first update, the first state S ｊ State S ２３ The six predetermined second states S ｋ of, State S ０ , S ３ , S ６ , S １３ , S １７ , S １９ , State S ０ , S ２ , S ３ , S ６ , S １７ , S ２２ , State S ３ , S ５ , S ６ , S １２ , S １７ , S ２２ , State S ３ , S ５ , S ９ , S １２ , S １７ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １７ , S ２２ , State S ３ , S ７ , S ９ , S １２ , S １７ , S ２２ , State S ３ , S ６ , S １４ , S １６ , S １７ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S １１ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S １２ , S ２０ , S ２２ , State S ２ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ５ , S ７ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S １６ , S ２０ , S ２２ , State S ６ , S ９ , S １１ , S １６ , S ２０ , S ２２ , State S ５ , S ６ , S １２ , S １６ , S ２０ , S ２２ , State S ６ , S ９ , S １２ , S １６ , S ２０ , S ２２ , and State S ５ , S １２ , S １３ , S １６ , S ２０ , S ２２ , The first state S is one of the following: ｊ The value of and six predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 7, then in the first update, the first state S ｊ State S ２３ The seven predetermined second states S ｋ of, State S ０ , S ２ , S ３ , S ４ , S ６ , S １１ , S １３ , State S ０ , S ２ , S ３ , S ５ , S ６ , S １１ , S １３ , State S ３ , S ４ , S ５ , S ６ , S １１ , S １２ , S １７ , State S ０ , S ２ , S ３ , S ６ , S １１ , S １３ , S １７ , State S ０ , S ３ , S ４ , S ５ , S ６ , S １３ , S １９ , State S ３ , S ４ , S ５ , S １１ , S １２ , S １３ , S １９ , State S ０ , S ３ , S ４ , S ６ , S １３ , S １７ , S １９ , State S ０ , S ３ , S ５ , S ６ , S １３ , S １７ , S １９ , State S ０ , S ３ , S ６ , S １３ , S １４ , S １７ , S １９ , State S ０ , S ３ , S ４ , S ６ , S １１ , S １２ , S ２０ , State S ３ , S ４ , S ５ , S ６ , S １１ , S １９ , S ２０ , State S ０ , S ２ , S ３ , S ５ , S ７ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ５ , S ９ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ５ , S ９ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ６ , S ９ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ５ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ５ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ６ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S １１ , S １３ , S １７ , S ２２ , State S ３ , S ５ , S ６ , S １１ , S １３ , S １７ , S ２２ , State S ０ , S ５ , S ７ , S １１ , S １３ , S １７ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １３ , S １７ , S ２２ , State S ０ , S ５ , S １２ , S １４ , S １６ , S １７ , S ２２ , State S ３ , S ５ , S １２ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ５ , S ６ , S ９ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ６ , S １１ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ２ , S ４ , S ６ , S １２ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ６ , S １２ , S ２０ , S ２２ , State S ０ , S ２ , S ４ , S ７ , S １２ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ７ , S １２ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S ９ , S １２ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S ９ , S １２ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S ９ , S １３ , S ２０ , S ２２ , State S ４ , S ５ , S ９ , S １１ , S １３ , S ２０ , S ２２ , State S ５ , S ７ , S ９ , S １１ , S １３ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S １２ , S １３ , S ２０ , S ２２ , State S ２ , S ３ , S ５ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S １２ , S １３ , S ２０ , S ２２ 、 State S ４ , S ５ , S ７ , S １２ , S １３ , S ２０ , S ２２ 、 State S ０ , S ３ , S ６ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ７ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S ４ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ９ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ５ , S １４ , S １７ , S ２０ , S ２２ 、 State S ０ , S ６ , S １１ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ７ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ４ , S ７ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ２ , S ４ , S ５ , S ７ , S １２ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S ９ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ６ , S １１ , S １６ , S ２１ , S ２２ , State S ０ , S ４ , S ６ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ７ , S １３ , S １６ , S ２１ , S ２２ , State S ３ , S ６ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ７ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ３ , S ９ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ９ , S １４ , S １６ , S ２１ , S ２２ , State S ３ , S ６ , S ９ , S １１ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S ６ , S １２ , S １９ , S ２１ , S ２２ , State S ３ , S ７ , S １１ , S １３ , S １９ , S ２１ , S ２２ , State S ３ , S ６ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ４ , S ６ , S ７ , S ９ , S １１ , State S ４ , S ５ , S ９ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S １２ , S １４ , S １６ , S ２０ , S ２２ , and State S ３ , S ５ , S ９ , S １２ , S １９ , S ２１ , S ２２ , The first state S is one of the following: ｊ The value of and seven predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 8, then in the first update, the first state S ｊ State S ２３ The eight predetermined second states S ｋ of, State S ０ , S ２ , S ５ , S ７ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ２ , S ３ , S ４ , S ６ , S ７ , S ９ , S １１ , State S ０ , S ３ , S ４ , S ５ , S ６ , S ７ , S ９ , S １１ , State S ０ , S ３ , S ４ , S ６ , S ７ , S ９ , S １１ , S １２ , State S ０ , S ２ , S ３ , S ５ , S １１ , S １２ , S １３ , S １４ , State S ０ , S ３ , S ５ , S １１ , S １２ , S １３ , S １４ , S １９ , State S ３ , S ４ , S ５ , S １１ , S １２ , S １３ , S １４ , S １９ , State S ０ , S ３ , S ５ , S ６ , S ７ , S １３ , S １７ , S １９ , State S ０ , S ３ , S ４ , S ６ , S １３ , S １４ , S １７ , S １９ , State S ０ , S ３ , S ５ , S ６ , S ７ , S １１ , S １２ , S ２０ , State S ３ , S ４ , S ５ , S ６ , S ７ , S １１ , S １２ , S ２０ , State S ３ , S ４ , S ５ , S ６ , S ９ , S １１ , S ２０ , S ２１ , State S ０ , S ６ , S ９ , S １１ , S １２ , S １３ , S ２０ , S ２１ , State S ０ , S ３ , S ５ , S ９ , S １１ , S １７ , S ２０ , S ２１ , State S ０ , S ５ , S ９ , S １１ , S １３ , S １９ , S ２０ , S ２１ , State S ０ , S ２ , S ４ , S ５ , S ６ , S ９ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ５ , S ９ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ５ , S ９ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ６ , S ９ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ６ , S ９ , S １２ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ６ , S １１ , S １３ , S １７ , S ２２ , State S ４ , S ５ , S ７ , S ９ , S １１ , S １３ , S １７ , S ２２ , State S ０ , S ２ , S ６ , S ９ , S １２ , S １３ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ５ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ５ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S ６ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ６ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ４ , S ７ , S １４ , S １６ , S １７ , S ２２ , State S ３ , S ５ , S ９ , S １１ , S １４ , S １６ , S １７ , S ２２ , State S ３ , S ７ , S ９ , S １１ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ３ , S １２ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ５ , S １２ , S １４ , S １６ , S １７ , S ２２ , State S ０ , S ２ , S ５ , S ６ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ２ , S ４ , S ７ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ７ , S ９ , S １１ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ７ , S ９ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S ９ , S １１ , S １３ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S ９ , S １１ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S ７ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S ９ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S ９ , S １２ , S １３ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S ６ , S ９ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ７ , S ９ , S １１ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S ９ , S １１ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S ９ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S ２ , S ４ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ２ , S ６ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ５ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ４ , S ５ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ５ , S ６ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ９ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ０ , S ２ , S ３ , S ５ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ２ , S ４ , S ７ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S １１ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ５ , S １１ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S １１ , S １４ , S １７ , S ２０ , S ２２ , State S ４ , S ７ , S ９ , S １１ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S １１ , S １６ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ９ , S １１ , S １６ , S １７ , S ２０ , S ２２ , State S ０ , S ５ , S ７ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ４ , S ５ , S ７ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ０ , S ６ , S ９ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ５ , S ６ , S ９ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ０ , S ７ , S ９ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ５ , S ６ , S １２ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ５ , S ９ , S １２ , S １３ , S １６ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ９ , S １４ , S １７ , S １９ , S ２０ , S ２２ , State S ４ , S ５ , S ９ , S １４ , S １７ , S １９ , S ２０ , S ２２ , State S ０ , S ３ , S ５ , S ６ , S ９ , S １６ , S ２１ , S ２２ , State S ０ , S ４ , S ５ , S ７ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ６ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ４ , S ６ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ９ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ４ , S ９ , S １１ , S １３ , S １６ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S ６ , S １１ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S ９ , S １１ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １１ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S ６ , S １２ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ５ , S ７ , S １２ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １２ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １３ , S １９ , S ２１ , S ２２ , State S ０ , S ４ , S ６ , S １１ , S １３ , S １９ , S ２１ , S ２２ , State S ０ , S ３ , S ７ , S １１ , S １３ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S ９ , S １１ , S １３ , S １９ , S ２１ , S ２２ , State S ３ , S ６ , S ９ , S １１ , S １３ , S １９ , S ２１ , S ２２ , State S ０ , S ４ , S ６ , S ９ , S １４ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S ７ , S ９ , S １４ , S １９ , S ２１ , S ２２ , State S ０ , S ２ , S ５ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ２ , S ６ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ４ , S ６ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S ６ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S ７ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ４ , S ９ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ４ , S ９ , S １３ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ７ , S ９ , S １３ , S １６ , S １９ , S ２１ , S ２２ , State S ４ , S ７ , S ９ , S １３ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ９ , S １１ , S １４ , S １６ , S １９ , S ２１ , S ２２ , State S ２ , S ５ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , State S ３ , S ５ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , State S ３ , S ６ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , State S ０ , S ７ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , State S ３ , S ７ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , and State S ４ , S ７ , S １２ , S １４ , S １６ , S １９ , S ２１ , S ２２ , The first state S is one of the following: ｊ The value of and eight predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 9.

11. The data stirring means performs the stirring process for each of the multiple input data blocks, in which the input data is divided into 4*n bits, by using the round function twice for each round. The aforementioned master key is an n*8 bit random number composed of eight master key parts, each of which is n bits. The aforementioned key scheduling means is The initial setup is performed by setting one of the eight master key portions for each of the 24 n-bit states corresponding to each round key portion of the two rounds. For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. After generating round keys for two rounds, the update process is performed to generate round keys to be used in the following two rounds by updating the value of the state. The information processing apparatus according to claim 2.

12. The aforementioned key scheduling means is The initial setup involves setting one of the eight master key portions for each of the 24 n-bit states corresponding to each round key portion of the two rounds, and further, The third round key portion K used in the first use of the round function in the rth round (where r is an odd number) １ ３ , 6th round key part K ２ ３ Each of the master key portions assigned to the two states corresponding to each of them is a first round key portion K used in the first use of the round function in the r+1th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ One of the four states corresponding to each of them, and the first round key portion K used in the second use of the round function in the r+1th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ Each is assigned to one of the four corresponding states. Third round key portion K used in the second use of the round function in the r-th round １ ３ , 6th round key part K ２ ３ Each of the master key portions assigned to the two states corresponding to each of them is a first round key portion K used in the first use of the round function in the r+1th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ One of the four states corresponding to each of them, and the first round key portion K used in the second use of the round function in the r+1th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ Each is assigned to one of the four corresponding states. The third round key portion K used in the first use of the round function in the r+1th round １ ３ , 6th round key part K ２ ３ Each of the master key portions assigned to the two states corresponding to each of the first round key portions K used in the first use of the round function in the r-th round １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ One of the four states corresponding to each of them, and the first round key portion K used in the second use of the round function in the r-th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ Each is assigned to one of the four corresponding states. The third round key portion K used in the second use of the round function in the r+1th round １ ３ , 6th round key part K ２ ３ Each of the master key portions assigned to the two states corresponding to each of the first round key portions K used in the first use of the round function in the r-th round １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ One of the four states corresponding to each of them, and the first round key portion K used in the second use of the round function in the r-th round. １ １ , second round key part K １ ２ , fourth round key part K ２ １ , fifth round key part K ２ ２ Each of these is assigned to one of the four corresponding states. This will be done under the following conditions: The information processing apparatus according to claim 11.

13. 24 states S ０ , ..., S ２３ Of these, S ０ , ..., S ５ These are the first round key portion K used in the first use of the round function in the rth round (where r is odd). １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S ６ , ..., S １１ These are the first round key portion K used in the second use of the round function in the r-th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S １２ , ..., S １７ These are the first round key portion K used in the first use of the round function in the r+1th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, S １８ , ..., S ２３ These are the first round key portion K used in the second use of the round function in the r+1th round, respectively. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ Corresponding to each, The aforementioned key scheduling means is 24 states S ０ , ..., S ２３ The initial setting for this is to set one of the eight master key portions. 3 states S ０ , S １ , S ２ Assigning different master key portions to each of the three states S ３ , S ４ , S ５ Assigning different master key portions to each of the three states S ６ , S ７ , S ８ Assigning different master key portions to each of the three states S ９ , S １０ , S １１ Assigning different master key portions to each of the three states S １２ , S １３ , S １４ Assigning different master key portions to each of the three states S １５ , S １６ , S １７ Assigning different master key portions to each of the three states S １８ , S １９ , S ２０ Assigning different master key portions to each of the three states S ２１ , S ２２ , S ２３ Assign different master key portions to each of them, 4 states S ０ , S １ , S ３ , S ４ The four states S are assigned different master key portions to each other. ６ , S ７ , S ９ , S １０ The four states S are assigned different master key portions to each other. １２ , S １３ , S １５ , S １６ The four states S are assigned different master key portions to each other. １８ , S １９ , S ２１ , S ２２ Assign different master key portions to each of them, 8 states S ２ , S ５ , S ８ , S １１ , S １４ , S １７ , S ２０ , S ２３ Assign different master key portions to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for two rounds. In the update process, which generates round keys for two rounds and then updates the value of the state to generate round keys to be used in the following two rounds, In the first update, the first state S of the multiple states ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each value of the second state with each of the values ​​of (j, k are integer indices from 0 to 23, where k ≠ j), In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k of each is decremented by the same amount (however, once the index is decremented to 0, it returns to 23 and is decremented again), and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 11.

14. The key scheduling means comprises 24 states S ０ , ..., S ２３ Furthermore, the initial setting for configuring one of the eight master key portions is as follows: State S ２ , S ５ Each of the two master key portions assigned to state S １２ , S １３ , S １５ , S １６ Either of the above, and state S １８ , S １９ , S ２１ , S ２２ Assigned to one of the following, State S ８ , S １１ Each of the two master key portions assigned to state S １２ , S １３ , S １５ , S １６ Either of the above, and state S １８ , S １９ , S ２１ , S ２２ Assigned to one of the following, State S １４ , S １７ Each of the two master key portions assigned to state S ０ , S １ , S ３ , S ４ Either of the above, and state S ６ , S ７ , S ９ , S １０ Assigned to one of the following, State S ２０ , S ２３ Each of the two master key portions assigned to state S ０ , S １ , S ３ , S ４ Either of the above, and state S ６ , S ７ , S ９ , S １０ It will be assigned to one of the following: This will be done under the following conditions: The information processing apparatus according to claim 13.

15. The key scheduling means, in the update process, In the first update, the first state S ｊ State S ２３ And the first state S ｊ The value of and the first state S ｊ Two or more predetermined second states S that are different from the above. ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the second and subsequent updates, the first state S from the previous update ｊ The index j and the predetermined number of second states S ｋ The index k is decremented by 1, and the first state S ｊ The value of and the predetermined number of second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 14.

16. The aforementioned key scheduling means is In the update process described above, if the predetermined number is set to 4, then in the first update, the first state S ｊ State S ２３ The four predetermined second states S ｋ of, State S ３ , S ９ , S １４ , S ２２ , And the first state S ｊ The value of and four predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 5, then in the first update, the first state S ｊ State S ２３ The five predetermined second states S ｋ of, State S ２ , S ５ , S ８ , S １３ , S ２２ , And the first state S ｊ The value of and five predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 6, then in the first update, the first state S ｊ State S ２３ The six predetermined second states S ｋ of, State S １ , S ３ , S ６ , S ９ , S １３ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １３ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S ２２ , State S １ , S ３ , S ８ , S １１ , S １４ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １４ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S １４ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １５ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １５ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １５ , S ２２ , State S ２ , S ５ , S ７ , S １３ , S １５ , S ２２ , State S １ , S ５ , S ８ , S １３ , S １５ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S １５ , S ２２ , State S ２ , S ５ , S ９ , S １４ , S １５ , S ２２ , State S ２ , S ５ , S ６ , S １３ , S １６ , S ２２ , State S ２ , S ６ , S ９ , S １３ , S １６ , S ２２ , State S ２ , S ５ , S ９ , S １４ , S １６ , S ２２ , State S ３ , S ６ , S ９ , S １４ , S １６ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S １７ , S ２２ , State S ２ , S ５ , S ８ , S １４ , S １７ , S ２２ , State S ２ , S ６ , S ９ , S １４ , S １７ , S ２２ , State S ３ , S ９ , S １２ , S １４ , S １７ , S ２２ , State S ２ , S ５ , S ９ , S １３ , S １８ , S ２２ , State S １ , S ６ , S ９ , S １３ , S １８ , S ２２ , State S ２ , S ５ , S ９ , S １４ , S １８ , S ２２ , State S １ , S ８ , S １１ , S １４ , S １８ , S ２２ , State S ２ , S ５ , S ７ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ９ , S １５ , S １８ , S ２２ , State S ２ , S ６ , S ９ , S １５ , S １８ , S ２２ , State S ２ , S ８ , S １１ , S １５ , S １８ , S ２２ , State S ２ , S ９ , S １４ , S １７ , S １８ , S ２２ , State S ３ , S ９ , S １４ , S １７ , S １８ , S ２２ , State S ２ , S ６ , S ８ , S １３ , S １９ , S ２２ , State S ２ , S ５ , S ９ , S １３ , S １９ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S １９ , S ２２ , State S １ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S ２ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S １ , S ３ , S ８ , S １４ , S １９ , S ２２ , State S １ , S ５ , S ８ , S １４ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S １４ , S １９ , S ２２ , State S ３ , S ６ , S ８ , S １４ , S １９ , S ２２ , State S ２ , S ５ , S ９ , S １４ , S １９ , S ２２ , State S ３ , S ６ , S ９ , S １５ , S １９ , S ２２ , State S ２ , S ８ , S １１ , S １５ , S １９ , S ２２ , State S ３ , S ８ , S １１ , S １５ , S １９ , S ２２ , State S ３ , S ７ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ６ , S ９ , S １６ , S １９ , S ２２ , State S ２ , S ８ , S １１ , S １６ , S １９ , S ２２ , State S ３ , S ７ , S １３ , S １６ , S １９ , S ２２ , State S ２ , S ８ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ７ , S １４ , S １７ , S １９ , S ２２ , State S １ , S ８ , S １４ , S １７ , S １９ , S ２２ , State S ２ , S ８ , S １４ , S １７ , S １９ , S ２２ , State S ３ , S ８ , S １４ , S １７ , S １９ , S ２２ , State S ２ , S ５ , S ７ , S １３ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S ２０ , S ２２ , State S ２ , S ５ , S ９ , S １３ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ２ , S ７ , S ９ , S １３ , S ２０ , S ２２ , State S ２ , S ８ , S １１ , S １４ , S ２０ , S ２２ , State S ２ , S ９ , S １２ , S １４ , S ２０ , S ２２ , State S ３ , S ９ , S １２ , S １４ , S ２０ , S ２２ , State S ２ , S ７ , S ９ , S １５ , S ２０ , S ２２ , State S ３ , S ７ , S ９ , S １５ , S ２０ , S ２２ , State S ３ , S ７ , S ９ , S １６ , S ２０ , S ２２ , State S ２ , S ７ , S １１ , S １６ , S ２０ , S ２２ , State S ３ , S ６ , S １４ , S １７ , S ２０ , S ２２ , State S ３ , S ７ , S １４ , S １７ , S ２０ , S ２２ , and State S ２ , S ７ , S １３ , S １８ , S ２０ , S ２２ , The first state S is one of the following: ｊ The value of and six predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 7, then in the first update, the first state S ｊ State S ２３ The seven predetermined second states S ｋ of, State S ２ , S ５ , S ８ , S ９ , S １３ , S １８ , S ２２ , State S １ , S ６ , S ９ , S １３ , S １６ , S １９ , S ２２ , and State S ２ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , The first state S is one of the following: ｊ The value of and seven predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. In the update process described above, if the predetermined number is set to 8, then in the first update, the first state S ｊ State S ２３ The eight predetermined second states S ｋ of, State S ２ , S ３ , S ５ , S ６ , S ９ , S １３ , S １５ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S １４ , S １５ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １２ , S １３ , S １６ , S ２２ , State S ０ , S ２ , S ５ , S ６ , S ９ , S １３ , S １７ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S １４ , S １７ , S ２２ , State S ２ , S ３ , S ５ , S ６ , S ７ , S １３ , S １８ , S ２２ , State S ２ , S ３ , S ５ , S ８ , S １１ , S １３ , S １８ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １１ , S １３ , S １８ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １１ , S １３ , S １８ , S ２２ , State S ２ , S ５ , S ６ , S ８ , S １１ , S １３ , S １８ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １２ , S １３ , S １８ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １１ , S １４ , S １８ , S ２２ , State S ２ , S ３ , S ５ , S ７ , S １２ , S １４ , S １８ , S ２２ , State S １ , S ６ , S ８ , S １１ , S １３ , S １４ , S １８ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S １４ , S １８ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １３ , S １４ , S １８ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １１ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ７ , S ９ , S １３ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １３ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ８ , S １１ , S １３ , S １５ , S １８ , S ２２ , State S ３ , S ６ , S ８ , S １１ , S １３ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １３ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S １４ , S １５ , S １８ , S ２２ , State S ２ , S ５ , S ９ , S １３ , S １４ , S １５ , S １８ , S ２２ , State S ３ , S ５ , S ９ , S １３ , S １４ , S １５ , S １８ , S ２２ , State S ３ , S ６ , S ８ , S １２ , S １４ , S １７ , S １８ , S ２２ , State S ２ , S ３ , S ５ , S ７ , S ８ , S １３ , S １９ , S ２２ , State S ２ , S ３ , S ５ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S １ , S ２ , S ６ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S ０ , S ３ , S ６ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S ３ , S ５ , S ６ , S ８ , S １１ , S １３ , S １９ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １２ , S １３ , S １９ , S ２２ , State S ０ , S ３ , S ６ , S ８ , S １１ , S １４ , S １９ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １３ , S １４ , S １９ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １１ , S １５ , S １９ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １１ , S １５ , S １９ , S ２２ , State S ３ , S ５ , S ６ , S ８ , S １１ , S １５ , S １９ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ６ , S ８ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ７ , S ８ , S １３ , S １５ , S １９ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ７ , S ９ , S １３ , S １５ , S １９ , S ２２ , State S １ , S ３ , S ８ , S １１ , S １３ , S １５ , S １９ , S ２２ , State S ３ , S ５ , S ８ , S １１ , S １３ , S １５ , S １９ , S ２２ , State S １ , S ６ , S ８ , S １１ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ７ , S １２ , S １３ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １４ , S １５ , S １９ , S ２２ , State S ２ , S ５ , S ６ , S ８ , S １３ , S １６ , S １９ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １３ , S １６ , S １９ , S ２２ , State S １ , S ２ , S ８ , S １１ , S １３ , S １６ , S １９ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １３ , S １６ , S １９ , S ２２ , State S ３ , S ６ , S ８ , S １１ , S １３ , S １６ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S １６ , S １９ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １４ , S １６ , S １９ , S ２２ , State S ０ , S ２ , S ５ , S ９ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １４ , S １６ , S １９ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １４ , S １６ , S １９ , S ２２ , State S ０ , S ３ , S ７ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ２ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ３ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ３ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ６ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ７ , S ８ , S １１ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ３ , S ７ , S １２ , S １４ , S １６ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １４ , S １６ , S １９ , S ２２ , State S １ , S ８ , S １１ , S １３ , S １４ , S １６ , S １９ , S ２２ , State S ３ , S ５ , S ８ , S １１ , S １５ , S １６ , S １９ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １５ , S １６ , S １９ , S ２２ , State S ２ , S ３ , S ５ , S ７ , S １３ , S １７ , S １９ , S ２２ , State S ２ , S ５ , S ７ , S ８ , S １３ , S １７ , S １９ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １３ , S １７ , S １９ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １３ , S １７ , S １９ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １４ , S １７ , S １９ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １３ , S １８ , S １９ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １３ , S １８ , S １９ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １４ , S １８ , S １９ , S ２２ , State S ２ , S ３ , S ５ , S ６ , S ９ , S １３ , S ２０ , S ２２ , State S ２ , S ３ , S ５ , S ８ , S １１ , S １３ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １１ , S １３ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １１ , S １３ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １２ , S １３ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １２ , S １３ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １１ , S １４ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １３ , S １４ , S ２０ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １２ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S ９ , S １２ , S １５ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ８ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ６ , S ８ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S ８ , S １３ , S １５ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S １ , S ２ , S ５ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ０ , S ３ , S ７ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S １ , S ３ , S ７ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １１ , S １３ , S １５ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １３ , S １５ , S ２０ , S ２２ , State S ３ , S ７ , S ９ , S １２ , S １３ , S １５ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １４ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ６ , S ８ , S １４ , S １５ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １４ , S １５ , S ２０ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １４ , S １５ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １４ , S １５ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １４ , S １５ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S １４ , S １５ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １２ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １２ , S １６ , S ２０ , S ２２ , State S ０ , S １ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ５ , S ７ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S ９ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ６ , S ８ , S １１ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １１ , S １３ , S １６ , S ２０ , S ２２ , State S ２ , S ６ , S ９ , S １１ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １２ , S １３ , S １６ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S ３ , S ５ , S ６ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S １ , S ３ , S ７ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S ２ , S ３ , S ７ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S １ , S ３ , S ８ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S ３ , S ５ , S ８ , S ９ , S １４ , S １６ , S ２０ , S ２２ , State S １ , S ３ , S ８ , S １１ , S １４ , S １６ , S ２０ , S ２２ , State S ２ , S ３ , S ８ , S １１ , S １４ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １１ , S １４ , S １６ , S ２０ , S ２２ , State S １ , S ７ , S ８ , S １１ , S １４ , S １６ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １４ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １５ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １５ , S １６ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １３ , S １５ , S １６ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S ８ , S １３ , S １７ , S ２０ , S ２２ , State S １ , S ３ , S ６ , S ９ , S １３ , S １７ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １３ , S １７ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １１ , S １３ , S １７ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １３ , S １７ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S １２ , S １４ , S １７ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １２ , S １４ , S １７ , S ２０ , S ２２ , State S ３ , S ６ , S ８ , S １２ , S １４ , S １７ , S ２０ , S ２２ , State S ０ , S ３ , S ９ , S １２ , S １４ , S １７ , S ２０ , S ２２ , State S １ , S ３ , S ９ , S １２ , S １４ , S １７ , S ２０ , S ２２ , State S ２ , S ５ , S ８ , S １３ , S １４ , S １７ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S １２ , S １５ , S １７ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １５ , S １７ , S ２０ , S ２２ , State S ３ , S ７ , S ９ , S １３ , S １５ , S １７ , S ２０ , S ２２ , State S ３ , S ８ , S １１ , S １４ , S １５ , S １７ , S ２０ , S ２２ , State S ０ , S ２ , S ５ , S ９ , S １３ , S １８ , S ２０ , S ２２ , State S ０ , S ３ , S ６ , S ９ , S １３ , S １８ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １３ , S １８ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S ９ , S １３ , S １８ , S ２０ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １３ , S １８ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １２ , S １３ , S １８ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S １２ , S １４ , S １８ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １３ , S １５ , S １８ , S ２０ , S ２２ , State S ２ , S ６ , S ９ , S １３ , S １５ , S １８ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S １５ , S １８ , S ２０ , S ２２ , State S １ , S ７ , S ９ , S １３ , S １５ , S １８ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １４ , S １５ , S １８ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S １３ , S １６ , S １８ , S ２０ , S ２２ , State S ３ , S ８ , S １１ , S １４ , S １６ , S １８ , S ２０ , S ２２ , State S １ , S ６ , S ９ , S １３ , S １７ , S １８ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S １７ , S １８ , S ２０ , S ２２ , State S ３ , S ７ , S １２ , S １４ , S １７ , S １８ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ８ , S １３ , S １５ , S ２１ , S ２２ , State S ３ , S ６ , S ８ , S １１ , S １３ , S １５ , S ２１ , S ２２ , State S ３ , S ６ , S ８ , S １２ , S １５ , S １９ , S ２１ , S ２２ , State S ３ , S ６ , S ８ , S １４ , S １５ , S １９ , S ２１ , S ２２ , State S ２ , S ５ , S ９ , S １２ , S １４ , S １８ , S ２０ , S ２２ , State S ３ , S ６ , S ９ , S １３ , S １４ , S １８ , S ２０ , S ２２ , State S ２ , S ３ , S ６ , S ９ , S １５ , S １８ , S ２０ , S ２２ , State S ２ , S ６ , S ８ , S １１ , S １５ , S １８ , S ２０ , S ２２ , State S ２ , S ５ , S ７ , S １３ , S １５ , S １８ , S ２０ , S ２２ , and State S ２ , S ５ , S ９ , S １３ , S １５ , S １８ , S ２０ , S ２２ , The first state S is one of the following: ｊ The value of and eight predetermined second states S ｋ The second state is updated by setting the exclusive OR of each of the values ​​of the second state as the respective values ​​of the second state. The information processing apparatus according to claim 15.

17. Accepts input data, The input data is divided into N bits (where N is a multiple of 8), and each of these input data blocks is mixed by repeatedly using a round function, which is input with a different round key each time it is used, A times per round (where A is an integer greater than or equal to 1), over multiple rounds, and then an output data block is produced. While the aforementioned round function is repeatedly used to perform the stirring process, a key scheduling process is performed using a pre-generated master key to generate the round key that is input to the round function. Control is performed to output output data composed of multiple output data blocks. The aforementioned round function is used each time, An n-bit (where n is a multiple of 2 less than N) input intermediate data consisting of an n / 2-bit first input data portion and an n / 2-bit second input data portion, and a first round key portion K consisting of six n-bit round key portions. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ The round key, which consists of the above, is accepted as input. First input data portion and first round key portion K １ １ The lower n bits of the value obtained by arithmetic addition of and the second input data portion and the second round key portion K １ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by arithmetic, and the lower n bits of the obtained value and the third round key part K １ ３ The first output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , First input data portion and fourth round key portion K ２ １ The lower n bits of the value obtained by arithmetic addition of and , the second input data portion and the fifth round key portion K ２ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by and the lower n bits of the obtained value and the 6th round key part K ２ ３ The second output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , It consists of a first output data section and a second output data section, and outputs intermediate output data. It is configured in such a way, The aforementioned master key is an n*M bit random number composed of M master key parts, each of which is n bits (where M is an integer greater than or equal to 4). In the aforementioned key scheduling process, Initial settings for setting one of the M master key parts for each of the 6 * R * A n-bit states corresponding to one of the multiple round key parts that constitute the round key for R rounds (where R is an integer greater than or equal to 2, and 6 * R = M * x for any integer x greater than or equal to 2), For the six round key portions input by one use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned third round key portion K １ ３ Three different master key portions are assigned to the three states corresponding to each of them, and the fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ and the aforementioned sixth round key portion K ２ ３ Three different master key portions are assigned to the three states corresponding to each of them. Regarding the multiple round key portions input by a single use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ Each of the four states corresponding to each of these is assigned a different master key portion. For a plurality of round key portions input by at least two consecutive uses of the round function, two of the third round key portions K １ ３ and two of the aforementioned sixth round key parts K ２ ３ Four different master key portions are assigned to the four states corresponding to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for R rounds. After generating round keys for R rounds, the update process generates round keys to be used in the subsequent R rounds by updating the value of the state. The second state is updated by setting the value of each of the second states as the exclusive OR of the value of one of the multiple first states and the values ​​of two or more predetermined second states that are different from the first state. The first state and the second state are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state. The first state and the second state are selected such that their positional relationship is predetermined. The update condition must include at least the following conditions: Information processing methods.

18. A function to accept input data, The function includes a stirring process that involves stirring each of the multiple input data blocks, each of which the input data is divided into N bits (where N is a multiple of 8), by repeatedly using a round function, which is input to a different round key each time it is used, A times per round (where A is an integer greater than or equal to 1), over multiple rounds, and then outputting an output data block. In parallel with the repeated use of the aforementioned round function to perform the stirring process, there is a function to perform a key scheduling process that generates the round key to be input to the round function using a pre-generated master key, A function for controlling the output of output data composed of multiple output data blocks, To make this a reality on a computer, The aforementioned round function is used each time, An n-bit (where n is a multiple of 2 less than N) input intermediate data consisting of an n / 2-bit first input data portion and an n / 2-bit second input data portion, and a first round key portion K consisting of six n-bit round key portions. １ １ , second round key part K １ ２ , third round key part K １ ３ , fourth round key part K ２ １ , fifth round key part K ２ ２ , 6th round key part K ２ ３ The round key, which consists of the above, is accepted as input. First input data portion and first round key portion K １ １ The lower n bits of the value obtained by arithmetic addition of and the second input data portion and the second round key portion K １ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by arithmetic, and the lower n bits of the obtained value and the third round key part K １ ３ The first output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , First input data portion and fourth round key portion K ２ １ The lower n bits of the value obtained by arithmetic addition of and , the second input data portion and the fifth round key portion K ２ ２ The lower n bits of the value obtained by arithmetic addition of and are multiplied by and the lower n bits of the obtained value and the 6th round key part K ２ ３ The second output data portion is calculated by taking the upper n / 2 bits of the lower n bits of the value obtained by arithmetic addition of and , It consists of a first output data section and a second output data section, and outputs intermediate output data. It is configured in such a way, The aforementioned master key is an n*M bit random number composed of M master key parts, each of which is n bits (where M is an integer greater than or equal to 4). In the aforementioned key scheduling process, Initial settings for setting one of the M master key parts for each of the 6 * R * A n-bit states corresponding to one of the multiple round key parts that constitute the round key for R rounds (where R is an integer greater than or equal to 2, and 6 * R = M * x for any integer x greater than or equal to 2), For the six round key portions input by one use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned third round key portion K １ ３ Three different master key portions are assigned to the three states corresponding to each of them, and the fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ and the aforementioned sixth round key portion K ２ ３ Three different master key portions are assigned to the three states corresponding to each of them. Regarding the multiple round key portions input by a single use of the aforementioned round function, the first round key portion K １ １ and the aforementioned second round key portion K １ ２ and the aforementioned fourth round key portion K ２ １ and the aforementioned fifth round key portion K ２ ２ Each of the four states corresponding to each of these is assigned a different master key portion. For a plurality of round key portions input by at least two consecutive uses of the round function, two of the third round key portions K １ ３ and two of the aforementioned sixth round key parts K ２ ３ Four different master key portions are assigned to the four states corresponding to each of them. This is done with the following initial conditions: For each of the multiple states, the multiple master key portions set in the initial setup conditions are generated as round keys for R rounds. After generating round keys for R rounds, the update process generates round keys to be used in the subsequent R rounds by updating the value of the state. The second state is updated by setting the value of each of the second states as the exclusive OR of the value of one of the multiple first states and the values ​​of two or more predetermined second states that are different from the first state. The first state and the second state are selected such that the master key portion set in the second state is not the same as the master key portion set in the first state. The first state and the second state are selected such that their positional relationship is predetermined. The update condition must include at least the following conditions: program.

Images