Cryptographic device, method, and program

Abstract

An encryption apparatus according to one embodiment of the present invention is for encrypting a plain text or decrypting an encrypted text by block cipher using a SPN type round function. The encryption apparatus has: a substitution table generation processing unit that, by performing predetermined transformation on a second substitution table in which the longest high-probability chain length in a first substitution table of a predetermined size determined in accordance with the block cipher is shortest, generates a third substitution table for use in a non-linear layer included in the round function; and an encryption processing unit that, by using the generated third substitution table, performs the encryption or the decryption by the block cipher. The high-probability chain is a difference sequence in which, when an input difference indicating a difference between two inputs to the first substitution table has been given for each round, a probability of transition to an output difference indicating an output difference corresponding to the input difference becomes maximum.

Description

[Technical field]

[0001] The present invention relates to an encryption device, a method, and a program. [Background technology]

[0002] An encryption method in which plaintext is encrypted with a certain key and the same key is used to decrypt the ciphertext is called a symmetric key encryption, and a method called a block encryption is known as a type of symmetric key encryption. A block encryption is a method in which data to be encrypted is divided into blocks of an appropriate length (for example, 64 bits or 128 bits) and each block is encrypted. Examples of block encryption include AES encryption (Non-Patent Document 1), SKINNY encryption (Non-Patent Document 2), and Midori encryption (Non-Patent Document 3). Of these, SKINNY encryption and Midori encryption are intended to be implemented on devices with poor computational resources and are also called lightweight encryption.

[0003] In a block cipher, a function called a round function is repeatedly applied to a block to encrypt the block. For example, there is an SPN round function. AES cipher, SKINNY cipher, and Midori cipher are all block ciphers that use SPN round functions. An SPN round function is a round function that consists of a nonlinear layer, a linear layer, and a subkey XOR.

[0004] The more times the round function is repeated, the better the data is mixed and the higher the security, but on the other hand, the more times the round function is repeated, the greater the amount of calculations and the lower the performance of the encryption process. Therefore, it is necessary to minimize the number of times the round function is repeated within a range that ensures security. At this time, the number of times the round function is repeated is determined by carrying out security evaluations against various cryptanalysis methods, with evaluation against differential cryptanalysis (Non-Patent Document 4) being considered the most important. [Prior art documents] [Non-patent literature]

[0005]

Linked Book1

Outdoor Tool2

Outdoor Tools3

Outdoor Tools 4

[0006] However, since lightweight cryptography is expected to be implemented on devices with limited computing resources, it is not possible to perform complex operations in the nonlinear or linear layers of the SPN round function. This makes it difficult to efficiently improve security against differential cryptanalysis, and the number of iterations of the round function increases, which can lead to a decrease in the performance of the cryptographic process.

[0007] An embodiment of the present invention has been made in consideration of the above points, and has an object to improve security against differential cryptanalysis of a block cipher that uses an SPN-type round function. [Means for solving the problem]

[0008] In order to achieve the above-mentioned object, an encryption device according to one embodiment is an encryption device that encrypts plaintext or decrypts ciphertext using a block cipher that uses an SPN-type round function, and includes: a substitution table generation processing unit that generates a third substitution table to be used in a nonlinear layer included in the round function by performing a predetermined conversion on a second substitution table having the shortest longest high-probability chain length among first substitution tables of a predetermined size determined according to the block cipher; and an encryption processing unit that performs the encryption or decryption using the block cipher using the generated third substitution table, and the high-probability chain is a series of differences that, in each round, when an input difference representing the difference between two inputs to the first substitution table is given, has the maximum transition probability to an output difference representing the output difference corresponding to the input difference. Effect of the Invention

[0009] It is possible to improve the security against differential cryptanalysis of a block cipher that uses an SPN-type round function. [Brief description of the drawings]

[0010] [Figure 1] This is a diagram showing a difference distribution table of S-Boxes of the Midori64 cipher. [Diagram 2] FIG. 1 is a diagram showing a high probability chain of the Midori64 cipher. [Diagram 3] FIG. 13 is a diagram showing an example of a differential distribution table for an S-Box whose longest high probability chain length is 2. [Figure 4] FIG. 13 is a diagram showing an example of a high probability chain of an S-Box where the longest high probability chain length is 2. [Diagram 5] FIG. 2 is a diagram illustrating an example of a hardware configuration of a cryptographic device according to the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a functional configuration of a cryptographic device according to the present embodiment. [Figure 7] 11A and 11B are diagrams for explaining an example of a substitution table generating process and an encryption process according to the embodiment; [Figure 8] FIG. 13 is a diagram illustrating a comparative example between Midori64 cipher and a case where its S-Box is replaced with formula (3). [Figure 9] FIG. 13 is a diagram illustrating a comparative example between SKINNY64 cipher and a case where its S-Box is replaced with formula (3). DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, one embodiment of the present invention will be described.

[0012] <Theoretical structure> The theoretical configuration of the method proposed in this embodiment and various techniques and concepts required for the explanation thereof will be described below.

[0013] ≪Differential deciphering method≫ In differential cryptanalysis, when there is a pair (P, C) of a plaintext and its encrypted ciphertext, and another pair (P', C'), the difference between the two pairs is taken into account. The difference Δ between the two data is calculated by exclusive OR.

[0014]

number

[0015]

number

[0016]

number

[0017] Let the block length of the block cipher be n bits. In the case of an ideal block cipher, the probability that two ciphertexts with a specific ciphertext difference ΔC are output for two plaintexts with a specific plaintext difference ΔP is 2 -n It is.

[0018] If the mixing algorithm of the block cipher being attacked is biased and the above probability is 2 -n A block cipher is considered vulnerable to differential cryptanalysis when there exists a set of ΔP and ΔC larger than 2. Conversely, the designer of the block cipher must be able to determine whether the above probability is 2. -n Aim to be smaller.

[0019] The probability of the above is 2 -n Whether or not larger ΔP and ΔC exist depends on the method of constructing the round function and the number of iterations of the round function.

[0020] <SPN type round function> The SPN type is known as one of the methods for constructing round functions.

[0021] In a block cipher that uses an SPN round function, a block of data is divided into multiple short pieces of data, each of which is called a byte.

[0022] For example, the AES cipher has a block length of 128 bits and splits the 128-bit input into 16 8-bit values, i.e., 16 bytes of length 8 bits.

[0023] In addition, the SKINNY128 cipher (Non-Patent Document 2), which has a block length of 128 bits, divides a 128-bit input into 16 bytes with a byte length of 8 bits, while the SKINNY64 cipher (Non-Patent Document 2) and Midori64 cipher (Non-Patent Document 3), which have a block length of 64 bits, divide a 64-bit input into 16 bytes with a byte length of 4 bits.

[0024] In this way, the SPN round function is repeatedly applied to the input data (plaintext) divided into bytes to generate ciphertext. Similarly, when decrypting the ciphertext, the SPN round function is repeatedly applied to the input data (ciphertext) to generate plaintext.

[0025] The SPN round function consists of a nonlinear layer, a linear layer, and a subkey XOR.

[0026] In the nonlinear layer, a transformation in which the input and output are expressed as a nonlinear function is applied to each byte. A substitution table called an S-Box is created in which the output value corresponding to every input value (16 input values ​​if the byte length is 4 bits, or 256 input values ​​if the byte length is 8 bits) is recorded, and the nonlinear layer transforms the data according to this S-Box.

[0027] In the linear layer, a linear transformation is applied to each output transformed by the nonlinear layer. For example, in the Midori64 cipher, 16 bytes are represented as a 4x4 matrix, and the byte positions are swapped using a function called ShuffleCell, and then a matrix process called MixColumns is performed. The ShuffleCell and MixColumns functions of the Midori64 cipher are shown below.

[0028]

number

[0029] The ShuffleCell function of the Midori64 cipher is a byte swap, and the MixColumns function is expressed as a byte-wise exclusive OR. In this case, the linear layer is said to be composed of byte-wise exclusive OR and byte swap.

[0030] In subkey XOR, a key (also called a common key or shared key) is input to a key schedule function, a value called a subkey is obtained for each iteration of the round function, and the output of the linear layer is updated to a value obtained by exclusive-oring the subkey for each round. It is known that the existence of subkey XOR does not affect the calculation of the probability of differential cryptanalysis, so a detailed explanation is omitted.

[0031] <Differential characteristic probability> When calculating the probability that two ciphertexts with a ciphertext difference ΔC will be obtained from two plaintexts with a plaintext difference ΔP using an SPN round function, the difference value after each round is usually determined and evaluated as the product of the differential transition probabilities for each round.

[0032] That is, the number of times the round function is repeated is r, the difference between the two plaintexts is Δ0, and the difference after the i round (i=1, 2, , r) is Δ r In addition, DP F [Δ A ,Δ B ], the difference Δ ATwo inputs with difference Δ B The probability that the input is converted to two inputs with the differential transition probability (Δ0, Δ1, . . . , Δ r ) differential characteristic probability DCP[Δ0,Δ r ] is calculated as follows:

[0033]

number

[0034] Considering implementation performance, a good design is one that minimizes the number of iterations of the round function and minimizes the differential characteristic probability.

[0035] For any linear transformation, a certain difference Δ in When two inputs with the same length are given, the difference between the two outputs corresponding to those two inputs is Δ out is determined with a probability of 1. Therefore, a linear layer alone does not improve security against differential cryptanalysis. In the following, the difference Δ in is the input difference, and the corresponding output difference Δ out is called the output difference.

[0036] On the other hand, in the case of nonlinear transformation, a certain input difference Δ in Output difference Δ out The transition to is probabilistic, and the probability depends on the specification of the nonlinear transformation. In the SPN round function, the specification of the nonlinear transformation is the specification of the S-Box.

[0037] Due to this property, most existing designs ignore the details of the linear transformation and are designed to minimize the maximum differential transition probability of the S-Box. The maximum differential transition probability of the S-Box is the input difference Δ in and output difference Δ outIn all combinations of , count the number of times that the differential transition is satisfied and calculate the probability (the differential transition probability of the S-Box). in and Δ out Calculate the following for all combinations of .

[0038]

number

[0039] Δ corresponds to the situation where there is no difference in = Δ out For all (Δ in ,Δ out ) is the maximum differential transition probability of the S-Box.

[0040] <Linear cryptanalysis> Linear cryptanalysis is known as an equally important cryptanalysis, and the maximum linear transition probability corresponds to the maximum differential transition probability. It is known that the only 4-bit S-Boxes that have the smallest maximum differential transition probability and maximum linear transition probability are those that are obtained by applying affine transformation to the inputs and outputs of the 16 S-Boxes shown in Table 1 below.

[0041] [Table 1] A new S-Box generated by applying an affine transformation to the input and output of an S-Box is said to be affine equivalent to the original S-Box. It is known that the maximum differential transition probability and the maximum linear transition probability always match in an affine equivalent S-Box. Many existing designs that use 4-bit S-Boxes, including the Midori64 cipher, use an S-Box that is affine equivalent to one of the 16 S-Boxes shown in Table 1.

[0042] Figure 1 shows the input difference Δ in and output difference Δ out For all combinations of in From Δ out The number of occurrences of the difference transition to the input Δ in Output difference Δ out The probability of transitioning to (the differential transition probability of the S-Box) is calculated by multiplying the value in the differential distribution table by 2 4 In Figure 1, Δ in = Δ out Since the maximum value except for the case of =0 is 4, the maximum differential transition probability of the S-Box is 4 / 2 4 =2 -2 It can be seen that.

[0043] ≪Proposed method≫ Lightweight ciphers such as SKINNY and Midori are intended to be implemented on devices with relatively poor computational resources, such as IoT devices, and therefore cannot perform complex calculations in the nonlinear or linear layers of SPN round functions. This makes it difficult to efficiently improve security against differential cryptanalysis, and the number of iterations of the round function increases, which can lead to a decrease in the performance of the cryptographic process.

[0044] Therefore, below we explain a method that can reduce the differential characteristic probability with fewer iterations than existing designs when the linear layer of an SPN-type round function is composed only of byte-wise exclusive OR and byte position swapping, such as in the SKINNY cipher and Midori cipher.The proposed method uses a substitution table (S-Box) that satisfies properties that are effective for block ciphers that use SPN-type round functions whose linear layer is composed of byte-wise exclusive OR and byte position swapping.

[0045] When the linear layer of an SPN round function is composed only of byte-wise exclusive OR and byte position swapping, the sum of the number of bytes with differences in the input and output of the linear layer is minimized only when the differences of each byte with differences are all identical.

[0046] In many cases, the differential characteristic probability has the property that it is maximized when the sum of the number of bytes with differences in the input and output of the linear layer is minimized. Therefore, in differential characteristics where the differential characteristic probability is maximized, the differences for each byte often match in the input and output of the linear layer.

[0047] Taking the above properties into consideration, the use of a substitution table (S-Box) that satisfies the following properties can be expected to improve security against differential cryptanalysis.

[0048] Takes a highly probable value among the differential transition probabilities of the S-Box (Δ in ,Δ out ) for such input difference and output difference pairs (Δ in ,Δ out ) is called high probability propagation. i There is a high probability that the difference Δ i+1 and Δ i+1 There is a high probability that the difference Δ i+2 and then Δ i+2 There is a high probability that the difference Δ i+3 Consider a chain of high probability propagation such that the probability of propagation is propagated to the next node. L ) is called a high probability chain, and the length of the high probability chain is L. Note that the chain may also be called a sequence or the like.

[0049] In this proposed method, we use the S-Box with the shortest maximum length among all high probability chains. Note that there are no existing encryption schemes that focus on high probability chains.

[0050] The high probability chain of the S-Box used in the Midori64 cipher is shown in Figure 2. The high probability chain shown in Figure 2 is the difference propagation with a frequency of 4 in the difference distribution table in Figure 1 (i.e., the difference distribution table of the S-Box used in the Midori64 cipher).

[0051] As shown in Figure 2, in the case of the S-Box used in the Midori64 cipher, for example, input difference 1 transitions to output difference 2 with high probability. Similarly, input difference 2 transitions to output differences 4, 9, C, and 1 with high probability. Similarly, input differences 4, 9, and C transition to output difference 2 with high probability. Similarly, input difference 2 transitions to output difference 1 with high probability.

[0052] In Figure 2, "iterate" represents a repetition (loop). For example, the loop is "1 → 2 → 1 → 2 → 1 →...". Therefore, the longest highly probable chain of S-Boxes used in the Midori64 cipher is infinitely long.

[0053] By using S-Boxes with short longest high probability chain lengths, we can expect to improve security against differential cryptanalysis. in ×M out M where is the identity matrix in and M out In this case, two S-Boxes S and S' that satisfy the following relationship have the same high probability chain length.

[0054]

number

[0055] For 4-bit S-Boxes, we investigated the high probability chain lengths of all S-Boxes that are affine equivalent to the 16 S-Boxes shown in Table 1, and found that the shortest longest high probability chain length was 2. Therefore, we can say that an S-Box with a longest high probability chain length of 2 is the optimal S-Box.

[0056] Table 2 below shows the 40 S-Boxes with the longest high probability chain length of 2.

[0057] [Table 2] In Table 2, 10 S-Boxes that are affine equivalent to G7 are listed under G7. 11 There are 10 S-Boxes in G that are affinely equivalent to 11 It is listed under G 12 There are 20 S-Boxes in G that are affinely equivalent to 12 In addition, S-Boxes that are affine equivalent to a certain S-Box are said to belong to the same class. In the following, we refer to the 10 S-Boxes listed under G7 in Table 2 as S-Boxes belonging to the G7 class, G 11 The 10 S-Boxes listed below are 11 S-Box, G 12 The 20 S-Boxes listed below are 12 It belongs to a class called S-Box.

[0058] The longest high probability chain length of the S-Boxes in which the transformation shown in formula (2) is applied to the 40 S-Boxes shown in Table 2 is also 2. (However, when using the transformation shown in formula (2), M in ×M out M where is the identity matrix in and M out is used.)

[0059] Therefore, by replacing the S-Boxes used in the SKINNY64 and Midori64 ciphers with any of the 40 S-Boxes shown in Table 2 converted using equation (2), security against differential cryptanalysis can be improved even with the same number of round function iterations.

[0060] Here, a specific example of an S-Box obtained by converting S-Box {0x0, 0x4, 0x2, 0xB, 0xA, 0xC, 0x9, 0x8, 0x5, 0xF, 0xD, 0x3, 0x7, 0x1, 0x6, 0xE} belonging to the G7 class shown in Table 2 using formula (2) is shown below. This is one of the 4-bit S-Boxes with the longest high probability chain length of 2. Note that when converting using formula (2), M in =0x05EBC927AF41638D,M out =0x0B6DA1C7E5834F29,c in =5, c out =3.

[0061]

number

[0062] As shown in Figures 3 and 4, no matter what input difference is started from, high probability propagation can only continue at most two times.

[0063] Note that this embodiment has been described primarily with respect to block ciphers that use 4-bit S-Boxes in the nonlinear layer of an SPN-type round function (particularly lightweight ciphers such as SKINNY64 cipher and Midori64 cipher), but it goes without saying that the present invention can be similarly applied to block ciphers that use S-Boxes of any size in the nonlinear layer of an SPN-type round function.

[0064] <Hardware configuration of the cryptographic device 10> Next, a hardware configuration of an encryption device 10 that performs encryption processing (encryption, decryption, or both) by a block cipher that uses an SPN type round function that utilizes the S-Box described in this proposed method in a non-linear layer is shown in Fig. 5. As shown in Fig. 5, the encryption device 10 according to this embodiment has an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a processor 105, and a memory device 106. Each of these pieces of hardware are connected to each other via a bus 107 so as to be able to communicate with each other.

[0065] The input device 101 is, for example, a keyboard, a mouse, a touch panel, various physical buttons, etc. The display device 102 is, for example, a display, etc. Note that the encryption device 10 does not necessarily have to have at least one of the input device 101 and the display device 102, for example.

[0066] The external I / F 103 is an interface with an external device such as a recording medium 103a. The encryption device 10 can read and write data from and to the recording medium 103a via the external I / F 103. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0067] The communication I / F 104 is an interface for connecting the encryption device 10 to a communication network. The processor 105 is, for example, various types of arithmetic devices such as a central processing unit (CPU) or a micro-processing unit (MPU). The memory device 106 is, for example, various types of storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a flash memory, a random access memory (RAM), a read only memory (ROM), etc.

[0068] The encryption device 10 according to this embodiment can realize various processes described below by having the hardware configuration shown in Fig. 5. Note that the hardware configuration shown in Fig. 5 is only an example, and the encryption device 10 may have various hardware other than the hardware shown in the figure.

[0069] <Functional configuration of the cryptographic device 10> Next, the functional configuration of an encryption device 10 that performs encryption processing by a block cipher using an SPN-type round function that uses the S-Box described in the present proposed method in a non-linear layer is shown in Fig. 6. As shown in Fig. 6, the encryption device 10 according to this embodiment has a substitution table generation processing unit 201 and an encryption processing unit 202. These units are realized, for example, by processing that one or more programs installed in the encryption device 10 cause the processor 105 to execute.

[0070] The substitution table generation processor 201 generates a substitution table (S-Box) by the proposed method described above. That is, the substitution table generation processor 201 generates an S-Box to be used in the encryption processor 202 by converting, by equation (2), an S-Box with the shortest longest high probability chain length among S-Boxes having the same size as an S-Box used in a nonlinear layer of an SPN-type round function of a block cipher that realizes the encryption processor 202. For example, when the encryption processor 202 is realized by SKINNY64 encryption or Midori64 encryption, the substitution table generation processor 201 generates an S-Box to be used in the encryption processor 202 by converting, by equation (2), any S-Box among the 40 S-Boxes shown in Table 2.

[0071] The cryptographic processing unit 202 performs cryptographic processing with a predetermined block cipher (for example, SKINNY64 cipher, Midori64 cipher, etc.) using the S-Box generated by the substitution table generation processing unit 201. That is, the cryptographic processing unit 202, for example, generates a ciphertext from a plaintext and transmits the ciphertext to another cryptographic device, or decrypts a ciphertext received from another cryptographic device.

[0072] 6 is an example, and for example, the substitution table generation processing unit 201 and the encryption processing unit 202 may be included in different devices. Specifically, for example, the system may be configured with a substitution table generation device having the substitution table generation processing unit 201 and an encryption device having the encryption processing unit 202.

[0073] <Substitution table generation process and encryption process> Next, the flow of the substitution table generation process and the encryption process executed by the encryption device 10 according to the present embodiment is shown in FIG. 7. As shown in FIG. 7, first, the substitution table generation processing unit 201 generates an S-Box to be used by the encryption processing unit 202 (S101). Note that the generation of this S-Box may be executed before the encryption process, and may be executed in advance, or may be executed immediately before each encryption process. Next, the encryption processing unit 202 executes encryption process (encryption of plaintext or decryption of ciphertext) by a predetermined block cipher using the S-Box generated by the substitution table generation processing unit 201 (S102). Note that, when the encryption device 10 functions as an encryption device, the encryption processing unit 202 encrypts the plaintext to generate a ciphertext, and then transmits the ciphertext to another encryption device. On the other hand, when the encryption device 10 functions as a decryption device, the encryption processing unit 202 decrypts the ciphertext received from another encryption device.

[0074] <Experimental Results> Below, we explain the results of experiments conducted to verify the effectiveness of the proposed method.

[0075] First, Fig. 8 shows the change in the maximum differential characteristic probability with respect to the number of iterations of the round function when the S-Box of the Midori64 cipher is replaced with the S-Box shown in formula (3). Note that the Midori64 cipher has a block length of 64 bits and is a block cipher that uses an SPN-type round function, and the longest high-probability chain length of its S-Box is infinite.

[0076] In Fig. 8, "original" is the case where the conventional S-Box is used with Midori64 encryption, and "ours" is the case where the S-Box shown in formula (3) is used with Midori64 encryption. The horizontal axis represents the number of iterations of the round function, and the vertical axis represents the log2 value of the maximum differential characteristic probability (MDCP).

[0077] As shown in Figure 8, the original Midori64 cipher, which has an infinitely long longest high probability chain, has a maximum differential characteristic probability of 2 -64 The round number must be repeated 7 times to ensure it is smaller.

[0078] On the other hand, in the Midori64 cipher (ours) where the longest high probability chain length is replaced by the S-Box, the maximum differential characteristic probability is 2 after 6 iterations. -64 In this way, when the security against differential cryptanalysis can be improved by at least one iteration of the round function, the number of iterations can be reduced while maintaining the same security, thereby improving the processing performance of the cryptographic process.

[0079] Similarly, FIG. 9 shows how the maximum differential characteristic probability changes with respect to the number of iterations of the round function when the S-Box of the SKINNY64 cipher is replaced with the S-Box shown in formula (3).

[0080] In FIG. 9, “original” is the case where the conventional S-Box is used in the SKINNY64 cipher, and “ours” is the case where the S-Box shown in formula (3) is used in the SKINNY64 cipher.

[0081] In SKINNY64, the maximum differential characteristic probability is 2 -64 Although the number of iterations of the round function to guarantee this does not decrease, a smaller maximum differential characteristic probability can be guaranteed with the same number of rounds, improving security against differential cryptanalysis.

[0082] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0083] 10 Cryptographic device 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 processors 106 Memory Device 107 Bus 201 Substitution table generation processing unit 202 Encryption processing unit

Claims

1. A cryptographic device that encrypts a plaintext or decrypts a ciphertext by a block cipher using an SPN type round function, the cryptographic device using a high probability chain that represents a sequence of differences in which, when an input difference representing a difference between two inputs to a first substitution table of a predetermined size determined according to the block cipher is given in each round, a transition probability to an output difference representing an output difference corresponding to the input difference is maximized, a substitution table generation processing unit that generates a third substitution table to be used in a nonlinear layer included in the round function by performing a predetermined conversion on a second substitution table having the shortest length of the longest high probability chain among the first substitution tables; a cryptography processing unit that performs the encryption or the decryption by the block cipher using the generated third substitution table; A cryptographic device having:

2. The conversion is Let S(x) be the second substitution table, S'(x) be the third substitution table, and + be the symbol representing exclusive OR. ｉｎ ×M ｏｕｔ M is a unit matrix ｉｎ and M. ｏｕｔ and the size constant c ｉｎ and c ｏｕｔ Using the above, S'(x) = M ｏｕｔ ×S (M ｉｎ ×(x+c ｉｎ )) + c ｏｕｔ 2. The cryptographic device of claim 1, wherein:

3. 3. The encryption device according to claim 1, wherein the linear layer of the round function is configured only with byte-wise exclusive OR and byte position swapping.

4. The block cipher is either a SKINNY64 cipher or a Midori64 cipher, said size being 4 bits; 4. The cryptographic apparatus of claim 3, wherein the length of the longest highly probable chain in said second permutation table is two.

5. A cryptographic device that encrypts a plaintext or decrypts a ciphertext by a block cipher using an SPN type round function, the cryptographic device using a high probability chain that represents a sequence of differences that maximizes a transition probability to an output difference that represents an output difference corresponding to an input difference when an input difference that represents a difference between two inputs to a first substitution table of a predetermined size determined according to the block cipher is given in each round, the cryptographic device comprising: a substitution table generation process for generating a third substitution table to be used in a nonlinear layer included in the round function by performing a predetermined conversion on a second substitution table having the shortest length of the longest high probability chain among the first substitution tables; a cryptographic processing step of performing the encryption or decryption by the block cipher using the generated third substitution table; How to do it.

6. A program for causing a computer to function as the encryption device according to any one of claims 1 to 4.

Images