Authentication encryption device, authentication decryption device, authentication encryption system, method and program

Abstract

In the present invention, an encryption unit (320) uses a tweakable block cipher, in which a nonce is used as a tweak, to encrypt plain text divided into plain text blocks of a prescribed length, per area of predetermined length. A random number calculation unit (330) generates, during the encryption, a set of random numbers for each area by using first data extracted from at least one of the input and output of a function related to the tweakable block cipher in each area, and a predetermined matrix having predetermined values as elements. A random number encryption unit (340) encrypts the sets of random numbers generated in each area using the tweakable block cipher. The encrypted random numbers respectively serve as the initial value of the process in the next areas. A tag generating unit (350) encrypts the set of random numbers generated in the last area using the tweakable block cipher to generate an authentication tag.

Description

[Technical field]

[0001] The present invention relates to an authentication encryption device, an authentication decryption device, an authentication encryption system, a method, and program Regarding. [Background technology]

[0002] There is a known technology called authenticated encryption (AE) that uses a secret key shared in advance to simultaneously encrypt a plaintext message and calculate an authentication tag for detecting tampering. By applying authenticated encryption AE to a communication path, it becomes possible to conceal the contents against eavesdropping and to detect unauthorized tampering, thereby realizing strong protection of the communication contents. For example, a technology disclosed in Non-Patent Document 1 is known as an authenticated encryption technology. When a primitive (encryption component) with b-bit input / output (plaintext block length is b bits) is used, generally, the security is a maximum of b bits, but the algorithm PFBω according to Non-Patent Document 1 can realize a security (security level) of ωb bits, which is higher than b bits. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Yusuke Naito, Yu Sasaki, and Takeshi Sugawara, "Lightweight Authenticated Encryption Mode Suitable for Threshold Implementation", IACR Cryptology ePrint Archive: Report 2020 / 542, https: / / eprint.iacr.org / 2020 / 542.pdf Summary of the Invention [Problem to be solved by the invention]

[0004] In the technology of Non-Patent Document 1, for security reasons, there is a limit to the number of plaintext blocks that can be processed in one authenticated encryption. Therefore, although the technology of Non-Patent Document 1 can increase security, it is difficult to encrypt a long plaintext at once due to the limit on the number of plaintext blocks that can be processed.

[0005] The present disclosure has been made in order to solve such problems, and provides an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, a method, and an authenticated encryption method that can increase the number of plaintext blocks that can be processed in one authenticated encryption while achieving high security. program The purpose of this invention is to provide [Means for solving the problem]

[0006] The authentication encryption device disclosed herein includes an encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each area of ​​a predetermined length using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each area using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements in the encryption; a random number encryption means for encrypting the set of random numbers generated in each area using the tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; and a tag generation means for encrypting the set of random numbers generated in the last area using the tweakable block cipher to generate a tag for authentication.

[0007] In addition, the authentication decryption device disclosed herein includes a decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each region of a predetermined length using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each region using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each region and a predetermined matrix having predetermined values ​​as elements in the decryption; a random number encryption means for encrypting the set of random numbers generated in each region using the tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next region; a tag generation means for encrypting the set of random numbers generated in the last region using the tweakable block cipher to generate a tag for inspection; and a tag inspection means for comparing the inspection tag with an input authentication tag to inspect for tampering and performing control to output the inspection result.

[0008] The authentication encryption system according to the present disclosure includes an authentication encryption device and an authentication decryption device that communicates with the authentication encryption device, the authentication encryption device including encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each area of ​​a predetermined length using a tweakable block cipher using a nonce as a tweak, a first random number calculation means for generating a set of random numbers for each area using data derived from at least one of an input and an output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements in the encryption, a first random number encryption means for encrypting the set of random numbers generated in each area using the tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area, and a first tag generation means for encrypting the set of random numbers generated in the last area using the tweakable block cipher to generate a tag for authentication, The apparatus includes a decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each region of a predetermined length using a tweakable block cipher using the nonce as a tweak; a second random number calculation means for generating a set of random numbers for each region in the decryption using data derived from at least one of an input and an output of a function related to the tweakable block cipher in each region and a predetermined matrix having predetermined values ​​as elements; a second random number encryption means for encrypting the set of random numbers generated in each region using the tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next region; a second tag generation means for encrypting the set of random numbers generated in the last region using the tweakable block cipher to generate a tag for inspection; and a tag inspection means for inspecting for tampering by comparing the inspection tag with the input authentication tag and controlling output of the inspection result.

[0009] In addition, the authentication encryption method disclosed herein uses a tweakable block cipher using a nonce as a tweak to encrypt a plaintext divided into plaintext blocks of a predetermined length for each area of ​​a predetermined length, and in the encryption, generates a set of random numbers for each area using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements, encrypts the set of random numbers generated in each area using the tweakable block cipher, and sets each of the encrypted random numbers as initial values ​​for processing in the next area, and encrypts the set of random numbers generated in the last area using the tweakable block cipher to generate an authentication tag.

[0010] In addition, the authentication decryption method disclosed herein uses a tweakable block cipher using a nonce as a tweak to decrypt a ciphertext divided into ciphertext blocks of a predetermined length for each region of a predetermined length, and in the decryption, generates a set of random numbers for each region using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each region and a predetermined matrix having predetermined values ​​as elements, encrypts the set of random numbers generated in each region using the tweakable block cipher, sets each of the encrypted random numbers as an initial value for processing in the next region, encrypts the set of random numbers generated in the last region using the tweakable block cipher to generate an inspection tag, and compares the inspection tag with an input authentication tag to check for tampering and perform control to output the inspection result.

[0011] In addition, the program disclosed herein causes a computer to execute the following steps: encrypting plaintext divided into plaintext blocks of a predetermined length for each area of ​​a predetermined length using a tweakable block cipher using a nonce as a tweak; generating a set of random numbers for each area using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each area and a predetermined matrix with predetermined values ​​as elements in the encryption; encrypting the set of random numbers generated in each area using the tweakable block cipher and setting each of the encrypted random numbers as the initial value for processing in the next area; and encrypting the set of random numbers generated in the last area using the tweakable block cipher to generate an authentication tag.

[0012] In addition, the program disclosed herein causes a computer to execute the following steps: decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each region of a predetermined length using a tweakable block cipher using a nonce as a tweak; in the decryption, generating a set of random numbers for each region using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each region and a predetermined matrix with predetermined values ​​as elements; encrypting the set of random numbers generated in each region using the tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next region; encrypting the set of random numbers generated in the last region using the tweakable block cipher to generate an inspection tag; and comparing the inspection tag with an input authentication tag to check for tampering and perform control to output the inspection result. Effect of the Invention

[0013] According to the present disclosure, an authenticated encryption device, an authenticated decryption device, an authenticated encryption system, a method, and an authenticated decryption method are provided that can increase the number of plaintext blocks that can be processed in one authenticated encryption while achieving high security. program can be provided. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating a configuration of an authentication encryption device according to a comparative example. [Diagram 2] FIG. 1 is a diagram illustrating a configuration of an authenticated encryption system according to a first embodiment. [Diagram 3] FIG. 1 is a diagram illustrating a configuration of an authentication encryption device according to a first embodiment. [Figure 4] 4 is a diagram for explaining the processing of a random number encryption unit and a tag generation unit of the authentication encryption device according to the first embodiment. FIG. [Diagram 5] FIG. 2 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the first embodiment. [Figure 8] FIG. 2 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the first embodiment. [Figure 9] FIG. 2 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating a configuration of an authentication and decryption device according to a first embodiment. [Figure 11] 4 is a diagram for explaining the processing of a random number encryption unit and a tag generation unit of the authentication and decryption device according to the first embodiment. FIG. [Figure 12] FIG. 4 is a diagram illustrating an outline of an operation in an authentication decryption process according to the first embodiment. [Figure 13] FIG. 4 is a diagram illustrating an outline of an operation in an authentication decryption process according to the first embodiment. [Figure 14] 4 is a flowchart showing an authentication encryption method executed in the authentication encryption device according to the first embodiment; [Figure 15] 5 is a flowchart showing an authentication and decryption method executed by the authentication and decryption device according to the first embodiment. [Figure 16]FIG. 11 is a diagram illustrating a configuration of an authentication encryption device according to a second embodiment. [Figure 17] 13 is a diagram for explaining the processing of a random number encryption unit and a tag generation unit of the authentication encryption device according to the second embodiment. FIG. [Figure 18] FIG. 11 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the second embodiment. [Figure 19] FIG. 11 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the second embodiment. [Figure 20] FIG. 11 is a diagram illustrating an outline of calculations in authenticated encryption processing according to the second embodiment. [Figure 21] FIG. 11 is a diagram illustrating a configuration of an authentication and decryption device according to a second embodiment. [Figure 22] FIG. 11 is a diagram illustrating a configuration of an authentication encryption device according to a third embodiment. [Figure 23] FIG. 11 is a diagram illustrating a configuration of an authentication and decryption device according to a third embodiment. [Figure 24] FIG. 11 is a diagram for explaining a second comparative example. [Diagram 25] FIG. 11 is a diagram for explaining a second comparative example. [Figure 26] FIG. 1 is a block diagram illustrating an example of the hardware configuration of a calculation processing device capable of realizing an apparatus and a system according to each embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] (Overview of the embodiment of the present disclosure) Prior to describing the embodiments of the present disclosure, an overview of the embodiments of the present disclosure will be described. Note that, although the embodiments of the present disclosure will be described below, the following embodiments do not limit the invention according to the claims. Also, not all of the combinations of features described in the embodiments are necessarily essential to the solution of the invention. Also, in the following description, indexes (English letters) used are not necessarily common throughout this specification. For example, index i may mean different things in one context and another context.

[0016] First, we will explain the basic input and output of authenticated encryption (AE). In the following explanation, we consider communication between Alice and Bob, two people who share a secret key K, and send a message encrypted by authenticated encryption from Alice to Bob.

[0017] The encryption function of authenticated encryption is Enc, and the decryption function is Dec. Furthermore, the plain text to be encrypted is M, and a variable N (initial vector) called a nonce is further introduced. Furthermore, the associated data (AD) is A. Here, the associated data A (header) is a value that is not encrypted but is used for tamper detection.

[0018] First, the encryption process on Alice's side will be explained. After generating a nonce N, Alice executes a process expressed as (C, T) = Enc_K (N, A, M). Here, Enc_K is an encryption function with a private key K as a parameter, and C is the ciphertext. Furthermore, T is a fixed-length variable for tamper detection called a tag (authentication tag). Alice transmits a set (N, A, C, T) of the nonce N, associated data A, ciphertext C, and tag T to Bob.

[0019] Next, the decryption process on Bob's side will be described. Let the information received by Bob be (N', A', C', T'). In this case, Bob executes Dec_K(N', A', C', T') as the decryption process. Note that Dec_K is a decryption function with the key K as a parameter. If there is tampering by a third party Eve during the communication and (N', A', C', T') ≠ (N, A, C, T), an error message (error symbol ⊥) indicating that there has been tampering is output for Dec_K(N', A', C', T'). That is, in this case, tampering is detected. On the other hand, if there is no tampering during the communication and (N', A', C', T') = (N, A, C, T), the plaintext M encrypted by Alice is correctly decrypted for Dec_K(N', A', C', T').

[0020] Also, in the above process, it is usually important to prevent the nonce N from accidentally matching a past value in encryption. For this reason, the encryption side uses some kind of state variable such as a counter to prevent the nonce from matching. That is, typically, the most recently used N is stored as a state variable, and N is incremented each time, thereby realizing that the nonce N does not overlap with past values.

[0021] In addition, Non-Patent Document 1 uses a block cipher called a Tweakable Block Cipher (TBC) that introduces a public tweaked value (auxiliary variable) called a tweak during encryption and decryption. In other words, in TBC, a keyed substitution that includes a tweak is performed on the input of the block cipher. TBCs with different tweaks can be regarded as independent block ciphers.

[0022] Here, if Tweak is Tw, the TBC function is expressed as the following Equation 1.

number

[0023] Fig. 1 is a diagram showing a configuration of an authenticated encryption device 80 according to a comparative example. Fig. 1 shows a configuration of an authenticated encryption device 80 realized using an encryption method in PFBω according to Non-Patent Document 1. Fig. 1 also shows an outline of the calculation of the authenticated encryption device 80 according to the comparative example.

[0024] The authentication encryption device 80 according to the comparative example includes an AD processing unit 82, an encryption unit 84, a calculation unit 86, and a tag generation unit 88. For convenience, the calculation unit 86 is illustrated in Fig. 1 as being separated into a front stage unit 86a and a rear stage unit 86b, but the calculation unit 86 may be an integrated unit. In other words, the calculation unit 86 may be configured such that the front stage unit 86a and the rear stage unit 86b are continuous with each other.

[0025] The AD processing unit 82 processes associated data (AD). Associated data A is input to the AD processing unit 82. The AD processing unit 82 divides the input associated data A into blocks (A_1,...,A_a) each having a length of b bits. That is, the data length of each of the associated data (AD) blocks A_1,...,A_a is b bits. Note that a indicates the number of AD blocks. The AD processing unit 82 processes each AD block using a TBC function to which the key K and Tweak are input.

[0026] Specifically, the AD processing unit 82 sets the initial value Z_0 (Z0) to 0^b(0 b Here, 0^b indicates b bits of all zero. The AD processor 82 calculates the value obtained by exclusive ORing (XOR) the initial value 0^b (=Z_0) and the first AD block A_1, and calculates the value by the TBC function E K ~ This encrypts the TBC function E K ~ The AD processing unit 82 calculates a value obtained by exclusive ORing the output encryption result Z_1 and the second AD block A_2 by applying the TBC function E K ~ This encrypts the TBC function E K ~ In this way, the AD processor 82 calculates the value obtained by exclusive ORing the output encryption result Z_i and the next (i+1)-th AD block A_(i+1) by the TBC function E K ~ The process of encrypting the data by i and encrypting it by a is repeated. Note that 1≦i≦a.

[0027] Then, the AD processing unit 82 outputs the value obtained by exclusive ORing the last AD block A_a and the encryption result Z_(a-1) as H_1 to the encryption unit 84. Here, H_1 is a b-bit value. The AD processing unit 82 also outputs the encryption result by the TBC function, that is, random numbers Z_1,...,Z_(a-1), which are the output values ​​of the TBC function, to the calculation unit 86. Note that Z is a value generated partway through the generation of H_1, and therefore can also be considered an intermediate value.

[0028] For security reasons, the tweak input to the TBC function must be in the format (0^n,i,0,0) for the block index i (1≦i≦a) of the related data A, as shown in Figure 1. n )" indicates n bits of all zero. Also, n indicates the data length (number of bits) of the nonce N. Note that although the tweaks input to multiple TBC functions are different from each other, the tweaks input to each TBC function can be the same even when different plaintexts are encrypted. In other words, the tweaks input to each TBC function can be constants. For example, the first E k ~ Tweak(0 n , 1, 0, 0) may be the same whether a certain plaintext Ma is encrypted or another plaintext Mb is encrypted. The same applies to the Tweak input to the TBC function in the encryption unit 84 and the tag generation unit 88, described later, except for the nonce value.

[0029] Also, the data length of the associated data A is assumed to be a multiple of b bits. Note that by increasing Tweak, AD processing becomes possible for associated data of any length (i.e., a length that is not a multiple of b bits). However, since this is self-evident to researchers in this field, a description will be omitted. This also applies to the present embodiment described below. Also, there are cases where the associated data (AD) is not included (is empty) as input to the AE. In such cases, the AD processing unit 82 is not necessary. In such cases, H_1 in the encryption unit 84 in FIG. 1 can be set to 0^b.

[0030] The encryption unit 84 encrypts plaintext. The encryption unit 84 receives the nonce N, plaintext M, and H_1 output from the AD processing unit 82. The encryption unit 84 divides the input plaintext M into blocks (M_1, . . . , M_m) each having a length of b bits. That is, the data length of each of the plaintext blocks M_1, . . . , M_m is b bits. Here, m indicates the number of plaintext blocks. The encryption unit 84 processes each plaintext block using the TBC function to which the key K, nonce N, and Tweak are input.

[0031] Specifically, the encryption unit 84 sets H_1 as an initial value. The encryption unit 84 applies the initial value H_1 to the TBC function E K ~ This encrypts the TBC function E K ~ As a result of encryption, a random number Z_a is output. Then, the encryption unit 84 obtains a ciphertext block C_1 by performing an exclusive OR on the output encryption result Z_a and the first plaintext block M_1. Note that Z is a value generated during the generation of the ciphertext blocks, and therefore can also be considered an intermediate value.

[0032] Next, the encryption unit 84 encrypts the plaintext block M_1 using the TBC function E K ~It encrypts. As a result of this encryption, a random number \(Z_{(a + 1)}\) is output. The encryption unit 84 obtains the ciphertext block \(C_2\) by performing an exclusive OR operation between the encryption result \(Z_{(a + 1)}\) and the second plaintext block \(M_2\). In this way, the encryption unit 84 repeats the process of obtaining the ciphertext block \(C_{(i + 1)}\) by performing an exclusive OR operation between the encryption result \(Z_{(a + i)}\) of the \(i\)-th plaintext block \(M_i\) and the next \((i + 1)\)-th plaintext block \(M_{(i + 1)}\), where \(0\leq i\leq m\).

[0033] And when the last plaintext block \(M_m\) is encrypted by the TBC function \(E\) K ~ the encryption result \(Z_{(a + m)}\) is output as \(T_1\) to the tag generation unit 88. Note that \(T_1\) is a \(b\)-bit value and is part of the tag. Also, the encryption unit 84 outputs the generated ciphertext blocks \(C_1,\cdots,C_m\) as the ciphertext \(C = C_1\|\cdots\|C_m\). Here, "\(\|\)" indicates the concatenation of bit strings. Also, the ciphertext \(C\) has the same length (bit length) as the plaintext \(M\). Further, the encryption unit 84 outputs the encryption results, that is, the random numbers \(Z_a,\cdots,Z_{(a + m)}\) which are the output values of the TBC function, to the calculation unit 86.

[0034] Note that the Tweak input to the TBC function needs to be in the form shown in FIG. 1 for security reasons. That is, the encryption unit 84 encrypts \(M_i\) using the encryption result of the TBC function with \((N,a,i,0)\) as the Tweak for the block index \(i(1\leq i\leq m)\) of the plaintext \(M\) to obtain \(C_i\). The Tweak input to the TBC function (the one that takes \(M_m\) as input and obtains \(T_1\)) used at the end of the encryption unit 84 is \((N,a,m,1)\). Also, as described above, the Tweaks input to the multiple TBC functions are different from each other, but each Tweak input to each TBC function can be the same except for the value of the nonce \(N\) even when different plaintexts are encrypted. That is, each Tweak input to each TBC function can be a constant except for the value of the nonce \(N\). Note that this also applies to the embodiments described later.

[0035] Also, like the related data, the data length of plaintext M is a multiple of b bits. Note that by increasing Tweak, plaintext processing becomes possible for plaintexts of any length (i.e., lengths that are not multiples of b bits). However, this is self-evident to researchers in this field, so an explanation will be omitted. Also, as mentioned above, if the related data (AD) is not included in the input of AE, H_1 should be set to 0^b.

[0036] The calculation unit 86 receives random numbers Z_1, . . ., Z_(a-1), Z_a, . . ., Z_(a+m) generated by the AD processing unit 82 and the encryption unit 84. That is, all output values ​​of the TBC functions in the AD processing unit 82 and the encryption unit 84 are input to the calculation unit 86. Then, the calculation unit 86 generates ω-1 values ​​using these random numbers and a predetermined matrix AM (Alpha Matrix).

[0037] Here, as shown in the following formula 2, the predetermined matrix AM is a matrix of size (ω-1)×(a+m) with predetermined values ​​α_(i,j) as elements. Here, ω is a value indicating a predetermined security level, and is an integer equal to or greater than 3. Here, i is an index of the number of rows in the matrix AM, and corresponds to the line index. Here, 2≦i≦ω. Here, j is an index of the number of columns in the matrix AM, and corresponds to the index of the input random number Z, that is, the block index. Here, 1≦j≦a+m.

number

[0038] The calculation unit 86 processes the random numbers Z_1, . . ., Z_(a-1), Z_a, . . ., Z_(a+m) using the matrix AM as shown in the following equation 3, to generate H_2, . . ., H_ω.

number

[0039] Furthermore, from equation 3, the following equation 4 holds for each line i (2≦i≦ω).

number

[0040] Here, element α_(i,j) of matrix AM is an element of the finite field GF(2^b). Also, element α_(i,j) of matrix AM is a specific value of b bits. Also, the "·" in α_(i,j)·Z_j means multiplication in the finite field GF(2^b), and is represented in Figure 1 by a symbol of an "X" in a circle. Also, a symbol of a "+" in a circle indicates exclusive OR (XOR).

[0041] That is, the calculation unit 86 calculates H_i by performing an exclusive OR of the multiplication value of the random number Z_j and α_(i,j) for each of the ω-1 lines i (2≦i≦ω). In the comparative example (Non-Patent Document 1), the random number Z_j is expanded from 1 to ω-1 in order to obtain high security. Therefore, it can be said that ω means the expansion number. Here, H_2,...,H_ω are each b-bit values ​​and are used in the tag generation process. Then, the calculation unit 86 outputs the obtained H_2,...,H_ω to the tag generation unit 88. In addition, the predetermined matrix AM shown in Equation 2 needs to satisfy a specific condition for security reasons. This will be described in detail later.

[0042] The tag generating unit 88 generates a tag T. The tag generating unit 88 receives T_1 from the encryption unit 84 and H_2,...,H_ω from the calculation unit 86. Furthermore, the tag generating unit 88 receives a nonce N. The tag generating unit 88 outputs T_1 as it is as a part of the tag. Furthermore, the tag generating unit 88 encrypts H_2,...,H_ω using a TBC function to which a key K, a nonce N, and Tweak, which is a constant, are respectively input. As a result, T_2,...,T_ω are obtained as encryption results. The tag generating unit 88 outputs these encryption results as tags. That is, the tag generating unit 88 outputs T_1,...,T_ω as a tag T=T_1||...||T_ω.

[0043] For security reasons, the tweak input to the TBC function must be in the format shown in Fig. 1. That is, the tag generation unit 88 obtains T_i by encrypting H_i using the encryption result of the TBC function that inputs (N, a, m, i) as a tweak for index i (2 < i < ω) of H. Also, as described above, the tweaks input to the multiple TBC functions are different from each other, but the tweaks input to each TBC function can be the same except for the value of the nonce N even when different plaintexts are encrypted. That is, the tweaks input to each TBC function can be constants except for the value of the nonce N.

[0044] Here, the problems associated with the comparative example will be described. In the authenticated encryption process (AE) according to the comparative example, due to security restrictions, the total number of AD blocks and plaintext blocks that can be processed at one time must be (2^b-1) or less. If no related data is input, due to security restrictions, the number of plaintext blocks that can be processed at one time must be (2^b-2) or less. That is, if the total number of AD blocks and plaintext blocks or the total number of plaintext blocks does not satisfy the above condition due to security restrictions, the matrix AM of α_ij shown in Equation 2 cannot satisfy the condition described below.

[0045] That is, the matrix AM must be a Maximum Distance Separable (MDS) matrix. In other words, all of the submatrices of the matrix AM that are square matrices must be regular. Here, a "submatrix" is a matrix that can be obtained by removing a specific row (which may be single or multiple) and a specific column (which may be single or multiple) from a matrix. Furthermore, the security of the matrix AM when it does not satisfy the above conditions is currently unknown. Therefore, the matrix AM must be an MDS matrix.

[0046] It can be mathematically proven that when the number of columns of the matrix AM exceeds 2^b-1, no matrix that satisfies the above condition exists. Here, "2^b-1" is the number of elements in the multiplicative group of the finite field GF(2^b) (i.e., the number of b-bit values ​​other than 0). Therefore, a+m≦2^b-1 must be true. Note that when the associated data (AD) is empty, due to the difference between AD processing and encryption processing, m≦2^b-2 must be true, as explained below.

[0047] That is, when the related data is not empty, in order to process the related data A of a AD blocks, it is necessary to prepare a matrix AM of the matrix AM of the formula 2 with the number of columns being a-1. This is because, as shown in FIG. 1, the AD blocks can be processed before and after the TBC function. That is, the first AD block A_1 is processed before the processing of the first TBC function, and the second AD block A_2 is processed after the TBC function. Also, the second AD block A_2 is processed before the processing of the second TBC function, and the third AD block A_3 is processed after the TBC function. After this, this is repeated, and finally, the a-1th AD block A_(a-1) is processed before the processing of the a-1th TBC function, and the ath, that is, the last AD block A_a is processed after the TBC function.

[0048] Also, in order to process plaintext M of m plaintext blocks, as shown in FIG. 1, it is necessary to prepare a matrix AM of Equation 2 with the number of columns being m+1. This is because, as shown in FIG. 1, it is necessary to generate a ciphertext block C_m using the m-th TBC function and the m-th (i.e., the last) plaintext block M_m, and then process the m-th plaintext block M_m with the m+1-th TBC function. Thus, if the associated data is not empty, it is necessary to satisfy (a-1)+(m+1)≦2^b-1, that is, a+m≦2^b-1. That is, if a+m≦2^b-1 in the matrix AM of Equation 2, the AE process is also possible in the PFBω according to the comparative example (Non-Patent Document 1). On the other hand, if the associated data is empty, it is necessary to satisfy m+1≦2^b-1, that is, m≦2^b-2. That is, if m≦2^b-2 in the matrix AM of Equation 2, the AE process is also possible in the PFBω according to the comparative example (Non-Patent Document 1).

[0049] As described above, the PFBω according to the comparative example (Non-Patent Document 1) has a limit on the number of blocks that can be processed at one time (the number of plaintext blocks, or the sum of the number of AD blocks and the number of plaintext blocks). Here, as described above, the PFBω can achieve a relatively high level of security of ωb bits. Therefore, ideally, it is desirable that the plaintext length that can be processed for the input in one AE process is about 2^(ωb) blocks. However, the PFBω has the same limit on the number of input blocks as the case of AE with b bits of security, which is inefficient.

[0050] In contrast, the authenticated encryption according to this embodiment can increase the number of plaintext blocks that can be processed in one authenticated encryption while realizing high security, as described below. That is, the authenticated encryption according to this embodiment can realize security greater than b bits and process (2^b-1) or more blocks by using a b-bit input / output TBC function. Note that this embodiment can target a security level greater than 2b bits of security.

[0051] (Embodiment 1) Hereinafter, the embodiments will be described with reference to the drawings. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same reference numerals, and repeated explanations are omitted as necessary. Note that the authenticated encryption method according to the first embodiment corresponds to a configuration in which the PFBω according to the comparative example (Non-Patent Document 1) is improved.

[0052] FIG. 2 is a diagram showing a configuration of an authentication encryption system 1 according to the first embodiment. The authentication encryption system 1 includes an authentication encryption device 10 and an authentication decryption device 20. The authentication encryption device 10 and the authentication decryption device 20 may be physically integrated or may be separate. When the authentication encryption device 10 and the authentication decryption device 20 are physically separate from each other, the authentication encryption device 10 and the authentication decryption device 20 are connected to each other so as to be able to communicate with each other via wire or wirelessly. In addition, components of the authentication encryption device 10, which will be described later, may be realized by different devices. Similarly, components of the authentication decryption device 20, which will be described later, may be realized by different devices.

[0053] In the following description, unless otherwise specified, the length of one block among the multiple blocks obtained by dividing the associated data A, the plaintext M, the ciphertext C, etc. is a predetermined length of b bits. In addition, in the above-mentioned example of communication between Alice and Bob, the authentication encryption device 10 corresponds to Alice, and the authentication decryption device 20 corresponds to Bob. That is, communication is performed between the authentication encryption device 10 and the authentication decryption device 20.

[0054] <Authentication Encryption Device> Fig. 3 is a diagram showing a configuration of the authentication encryption device 10 according to the first embodiment. As shown in Fig. 3, the authentication encryption device 10 includes an input unit 100, a division unit 102, a nonce generation unit 104, an AD processing unit 110, an encryption unit 120, a random number calculation unit 130, a random number encryption unit 140, a tag generation unit 150, and an output unit 160.

[0055] The authentication encryption device 10 can be realized by an information processing device such as a computer. That is, the authentication encryption device 10 has an arithmetic device such as a CPU (Central Processing Unit) and a storage device such as a memory or a disk. The authentication encryption device 10 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0056] The input unit 100 functions as an input means. The division unit 102 functions as a division means. The nonce generation unit 104 functions as a nonce generation means. The AD processing unit 110 functions as an associated data processing means. The encryption unit 120 functions as an encryption means. The random number calculation unit 130 functions as a random number calculation means (calculation means). The random number encryption unit 140 functions as a random number encryption means. The tag generation unit 150 functions as a tag generation means. The output unit 160 functions as an output means.

[0057] The input unit 100 accepts input of plaintext M to be encrypted and related data A. The input unit 100 may be realized by an input device such as a keyboard. The input unit 100 may accept input of plaintext M and related data A from an external device connected via a network, for example. Note that there may be cases where related data A does not exist, in which case related data A is not input. The input unit 100 outputs plaintext M and related data A to the division unit 102.

[0058] The division unit 102 divides each of the plaintext M and the associated data A into blocks of a predetermined length. Specifically, the division unit 102 divides the plaintext M into plaintext blocks M_1,...,M_m, each of b bits, where m is the number of plaintext blocks. The division unit 102 outputs the plaintext blocks M_1,...,M_m to the encryption unit 120. The division unit 102 also divides the associated data A into AD blocks A_1,...,A_a, each of b bits, where a is the number of AD blocks. The division unit 102 outputs the AD blocks A_1,...,A_a to the AD processing unit 110.

[0059] Furthermore, the division unit 102 divides the divided AD blocks A_1,...,A_a and plaintext blocks M_1,...,M_m into sections (groups) each having a block count of (2^b-2). That is, one section contains (2^b-2) blocks. Here, the sections are designated as section #1,...,section #β. Here, β is the number of sections. Section #k indicates the k-th section. Note that 1≦k≦β. At this time, the division unit 102 may divide the data string D=A_1||···||A_a||M_1||···||M_m into sections in the order of section #1, section #2,...,section #β, starting from the first block of the data string.

[0060] Specifically, the division unit 102 performs division so that all AD blocks A_1,...,A_a are included in the area #1. Then, if a<2^b-2, the division unit 102 performs division so that m' plaintext blocks are included in the area #1. Here, m' is the number of plaintext blocks included in the area #1 (first area). Then, m' satisfies a+m'=2^b-2. Note that in the first embodiment, m>m'.

[0061] Then, the division unit 102 divides the remaining (m-m') plaintext blocks into area #2 to area #β. Hereinafter, unless otherwise specified, the description will be made assuming that a<2^b-2. Note that β is a value determined according to the number a of AD blocks, the number m of plaintext blocks, and the value of 2^b-2 (i.e., the value of b). In other words, when (a+m)mod(2^b-2)=0, β corresponds to the quotient of the division (a+m) / (2^b-2). On the other hand, when (a+m)mod(2^b-2)≠0, β corresponds to the value obtained by adding 1 to the quotient of the division (a+m) / (2^b-2).

[0062] In addition, when a=2^b-2, the (2^b-2) blocks divided into section #1 are all AD blocks. Then, the division unit 102 divides the (2^b-2) plaintext blocks from the first block of the data string D=M_1||···||M_m into section #2.

[0063] Furthermore, if a>2^b-2, all of the (2^b-2) blocks that are allocated to area #1 become AD blocks. The remaining AD blocks are then allocated to area #2. When all AD blocks A_1,...,A_a have been allocated to areas #1 and #2, plaintext blocks are allocated to area #2 so that the total number of AD blocks and plaintext blocks allocated to area #2 is (2^b-2). Here, if the number of plaintext blocks allocated to area #2 is m'', then a+m''=2×(2^b-2). Note that if the allocation of all AD blocks is still not complete even after the AD blocks have been allocated to areas #1 and #2, further AD blocks are allocated to area #3 in a similar manner.

[0064] When the related data is empty, the division unit 102 divides the data string D=M_1||···||M_m into sections in the order of section #1, section #2,..., section #β from the beginning of the data string. In this case, if the number of plaintext blocks divided into section #1 is m', then m'=2^b-2.

[0065] If the bit string of a plaintext block divided into block #k is called the block plaintext block M[k], the plaintext M can also be written as M=M[1]||M[2]||···||M[β]. In this case, the number of plaintext blocks contained in the block plaintext block M[k] other than at least M[1] and M[β] is (2^b-2). In addition, if the related data is empty, the number of plaintext blocks contained in the block plaintext block M[1] is also (2^b-2).

[0066] Here, by dividing the blocks (AD blocks and plaintext blocks) into (2^b-2) blocks, encryption and random number calculation can be performed for each block using the method of PFBω according to the comparative example, as described later. This makes it possible to achieve the security of PFBω without relying on the limitation on the number of blocks, which is a problem in PFBω.

[0067] As stated above, if the associated data is not empty, a+m≦2^b-1 must be satisfied, and if the associated data is empty, m≦2^b-2 must be satisfied. However, in order to reduce the complexity of the process, in the first embodiment, the number of blocks per area is set to (2^b-2). Therefore, in the first embodiment, as will be described later, encryption and random number calculation are performed for each of (2^b-2) blocks (areas). As a result, in the first embodiment, even if a+m>2^b-1, authenticated encryption can be performed on the plaintext M at once. Details will be described later.

[0068] The nonce generation unit 104 generates a nonce N so that it does not overlap with past values. That is, the nonce generation unit 104 generates a nonce N different from values ​​generated in the past. Specifically, for example, the nonce generation unit 104 first outputs an arbitrary fixed value. The nonce generation unit 104 also stores the value of the nonce generated immediately before. Then, when generating a nonce N for the second or subsequent times, the nonce generation unit 104 outputs a value obtained by adding 1 to the stored immediately previous value. In this manner, the nonce generation unit 104 may generate a nonce N different from values ​​generated in the past by outputting a value obtained by adding 1 to the value already output one time before. Note that the nonce generation unit 104 may generate a nonce by a method different from the above-mentioned example, as long as it can generate a value different from values ​​generated in the past. The nonce generation unit 104 outputs the generated nonce N to the encryption unit 120, the random number encryption unit 140, and the tag generation unit 150. Furthermore, the nonce generation unit 104 may output the generated nonce N to the output unit 160.

[0069] The AD processing unit 110 processes the associated data A in the same manner as the AD processing unit 82 shown in FIG. 1. That is, the AD processing unit 110 processes the AD blocks A_1,...,A_a using the TBC function to which the key K and Tweak are input. At this time, the AD processing unit 110 processes the AD blocks for each of the above-mentioned areas. Note that if a<2^b-2, the processing of the AD processing unit 110 is substantially the same as the processing of the AD processing unit 82. The AD processing unit 110 outputs H_1 to the encryption unit 120. In addition, the AD processing unit 110 outputs random numbers Z_1,...,Z_(a-1), which are output values ​​of the TBC function, to the random number calculation unit 130.

[0070] Note that the tweaks input to the TBC functions used in the AD processing unit 110 may be different from the tweaks input to the TBC functions used in the AD processing unit 82. This will be described in detail later.

[0071] The encryption unit 120 processes the plaintext M in the same manner as the encryption unit 84 shown in FIG. 1. That is, the encryption unit 120 processes the plaintext blocks M_1, . . . , M_m using the TBC function to which the key K and Tweak are input. Then, the encryption unit 120 generates a ciphertext block by exclusive-ORing the plaintext block and the encryption result obtained by encrypting the plaintext block preceding this plaintext block using the TBC function. At this time, the encryption unit 120 encrypts the plaintext block (plaintext) for each of the above-mentioned zones. That is, the encryption unit 120 encrypts the plaintext block included in zone #1 in the same manner as the encryption unit 84. Then, the encryption unit 120 encrypts the plaintext block included in zone #2 in the same manner as the encryption unit 84. Thereafter, the encryption unit 120 encrypts the plaintext block included in zone #k in the same manner as the encryption unit 84. That is, the encryption unit 120 encrypts the zone plaintext block M[k] included in zone #k.

[0072] The encryption unit 120 outputs the generated ciphertext blocks C_1,...,C_m to the output unit 160 as ciphertext C=C_1||||C_m. The encryption unit 120 also encrypts the block plaintext block M[k] included in the block #k to obtain the block ciphertext block C[k]. Here, the block ciphertext block C[k] is composed of the same number of ciphertext blocks as the block plaintext block M[k]. The encryption unit 120 outputs the random numbers Z (output values ​​of the TBC function) obtained in each block to the random number calculation unit 130.

[0073] Furthermore, the encryption unit 120 outputs the encryption result Z obtained by processing the last plaintext block with the TBC function in each zone other than the last zone #β as a random number S_1 to the random number encryption unit 140. This random number S_1 is encrypted by the random number encryption unit 140 and becomes the initial value for the processing of the encryption unit 120 in the next zone. Furthermore, the encryption unit 120 outputs the encryption result Z obtained by processing the last plaintext block with the TBC function in the last zone #β as a random number S_1 to the tag generation unit 150. Details of the processing of the encryption unit 120 will be described later.

[0074] Note that the tweaks input to the TBC functions used in the encryption unit 120 may be different from the tweaks input to the TBC functions used in the encryption unit 84. Details will be described later. Note that in order to distinguish between the tweaks input to the TBC functions used in the AD processing performed for each area and the encryption processing, the number of digits of the tweak in the first embodiment is greater than the number of digits of the tweak in the comparative example. That is, in the comparative example, processing is performed for only one area, whereas in the first embodiment, processing is performed for multiple areas, so that the number of digits needs to be increased accordingly to distinguish between the tweaks.

[0075] 1, the random number calculation unit 130 calculates a value (random number) for generating a tag, using the random number Z generated by the AD processing unit 110 and the encryption unit 120 and a predetermined matrix AM. The matrix AM according to the first embodiment is shown in the following formula 5. Here, the matrix AM is a matrix with a size of (ω-1)×(2^b-1) and with predetermined values ​​α_(i,j) as elements.

number

[0076] The random number calculation unit 130 calculates a random number S for each area. Specifically, the random number calculation unit 130 generates a set of ω-1 random numbers S (S_2, . . . , S_ω) for each area using the random number Z generated by the AD processing unit 110 and the encryption unit 120 and a predetermined matrix AM. Here, as described later, the set of random numbers S is used to generate an initial value for processing in the next area. In addition, the set of random numbers S generated in the processing in the last area is used to generate a tag T. The random number calculation unit 130 calculates S_i by performing an exclusive OR on the multiplication value of the random number Z_j and α_(i,j) for each of the ω-1 lines i (2≦i≦ω) in each area.

[0077] That is, the random number calculation unit 130 processes random numbers Z_1^(k),...,Z_(2^b-1)^(k) using a matrix AM in each area #k as shown in the following formula 6 to generate a set of random numbers S_2^(k),...,S_ω^(k). That is, the random number calculation unit 130 generates a set of random numbers for each area #k using the same matrix AM shown in formula 5. Here, k is an index of the number of areas.

number

[0078] From equation 6, the following equation 7 holds for i (2≦i≦ω).

number

[0079] Here, the random number calculation unit 130 sets the initial value of each line of the exclusive OR of the multiplication value of Z and α for each zone as a set of random numbers generated in the previous zone and encrypted by the random number encryption unit 140 described later. Details will be described later. The random number calculation unit 130 outputs the set of random numbers S_1^(k),...,S_ω^(k) generated for each zone #k other than the last zone #β to the random number encryption unit 140. The random number calculation unit 130 also outputs the set of random numbers S_1^(β),...,S_ω^(β) generated for the last zone #β to the tag generation unit 150. As described above, the random number S_1^(k) in each zone #k is generated by the encryption unit 120 and output to the random number encryption unit 140 or the tag generation unit 150. Details of the processing by the random number calculation unit 130 will be described later.

[0080] The random number encryption unit 140 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k except the last area #β, using the nonce N. Specifically, the random number encryption unit 140 receives the nonce N from the nonce generation unit 104. The random number encryption unit 140 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k, using a TBC function to which Tweak including the nonce N and key K are input.

[0081] Then, the random number encryption unit 140 sets the encryption result obtained by encrypting the set of random numbers S_1^(k),...,S_ω^(k) as the initial value (initial state) of the process in the next area #(k+1). That is, the encrypted random number S_1^(k) becomes the initial value of the process of the encryption unit 120 in the next area #(k+1). Also, the encrypted random numbers S_2^(k),...,S_ω^(k) become the initial value of each line i (2≦i≦ω) in the process of the random number calculation unit 130 in the next area #(k+1). The specific process of the random number encryption unit 140 will be described later.

[0082] The tag generation unit 150 generates a tag T for authentication by using a set of random numbers S_1^(β),...,S_ω^(β) generated for the last area #β and a nonce N. Specifically, the tag generation unit 150 receives the nonce N from the nonce generation unit 104. The tag generation unit 150 encrypts the set of random numbers S_1^(β),...,S_ω^(β) generated for the area #β by using the nonce N. That is, the tag generation unit 150 encrypts the set of random numbers S_1^(β),...,S_ω^(β) generated for the area #β by using a TBC function to which a tweak including the nonce N and a key K are input. The tag generation unit 150 encrypts the set of random numbers S_1^(β),...,S_ω^(β) to obtain tags T[1],...,T[ω] as the encryption result. A specific process of the tag generation unit 150 will be described later.

[0083] FIG. 4 is a diagram for explaining the processing of the random number encryption unit 140 and the tag generation unit 150 of the authentication encryption device 10 according to the first embodiment. For the sake of clarity, the related data is left blank in FIG. 4. As described above, the authentication encryption device 10 divides the plaintext blocks of the plaintext M into block plaintext blocks M[1], M[2], . . . , M[β] corresponding to block #1, block #2, . . . block #β, respectively. As described above, each block plaintext block M[k] includes (2^b-2) plaintext blocks.

[0084] Then, the encryption unit 120 and the random number calculation unit 130 generate a block ciphertext block C[1] and a set of random numbers S_1^(1),...,S_ω^(1) for the block #1 using the input nonce N and block plaintext block M[1]. The random number encryption unit 140 encrypts the set of random numbers S_1^(1),...,S_ω^(1) generated for the block #1. The random number encryption unit 140 then sets the encrypted set of random numbers S_1^(1),...,S_ω^(1) as the initial value (initial state) for the next block #2. That is, the encrypted random number S_1^(1) becomes the initial value of the process of the encryption unit 120 in the next block #2. Also, the encrypted random numbers S_2^(1),...,S_ω^(1) become the initial value of each line in the process of the random number calculation unit 130 in the next block #2.

[0085] Furthermore, the encryption unit 120 and the random number calculation unit 130 use the input nonce N and the block plaintext block M[2] to generate a block ciphertext block C[2] and a set of random numbers S_1^(2),...,S_ω^(2) for block #2. At this time, the encryption unit 120 and the random number calculation unit 130 set the encryption result of S_1^(1),...,S_ω^(1) as the initial state in the process for block #2. The random number encryption unit 140 encrypts the set of random numbers S_1^(2),...,S_ω^(2) generated for block #2. Then, the random number encryption unit 140 sets the encrypted set of random numbers S_1^(2),...,S_ω^(2) as the initial value (initial state) in the next block #3. That is, the encrypted random number S_1^(2) becomes the initial value of the process of the encryption unit 120 in the next block #3. Moreover, the encrypted random numbers S_2^(2), . . . , S_ω^(2) become the initial values ​​of each line in the processing of the random number calculation unit 130 in the next area #3.

[0086] Similarly, the encryption unit 120 and the random number calculation unit 130 use the input nonce N and the block plaintext block M[k] to generate a block ciphertext block C[k] and a set of random numbers S_1^(k),...,S_ω^(k) for each block #k. At this time, the encryption unit 120 and the random number calculation unit 130 set the encryption result of S_1^(k-1),...,S_ω^(k-1) as the initial state in the process for the block #k. The random number encryption unit 140 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for the block #k other than the last block #β. ​​Then, the random number encryption unit 140 sets the set of random numbers S_1^(k),...,S_ω^(k) encrypted in the block #k as the initial value (initial state) in the next block #(k+1).

[0087] At this time, the encryption unit 120 can perform processing for each area using substantially the same calculation as that of the encryption unit 84 according to the comparative example as a subroutine. Note that at this time, it is necessary to set Tweak appropriately. Also, the random number calculation unit 130 can call the matrix AM shown in Equation 5 for each area and perform processing using substantially the same calculation as that of the calculation unit 86 according to the comparative example as a subroutine. The same applies to the decryption processing in the authentication decryption device 20 described later.

[0088] Then, the tag generation unit 150 obtains authentication tags T[1],...,T[ω] using the set of random numbers S_1^(β),...,S_ω^(β) generated for the last section #β and the nonce N. Here, as described later, the authentication tag T is the encryption result obtained by encrypting the set of random numbers with the TBC function that inputs the nonce N and Tweak including the number m of plaintext blocks (plaintext length). Therefore, the security of the set of tags T is ensured.

[0089] 5 to 9 are diagrams showing an outline of the calculation in the authentication encryption process according to the first embodiment. FIG. 5 is a diagram showing an outline of the calculation of the AD processing unit 110 and the random number calculation unit 130 for the first area, that is, area #1. FIG. 6 is a diagram showing an outline of the calculation of the encryption unit 120 and the random number calculation unit 130 for the first area, that is, area #1. FIG. 7 is a diagram showing an outline of the calculation of the random number encryption unit 140. FIG. 8 is a diagram showing an outline of the calculation of the encryption unit 120 and the random number calculation unit 130 for the second area, that is, area #2. FIG. 9 is a diagram showing an outline of the calculation of the tag generation unit 150. For convenience, the random number calculation unit 130 is depicted as being separated into a front stage unit 130a and a rear stage unit 130b in FIG. 5 and FIG. 6, but the random number calculation unit 130 may be an integrated unit. That is, the random number calculation unit 130 may be configured such that the front stage unit 130a and the rear stage unit 130b are continuous with each other. In fact, in FIG. 8, the random number calculation unit 130 is depicted as an integrated unit.

[0090] As shown in FIG. 5, the AD processing unit 110 performs substantially the same processing as the AD processing unit 82 shown in FIG. 1 on the AD blocks A_1, . . . , A_a for the area #1. Then, the AD processing unit 110 outputs the encryption result, that is, the random numbers Z_1^(1), . . . , Z_(a-1)^(1), which are the output values ​​of the TBC function, to the random number calculation unit 130. As described above, k in Z_j^(k) is an index of the number of areas. That is, the "(1)" in the random number Z_1^(1) indicates that it is a random number generated in the area #1 (first area). The AD processing unit 110 outputs the value obtained by exclusive ORing the last AD block A_a and the encryption result Z_(a-1)^(1) to the encryption unit 120 as H_1. In the examples of FIG. 5 to FIG. 9, a<2^b-2, so the AD processing unit 110 performs processing only on the area #1.

[0091] As shown in FIG. 6, the encryption unit 120 performs substantially the same processing as the encryption unit 84 shown in FIG. 1 on M_1,...,M_m' of the plaintext blocks M_1,...,M_m for the area #1. The encryption unit 120 then obtains ciphertext blocks C_1,...,C_m' corresponding to M_1,...,M_m', respectively. The encryption unit 120 also outputs the encryption result, that is, random numbers Z_a^(1),...,Z_(a+m')^(1), which are output values ​​of the TBC function, to the random number calculation unit 130. The encryption unit 120 obtains the last random number Z_(a+m')^(1) in the area #1 by encrypting the last plaintext block M_m' in the area #1 with the last TBC function in the area #1. Furthermore, when the last plaintext block M_m' is encrypted with the TBC function, the encryption unit 120 outputs the encryption result Z_(a+m')^(1) to the random number calculation unit 130 as S_1^(1).

[0092] Here, as described above, the tweak input to each of the TBC functions used in the AD processing unit 110 and the encryption unit 120 is different from the tweak input to each of the TBC functions used in the AD processing unit 82 and the encryption unit 84. The tweak input to the TBC function used in the AD processing unit 110 is (0^n,i,0,0,0) for the block index i (1≦i≦a) of the related data A. Also, the tweak input to the TBC function used in the encryption unit 120 is (N,a,i,0,0) for the block index i (1≦i≦m') of the plain text M. Note that for the area #1, the tweak input to the TBC function used last in the encryption unit 120 (which inputs M_m' and obtains S_1^(1)) is (N,a,m',1,0). By setting the tweak in this way, a certain tweak will not match another tweak.

[0093] 5 and 6, the random number calculation unit 130 processes random numbers Z_1^(1),...,Z_(a-1)^(1),Z_a^(1),...,Z_(a+m')^(1) generated by the AD processing unit 110 and the encryption unit 120 for area #1. That is, the random number calculation unit 130 processes random numbers Z_1^(1),...,Z_(a-1)^(1),Z_a^(1),...,Z_(a+m')^(1) using the matrix AM shown in equation 5 according to equation 6 above. In this way, the random number calculation unit 130 generates a set of random numbers S_2^(1),...,S_ω^(1) for area #1. In other words, the random number calculation unit 130 generates a set of random numbers S_2^(1),...,S_ω^(1) by calculating the exclusive OR of the multiplication values ​​of the random numbers Z_1^(1),...,Z_(a+m')^(1) and the corresponding elements of the matrix AM. The random number calculation unit 130 outputs the set of random numbers S_1^(1),...,S_ω^(1) generated for the area #1 to the random number encryption unit 140.

[0094] Here, as described above, a+m'=2^b-2. That is, the last random number Z_(a+m')^(1) of area #1 corresponds to Z_(2^b-2)^(1). Therefore, for area #1, in the above formula 6, Z_(2^b-1)^(1)=0. That is, for area #1, the last column (α_(2,2^b-1),···α_(ω,2^b-1)) of the matrix AM shown in the above formula 5 is not used. That is, in area #1, 0 (=α_(i,2^b-1)·Z_(2^b-1)^(1)) is exclusive-ORed in the last exclusive-OR of the above formula 7. This is also true in the decryption process in the authentication decryption device 20 described later.

[0095] 7, the random number encryption unit 140 encrypts the set of random numbers S_1^(k), . . . , S_ω^(k) generated for each area #k using a TBC function E K ~ The random number encryption unit 140 uses the TBC function to encrypt the data. A Tweak that is used only once is input to the TBC function. K ~ ' ' to the top right, the function E K ~ In the example of Figure 7, the TBC function E K ~ The Tweak input to ' includes a nonce N, an index k of the region #k, and a line index i. For example, the TBC function E K ~ The Tweak input to the TBC function E ′ includes a nonce N, an index of region #1 “1”, and a line index “2”. K ~ The set of random numbers S_1^(k), . . . , S_ω^(k) encrypted using ' is input to the encryption unit 120 and the random number calculation unit 130 during processing in area #(k+1).

[0096] As shown in FIG. 8, the random number encryption unit 140 encrypts the set of random numbers S_1^(k), . . . ,S_ω^(k) generated for the area #1 using the TBC function E K ~ The encryption result is then input to the encryption unit 120 and the random number calculation unit 130 during processing in area #2.

[0097] Here, the TBC function E K ~ ' is any of the TBC functions E K ~ This is a TBC function that inputs a different tweak from the tweak input to the TBC function E. K ~ The Tweak input to ' does not include the number of AD blocks a and the number of plaintext blocks m, but is the same as other TBC functions E K ~ The Tweak input to the TBC function E K ~ The format of the tweak entered in ' is TBC function E K ~ For example, the TBC function E K ~ 'The Tweak entered in is the TBC function E K ~ In this case, the TBC function E used in the AD processing unit 110 and the encryption unit 120 may be expressed as (N, k, i, 0, 0, 1). K ~ The Tweak input to the function E can be (N, a, m', 0, 0, 0). K ~ The final value of Tweak input to the AD processor 110 and the encryption unit 120 is “1”, whereas the TBC function E K ~ The last value of Tweak input to the TBC function E may be "0". K ~and TBC function E K ~ The final value of the tweak entered can be different between ' and '. This allows you to avoid duplication of tweaks.

[0098] 8, for area #2, the encryption unit 120 performs the same processing as for area #1 on the (2^b-2) plaintext blocks M_(m'+1),...,M_(m'+2^b-2) following M_m' among the plaintext blocks M_1,...,M_m. Here, for area #2, the encryption unit 120 inputs the encryption result obtained by encrypting the random number S_1^(1) by the random number encryption unit 140 to the first TBC function as an initial value. That is, the random number S_1^(1) generated in area #1 is input to the TBC function E to which a tweak including the nonce N, the index "1" of area #1, and the line index "1" is input. K ~ The encryption result obtained by encrypting with ' corresponds to the initial value.

[0099] Then, the encryption unit 120 obtains ciphertext blocks C_(m'+1),...,C_(m'+2^b-2) corresponding to M_(m'+1),...,M_(m'+2^b-2), respectively. The encryption unit 120 also outputs the encryption results, that is, random numbers Z_1^(2),...,Z_(2^b-1)^(2), which are output values ​​of the TBC function, to the random number calculation unit 130. The encryption unit 120 obtains the last random number Z_(2^b-1)^(2) in area #2 by encrypting the last plaintext block M_(m'+2^b-2) in area #2 with the last TBC function in area #2. Furthermore, when the last plaintext block M_(m'+2^b-2) is encrypted with the TBC function, the encryption unit 120 outputs the encryption result Z_(2^b-1)^(2) to the random number calculation unit 130 as S_1^(2).

[0100] Also, as shown in FIG. 8, the random number calculation unit 130 processes random numbers Z_1^(2),...,Z_(2^b-1)^(2) generated by the encryption unit 120 for the area #2. That is, the random number calculation unit 130 processes random numbers Z_1^(2),...,Z_(2^b-1)^(2) using the matrix AM shown in Equation 5 according to Equation 6 above. In this way, the random number calculation unit 130 generates a set of random numbers S_2^(2),...,S_ω^(2) for the area #2. In other words, the random number calculation unit 130 generates a set of random numbers S_2^(2),...,S_ω^(2) by calculating the exclusive OR of the multiplication values ​​of the random numbers Z_1^(2),...,Z_(2^b-1)^(2) and the corresponding elements of the matrix AM.

[0101] Here, for area #2, the random number calculation unit 130 inputs the encryption result obtained by encrypting the random number S_i^(1) by the random number encryption unit 140 as an initial value to each line i. That is, the random number S_2^(1) generated in area #1 is input to the TBC function E K ~ The encryption result obtained by encrypting with ' corresponds to the initial value of line "2". Similarly, the random number S_ω^(1) generated in area #1 is encrypted by the TBC function E K ~ The encryption result obtained by encrypting with ' corresponds to the initial value of line "ω". The random number calculation unit 130 outputs the set of random numbers S_1^(2), . . . , S_ω^(2) generated for area #2 to the random number encryption unit 140.

[0102] Here, as described above, the tweak input to each TBC function used in the encryption unit 120 is different from the tweak input to each TBC function used in the encryption unit 84. In the area #2, the tweak input to the TBC function used in the encryption unit 120 is (N, a, i, 0, 0) for the block index i (m'+1≦i≦m'+2^b-2) of the plaintext M. Note that, for the area #2, the tweak input to the TBC function (which inputs M_(m'+2^b-2) and obtains S_1^(2)) used last in the encryption unit 120 is (N, a, m'+2^b-2, 1, 0). As a result, the tweak input to each TBC function in the area #2 is different from the tweak input to each TBC function in the area #1. The same applies to the decryption process in the authentication and decryption device 20 described later.

[0103] 5, 6, and 8 show an outline of the calculation for area #1 and area #2, but for area #3 and onwards, substantially the same calculation as for area #2 shown in FIG. 8 is performed. Therefore, a description of the specific processing for area #3 and onwards will be omitted. Each time the encryption unit 120 processes a certain area, it repeatedly calls the TBC function to encrypt the plaintext block. Also, each time the random number calculation unit 130 processes a certain area, it uses the encryption result obtained by encrypting the random numbers obtained for the previous area as the initial value for each line, and repeatedly calls the same matrix AM (i.e., the same element α) shown in Equation 5 to generate a set of random numbers.

[0104] The tweak input to each TBC function used in the encryption unit 120 is set according to the rule described above with reference to FIG. 8. That is, in each region #k, the tweak input to the first to (2^b-2)th TBC functions is (N, a, i, 0, 0) for the block index i of the plaintext M. The tweak input to the last (2^b-1) TBC function used in the encryption unit 120 is (N, a, i, 1, 0). Here, since i is the index of the number of plaintext blocks m, the tweak input to each TBC function in a certain region #k is different from the tweak input to each TBC function in another region. In the final region #β, if the number of plaintext blocks is less than 2^b-2, the value of the random number Z_(j)^(β) for the remaining portion is 0. The same applies to the decryption process in the authentication and decryption device 20 described later.

[0105] As shown in FIG. 9, the tag generator 150 generates a tag T for authentication by using a tweak including a nonce N, the number of AD blocks a, and the number of plaintext blocks m for each of the sets of random numbers S_1^(β), . . . ,S_ω^(β) generated for the last area #β. Here, a tweak that is used only once is input to the TBC function used by the tag generator 150. In FIG. 9, "E K ~ " The function E K ~ In the example of Figure 9, the TBC function E K ~ The Tweak input to includes a nonce N, the number of AD blocks a, the number of plaintext blocks m, the index "β" of the area #β, and the line index i. K ~ A tag T[i] is generated by encrypting a random number S_i^(β) using the TBC function E K ~The Tweak input to includes a nonce N, the number of AD blocks a, the number of plaintext blocks m, the index "β" of the area #β, and the line index "1". K ~ The tag T[1] is generated by encrypting the random number S_1^(β) using the above. Then, the tag generation unit 150 outputs T[1], . . . , T[ω] as the tag T = T[1] || . . . , T[ω].

[0106] Here, the random number encryption unit 140 uses the TBC function E K ~ ' is used, whereas the tag generator 150 uses the TBC function E K ~ Therefore, the TBC function E used in the tag generator 150 K ~ The tweak input to the random number encryption unit 140 is different from the tweak input to the TBC function E used in the AD processing unit 110 and the encryption unit 120. K ~ Unlike the Tweak input to the K ~ The Tweak input to includes the number of sections β and the line index i. Therefore, the TBC function E used in the tag generator 150 K ~ The tweak input to the encryption unit 120 is different from the tweak input to the TBC function used in the AD processing unit 110 and the encryption unit 120. This makes it possible to avoid duplication of tweaks. The same applies to the decryption process in the authentication and decryption device 20, which will be described later.

[0107] Furthermore, the TBC function E used in the tag generator 150 K ~The tweak input to includes the number a of AD blocks and the number m of plaintext blocks. Therefore, the security of the tag T can be ensured. That is, even if an attacker inputs tampering information in which the number a of AD blocks or the number m of plaintext blocks is different, the tampering information can be immediately rejected (the tampering can be detected). Therefore, it is clear that it is not easy to tamper with the tag T. In other words, since the tweak includes the number a of AD blocks and the number m of plaintext blocks, it becomes easy to prove the security of the tag T. In other words, the tag T can be safely generated from the random number S. The same applies to the decryption process in the authentication decryption device 20 described later. The same applies to the second embodiment described later.

[0108] The output unit 160 performs control to output the ciphertext C and the tag T. At this time, the output unit 160 may output the ciphertext C and the tag T in a concatenated form. The output unit 160 may perform control to display the ciphertext C and the tag T on an output device such as a display. The output unit 160 may also perform control to output the ciphertext C and the tag T to an external device connected via a network. The output unit 160 may also perform control to output the nonce N and the associated data A. For example, the output unit 160 transmits (N, A, C, T) to the authentication and decryption device 20.

[0109] <Authentication and Decryption Device> Fig. 10 is a diagram showing a configuration of the authentication and decryption device 20 according to the first embodiment. As shown in Fig. 10, the authentication and decryption device 20 includes an input unit 200, a division unit 202, an AD processing unit 210, a decryption unit 220, a random number calculation unit 230, a random number encryption unit 240, a tag generation unit 250, and a tag inspection unit 260.

[0110] The authentication and decryption device 20 can be realized by an information processing device such as a computer. That is, the authentication and decryption device 20 has an arithmetic device such as a CPU and a storage device such as a memory or a disk. The authentication and decryption device 20 realizes each of the above components by, for example, causing the arithmetic device to execute a program stored in the storage device. This also applies to other embodiments described later.

[0111] The input unit 200 functions as an input means. The division unit 202 functions as a division means. The AD processing unit 210 functions as an associated data processing means. The decryption unit 220 functions as a decryption means. The random number calculation unit 230 functions as a random number calculation means (calculation means). The random number encryption unit 240 functions as a random number encryption means. The tag generation unit 250 functions as a tag generation means. The tag inspection unit 260 functions as a tag inspection means.

[0112] The input unit 200 accepts input of the nonce N, the associated data A, the ciphertext C to be decrypted, and the tag T output from the authentication encryption device 10. The input unit 200 may be realized by an input device such as a keyboard. The input unit 200 may accept input of the nonce N, the associated data A, the ciphertext C, and the tag T from an external device connected via a network. Note that there may be cases where the associated data A does not exist, in which case the associated data A is not input. The input unit 200 outputs the nonce N to the decryption unit 220, the random number encryption unit 240, and the tag generation unit 250. The input unit 200 also outputs the ciphertext C and the associated data A to the division unit 202. The input unit 200 also outputs the tag T to the tag inspection unit 260.

[0113] The division unit 202 divides each of the ciphertext C and the associated data A into blocks of a predetermined length. Specifically, the division unit 202 divides the ciphertext C into ciphertext blocks C_1,...,C_m, each of b bits, where m is the number of ciphertext blocks (i.e., plaintext blocks). The division unit 202 outputs the ciphertext blocks C_1,...,C_m to the decryption unit 220. The division unit 202 also divides the associated data A into AD blocks A_1,...,A_a, each of b bits. The division unit 202 outputs the AD blocks A_1,...,A_a to the AD processing unit 210.

[0114] Similarly to the above-mentioned dividing unit 102, the dividing unit 202 divides each of the divided AD blocks A_1,...,A_a and the ciphertext blocks C_1,...,C_m into sections (groups) each having a block count of (2^b-2). That is, one section contains (2^b-2) blocks. In this case, the dividing unit 202 divides the data string D=A_1||...||A_a||C_1||...||C_m into sections in the order of section #1, section #2,..., section #β, starting from the first block of the data string. The dividing method may be the same as that of the above-mentioned dividing unit 102.

[0115] If the bit string of the ciphertext block divided into the region #k is called the "region ciphertext block C[k]", the ciphertext C can also be expressed as C=C[1]||C[2]||···||C[β]. In this case, the number of ciphertext blocks included in the region ciphertext block C[k] other than at least C[1] and C[β] is (2^b-2). In addition, if the associated data is empty, the number of ciphertext blocks included in the region ciphertext block C[1] is also (2^b-2).

[0116] The AD processing unit 210 performs substantially the same processing as the AD processing unit 110 described above. That is, the AD processing unit 210 processes the AD blocks A_1,...,A_a using the TBC function to which the key K and Tweak are input. At this time, the AD processing unit 210 processes the AD block for each of the above-mentioned regions. The AD processing unit 210 outputs H_1 to the decryption unit 220. In addition, the AD processing unit 210 outputs random numbers Z_1,...,Z_(a-1), which are output values ​​of the TBC function, to the random number calculation unit 230. Note that the Tweak input to each of the TBC functions used in the AD processing unit 210 may be set substantially similarly to the Tweak input to each of the TBC functions used in the AD processing unit 110 described above.

[0117] The decryption unit 220 performs a decryption process corresponding to the encryption process in the encryption unit 120 described above. The decryption unit 220 processes the ciphertext blocks C_1,...,C_m using the TBC function to which the key K and Tweak are input. At this time, the decryption unit 220 decrypts the ciphertext block (ciphertext) for each of the above-mentioned zones. That is, the decryption unit 220 performs a decryption process corresponding to the encryption process in the encryption unit 120 described above for the ciphertext blocks included in zone #1. Then, the decryption unit 220 performs a decryption process corresponding to the encryption process in the encryption unit 120 described above for the ciphertext blocks included in zone #2. Thereafter, the decryption unit 220 performs a decryption process corresponding to the encryption process in the encryption unit 120 described above for the ciphertext blocks included in zone #k. That is, the decryption unit 220 decrypts the zone ciphertext block C[k] included in zone #k.

[0118] The decryption unit 220 outputs the generated plaintext blocks M_1,...,M_m to the tag inspection unit 260 as plaintext M = M_1||...||M_m. The decryption unit 220 also performs decryption on the block ciphertext block C[k] included in block #k to obtain block plaintext block M[k]. The decryption unit 220 may output the obtained plaintext to the tag inspection unit 260 as plaintext M = M[1]||M[2]||...||M[β]. The decryption unit 220 also outputs the random numbers Z (output values ​​of the TBC function) obtained in each block to the random number calculation unit 230.

[0119] Moreover, the decryption unit 220 outputs the encryption result Z obtained by processing the last ciphertext block with the TBC function in each zone other than the last zone #β as a random number S_1 to the random number encryption unit 240. Note that this random number S_1 is encrypted by the random number encryption unit 240 and becomes an initial value for the processing of the decryption unit 220 in the next zone. Also, the decryption unit 220 outputs the encryption result Z obtained by processing the last ciphertext block with the TBC function in the last zone #β as a random number S_1 to the tag generation unit 250. Details of the processing of the decryption unit 220 will be described later. Note that the Tweak input to each TBC function used in the decryption unit 220 may be set substantially similarly to the Tweak input to each TBC function used in the encryption unit 120 described above.

[0120] The random number calculation unit 230, like the random number calculation unit 130 described above, calculates a random number S for generating a tag, using the random number Z generated by the AD processing unit 210 and the decryption unit 220 and the predetermined matrix AM shown in Equation 5. At this time, the random number calculation unit 230 calculates the random number S for each zone. Specifically, the random number calculation unit 230 generates a set of ω-1 random numbers S (S_2, . . . , S_ω) for each zone, using the random number Z generated by the AD processing unit 210 and the decryption unit 220 and the predetermined matrix AM. Here, as will be described later, the set of random numbers S is used to generate an initial value for processing in the next zone. Also, the set of random numbers S generated in the processing in the last zone is used to generate the tag T for inspection. *The random number calculation unit 230, like the random number calculation unit 130 described above, calculates S_i by performing an exclusive OR on the multiplication value of the random number Z_j and α_(i,j) for each of the ω-1 lines i (2≦i≦ω) in each region. That is, the random number calculation unit 230 processes the random numbers Z_1^(k),···,Z_(2^b-1)^(k) using the matrix AM in each region #k as shown in the above formula 6, to generate a set of random numbers S_2^(k),···,S_ω^(k).

[0121] Here, the random number calculation unit 230 sets the initial value of each line of the exclusive OR of the multiplication value of Z and α for each zone as a set of random numbers generated in the previous zone and encrypted by the random number encryption unit 240 described later. Details will be described later. The random number calculation unit 230 outputs the set of random numbers S_1^(k),...,S_ω^(k) generated for each zone #k other than the last zone #β to the random number encryption unit 240. The random number calculation unit 230 also outputs the set of random numbers S_1^(β),...,S_ω^(β) generated for the last zone #β to the tag generation unit 250. As described above, the random number S_1^(k) in each zone #k is generated by the decryption unit 220 and output to the random number encryption unit 240 or the tag generation unit 250. Details of the processing by the random number calculation unit 230 will be described later.

[0122] The random number encryption unit 240 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k except the last area #β, using a nonce N, similar to the above-mentioned random number encryption unit 140. Here, the contents of the calculation of the random number encryption unit 240 are substantially similar to those shown in FIG. 7. Therefore, the random number encryption unit 240 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k, using a TBC function to which Tweak including the nonce N and key K are input. Then, the random number encryption unit 240 sets the encryption result obtained by encrypting the set of random numbers S_1^(k),...,S_ω^(k) as the initial value (initial state) of the process in the next area #(k+1). Therefore, the encrypted random number S_1^(k) becomes the initial value of the process of the decryption unit 220 in the next area #(k+1). Moreover, the encrypted random numbers S_2^(k), . . . , S_ω^(k) become the initial values ​​of each line i (2≦i≦ω) in the processing of the random number calculation unit 230 in the next area #(k+1).

[0123] The tag generator 250, like the tag generator 150 described above, generates a test tag T using the set of random numbers S_1^(β), . . . , S_ω^(β) generated for the last section #β and the nonce N. * Note that the tag T * The method of generating is substantially the same as the method of generating the tag T in the tag generation unit 150. Therefore, the tag generation unit 250 performs the calculation shown in FIG. 9. That is, the tag generation unit 250 encrypts the set of random numbers S_1^(β),...,S_ω^(β) generated for the area #β, using a TBC function to which a Tweak including a nonce N and a key K are input. By encrypting the set of random numbers S_1^(β),...,S_ω^(β), the tag generation unit 250 generates the tag T * [1],···,T * Then, the tag generator 250 obtains T * [1],···,T * [ω], tag T * =T * [1]||···||T * [ω] and output to tag inspection unit 260.

[0124] Fig. 11 is a diagram for explaining the processing of the random number encryption unit 240 and the tag generation unit 250 of the authentication and decryption device 20 according to the first embodiment. For the sake of clarity, the related data is omitted in Fig. 11. As described above, the authentication and decryption device 20 divides the ciphertext blocks of the ciphertext C into area ciphertext blocks C[1], C[2], ..., C[β] corresponding to area #1, area #2, ..., area #β, respectively. As described above, each area ciphertext block C[k] includes (2^b-2) ciphertext blocks.

[0125] Then, the decryption unit 220 and the random number calculation unit 230 generate the block plaintext block M[1] and the set of random numbers S_1^(1),...,S_ω^(1) for the block #1 using the input nonce N and the block ciphertext block C[1]. The random number encryption unit 240 encrypts the set of random numbers S_1^(1),...,S_ω^(1) generated for the block #1. Then, the random number encryption unit 240 sets the encrypted set of random numbers S_1^(1),...,S_ω^(1) as the initial value (initial state) in the process for the next block #2. That is, the encrypted random number S_1^(1) becomes the initial value of the process of the decryption unit 220 in the next block #2. Also, the encrypted random numbers S_2^(1),...,S_ω^(1) become the initial value of each line in the process of the random number calculation unit 230 in the next block #2.

[0126] Further, the decryption unit 220 and the random number calculation unit 230 generate the block plaintext block M[2] and the set of random numbers S_1^(2),...,S_ω^(2) for the block #2 using the input nonce N and the block ciphertext block C[2]. At this time, the decryption unit 220 and the random number calculation unit 230 set the encryption result of S_1^(1),...,S_ω^(1) as the initial state in the process for the block #2. The random number encryption unit 240 encrypts the set of random numbers S_1^(2),...,S_ω^(2) generated for the block #2. Then, the random number encryption unit 240 sets the encrypted set of random numbers S_1^(2),...,S_ω^(2) as the initial value (initial state) in the process for the next block #3. That is, the encrypted random number S_1^(2) becomes the initial value of the process of the decryption unit 220 in the next block #3. Moreover, the encrypted random numbers S_2^(2), . . . , S_ω^(2) become the initial values ​​of each line in the processing of the random number calculation unit 230 in the next area #3.

[0127] Similarly, the decryption unit 220 and the random number calculation unit 230 use the input nonce N and the block ciphertext block C[k] to generate a block plaintext block M[k] and a set of random numbers S_1^(k),...,S_ω^(k) for each block #k. At this time, the decryption unit 220 and the random number calculation unit 230 set the encryption result of S_1^(k-1),...,S_ω^(k-1) as the initial state in the process for the block #k. The random number encryption unit 240 encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for the block #k other than the last block #β. ​​Then, the random number encryption unit 240 sets the set of random numbers S_1^(k),...,S_ω^(k) encrypted in the block #k as the initial value (initial state) in the process for the next block #(k+1). Then, the tag generator 250 generates the inspection tag T using the set of random numbers S_1^(β), . . . , S_ω^(β) generated for the last section #β and the nonce N. * [1],···,T * Get [ω].

[0128] The tag inspection unit 260 detects the authentication tag T generated by the authentication encryption device 10 and the inspection tag T generated by the tag generation unit 250. * and inspects whether or not the tag has been tampered with. Then, the tag inspection unit 260 performs control to output information based on the inspection result. Note that the tag inspection unit 260 may perform control to display the information on an output device such as a display. The tag inspection unit 260 may also perform control to output the information to an external device connected via a network, for example.

[0129] Specifically, the tag inspection unit 260 detects an authentication tag T and an inspection tag T * If they match, it is determined that the authentication is successful, and the plain text M=M[1]||||M[β] generated by the decryption unit 220 is output. On the other hand, the tag inspection unit 260 detects the tag T for authentication and the tag T for inspection. * If they do not match, authentication fails and tag T and tag T * The control section 12 controls to output an error message ⊥ indicating that the and do not match.

[0130] Fig. 12 and Fig. 13 are diagrams showing an outline of the calculations in the authentication decryption process according to the first embodiment. Fig. 12 is a diagram showing an outline of the calculations of the decryption unit 220 and the random number calculation unit 230 for the first area, i.e., area #1. Note that the outline of the calculations of the AD processing unit 210 for area #1 is substantially similar to that shown in Fig. 5, and is therefore omitted from the illustration. Fig. 13 is a diagram showing an outline of the calculations of the decryption unit 220 and the random number calculation unit 230 for the second area, i.e., area #2.

[0131] As shown in FIG. 12, the decryption unit 220 performs decryption processing on C_1, . . . , C_m' of the ciphertext blocks C_1, . . . , C_m for the area #1. Specifically, the decryption unit 220 sets H_1 as an initial value. The decryption unit 220 applies the initial value H_1 to the TBC function E K ~ This encrypts the TBC function E K~ A random number Z_a^(1) is output as the encryption result from the encryption unit 220. The decryption unit 220 then obtains the plaintext block M_1 by performing an exclusive OR on the output encryption result Z_a and the first ciphertext block C_1.

[0132] Next, the decryption unit 220 applies the plaintext block M_1 to the TBC function E K ~ As a result, a random number Z_(a+1)^(1) is output as the encryption result. The decryption unit 220 obtains plaintext block M_2 by exclusive-ORing the encryption result Z_(a+1)^(1) and the second ciphertext block C_2. Thereafter, the decryption unit 220 repeats the process of obtaining plaintext block M_(i+1) by exclusive-ORing the encryption result Z_(a+i) of plaintext block M_i decrypted using ciphertext block C_i and ciphertext block C_(i+1).

[0133] Then, the decryption unit 220 obtains plaintext blocks M_1,...,M_m' corresponding to C_1,...,C_m', respectively. The decryption unit 220 also outputs the encryption result, that is, the random numbers Z_a^(1),...,Z_(a+m')^(1) which are the output values ​​of the TBC function, to the random number calculation unit 230. The decryption unit 220 obtains the last random number Z_(a+m')^(1) in area #1 by encrypting the last plaintext block M_m' in area #1 with the last TBC function in area #1. After the last plaintext block M_m' is encrypted with the TBC function, the decryption unit 220 outputs the encryption result Z_(a+m')^(1) to the random number calculation unit 230 as S_1^(1).

[0134] As shown in FIG. 12, the random number calculation unit 230 processes the random numbers Z_a^(1),...,Z_(a+m')^(1) generated by the decryption unit 220 for the area #1. Although the AD processing unit 210 is not shown in FIG. 12, the random number calculation unit 230 processes the random numbers Z_1^(1),...,Z_(a-1)^(1) generated by the AD processing unit 210 for the area #1 in the same manner as in FIG. 5. That is, the random number calculation unit 230 processes the random numbers Z_1^(1),...,Z_(a-1)^(1),Z_a^(1),...,Z_(a+m')^(1) using the matrix AM shown in the formula 5 according to the above formula 6. In this way, the random number calculation unit 230 generates a set of random numbers S_2^(1),...,S_ω^(1) for the area #1. In other words, the random number calculation unit 230 generates a set of random numbers S_2^(1),...,S_ω^(1) by calculating the exclusive OR of the multiplication values ​​of the random numbers Z_1^(1),...,Z_(a+m')^(1) and the corresponding elements of the matrix AM. The random number calculation unit 230 outputs the set of random numbers S_1^(1),...,S_ω^(1) generated for the area #1 to the random number encryption unit 240.

[0135] As shown in FIG. 13, the random number encryption unit 240 encrypts the set of random numbers S_1^(1), . . . , S_ω^(1) generated for the area #1 using a TBC function E K ~ ' is used to encrypt the data. K ~ The set of random numbers S_1^(1), . . . , S_ω^(1) encrypted using ' is input to the decryption unit 220 and the random number calculation unit 230 during processing in area #2.

[0136] 13, for area #2, the decryption unit 220 performs the same processing as for area #1 on the (2^b-2) ciphertext blocks C_(m'+1),...,C_(m'+2^b-2) following C_m' among the ciphertext blocks C_1,...,C_m. Here, for area #2, the decryption unit 220 inputs the encryption result obtained by encrypting the random number S_1^(1) by the random number encryption unit 240 to the first TBC function as an initial value. That is, the decryption unit 220 inputs the random number S_1^(1) generated in area #1 to the TBC function E to which the nonce N, the index "1" of area #1, and the tweak including the line index "1" are input. K ~ The encryption result obtained by encrypting with ' corresponds to the initial value.

[0137] Then, the decryption unit 220 obtains plaintext blocks M_(m'+1),...,M_(m'+2^b-2) corresponding to C_(m'+1),...,C_(m'+2^b-2), respectively. The decryption unit 220 also outputs the encryption result, that is, the random numbers Z_1^(2),...,Z_(2^b-1)^(2), which are the output values ​​of the TBC function, to the random number calculation unit 230. The decryption unit 220 obtains the last random number Z_(2^b-1)^(2) in area #2 by encrypting the last plaintext block M_(m'+2^b-2) in area #2 with the last TBC function in area #2. Furthermore, when the last plaintext block M_(m'+2^b-2) is encrypted with the TBC function, the decryption unit 220 outputs the encryption result Z_(2^b-1)^(2) to the random number calculation unit 230 as S_1^(2).

[0138] 13, the random number calculation unit 230 processes the random numbers Z_1^(2),...,Z_(2^b-1)^(2) generated by the decryption unit 220 for the area #2 in a manner substantially similar to that of the random number calculation unit 130. That is, the random number calculation unit 230 processes the random numbers Z_1^(2),...,Z_(2^b-1)^(2) using the matrix AM shown in Equation 5 according to Equation 6 above. In this way, the random number calculation unit 230 generates a set of random numbers S_2^(2),...,S_ω^(2) for the area #2. In other words, the random number calculation unit 230 generates a set of random numbers S_2^(2),...,S_ω^(2) by calculating the exclusive OR of the multiplication values ​​of the random numbers Z_1^(2),...,Z_(2^b-1)^(2) and the corresponding elements of the matrix AM.

[0139] 8, the random number calculation unit 230 inputs the encryption result obtained by encrypting the random number S_i^(1) by the random number encryption unit 240 for the area #2 as an initial value to each line i. That is, the random number S_2^(1) generated in the area #1 is input to the TBC function E K ~ The encryption result obtained by encrypting with ' corresponds to the initial value of line "2". Similarly, the random number S_ω^(1) generated in area #1 is encrypted by the TBC function E K ~ The encryption result obtained by encrypting with ' corresponds to the initial value of line "ω". The random number calculation unit 230 outputs the set of random numbers S_1^(2), . . . , S_ω^(2) generated for area #2 to the random number encryption unit 240.

[0140] 12 and 13 show an outline of the calculation for area #1 and area #2, but for area #3 and onwards, substantially the same calculation as for area #2 shown in Fig. 13 is performed. Therefore, a description of the specific processing for area #3 and onwards will be omitted. Like the random number calculation unit 130, the random number calculation unit 230 repeatedly calls the same matrix AM (i.e., the same element α) shown in Equation 5 each time processing is performed for a certain area, to generate a set of random numbers.

[0141] <Authentication Encryption Method and Authentication Decryption Method> Next, the operation of the authenticated encryption system 1 according to the first embodiment will be described with reference to Fig. 14 and Fig. 15. Fig. 13 is a flowchart showing the authenticated encryption method executed by the authenticated encryption device 10 according to the first embodiment.

[0142] The input unit 100 inputs plaintext M and associated data A as described above (step S102). The division unit 102 divides each of the plaintext M and associated data A into blocks of a predetermined length (plaintext blocks and AD blocks) as described above (step S104). Furthermore, the division unit 102 divides the divided AD blocks and plaintext blocks into sections as described above (step S106). The nonce generation unit 104 generates a nonce N as described above (step S108).

[0143] Next, the authentication encryption device 10 sets k=1 and processes the area #1 (step S110). Then, the AD processing unit 110 processes the AD block as described above (step S112). The encryption unit 120 encrypts the plaintext block as described above and obtains the ciphertext block (step S114). The random number calculation unit 130 obtains a set of random numbers S as described above (step S116).

[0144] If k=β is not satisfied (NO in step S118), that is, if the area to be processed is not the last area #β, the random number encryption unit 140 encrypts the set of random numbers S as described above (step S120). The random number encryption unit 140 then sets the encrypted random number as the initial value for processing in area #(k+1), that is, area #2 (step S122). The authentication encryption device 10 then increments k by one (step S124) and advances the area to be processed by one. The processes of S114 to S124 are then repeated.

[0145] If k=β (YES in S118), that is, if the area to be processed is the last area #β, the tag generation unit 150 generates a tag T using the set of random numbers S generated in the area #β (step S132). Then, the output unit 160 outputs the nonce N, the associated data A, the ciphertext C, and the tag T (step S134).

[0146] 15 is a flowchart showing an authentication and decryption method executed by the authentication and decryption device 20 according to the first embodiment. The input unit 200 inputs a nonce N, associated data A, ciphertext C, and tag T (step S202). As described above, the division unit 202 divides each of the ciphertext C and associated data A into blocks of a predetermined length (ciphertext blocks and AD blocks) (step S204). Furthermore, as described above, the division unit 202 divides the divided AD blocks and ciphertext blocks into sections (step S206).

[0147] Next, the authentication decryption device 20 sets k=1 and processes area #1 (step S210). Then, the AD processing unit 210 processes the AD block as described above (step S212). The decryption unit 220 decrypts the ciphertext block as described above and obtains the plaintext block (step S214). The random number calculation unit 230 obtains a set of random numbers S as described above (step S216).

[0148] If k=β is not satisfied (NO in step S218), that is, if the area to be processed is not the last area #β, the random number encryption unit 240 encrypts the set of random numbers S as described above (step S220). The random number encryption unit 240 then sets the encrypted random number as the initial value for processing in area #(k+1), that is, area #2 (step S222). The authentication and decryption device 20 then increments k by one (step S224) and advances the area to be processed by one. The processes of S214 to S224 are then repeated.

[0149] If k=β (YES in S218), that is, if the area to be processed is the last area #β, the tag generation unit 250 generates the tag T * (Step S232). As described above, the tag inspection unit 260 generates the authentication tag T and the inspection tag T * It is determined whether the authentication tag T and the inspection tag T match (step S240). * If the authentication tag T and the inspection tag T match (YES in S240), the tag inspection unit 260 outputs the plain text M (step S242). * If they do not match (NO in S240), tag inspection unit 260 outputs an error message ⊥ (step S244).

[0150] <Effects> As described above, the authentication encryption device 10 according to the first embodiment divides the input blocks (AD blocks and plaintext blocks) into zones each including (2^b-2) blocks, which is a size that can be processed by the PFBω method according to the comparative example. The authentication encryption device 10 according to the first embodiment is configured to appropriately derive the tag T from a set of random numbers S generated in each zone. This makes it possible for the authentication encryption system 1 according to the first embodiment to process more than (2^b-1) input blocks, which was not possible in terms of security by the PFBω method according to the comparative example.

[0151] As described above, in the comparative example, although ωb-bit security can be realized, the limit on the number of input blocks is the same as that in the case of AE with b-bit security. Therefore, in the comparative example, when transmitting a plaintext of a size exceeding the limit on the number of input blocks (a size exceeding b×(2^b-2) bits), it is necessary to divide the plaintext into a number of blocks that can be processed in advance. Then, it is necessary to encrypt each divided plaintext and transmit the obtained ciphertext. That is, in the comparative example, it is necessary to transmit multiple (N, A, C, T) for one plaintext. In contrast, in the authentication encryption system 1 according to the first embodiment, there is no limit on the number of blocks that can be processed, so it is possible to transmit a ciphertext at once regardless of the size of the plaintext. That is, in the first embodiment, it is sufficient to transmit only a single (N, A, C, T). Therefore, it is possible to suppress the communication load.

[0152] (Embodiment 2) Next, the second embodiment will be described. For clarity of explanation, the following description and drawings are omitted and simplified as appropriate. In addition, in each drawing, the same elements are given the same symbols, and repeated explanations are omitted as necessary. Note that the system configuration according to the second embodiment is substantially similar to the system configuration of the first embodiment, so explanations will be omitted. In other words, the authentication encryption system 1 according to the second embodiment has an authentication encryption device 10A corresponding to the authentication encryption device 10, and an authentication decryption device 20A corresponding to the authentication decryption device 20.

[0153] The second embodiment corresponds to ΘCBω, which is an improvement when the PFBω method according to the above-mentioned comparative example is extended to the ΘCB method mentioned in the comparative example. That is, in the second embodiment, processing using the TBC function of blocks in PFBω (encryption or decryption, and AD processing) can be executed in parallel. Furthermore, in the second embodiment, similar to the first embodiment, the plaintext block (and the AD block) is divided into sections of a predetermined length, and processing is performed for each section.

[0154] <Authentication Encryption Device> Fig. 16 is a diagram showing a configuration of an authentication encryption device 10A according to the embodiment 2. As shown in Fig. 16, the authentication encryption device 10A includes an input unit 100, a division unit 102A, a nonce generation unit 104, an AD processing unit 110A, an encryption unit 120A, a random number calculation unit 130A, a random number encryption unit 140A, a tag generation unit 150A, and an output unit 160.

[0155] The authentication encryption device 10A corresponds to the authentication encryption device 10 shown in Fig. 2 and Fig. 3. The division unit 102A corresponds to the division unit 102 according to the first embodiment. The AD processing unit 110A corresponds to the AD processing unit 110 according to the first embodiment. The encryption unit 120A corresponds to the encryption unit 120 according to the first embodiment. The random number calculation unit 130A corresponds to the random number calculation unit 130 according to the first embodiment. The random number encryption unit 140A corresponds to the random number encryption unit 140 according to the first embodiment. The tag generation unit 150A corresponds to the tag generation unit 150 according to the first embodiment. Note that, hereinafter, the configuration of the authentication encryption device 10A will be described mainly with respect to the parts that differ from the configuration of the authentication encryption device 10.

[0156] The division unit 102A divides each of the plaintext M and the associated data A into blocks of a predetermined length, similar to the division unit 102 according to the first embodiment. Specifically, the division unit 102A divides the plaintext M into plaintext blocks M_1,...,M_m, each of b bits. The division unit 102A outputs the plaintext blocks M_1,...,M_m to the encryption unit 120A. The division unit 102A also divides the associated data A into AD blocks A_1,...,A_a, each of b bits. The division unit 102A outputs the AD blocks A_1,...,A_a to the AD processing unit 110A.

[0157] Furthermore, the division unit 102A divides the divided AD blocks A_1,...,A_a and the plaintext blocks M_1,...,M_m into sections (groups) each having a block count of (2^b-1). That is, in the second embodiment, one section contains (2^b-1) blocks. In this case, the division unit 102A divides the data string D=A_1||...||A_a||M_1||...||M_m into sections in the order of section #1, section #2,..., section #β, starting from the first block of the data string. Unlike the first embodiment, the number of blocks included in one section is (2^b-1) because parallel processing of blocks is possible in the second embodiment. This will be described in detail later.

[0158] The division unit 102A performs division so that all AD blocks A_1,...,A_a are included in the region #1. If a<2^b-1, the division unit 102A performs division so that m' plaintext blocks are included in the region #1. Here, m' is the number of plaintext blocks included in the region #1 (first region). Then, m' satisfies a+m'=2^b-1. The division unit 102A then divides the remaining (m-m') plaintext blocks into regions #2 to #β. Hereinafter, unless otherwise specified, the description will be given assuming a<2^b-1. Note that the processing when a=2^b-1 or a>2^b-1 is substantially the same as the processing when a=2^b-2 or a>2^b-2 in the first embodiment.

[0159] When the related data is empty, the division unit 102A divides the data string D=M_1||···||M_m into sections in the order of section #1, section #2,..., section #β from the beginning of the data string. In this case, if the number of plaintext blocks divided into section #1 is m', then m'=2^b-1.

[0160] If the bit string of a plaintext block divided into block #k is called the block plaintext block M[k], the plaintext M can also be written as M=M[1]||M[2]||···||M[β]. In this case, the number of plaintext blocks contained in the block plaintext block M[k] other than at least M[1] and M[β] is (2^b-1). In addition, if the related data is empty, the number of plaintext blocks contained in the block plaintext block M[1] is also (2^b-1).

[0161] The AD processing unit 110A processes the associated data A in the same manner as the AD processing unit 110 according to the first embodiment. Here, the AD processing unit 110A processes the AD blocks A_1,...,A_a in parallel using the TBC function to which the key K and Tweak are input. At this time, the AD processing unit 110A processes the AD blocks for each of the above-mentioned areas. The AD processing unit 110A obtains a random number Z by inputting each AD block to the TBC function to which the key K and Tweak are input. The AD processing unit 110A outputs intermediate values ​​Z_1,...,Z_a, which are output values ​​(random numbers) of each TBC function, to the random number calculation unit 130A. Details of the processing of the AD processing unit 110A will be described later.

[0162] The encryption unit 120A processes the plaintext M in the same manner as the encryption unit 120 according to the first embodiment. Here, the encryption unit 120A processes the plaintext blocks M_1, . . . , M_m in parallel using the TBC function to which the key K and Tweak are input. At this time, the encryption unit 120A encrypts the plaintext blocks (plaintext) in parallel for each of the above-mentioned zones using the TBC function. That is, the encryption unit 120A encrypts the plaintext blocks included in zone #1 in parallel using the TBC function. Then, the encryption unit 120A encrypts the plaintext blocks included in zone #2 in parallel using the TBC function. Thereafter, the encryption unit 120A encrypts the plaintext blocks included in zone #k in parallel using the TBC function. That is, the encryption unit 120A encrypts the zone plaintext blocks M[k] included in zone #k in parallel for each plaintext block. The encryption unit 120A obtains a ciphertext block as an output value of the TBC function by inputting each plaintext block to the TBC function to which the key K and Tweak have been input. That is, the encryption unit 120A generates a ciphertext block by encrypting multiple plaintext blocks in parallel for each zone using the TBC function.

[0163] The encryption unit 120A outputs the generated ciphertext blocks C_1,...,C_m as ciphertext C=C_1||||C_m to the output unit 160. The encryption unit 120A also encrypts the block plaintext block M[k] included in the block #k to obtain the block ciphertext block C[k]. Here, the block ciphertext block C[k] is composed of the same number of ciphertext blocks as the block plaintext block M[k]. The encryption unit 120A also outputs the plaintext block (input value of the TBC function) input to the TBC function in each block as the intermediate value Z to the random number calculation unit 130A. Details of the process of the encryption unit 120A will be described later.

[0164] Note that the tweaks input to the TBC functions used in encryption unit 120A may be different from the tweaks input to the TBC functions used in encryption unit 84. Details will be described later. Note that, in order to distinguish between the tweaks input to the TBC functions used in AD processing and encryption processing performed for each area, the number of digits of the tweak in the second embodiment is greater than the number of digits of the tweak in the comparative example, as in the first embodiment. That is, in the comparative example, processing is performed for only one area, whereas in the second embodiment, processing is performed for multiple areas, so that the number of digits needs to be increased accordingly to distinguish between the tweaks.

[0165] The random number calculation unit 130A calculates random numbers for generating tags, similarly to the random number calculation unit 130 according to the first embodiment. The random number calculation unit 130A calculates a value for generating a tag, using a random number (intermediate value) Z generated by the AD processing unit 110A, a plaintext block output from the encryption unit 120A, and a predetermined matrix AM. The matrix AM according to the second embodiment is shown in the following formula 8. Here, the matrix AM is a matrix of size ω×(2^b-1) with elements of the predetermined value α_(i,j).

number

[0166] The random number calculation unit 130A calculates a random number S for each area. The random number calculation unit 130A performs substantially the same process as the random number calculation unit 130 to generate a set of random numbers S for each area. Specifically, the random number calculation unit 130A generates a set of ω random numbers S (S_1, . . . , S_ω) for each area using a random number (intermediate value) Z generated by the AD processing unit 110A, a plaintext block (intermediate value Z) output from the encryption unit 120A, and a predetermined matrix AM. Here, as described later, the set of random numbers S is used to generate an initial value for the process in the next area. In addition, the set of random numbers S generated in the process in the last area is used to generate a tag T. The random number calculation unit 130A calculates S_i by calculating the exclusive OR of the multiplication value of the intermediate value Z_j and α_(i,j) for each of the ω lines i (1≦i≦ω) in each area. Details will be described later.

[0167] The random number calculation unit 130A processes the intermediate values ​​Z_1^(k), . . . ,Z_(2^b-1)^(k) in each area #k using a matrix AM as shown in the following formula 9 to generate a set of random numbers S_1^(k), . . . ,S_ω^(k). That is, the random number calculation unit 130A generates a set of random numbers for each area #k using the same matrix AM shown in formula 8.

number

[0168] From equation 9, the following equation 10 holds for i (1≦i≦ω).

number

[0169] Here, similarly to the random number calculation unit 130, the random number calculation unit 130A sets the initial value of each line of the exclusive OR of the multiplication value of Z and α for each zone as a set of random numbers generated in the previous zone and encrypted by the random number encryption unit 140A described later. Details will be described later. The random number calculation unit 130A outputs the set of random numbers S_1^(k),...,S_ω^(k) generated for each zone #k other than the last zone #β to the random number encryption unit 140A. In addition, the random number calculation unit 130A outputs the set of random numbers S_1^(β),...,S_ω^(β) generated for the last zone #β to the tag generation unit 150A. Details of the processing of the random number calculation unit 130A will be described later.

[0170] The random number encryption unit 140A encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k except the last area #β, using a nonce N, just like the above-mentioned random number encryption unit 140. Here, the contents of the calculation of the random number encryption unit 140A are substantially similar to those shown in FIG. 7. Therefore, the random number encryption unit 140A encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k, using a TBC function to which Tweak including the nonce N and key K are input. Then, the random number encryption unit 140A sets the encryption result obtained by encrypting the set of random numbers S_1^(k),...,S_ω^(k) as the initial value (initial state) of the process in the next area #(k+1). That is, the encrypted random numbers S_1^(k), . . . , S_ω^(k) become the initial values ​​of each line i (1≦i≦ω) in the processing of the random number calculation unit 130A in the next area #(k+1).

[0171] The tag generation unit 150A generates a tag T for authentication using a set of random numbers S_1^(β), ···,S_ω^(β) generated for the last area #β and a nonce N, similarly to the above-mentioned tag generation unit 150. The method of generating the tag T is substantially the same as the method of generating the tag T in the tag generation unit 150. Therefore, the tag generation unit 150A performs the calculation shown in FIG. 9. That is, the tag generation unit 150A encrypts the set of random numbers S_1^(β), ···,S_ω^(β) generated for the area #β using a TBC function to which a tweak including a nonce N and a key K are input. The tag generation unit 150A obtains tags T[1], ···,T[ω] as the encryption result by encrypting the set of random numbers S_1^(β), ···,S_ω^(β).

[0172] FIG. 17 is a diagram for explaining the processing of the random number encryption unit 140A and the tag generation unit 150A of the authentication encryption device 10A according to the second embodiment. For the sake of clarity, the related data is left blank in FIG. 17. As described above, the authentication encryption device 10 divides the plaintext blocks of the plaintext M into area plaintext blocks M[1], M[2], . . . , M[β] corresponding to area #1, area #2, . . . area #β, respectively. As described above, each area plaintext block M[k] includes (2^b-1) plaintext blocks.

[0173] Then, the encryption unit 120A and the random number calculation unit 130A generate a block ciphertext block C[1] and a set of random numbers S_1^(1),...,S_ω^(1) for the block #1 using the input nonce N and block plaintext block M[1]. The random number encryption unit 140A encrypts the set of random numbers S_1^(1),...,S_ω^(1) generated for the block #1. Then, the random number encryption unit 140 sets the encrypted set of random numbers S_1^(1),...,S_ω^(1) as the initial value (initial state) in the process for the next block #2. That is, the encrypted random numbers S_1^(1),...,S_ω^(1) become the initial value of each line in the process of the random number calculation unit 130A in the next block #2.

[0174] Furthermore, the encryption unit 120A and the random number calculation unit 130A use the input nonce N and the area plaintext block M[2] to generate an area ciphertext block C[2] and a set of random numbers S_1^(2),...,S_ω^(2) for area #2. At this time, the random number calculation unit 130A sets the encryption result of S_1^(1),...,S_ω^(1) as the initial state in the process for area #2. The random number encryption unit 140A encrypts the set of random numbers S_1^(2),...,S_ω^(2) generated for area #2. Then, the random number encryption unit 140A sets the encrypted set of random numbers S_1^(2),...,S_ω^(2) as the initial value (initial state) in the process for the next area #3. That is, the encrypted random numbers S_1^(2), . . . , S_ω^(2) become the initial values ​​of each line in the processing of the random number calculation unit 130A in the next area #3.

[0175] Similarly, the encryption unit 120A and the random number calculation unit 130A use the input nonce N and the block plaintext block M[k] to generate a block ciphertext block C[k] and a set of random numbers S_1^(k),...,S_ω^(k) for each block #k. At this time, the encryption unit 120A and the random number calculation unit 130A set the encryption result of S_1^(k-1),...,S_ω^(k-1) as the initial state in the process for the block #k. The random number encryption unit 140A encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for the block #k other than the last block #β. ​​Then, the random number encryption unit 140A sets the set of random numbers S_1^(k),...,S_ω^(k) encrypted in the block #k as the initial value (initial state) in the next block #(k+1).

[0176] At this time, the encryption unit 120A can perform processing for each area using the calculations shown in Fig. 19 and Fig. 20 as subroutines, which will be described later. Also, the random number calculation unit 130A can call the matrix AM shown in Equation 8 for each area and perform processing using the calculations shown in Fig. 18 to Fig. 20 as subroutines, which will be described later. The same applies to the decryption processing in the authentication decryption device 20A, which will be described later.

[0177] Then, the tag generation unit 150A obtains authentication tags T[1], ,T[ω] using the set of random numbers S_1^(β), ,S_ω^(β) generated for the last section #β and the nonce N. Here, as described above, the authentication tag T is the encryption result obtained by encrypting the set of random numbers with the TBC function that inputs the nonce N and Tweak including the number m of plaintext blocks (plaintext length). Therefore, the security of the set of tags T is ensured.

[0178] Fig. 18 to Fig. 20 are diagrams showing an outline of the calculations in the authentication encryption process according to the second embodiment. Fig. 18 is a diagram showing an outline of the calculations of the AD processing unit 110A and the random number calculation unit 130A for the first area, that is, area #1. Fig. 19 is a diagram showing an outline of the calculations of the encryption unit 120A and the random number calculation unit 130A for the first area, that is, area #1. Fig. 20 is a diagram showing an outline of the calculations of the encryption unit 120A and the random number calculation unit 130A for the second area, that is, area #2.

[0179] As shown in FIG. 18, the AD processing unit 110A processes the AD blocks A_1, . . . , A_a in parallel for the area #1 using the TBC function to which the key K and Tweak are input. Specifically, the AD processing unit 110A encrypts the AD block A_1 with the TBC function. As a result, the TBC function outputs an intermediate value (random number) Z_1^(1) as the encryption result. Similarly, the AD processing unit 110A encrypts the AD block A_2 with the TBC function. As a result, the TBC function outputs an intermediate value (random number) Z_2^(1) as the encryption result. Similarly, the AD processing unit 110A encrypts the AD block A_a with the TBC function. As a result, the TBC function outputs an intermediate value (random number) Z_a^(1) as the encryption result. The AD processing unit 110A outputs the encryption results, that is, the intermediate values ​​Z_1^(1), . . . , Z_a^(1) which are the output values ​​of the TBC function, to the random number calculation unit 130A.

[0180] Here, in the first embodiment, the number of random numbers Z, which are output values ​​from the TBC function, is one less than the number of AD blocks. In contrast, in the second embodiment, since parallel processing of AD blocks is possible, the number of intermediate values ​​Z, which are output values ​​from the TBC function, is the same as the number of AD blocks. In the examples of Figs. 18 to 20, since a<2^b-1, the AD processing unit 110A performs processing only for area #1.

[0181] Also, as shown in FIG. 19, the encryption unit 120A performs encryption processing in parallel on M_1,...,M_m' of plaintext blocks M_1,...,M_m for area #1, using the TBC function to which the key K and Tweak are input. Specifically, the encryption unit 120A encrypts the plaintext block M_1 with the TBC function. As a result, the ciphertext block C_1 is output from the TBC function as the encryption result. Similarly, the encryption unit 120A encrypts the plaintext block M_2 with the TBC function. As a result, the ciphertext block C_2 ​​is output from the TBC function as the encryption result. Similarly, the encryption unit 120A encrypts the plaintext block M_m' with the TBC function. As a result, the ciphertext block C_m' is output from the TBC function as the encryption result. In this way, the encryption unit 120A obtains the ciphertext blocks C_1,...,C_m' corresponding to M_1,...,M_m', respectively. Moreover, the encryption unit 120A outputs the plaintext blocks M_1, . . . , M_m', which are inputs to the TBC function, to the random number calculation unit 130A as intermediate values ​​Z_(a+1)^(1), . . . , Z_(a+m')^(1), respectively.

[0182] The tweaks input to the TBC functions used in the AD processing unit 110A and the encryption unit 120A can be set by substantially the same rules as those in the AD processing unit 110 and the encryption unit 120. That is, the tweaks input to the TBC function used in the AD processing unit 110A are (0^n,i,0,0,0) for the block index i (1≦i≦a) of the associated data A. Also, the tweaks input to the TBC function used in the encryption unit 120A are (N,a,i,0,0) for the block index i (1≦i≦m′) of the plaintext M. For the area #1, the tweaks input to the TBC function used at the end of the encryption unit 120A are (N,a,m′,1,0). That is, for the tweaks input to the TBC function used at the end of the area, x in (N,a,i,x,0) is set to “1”. Setting tweaks in this way ensures that one tweak will not match another.

[0183] 18 and 19, the random number calculation unit 130A processes intermediate values ​​Z_1^(1),···,Z_a^(1),Z_(a+1)^(1),···,Z_(a+m')^(1) output from the AD processing unit 110A and the encryption unit 120A for the area #1. That is, the random number calculation unit 130A processes intermediate values ​​Z_1^(1),···,Z_a^(1),Z_(a+1)^(1),···,Z_(a+m')^(1) using the matrix AM shown in the formula 8 according to the above formula 9. In this way, the random number calculation unit 130A generates a set of random numbers S_1^(1),···,S_ω^(1) for the area #1. The random number calculation unit 130A outputs the set of random numbers S_1^(1), . . . , S_ω^(1) generated for the area #1 to the random number encryption unit 140A.

[0184] As shown in FIG. 20, the random number encryption unit 140A encrypts the set of random numbers S_1^(k), . . . , S_ω^(k) generated for the area #1 using a TBC function E K ~The encryption result is input to the random number calculation unit 130A during processing in area #2. Here, as in the first embodiment, the TBC function E K ~ ' is any TBC function E shown in FIG. 18 to FIG. 20. K ~ This is a TBC function that inputs a different tweak from the tweak input to the TBC function E. K ~ The Tweak input to ' does not include the number of AD blocks a and the number of plaintext blocks m, but is the same as other TBC functions E K ~ In addition, as described above, the TBC function E K ~ 'The Tweak entered in is the TBC function E K ~ If we assume that the function is written in the form of (N, k, i, 0, 0, 1), then we can write the TBC function E K ~ The final value of Tweak input to ' may be "1". On the other hand, in this case, the TBC function E K ~ The tweak entered in may have the last value set to "0", such as (N, a, m', 0, 0, 0). This avoids duplication of tweaks.

[0185] 20, the encryption unit 120A performs the same process as that for the area #1 on the (2^b-1) plaintext blocks M_(m'+1),...,M_(m'+2^b-1) following M_m' among the plaintext blocks M_1,...,M_m for the area #2. That is, the encryption unit 120A performs encryption process in parallel on the plaintext blocks M_(m'+1),...,M_(m'+2^b-1) for the area #2 using the TBC function to which the key K and Tweak are input. As a result, the encryption unit 120A obtains ciphertext blocks C_(m'+1),...,C_(m'+2^b-1) corresponding to the plaintext blocks M_(m'+1),...,M_(m'+2^b-1), respectively. In addition, the encryption unit 120A outputs the plaintext blocks M_(m'+1), ···, M_(m'+2^b-1), which are input to the TBC function, as intermediate values ​​Z_1^(2), ···, Z_(2^b-1)^(2), respectively, to the random number calculation unit 130A.

[0186] 20, the random number calculation unit 130A processes intermediate values ​​Z_1^(2),...,Z_(2^b-1)^(2) corresponding to plaintext blocks output from the encryption unit 120A for area #2. That is, the random number calculation unit 130A processes intermediate values ​​Z_1^(2),...,Z_(2^b-1)^(2) using the matrix AM shown in equation 8 according to equation 9 above. In this way, the random number calculation unit 130A generates a set of random numbers S_1^(2),...,S_ω^(2) for area #2.

[0187] Here, for area #2, the random number calculation unit 130A inputs the encryption result obtained by encrypting the random number S_i^(1) by the random number encryption unit 140A as an initial value to each line i. That is, the random number S_1^(1) generated in area #1 is input to the TBC function E K ~' corresponds to the initial value of line "1". Similarly, the random number S_ω^(1) generated in area #1 is encrypted by the TBC function E K ~ The encryption result obtained by encrypting with ' corresponds to the initial value of line "ω". The random number calculation unit 130A outputs the set of random numbers S_1^(2),...,S_ω^(2) generated for area #2 to the random number encryption unit 140A.

[0188] For area #2, the tweaks input to each TBC function used in the encryption unit 120A can be set by substantially the same rules as those in the encryption unit 120. That is, the tweaks input to the TBC functions used in the encryption unit 120A are (N, a, i, 0, 0) for block index i (m'+1 ≤ i ≤ m'+2^b-1) of plaintext M. For area #2, the tweaks input to the TBC function used last in the encryption unit 120A are (N, a, m'+2^b-1, 1, 0). That is, for the tweaks input to the TBC function used last in the area, x in (N, a, i, x, 0) is set to "1". By setting the tweaks in this way, a certain tweak will not match another tweak.

[0189] Here, as described in the problem of the comparative example, the number of columns of the matrix AM must not exceed 2^b-1. Therefore, similarly to the first embodiment, the number of columns of the matrix AM in the second embodiment is (2^b-1) as shown in Equation 8. Here, in the authenticated encryption according to the second embodiment, each block is encrypted in parallel. Therefore, in the second embodiment, as shown in FIG. 18, in order to process a AD blocks, it is sufficient to prepare a matrix AM with a number of columns. Also, in the second embodiment, as shown in FIG. 19 and FIG. 20, in order to process m" plaintext blocks, it is sufficient to prepare a matrix AM with m" columns. That is, in the second embodiment, the number of blocks to be processed and the number of columns of the corresponding matrix AM match. Therefore, in order to satisfy the condition of matrix AM described in the problem of the comparative example above, it is sufficient that a+m"≦2^b-1. Therefore, in embodiment 2, the number of blocks (AD blocks or plaintext blocks) included in one area is set to (2^b-1). Also, for area #1, a+m'=2^b-1. Therefore, the number of blocks that can be processed in one area in embodiment 2 may be one more than the number of blocks that can be processed in one area in embodiment 1. Note that since a+m'=2^b-1, α_(1,a+m') in Figure 19 corresponds to α_(1,2^b-1) in equation 8.

[0190] 18 to 20 show an outline of the calculation for area #1 and area #2, but for area #3 and onwards, substantially the same calculation as for area #2 shown in FIG. 20 is performed. Therefore, a description of the specific processing for area #3 and onwards will be omitted. Each time the encryption unit 120A processes a certain area, it repeatedly calls the TBC function to encrypt the plaintext block. Also, each time the random number calculation unit 130A processes a certain area, it uses the encryption result obtained by encrypting the random numbers obtained for the previous area as the initial value for each line, and repeatedly calls the same matrix AM (i.e., the same element α) shown in Equation 8 to generate a set of random numbers.

[0191] The tweak input to each TBC function used in the encryption unit 120A is set according to the rule described above with reference to FIG. 20. That is, in each area #k, the tweak input to the first to (2^b-2)-th TBC functions is (N, a, i, 0, 0) for the block index i of the plaintext M. In addition, in each area #k, the tweak input to the (2^b-1)-th TBC function is (N, a, i, 1, 0) for the block index i of the plaintext M. Here, since i is the index of the number of plaintext blocks m, the tweak input to each TBC function in a certain area #k is different from the tweak input to each TBC function in another area. In addition, in the final area #β, if the number of plaintext blocks is less than 2^b-1, the value of the intermediate value Z_(j)^(β) for the remaining part is 0. The same applies to the decryption process in the authentication and decryption device 20A described later.

[0192] As shown in Fig. 9, the tag generation unit 150A generates a tag T for authentication from the set of random numbers S_1^(β), ···,S_ω^(β) generated for the last area #β, using a tweak including a nonce N, the number of AD blocks a, and the number of plaintext blocks m. Here, similar to the first embodiment, a tweak that is used only once is input to the TBC function used by the tag generation unit 150A. Then, the tag generation unit 150A outputs T[1], ···,T[ω] as the tag T = T[1]||···||T[ω].

[0193] Here, the random number encryption unit 140A uses the TBC function E K ~ ' is used, whereas the tag generator 150A uses the TBC function E K ~ Therefore, the TBC function E used in the tag generator 150A is K ~ The tweak input to the random number encryption unit 140A is different from the tweak input to the TBC function E used in the AD processing unit 110A and the encryption unit 120A.K ~ Unlike the Tweak input to the tag generator 150A, the TBC function E K ~ The Tweak input to includes the number of sections β and the line index i. Therefore, the TBC function E used in the tag generator 150A K ~ The tweak input to the AD processing unit 110A is different from the tweak input to the TBC function used in the AD processing unit 110A and the encryption unit 120A. Therefore, it is possible to prevent duplication of tweak. The same applies to the decryption process in the authentication and decryption device 20A described later.

[0194] <Authentication and Decryption Device> Fig. 21 is a diagram showing a configuration of an authentication and decryption device 20A according to embodiment 2. As shown in Fig. 21, the authentication and decryption device 20A includes an input unit 200, a division unit 202A, an AD processing unit 210A, a decryption unit 220A, a random number calculation unit 230A, a random number encryption unit 240A, a tag generation unit 250A, and a tag inspection unit 260.

[0195] The authentication and decryption device 20A corresponds to the authentication and decryption device 20 shown in Fig. 2 and Fig. 10. The division unit 202A corresponds to the division unit 202 according to the first embodiment. The AD processing unit 210A corresponds to the AD processing unit 210 according to the first embodiment. The decryption unit 220A corresponds to the decryption unit 220 according to the first embodiment. The random number calculation unit 230A corresponds to the random number calculation unit 230 according to the first embodiment. The random number encryption unit 240A corresponds to the random number encryption unit 240 according to the first embodiment. The tag generation unit 250A corresponds to the tag generation unit 250 according to the first embodiment. Note that, hereinafter, the configuration of the authentication and decryption device 20A will be mainly described with respect to the parts that are different from the configuration of the authentication and decryption device 20.

[0196] The division unit 202A divides each of the ciphertext C and the related data A into blocks of a predetermined length, similar to the division unit 102A. Specifically, the division unit 202A divides the ciphertext C into ciphertext blocks C_1,...,C_m, each of b bits. The division unit 202A also divides the related data A into AD blocks A_1,...,A_a, each of b bits. The division unit 202A outputs the AD blocks A_1,...,A_a to the AD processing unit 210A.

[0197] Similarly to the above-mentioned division unit 102A, the division unit 202A divides the divided AD blocks A_1,...,A_a and the ciphertext blocks C_1,...,C_m into sections (groups) each having a block count of (2^b-1). That is, one section contains (2^b-1) blocks. In this case, the division unit 202A divides the data string D=A_1||...||A_a||C_1||...||C_m into sections in the order of section #1, section #2,..., section #β, starting from the first block of the data string. The division method may be the same as that of the above-mentioned division unit 102A.

[0198] If the bit string of the ciphertext block divided into the region #k is called the "region ciphertext block C[k]", the ciphertext C can also be expressed as C=C[1]||C[2]||···||C[β]. In this case, the number of ciphertext blocks included in the region ciphertext block C[k] other than at least C[1] and C[β] is (2^b-1). In addition, if the related data is empty, the number of ciphertext blocks included in the region ciphertext block C[1] is also (2^b-1).

[0199] The AD processing unit 210A performs substantially the same processing as the AD processing unit 110A described above. That is, the AD processing unit 210A processes the AD blocks A_1,...,A_a using the TBC function to which the key K and Tweak are input. At this time, the AD processing unit 210A processes the AD blocks for each of the above-mentioned regions. The AD processing unit 210A outputs intermediate values ​​Z_1,...,Z_a, which are output values ​​(random numbers) of the TBC function, to the random number calculation unit 230A. Note that the Tweak input to each of the TBC functions used in the AD processing unit 210A may be set substantially similarly to the Tweak input to each of the TBC functions used in the AD processing unit 110A described above.

[0200] The decryption unit 220A performs a decryption process corresponding to the encryption process in the encryption unit 120A described above. The decryption unit 220A processes the ciphertext blocks C_1,...,C_m in parallel using the TBC function to which the key K and Tweak are input. At this time, the decryption unit 220A decrypts the ciphertext blocks (ciphertext) in parallel for each of the above-mentioned zones. That is, the decryption unit 220A performs a decryption process corresponding to the encryption process in the encryption unit 120A described above for the ciphertext blocks included in the zone #1. Then, the decryption unit 220A performs a decryption process corresponding to the encryption process in the encryption unit 120A described above for the ciphertext blocks included in the zone #2. Thereafter, the decryption unit 220A performs a decryption process corresponding to the encryption process in the encryption unit 120A described above for the ciphertext blocks included in the zone #k. That is, the decryption unit 220A decrypts the zone ciphertext block C[k] included in the zone #k. The decryption unit 220A inputs each ciphertext block to the TBC function (decryption function) to which the key K and Tweak are input, and obtains a plaintext block as the output value of the TBC function. This decryption function is the TBC function E used in the encryption unit 120A described above. K ~ The encryption processing unit 100 is configured to perform a decryption process corresponding to the encryption process performed by the encryption processing unit 100.

[0201] The decryption unit 220A outputs the generated plaintext blocks M_1,...,M_m to the tag inspection unit 260 as plaintext M = M_1||...||M_m. The decryption unit 220A also performs decryption on the zone ciphertext block C[k] included in zone #k to obtain zone plaintext block M[k]. The decryption unit 220A may output the obtained plaintext to the tag inspection unit 260 as plaintext M = M[1]||M[2]||...||M[β]. The decryption unit 220A also outputs the plaintext block (output value of the TBC function) output from the TBC function (decryption function) in each zone to the random number calculation unit 230A as intermediate value Z.

[0202] 19 and 20, the TBC function which is an encryption function is replaced with a decryption function, a ciphertext block is input to the decryption function (TBC function), and a plaintext block is output. The tweak input to each TBC function used in the decryption unit 220A may be set substantially similarly to the tweak input to each TBC function used in the encryption unit 120A described above.

[0203] The random number calculation unit 230A, like the above-mentioned random number calculation unit 130A, calculates random numbers for generating tags using the random numbers Z generated by the AD processing unit 210A and the decryption unit 220A and the predetermined matrix AM shown in Equation 8. At this time, the random number calculation unit 230A calculates random numbers for each zone. Specifically, the random number calculation unit 230A generates a set of ω random numbers S (S_1, . . . , S_ω) for each zone using the intermediate values ​​Z generated by the AD processing unit 210A and the decryption unit 220A and the predetermined matrix AM. Here, like the case of the above-mentioned random number calculation unit 130A, the set of random numbers S is used to generate initial values ​​for processing in the next zone. Also, the set of random numbers S generated in the processing in the last zone is used to generate the tag T for inspection. *The random number calculation unit 230A, like the random number calculation unit 130A described above, calculates S_i by performing an exclusive OR on the multiplication value of the intermediate value Z_j and α_(i,j) for each of the ω lines i (1≦i≦ω) in each region. That is, the random number calculation unit 230A processes the random numbers Z_1^(k),···,Z_(2^b-1)^(k) using the matrix AM in each region #k as shown in the above formula 9 to generate a set of random numbers S_1^(k),···,S_ω^(k).

[0204] Here, similarly to the random number calculation unit 130A, the random number calculation unit 230A sets the initial value of each line of the exclusive OR of the product of Z and α for each zone as a set of random numbers generated in the previous zone and encrypted by the random number encryption unit 240A described later. The random number calculation unit 230A outputs the set of random numbers S_1^(k),...,S_ω^(k) generated for each zone #k other than the last zone #β to the random number encryption unit 240A. The random number calculation unit 230A also outputs the set of random numbers S_1^(β),...,S_ω^(β) generated for the last zone #β to the tag generation unit 250A.

[0205] The random number encryption unit 240A encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k except the last area #β, using a nonce N, just like the above-mentioned random number encryption unit 140. Here, the contents of the calculation of the random number encryption unit 240A are substantially similar to those shown in FIG. 7. Therefore, the random number encryption unit 240A encrypts the set of random numbers S_1^(k),...,S_ω^(k) generated for each area #k, using a TBC function to which Tweak including the nonce N and key K are input. Then, the random number encryption unit 240A sets the encryption result obtained by encrypting the set of random numbers S_1^(k),...,S_ω^(k) as the initial value (initial state) of the process in the next area #(k+1). That is, the encrypted random numbers S_1^(k), . . . , S_ω^(k) become the initial values ​​of each line i (1≦i≦ω) in the processing of the random number calculation unit 230A in the next area #(k+1).

[0206] The tag generator 250A, like the tag generator 250 described above, generates a test tag T using the set of random numbers S_1^(β), . . . , S_ω^(β) generated for the last section #β and the nonce N. * The method of generating the tag T is substantially the same as the method of generating the tag T in the tag generation unit 150. Therefore, the tag generation unit 250A performs the calculation shown in FIG. 9. That is, the tag generation unit 250A encrypts the set of random numbers S_1^(β),...,S_ω^(β) generated for the area #β, using the TBC function to which Tweak including the nonce N and the key K are input. By encrypting the set of random numbers S_1^(β),...,S_ω^(β), the tag generation unit 250A generates the tag T * [1],···,T * [ω]. Then, the tag generation unit 250A obtains T * [1],···,T * [ω], tag T * =T * [1]||···||T * [ω] and output to tag inspection unit 260.

[0207] <Effects> The authentication encryption system 1 according to the second embodiment can achieve substantially the same effect as the authentication encryption system 1 according to the first embodiment. That is, as described above, the authentication encryption device 10A according to the second embodiment divides the input block (AD block and plaintext block) into sections including (2^b-1) blocks, which is a size that can be processed by the method according to the comparative example. Then, the authentication encryption device 10A according to the second embodiment is configured to appropriately derive the tag T from a set of random numbers S generated in each section. As a result, the authentication encryption system 1 according to the second embodiment can process (2^b-1) or more input blocks, which was impossible in terms of security by the method according to the comparative example. Also, in the authentication encryption system 1 according to the second embodiment, there is no limit to the number of blocks that can be processed, so that it is possible to transmit a ciphertext at one time regardless of the size of the plaintext. That is, in the second embodiment, it is only necessary to transmit only a single (N, A, C, T). Therefore, it is possible to suppress the communication load.

[0208] (Embodiment 3) Next, a description will be given of embodiment 3. Embodiment 3 shows an outline of the configuration according to the above-mentioned embodiments.

[0209] FIG. 22 is a diagram showing a configuration of an authentication encryption device 30 according to the third embodiment. The authentication encryption device 30 according to the third embodiment corresponds to the authentication encryption device 10 according to the first embodiment and the authentication encryption device 10A according to the second embodiment. The authentication encryption device 30 according to the third embodiment includes an encryption unit 320, a random number calculation unit 330, a random number encryption unit 340, and a tag generation unit 350. The encryption unit 320 has a function as an encryption means. The random number calculation unit 330 has a function as a random number calculation means (first random number calculation means). The random number encryption unit 340 has a function as a random number encryption means (first random number encryption means). The tag generation unit 350 has a function as a tag generation means (first tag generation means).

[0210] The encryption unit 320 can be realized by substantially the same functions as those of the encryption unit 120 shown in Fig. 3 or the encryption unit 120A shown in Fig. 16. The encryption unit 320 encrypts a plaintext divided into plaintext blocks of a predetermined length (e.g., b bits) for each section of the predetermined length, using a tweakable block cipher (TBC function) using a nonce as a tweak.

[0211] Here, in the above-mentioned embodiment, when the bit length of the plaintext block is b bits, the "area of ​​a predetermined length" corresponds to an area that may contain (2^b-2) blocks in the first embodiment, and corresponds to an area that may contain (2^b-1) blocks in the second embodiment. However, the "area of ​​a predetermined length" is not limited to an area that may contain these numbers of blocks. As mentioned above, the last area does not need to have (2^b-2) (or (2^b-1)) blocks. Also, when related data is input, at least the first area may not contain (2^b-2) (or (2^b-1)) plaintext blocks. The same applies to the authentication / decryption device 40 according to the third embodiment described later.

[0212] The random number calculation unit 330 can be realized by substantially the same functions as those of the random number calculation unit 130 shown in Fig. 3 or the random number calculation unit 130A shown in Fig. 16. In encryption, the random number calculation unit 330 generates a set of random numbers for each area using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements.

[0213] Here, the "function related to the tweakable block cipher" corresponds to the TBC function in the above-mentioned embodiment. Also, the "first data" corresponds to the random number Z output from the TBC function in the first embodiment. Meanwhile, in the second embodiment, the "first data" corresponds to the plaintext block (intermediate value Z) input to the TBC function. Note that the first data is not limited to the data input to the TBC function or the data output from the TBC function. The first data may be derived using both the input data and the output data of the TBC function. Also, the "function related to the tweakable block cipher" is not limited to the TBC function in the above-mentioned embodiment. The same applies to the authentication decryption device 40 according to the third embodiment described later.

[0214] The "predetermined matrix" corresponds to the matrix AM described above, but is not limited to this. In the above-mentioned first embodiment, the "predetermined matrix" corresponds to the matrix AM shown in Equation 5. In the above-mentioned second embodiment, the "predetermined matrix" corresponds to the matrix AM shown in Equation 8. The "predetermined value" corresponds to α, which is an element in the above-mentioned matrix AM, but is not limited to this. The random number generated by the random number calculation unit 330 corresponds to the above-mentioned random number S, but is not limited to this. The same applies to the authentication and decryption device 40 according to the embodiment 3 described later.

[0215] The random number encryption unit 340 can be realized by substantially the same functions as those of the random number encryption unit 140 shown in Fig. 3 or the random number encryption unit 140A shown in Fig. 16. The random number encryption unit 340 encrypts a set of random numbers generated in each area using a tweakable block cipher, and sets each of the encrypted random numbers as an initial value for processing in the next area.

[0216] The tag generator 350 can be realized by substantially the same functions as those of the tag generator 150 shown in Fig. 3 or the tag generator 150A shown in Fig. 16. The tag generator 350 encrypts the set of random numbers generated in the last section using a tweakable block cipher to generate a tag for authentication. Here, the generated tag corresponds to the tag T described above.

[0217] Also, as in the above-mentioned embodiment, the random number calculation unit 330 may generate a set of random numbers using the same predetermined matrix for each zone. Also, as in the above-mentioned embodiment, the random number calculation unit 330 may generate a set of random numbers consisting of a number of random numbers corresponding to a value ω indicating a predetermined security level for each of the β zones. At this time, the random number encryption unit 340 may encrypt each of the generated ω random numbers for each of the 1st to (β-1)th zones using a tweakable block cipher, and set each of the encrypted ω random numbers as an initial value for processing in the next zone. Also, at this time, the tag generation unit 350 may encrypt each of the ω random numbers generated in the βth zone using a tweakable block cipher to generate a set of ω tags. These are similar to the authentication and decryption device 40 according to the third embodiment described later.

[0218] FIG. 23 is a diagram showing a configuration of an authentication / decryption device 40 according to the third embodiment. The authentication / decryption device 40 according to the third embodiment corresponds to the authentication / decryption device 20 according to the first embodiment and the authentication / decryption device 20A according to the second embodiment. The authentication / decryption device 40 according to the third embodiment includes a decryption unit 420, a random number calculation unit 430, a random number encryption unit 440, a tag generation unit 450, and a tag inspection unit 460. The decryption unit 420 has a function as a decryption means. The random number calculation unit 430 has a function as a random number calculation means (second random number calculation means). The random number encryption unit 440 has a function as a random number calculation means (second random number encryption means). The tag generation unit 450 has a function as a tag generation means (second tag generation means). The tag inspection unit 460 has a function as a tag inspection means.

[0219] The decryption unit 420 can be realized by substantially the same functions as those of the decryption unit 220 shown in Fig. 10 or the decryption unit 220A shown in Fig. 21. The decryption unit 420 uses a tweakable block cipher (TBC function) using a nonce as a tweak to decrypt a ciphertext divided into ciphertext blocks of a predetermined length (e.g., b bits) for each section of the predetermined length.

[0220] The random number calculation unit 430 can be realized by substantially the same functions as those of the random number calculation unit 230 shown in Fig. 10 or the random number calculation unit 230A shown in Fig. 21. In decryption, the random number calculation unit 430 generates a set of random numbers for each area using first data derived from at least one of the input and output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements.

[0221] The random number encryption unit 440 can be realized by substantially the same functions as those of the random number encryption unit 240 shown in Fig. 10 or the random number encryption unit 240A shown in Fig. 21. The random number encryption unit 440 encrypts a set of random numbers generated in each area using a tweakable block cipher, and sets each of the encrypted random numbers as an initial value for processing in the next area.

[0222] The tag generator 450 can be realized by substantially the same function as the tag generator 250 shown in FIG. 10 or the tag generator 250A shown in FIG. 21. The tag generator 450 encrypts the set of random numbers generated in the last section using a tweakable block cipher to generate a tag for inspection. Here, the generated tag is the tag T * Corresponds to.

[0223] Tag inspection unit 460 can be realized by substantially the same functions as those of tag inspection unit 260 shown in Fig. 10 or 21. Tag inspection unit 460 compares an inspection tag with an input authentication tag to inspect whether or not the tag has been tampered with, and performs control to output the inspection result.

[0224] The authentication encryption device 30 and the authentication decryption device 40 according to the third embodiment, with the above-mentioned configuration, can increase the number of plaintext blocks that can be processed in one authentication encryption while realizing high security. The authentication encryption system including the authentication encryption device 30 and the authentication decryption device 40 can also increase the number of plaintext blocks that can be processed in one authentication encryption while realizing high security. The authentication encryption method and the program for executing the authentication encryption method executed by the authentication encryption device 30 can also increase the number of plaintext blocks that can be processed in one authentication encryption while realizing high security. It is also possible to suppress delays in encryption and decryption. The authentication decryption method and the program for executing the authentication decryption method executed by the authentication decryption device 40 can also increase the number of plaintext blocks that can be processed in one authentication encryption while realizing high security.

[0225] (Second Comparative Example) Here, a second comparative example will be described. 24 and 25 are diagrams for explaining the second comparative example. The authentication encryption device 90 according to the second comparative example does not have the random number encryption unit 140 that is a component of the authentication encryption device 10 according to the first embodiment, and has a tag generation unit 940 instead of the tag generation unit 150.

[0226] In the first embodiment, the initial value of the process in area #(k+1) is the encryption result of encrypting the set of random numbers generated in the process in area #k. In contrast, in the second comparative example, the initial value is reset for each area. That is, the initial value becomes 0^b for each area. In the second comparative example, the encryption unit 120 uses this reset initial value for each area to encrypt the plaintext block in a manner substantially similar to that of the first embodiment described above. Also, in the second comparative example, the random number calculation unit 130 uses this reset initial value for each area to generate a set of random numbers S in a manner substantially similar to that of the first embodiment described above.

[0227] On the other hand, the tag generation unit 950 according to the second comparative example uses a set of random numbers S generated by the random number calculation unit 130 for each zone and a nonce N to generate a tag T for authentication by a message authentication code using a tweakable block cipher. In order to securely generate the tag T from the random numbers S, the tag generation unit 950 uses a nonce-based Message Authentication Code (MAC) to combine the set of random numbers to generate the tag T. Here, the nonce-based MAC is a MAC input that includes a nonce.

[0228] The tag generation unit 950 receives a nonce N from the nonce generation unit 104. The tag generation unit 950 also receives a set of random numbers from the random number calculation unit 130. The random number calculation unit 130 performs the above-mentioned process for each zone, and the tag generation unit 950 obtains a set of random numbers as shown in the matrix of the following formula 11. Here, formula 11 shows a random number matrix with a size of ω×β and with random number S as an element.

number

[0229] Then, the tag generation unit 950 processes the random numbers S_i^(1),...,S_i^(β) included in each row of the random number matrix shown in Equation 11 using a nonce-based MAC to generate a tag T[i]. Here, the tag generation unit 950 generates tags T[1],...,T[ω] using ω MACs. That is, for 1≦i≦ω, the tag generation unit 950 generates a tag T[i] using the i-th MAC_i.

[0230] Fig. 25 is a diagram showing an outline of the calculation of the tag generation unit 950 according to the second comparative example. Fig. 25 shows a tag derivation function used in the tag generation unit 950. That is, Fig. 25 shows a nonce-based MAC used in the tag generation unit 950. Here, Fig. 25 shows an example in which the tag generation unit 950 processes random numbers S_i^(1),...,S_i^(β) corresponding to the i-th row in Equation 11 with MAC_i to generate a tag T[i].

[0231] The tag generation unit 950 calculates the constant fix by applying the key K, the nonce N, and the Tweak to the TBC function E K ~ The tag generating unit 950 encrypts the constant fix using the encryption result of the TBC function to which (N, a, m, i, 1) is input as a tweak for index i (1≦i≦ω) of each row (each line) of formula 11. Since the encryption result obtained by encrypting the constant fix is ​​generated using the TBC function to which a tweak including a nonce is input, it can be said to be a nonce-derived random number.

[0232] The tag generator 950 also calculates the random numbers S_i^(1), . . . , S_i^(β) using the TBC function E K ~ ', where TBC function E K ~ 'Which TBC function E K ~ This is a TBC function that inputs a different tweak from the tweak input to the tweak input to the tweak input to the tweak input. Therefore, duplication of tweaks can be avoided.

[0233] Then, the tag generator 950 generates the TBC function E K ~ The encryption result of the constant fix encrypted using the TBC function E K ~ The tag generation unit 950 generates tag T[i] by performing the exclusive OR (sum) of the encryption result of encrypting random numbers S_i^(1),...,S_i^(β) using '. The tag generation unit 950 performs the above process for i=1 to ω to generate tags T[1],...,T[ω]. The tag generation unit 950 then outputs T[1],...,T[ω] as tag T=T[1]||...||T[ω]. In the second comparative example, the security of the MAC can be ensured by such processing.

[0234] Here, the tag generation unit 950 according to the second comparative example generates the tag T using all the random numbers S generated in each zone. In this case, it is necessary to hold all the elements of the random number matrix (Equation 11) in memory. Therefore, a storage area is required to store the sets of random numbers S generated for all the zones.

[0235] In addition, by proceeding with the tag generation process every time a random number S is generated in each area, the capacity of the storage area can be saved. That is, specifically, in FIG. 25, the tag generation unit 950 first generates a random number derived from a nonce and sets it as a temporary tag. Then, when a random number S_i^(1) is generated for the first area, the tag generation unit 950 encrypts the random number S_i^(1) with a TBC function, calculates an exclusive OR with the temporary tag, and updates the temporary tag. The tag generation unit 950 generates a tag T by repeating this process every time a random number S is generated for each area. By performing such a process, it is not necessary to hold all elements of the random number matrix in a memory. However, even in this case, a memory for holding the temporary tag is required.

[0236] In contrast, in this embodiment, as described above, the set of random numbers S is encrypted and used as an initial value (or a source of tag generation), so there is no need to store the set of random numbers S. Therefore, the method according to this embodiment can save storage capacity. Specifically, it is possible to increase the number of plaintext blocks that can be processed in one authenticated encryption while achieving high security with approximately the same storage capacity as the PFBω technology according to the above-mentioned Non-Patent Document 1.

[0237] (Hardware configuration example) An example of the configuration of hardware resources for implementing the devices and systems according to the above-mentioned embodiments using one calculation processing device (information processing device, computer) will be described. However, the devices according to the embodiments (authentication encryption device and authentication decryption device) may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the devices according to the embodiments may be implemented as dedicated devices or general-purpose information processing devices.

[0238] FIG. 26 is a block diagram showing an example of a hardware configuration of a calculation processing device capable of realizing the device and system according to each embodiment. The calculation processing device 1000 has a CPU 1001, a volatile storage device 1002, a disk 1003, a non-volatile recording medium 1004, and a communication IF 1007 (IF: Interface). Therefore, it can be said that the device according to each embodiment has the CPU 1001, the volatile storage device 1002, the disk 1003, the non-volatile recording medium 1004, and the communication IF 1007. The calculation processing device 1000 may be connectable to an input device 1005 and an output device 1006. The calculation processing device 1000 may include the input device 1005 and the output device 1006. In addition, the calculation processing device 1000 can transmit and receive information to and from other calculation processing devices and communication devices via the communication IF 1007.

[0239] The non-volatile recording medium 1004 is a computer-readable medium, such as a compact disc or a digital versatile disc. The non-volatile recording medium 1004 may also be a universal serial bus (USB) memory, a solid state drive, or the like. The non-volatile recording medium 1004 holds the relevant program without the need for a power supply, making it possible to carry the program. The non-volatile recording medium 1004 is not limited to the above-mentioned medium. Instead of the non-volatile recording medium 1004, the relevant program may be supplied via the communication IF 1007 and a communication network.

[0240] The volatile storage device 1002 is computer-readable and can temporarily store data. The volatile storage device 1002 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0241] That is, when the CPU 1001 executes a software program (computer program: hereinafter, simply referred to as a "program") stored in the disk 1003, the CPU 1001 copies the program to the volatile storage device 1002 and executes arithmetic processing. The CPU 1001 reads data required for executing the program from the volatile storage device 1002. When display is required, the CPU 1001 displays the output result on the output device 1006. When a program is input from the outside, the CPU 1001 acquires the program from the input device 1005. The CPU 1001 interprets and executes a program corresponding to the function (process) of each component shown in the above-mentioned FIGS. 3, 10, 16, 21 to 23. The CPU 1001 executes the process described in each of the above-mentioned embodiments. In other words, the function of each component shown in the above-mentioned FIGS. 3, 10, 16, 21 to 23 can be realized by the CPU 1001 executing a program stored in the disk 1003 or the volatile storage device 1002.

[0242] That is, each of the embodiments can be realized by the above-mentioned program. Furthermore, each of the embodiments can be realized by a computer-readable non-volatile recording medium on which the above-mentioned program is recorded.

[0243] (Modification) The present invention is not limited to the above embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, in the above-mentioned flow chart, the order of each process (step) can be modified as appropriate. Also, one or more of the multiple processes (steps) may be omitted.

[0244] For example, in the flowchart shown in Fig. 14, the process of S108 may be executed before the process of S104 or S106. Furthermore, the process of S108 may be executed in parallel with the processes of S104 and S106. This also applies to the flowchart in Fig. 15.

[0245] In addition, in the above-mentioned first embodiment, the division of the associated data A and the plaintext M is performed by the division unit 102, but this is not limited to the configuration. The division of the associated data A may be performed by the AD processing unit 110. Similarly, the division of the plaintext M may be performed by the encryption unit 120. Moreover, the division of the AD blocks into each section may also be performed by the AD processing unit 110. Similarly, the division of the plaintext blocks into each section may also be performed by the encryption unit 120. In these cases, the division unit 102 may not be necessary. The same applies to the division units shown in FIG. 10, FIG. 16, and FIG. 21.

[0246] Also, in the above-mentioned embodiment, it has been described that blocks (AD blocks, plaintext blocks, or ciphertext blocks) are divided into each zone, but this is not a limitation. Starting from the first block, blocks may be divided by the number of blocks contained in each zone ((2^b-1) in the first embodiment, and (2^b-1) in the second embodiment) and encryption (or decryption) and random number generation processing may be performed. In this case, after processing for the first zone is completed, blocks may be divided for the second zone and encryption (or decryption) and random number generation processing may be performed. The same applies to the subsequent zones.

[0247] In the above examples, the program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, the computer-readable medium or tangible storage medium includes random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disk (DVD), Blu-ray® disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, the transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

[0248] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the invention.

[0249] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. (Appendix 1) An encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each area and a predetermined matrix having elements of predetermined values; a random number encryption means for encrypting a set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a tag generating means for generating a tag for authentication by encrypting the set of random numbers generated in the last zone using a tweakable block cipher; An authentication encryption device having: (Appendix 2) The random number calculation means generates the set of random numbers using the same predetermined matrix for each area. 2. An authentication encryption device as claimed in claim 1. (Appendix 3) the random number calculation means generates, for each of the β zones, a set of random numbers, the number of which corresponds to a value ω indicating a predetermined security level; the random number encryption means encrypts each of the generated ω random numbers for each of the first to (β-1)th zones using a tweakable block cipher, and sets each of the encrypted ω random numbers as an initial value for processing in the next zone; The tag generation means encrypts each of the ω random numbers generated in the β-th area using a tweakable block cipher to generate a set of ω tags. 3. An authentication encryption device according to claim 1 or 2. (Appendix 4) the encryption means generates a ciphertext block for each of the zones by exclusive-ORing the plaintext block and an encryption result obtained by encrypting the plaintext block preceding the plaintext block using a function related to a tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the encryption result corresponding to the first data and an element of the predetermined matrix. 4. An authentication encryption device according to any one of claims 1 to 3. (Appendix 5) the encryption means generates ciphertext blocks by encrypting the plaintext blocks in parallel for each of the zones using a function related to a tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the plaintext block corresponding to the first data and an element of the predetermined matrix; 4. An authentication encryption device according to any one of claims 1 to 3. (Appendix 6) A decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each area and a predetermined matrix having elements of predetermined values; a random number encryption means for encrypting a set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a tag generating means for generating a tag for inspection by encrypting the set of random numbers generated in the last area using a tweakable block cipher; a tag inspection means for inspecting whether the tag has been tampered with by comparing the inspection tag with an input authentication tag and controlling output of the inspection result; An authentication and decryption device having the above configuration. (Appendix 7) The random number calculation means generates the set of random numbers using the same predetermined matrix for each area. 7. An authentication and decryption device according to claim 6. (Appendix 8) the random number calculation means generates, for each of the β zones, a set of random numbers, the number of which corresponds to a value ω indicating a predetermined security level; the random number encryption means encrypts each of the generated ω random numbers for each of the first to (β-1)th zones using a tweakable block cipher, and sets each of the encrypted ω random numbers as an initial value for processing in the next zone; The tag generation means encrypts each of the ω random numbers generated in the β-th area using a tweakable block cipher to generate a set of ω tags. 8. The authentication and decryption device according to claim 6 or 7. (Appendix 9) the decryption means generates, for each of the regions, a plaintext block by performing an exclusive OR operation on the ciphertext block and an encryption result obtained by encrypting, using a function related to a tweakable block cipher, a plaintext block obtained by using the ciphertext block preceding the ciphertext block, and the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the encryption result corresponding to the first data and an element of the predetermined matrix. 9. An authentication and decryption device according to any one of Supplementary Notes 6 to 8. (Appendix 10) the decryption means generates plaintext blocks by decrypting the plurality of ciphertext blocks in parallel for each of the zones using a function related to a tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the plaintext block corresponding to the first data and an element of the predetermined matrix; 9. An authentication and decryption device according to any one of Supplementary Notes 6 to 8. (Appendix 11) an authentication encryption device; an authentication / decryption device that communicates with the authentication / encryption device; having The authentication encryption device includes: An encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a first random number calculation means for generating a set of random numbers for each zone by using data derived from at least one of an input and an output of a function related to the tweakable block cipher in each zone and a predetermined matrix having elements of predetermined values; a first random number encryption means for encrypting a set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a first tag generating means for generating a tag for authentication by encrypting the set of random numbers generated in the last zone using a tweakable block cipher; having The authentication and decryption device includes: A decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using the nonce as a tweak; a second random number calculation means for generating a set of random numbers for each area using data derived from at least one of an input and an output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements in the decryption; a second random number encryption means for encrypting the set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a second tag generating means for generating a tag for inspection by encrypting the set of random numbers generated in the last zone using a tweakable block cipher; a tag inspection means for inspecting whether the tag has been tampered with by comparing the inspection tag with the input authentication tag and controlling output of the inspection result; having Authenticated cryptography system. (Appendix 12) Using a tweakable block cipher that uses a nonce as a tweak, the plaintext divided into plaintext blocks of a predetermined length is encrypted for each section of the predetermined length. In the encryption, a set of random numbers is generated for each zone using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each zone and a predetermined matrix having predetermined values ​​as elements; The set of random numbers generated in each area is encrypted using a Tweakable block cipher, and each encrypted random number is used as an initial value for processing in the next area. The set of random numbers generated in the last section is encrypted using a Tweakable block cipher to generate a tag for authentication. Authentication encryption method. (Appendix 13) Using a tweakable block cipher using a nonce as a tweak, the ciphertext divided into ciphertext blocks of a predetermined length is decrypted for each section of the predetermined length. In the decryption, generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements; The set of random numbers generated in each area is encrypted using a Tweakable block cipher, and each encrypted random number is used as an initial value for processing in the next area. The set of random numbers generated in the last section is encrypted using a Tweakable block cipher to generate a tag for testing; By comparing the inspection tag with the input authentication tag, the presence or absence of tampering is inspected, and control is performed to output the inspection result. Authentication decryption method. (Appendix 14) A step of encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length using a tweakable block cipher using a nonce as a tweak; In the encryption, a step of generating a set of random numbers for each zone using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each zone and a predetermined matrix having predetermined values ​​as elements; A step of encrypting the set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; encrypting the set of random numbers generated in the last section using a tweakable block cipher to generate a tag for authentication; A non-transitory computer-readable medium on which a program for causing a computer to execute the program is stored. (Appendix 15) A step of decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length using a tweakable block cipher using a nonce as a tweak; In the decryption, a step of generating a set of random numbers for each zone using first data derived from at least one of an input and an output of a function related to the tweakable block cipher in each zone and a predetermined matrix having predetermined values ​​as elements; A step of encrypting the set of random numbers generated in each area using a tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; encrypting the set of random numbers generated in the last zone using a tweakable block cipher to generate a tag for testing; a step of controlling the comparison of the inspection tag with an input authentication tag to check for tampering and outputting the inspection result; A non-transitory computer-readable medium on which a program for causing a computer to execute the program is stored. [Explanation of symbols]

[0250] 1. Authenticated Encryption System 10 Authentication Encryption Device 20 Authentication and Decryption Device 30 Authentication Encryption Device 40 Authentication and Decryption Device 100 Input section 102 Division 104 Nonce Generation Unit 110 AD Processing Unit 120 Encryption section 130 Random Number Calculation Section 140 Random Number Encryption Unit 150 Tag Generator 160 Output section 200 Input section 202 Division 210 AD Processing Unit 220 Decoding section 230 Random Number Calculation Department 240 Random Number Encryption Unit 250 Tag Generator 260 Tag Inspection Department 320 Encryption section 330 Random Number Calculation Department 340 Random Number Encryption Unit 350 Tag Generator 420 Decoding section 430 Random Number Calculation Department 440 Random Number Encryption Unit 450 Tag Generator 460 Tag Inspection Department

Claims

1. An encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having elements of predetermined values; a random number encryption means for encrypting a set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a tag generating means for encrypting the set of random numbers generated in the last zone using a Tweakable block cipher to generate a tag for authentication; An authentication encryption device having:

2. The random number calculation means generates the set of random numbers using the same predetermined matrix for each area.

2. The authentication encryption device of claim 1.

3. the random number calculation means generates, for each of the β zones, a set of random numbers, the number of which corresponds to a value ω indicating a predetermined security level; the random number encryption means encrypts each of the generated ω random numbers for each of the first to (β−1)th zones using a Tweakable block cipher, and sets each of the encrypted ω random numbers as an initial value for processing in the next zone; The tag generation means encrypts each of the ω random numbers generated in the β-th area using a Tweakable block cipher to generate a set of ω tags.

3. An authentication encryption device according to claim 1 or 2.

4. the encryption means generates a ciphertext block for each of the areas by exclusive-ORing the plaintext block and an encryption result obtained by encrypting the plaintext block preceding the plaintext block using a function related to a Tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the encryption result corresponding to the first data and an element of the predetermined matrix.

4. An authentication encryption device according to claim 1.

5. the encryption means generates ciphertext blocks by encrypting the plaintext blocks in parallel for each of the zones using a function related to a Tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the plaintext block corresponding to the first data and an element of the predetermined matrix.

4. An authentication encryption device according to claim 1.

6. A decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a random number calculation means for generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having elements of predetermined values; a random number encryption means for encrypting a set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a tag generating means for encrypting the set of random numbers generated in the last zone using a Tweakable block cipher to generate a tag for testing; a tag inspection means for inspecting whether the tag has been tampered with by comparing the inspection tag with an input authentication tag and controlling output of the inspection result; An authentication and decryption device having the above configuration.

7. The random number calculation means generates the set of random numbers using the same predetermined matrix for each area. The authentication and decryption device according to claim 6.

8. the random number calculation means generates, for each of the β zones, a set of random numbers, the number of which corresponds to a value ω indicating a predetermined security level; the random number encryption means encrypts each of the generated ω random numbers for each of the first to (β−1)th zones using a Tweakable block cipher, and sets each of the encrypted ω random numbers as an initial value for processing in the next zone; The tag generation means encrypts each of the ω random numbers generated in the β-th area using a Tweakable block cipher to generate a set of ω tags. The authentication and decryption device according to claim 6 or 7.

9. the decryption means generates a plaintext block by performing an exclusive OR operation on the ciphertext block and an encryption result obtained by encrypting, by using a function related to a Tweakable block cipher, a plaintext block obtained by using the ciphertext block preceding the ciphertext block, for each of the regions; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the encryption result corresponding to the first data and an element of the predetermined matrix. The authentication and decryption device according to any one of claims 6 to 8.

10. the decryption means generates plaintext blocks by decrypting the plurality of ciphertext blocks in parallel for each of the zones using a function related to a Tweakable block cipher; the random number calculation means generates the random number by performing an exclusive OR on a multiplication value of the plaintext block corresponding to the first data and an element of the predetermined matrix. The authentication and decryption device according to any one of claims 6 to 8.

11. an authentication encryption device; an authentication / decryption device that communicates with the authentication / encryption device; having The authentication encryption device includes: An encryption means for encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using a nonce as a tweak; a first random number calculation means for generating a set of random numbers for each area using data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements in the encryption; a first random number encryption means for encrypting a set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in a next area; a first tag generating means for encrypting the set of random numbers generated in the last zone using a Tweakable block cipher to generate a tag for authentication; having The authentication and decryption device includes: a decryption means for decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length by using a tweakable block cipher using the nonce as a tweak; a second random number calculation means for generating a set of random numbers for each area using data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements in the decryption; a second random number encryption means for encrypting the set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; a second tag generating means for generating a tag for testing by encrypting the set of random numbers generated in the last zone using a Tweakable block cipher; a tag inspection means for inspecting whether the tag has been tampered with by comparing the inspection tag with the input authentication tag and controlling output of the inspection result; having Authenticated cryptography system.

12. A computer comprising: A plaintext divided into plaintext blocks of a predetermined length is encrypted for each section of the predetermined length using a tweakable block cipher using a nonce as a tweak; In the encryption, a set of random numbers is generated for each zone using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each zone and a predetermined matrix having predetermined values ​​as elements; The set of random numbers generated in each area is encrypted using a Tweakable block cipher, and each of the encrypted random numbers is used as an initial value for processing in the next area; The set of random numbers generated in the last section is encrypted using a Tweakable block cipher to generate a tag for authentication. Authentication encryption method.

13. A computer comprising: Using a Tweakable block cipher using a nonce as a tweak, a ciphertext divided into ciphertext blocks of a predetermined length is decrypted for each section of the predetermined length; In the decryption, a set of random numbers is generated for each area using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements; The set of random numbers generated in each area is encrypted using a Tweakable block cipher, and each of the encrypted random numbers is used as an initial value for processing in the next area; encrypting the set of random numbers generated in the last section using a Tweakable block cipher to generate a tag for testing; By comparing the inspection tag with the input authentication tag, the presence or absence of tampering is inspected, and control is performed to output the inspection result. Authentication decryption method.

14. A step of encrypting a plaintext divided into plaintext blocks of a predetermined length for each section of the predetermined length using a Tweakable block cipher using a nonce as a tweak; In the encryption, a step of generating a set of random numbers for each zone using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each zone and a predetermined matrix having predetermined values ​​as elements; A step of encrypting the set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; encrypting the set of random numbers generated in the last zone using a Tweakable block cipher to generate a tag for authentication; A program that causes a computer to execute the following.

15. A step of decrypting a ciphertext divided into ciphertext blocks of a predetermined length for each section of the predetermined length using a Tweakable block cipher using a nonce as a tweak; In the decryption, a step of generating a set of random numbers for each area using first data derived from at least one of an input and an output of a function related to the Tweakable block cipher in each area and a predetermined matrix having predetermined values ​​as elements; A step of encrypting the set of random numbers generated in each area using a Tweakable block cipher and setting each of the encrypted random numbers as an initial value for processing in the next area; encrypting the set of random numbers generated in the last zone using a Tweakable block cipher to generate a tag for testing; a step of controlling the comparison of the inspection tag with an input authentication tag to check for tampering and outputting the inspection result; A program that causes a computer to execute the following.

Images