Encryption device, decryption device, encryption method, and encryption program

Abstract

To provide an encryption device, a decryption device, an encryption method, and an encryption program that can handle keys longer than a specified key length in existing encryption methods.SOLUTION: An encryption device 1 includes: a parameter setting unit 111 that accepts input of a key longer than a specified key length used in a predetermined stream encryption method, divides a portion exceeding the specified key length, and assigns it as a constant that is an input parameter of the stream encryption method; an initialization processing unit 112 that initializes the stream encryption method using the input parameter assigned by the parameter setting unit 111; and an encryption execution unit 113 that performs encryption in accordance with the stream encryption method.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technique for improving the security of a cryptographic method. [Background technology]

[0002] Conventionally, symmetric key cryptography using a 128-bit key has been widely used, but for quantum computers, which can execute calculation algorithms more efficiently than classical computers, the key length is √(2 128 ) and it has been pointed out that it may be possible to decrypt it using a large-scale quantum computer. Therefore, in order to ensure 128-bit security even against quantum computers, encryption methods compatible with 256-bit key lengths have been proposed (see, for example, Non-Patent Documents 1 to 3). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Hongjun Wu and Bart Preneel, AEGIS: A Fast Authenticated Encryption Algorithm, Selected Areas in Cryptography -- SAC 2013. [Non-patent document 2] Daniel J. Bernstein. ChaCha, a variant of Salsa20. In Workshop Record of SASC, volume 8, 2008. [Non-patent document 3] K. Sakamoto, F. Liu, Y. Nakano, S. Kiyomoto and T. Isobe. Rocca: An Efficient AES-based Encryption Scheme for Beyond 5G. IACR Transactions on Symmetric Cryptology, 2021(2), 1-30. Summary of the Invention [Problem to be solved by the invention]

[0004] Using a 256-bit key can ensure 128-bit security against quantum computers, but to achieve even higher security, a cryptographic method that supports longer key lengths is desired.

[0005] An object of the present invention is to provide an encryption device, a decryption device, an encryption method, and an encryption program that can handle keys longer than the specified key length in existing encryption methods. [Means for solving the problem]

[0006] The encryption device of the present invention comprises a parameter setting unit that accepts input of a key longer than a specified key length used in a specified stream encryption method, divides the portion exceeding the specified key length, and assigns it as a constant that is an input parameter of the stream encryption method; an initialization processing unit that initializes the stream encryption method using the input parameters assigned by the parameter setting unit; and an encryption execution unit that performs encryption in accordance with the stream encryption method.

[0007] The constant may be a value that is initialized as part of the internal state of the stream cipher.

[0008] The stream encryption method may be Rocca or Rocca-S, and the parameter setting unit may assign a portion of a 512-bit key to each of two 128-bit constants.

[0009] The decryption device according to the present invention comprises a parameter setting unit that accepts input of a key longer than a specified key length used in a predetermined stream encryption method, divides the portion exceeding the specified key length, and assigns it as a constant that is an input parameter of the stream encryption method; an initialization processing unit that initializes the stream encryption method using the input parameters assigned by the parameter setting unit; and a decryption execution unit that decrypts a ciphertext output by an encryption device according to any one of claims 1 to 3 in accordance with the stream encryption method.

[0010] The encryption method of the present invention is carried out by a computer, and includes a parameter setting step of accepting input of a key longer than a specified key length used in a specified stream encryption method, dividing the portion exceeding the specified key length, and assigning it as a constant that is an input parameter of the stream encryption method; an initialization processing step of initializing the stream encryption method using the input parameters assigned in the parameter setting step; and an encryption execution step of performing encryption in accordance with the stream encryption method.

[0011] The encryption program according to the present invention is for causing a computer to function as the encryption device. [Effects of the Invention]

[0012] According to the present invention, it is possible to deal with keys longer than the prescribed key length in existing encryption methods. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 2 is a diagram illustrating a functional configuration of an encryption device according to an embodiment. [Figure 2] FIG. 10 is a diagram illustrating a parameter setting method according to an embodiment. [Figure 3] FIG. 2 is a diagram illustrating a functional configuration of a decoding device according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] An example of an embodiment of the present invention will be described below. The encryption method of this embodiment is an improved method for existing stream ciphers. When encrypting data using a stream cipher, the first step is to perform initialization. There are three values ​​to input into the encryption program during initialization: a key, an initial value, and a constant. In this embodiment, by inputting a part of the key instead of the original value for the constant among these three values, it is possible to support a key longer than the key length originally supported by the encryption method.

[0015] FIG. 1 is a diagram showing the functional configuration of an encryption device 1 according to this embodiment. The encryption device 1 is an information processing device (computer) that includes a control unit 11, a memory unit 12, and various communication devices, and may be a general-purpose device such as a server or a personal computer, or small hardware such as a mobile terminal or IoT device.

[0016] The control unit 11 is a part that controls the entire encryption device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 12. The control unit may be a CPU. The storage unit 12 is a storage area for storing various programs for causing the hardware group to function as the encryption device 1, various data, and the like, and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like.

[0017] The encryption device 1 may be configured such that the control unit 11 executes the encryption program stored in the memory unit 12, but the control unit 11 and the memory unit 12 may also be implemented as hardware circuits dedicated to the encryption device 1.

[0018] The control unit 11 includes a parameter setting unit 111 , an initialization processing unit 112 , and an encryption execution unit 113 .

[0019] When the parameter setting unit 111 receives an input of a key longer than the specified key length used in a predetermined stream encryption method, it divides the portion exceeding the specified key length and assigns it as a constant that is an input parameter of the stream encryption method. This constant is a value that is initialized as part of the stream cipher's internal state.

[0020] FIG. 2 is a diagram illustrating a parameter setting method in this embodiment. In this example, an encryption method with a default key length of 256 bits and a constant of 256 bits is described.

[0021] The input parameters for initializing the internal state are a key, an initial value, and a constant, but the key can only be set to 256 bits. To make this encryption method compatible with a 512-bit key, the parameter setting unit 111 divides 256 bits of the 512-bit key and sets them as a constant. The initial value is set to a different value each time the initialization process is performed.

[0022] The keys and constants set in this manner are common values ​​on the encryption side (encryption device 1) and the decryption side (decryption device 2), and as a result, encryption and decryption are possible without modifying the encryption method (algorithm).

[0023] The initialization processing unit 112 initializes the stream encryption method using the input parameters assigned by the parameter setting unit 111 . The encryption execution unit 113 executes encryption in accordance with the algorithm of the target stream encryption method.

[0024] FIG. 3 is a diagram showing the functional configuration of the decoding device 2 in this embodiment. The decryption device 2 is a device that decrypts the data encrypted by the encryption device 1 using a corresponding decryption algorithm. Like the encryption device 1, the decryption device 2 is an information processing device (computer) that includes a control unit 21, a memory unit 22, and various communication devices, and may be a general-purpose device such as a server or a personal computer, or small hardware such as a mobile terminal or IoT device.

[0025] The control unit 21 is a part that controls the entire decoding device 2, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 22. The control unit may be a CPU. The storage unit 22 is a storage area for storing various programs for causing the hardware group to function as the decryption device 2, various data, and the like, and may be a ROM, RAM, flash memory, hard disk drive (HDD), or the like.

[0026] In addition, the decoding device 2 may be configured so that the control unit 21 executes the decoding program stored in the memory unit 22, but the control unit 21 and the memory unit 22 may also be implemented as hardware circuits dedicated to the decoding device 2.

[0027] The control unit 21 includes a parameter setting unit 211 , an initialization processing unit 212 , and a decoding execution unit 213 .

[0028] The parameter setting unit 211 and the initialization processing unit 212 perform the same functions as the parameter setting unit 111 and the initialization processing unit 112 of the encryption device 1, respectively. That is, as mentioned above, the key and constants are shared between the encryption side (encryption device 1) and the decryption side (decryption device 2) and initialization is performed, making it possible to encrypt and decrypt without modifying the encryption method (algorithm).

[0029] The decryption execution unit 213 is a functional unit corresponding to the encryption execution unit 113 of the encryption device 1, and executes decryption of data encrypted by the encryption device 1 according to the algorithm of the target stream encryption method.

[0030] Here, the initialization process improved by this embodiment will be described by taking a specific example of the stream encryption method in question.

[0031] [AEGIS] In the case of the encryption method AEGIS-256, which has a specified key length of 256 bits as shown in Non-Patent Document 1, during initialization, the key K, initial value IV, and constant const are set for six internal states S (each 128 bits) as follows: S(-16,0)=K(256,0)+IV(256,0); S(-16,1)=K(256,1)+IV(256,1); S(-16,2)=const1; S(-16,3)=const0; S(-16,4)=K(256,0)+const0; S(-16,5)=K(256,1)+const1 (where + is bitwise exclusive OR)

[0032] K(256,0) and K(256,1) are the first 128 bits and the last 128 bits of the 256-bit key K, respectively. Const1 and const0 are the first 128 bits and the last 128 bits of the constant const, respectively. IV(256,0) and IV(256,1) are the first 128 bits and the last 128 bits of the initial value IV, respectively.

[0033] Here, to accommodate a 512-bit key, the parameter setting unit 111 allocates, for example, 128 bits each of the first 256 bits to K(256,0) and K(256,1), and 128 bits each of the last 256 bits to const1 and const0. As a result, the encryption device 1 can realize a stream cipher using a 512-bit key, which is greater than 256 bits, by using the 256-bit constant portion as part of the key.

[0034] [ChaCha] In the case of the ChaCha encryption method with a specified key length of 256 bits as shown in Non-Patent Document 2, the following matrix with each element being 32 bits is defined as the internal state. x0x1x2x3 x4x5x6x7 x8x9x 10 x 11 x 12 x 13 x 14 x 15

[0035] In the initialization, keys key0 to key7 (total of 256 bits), initial values ​​counter0 and nonce0 to nonce2, and constants const1 to const3 (total of 128 bits) are set for each element as follows: const0 const1 const2 const3 key0key1key2key3 key4key5key6key7 counter0nonce0nonce1nonce2

[0036] Here, to accommodate a 384-bit key, the parameter setting unit 111 allocates, for example, 32 bits each of the first 256 bits to key0 to key7, and 32 bits each of the last 128 bits to const1 to const3. As a result, the encryption device 1 can realize a stream cipher using a 384-bit key, which is greater than 256 bits, by using the 128-bit constant portion as part of the key.

[0037] [Rocca] In the case of the Rocca encryption method with a specified key length of 256 bits as shown in Non-Patent Document 3, for eight internal states S (each 128 bits), keys K0 and K1 (each 128 bits), initial value N, and constants Z0 and Z1 (each 128 bits) are set as follows: S[0]=K1, S[1]=N, S[2]=Z0, S[3]=Z1, S[4]=N+K1, S[5]=0, S[6]=K0, S[7]=0 (where + is bitwise exclusive OR)

[0038] Similarly, in the case of the Rocca-S encryption scheme, which has a standard key length of 256 bits, the keys K0 and K1 (each 128 bits), the initial value N, and the constants Z0 and Z1 (each 128 bits) are set as follows for seven internal states S (each 128 bits): S[0]=K1, S[1]=N, S[2]=Z0, S[3]=K0, S[4]=Z1, S[5]=N+K1, S[6]=0 (where + is bitwise exclusive OR)

[0039] Here, to accommodate a 512-bit key, the parameter setting unit 111 allocates, for example, 128 bits each of the first 256 bits to K0 and K1, and 128 bits each of the last 256 bits to Z0 and Z1. As a result, the encryption device 1 can realize a stream cipher using a 512-bit key, which exceeds the original design of 256 bits, by using the 256-bit constant portion as part of the key. As a result, it is possible to support longer key lengths than originally designed without making major changes to existing encryption methods, thereby enabling the construction of more secure encryption methods.

[0040] According to this embodiment, the encryption device 1 and the decryption device 2 accept input of a key that is longer than the specified key length used in the stream encryption method, divide the portion exceeding the specified key length, and assign it as a constant that is an input parameter of the encryption method. This allows existing encryption methods to support keys longer than the specified key length without modifying the encryption algorithm.

[0041] The constants of the input parameters are usually specified as fixed values ​​as part of the specifications of the encryption algorithm, but other values ​​can also be used as long as they are shared between the encryption side (encryption device 1) and the decryption side (decryption device 2). Therefore, the encryption device 1 and the decryption device 2 can increase the corresponding key size compared to conventional devices by inputting a part of the key instead of the usual constant that is input during initialization.

[0042] The size of the constant varies depending on the encryption method, but as mentioned above, the key size can be extended up to 2 or 1.5 times the original length. In this case, by padding the input key with a fixed value, it is possible to support keys that do not meet the maximum length. Furthermore, the key length of the stream encryption method targeted for improvement in this embodiment is not limited to 256 bits, and the security of each method can be enhanced by applying it to encryption methods using 128-bit keys, which have been widely used in the past, or encryption methods such as 64-bit and 512-bit keys.

[0043] Furthermore, the constants that are input parameters are values ​​that are initialized as part of the internal state of the stream cipher system, and replacing these values ​​with part of the key does not cause any problems for the cipher algorithm, making it possible to easily improve security without modifying existing algorithms. For example, when using Rocca or Rocca-S as a stream cipher, by assigning a portion of the key (256 bits) to each of two 128-bit constants, a maximum key of 512 bits can be used, providing 256 bits of security.

[0044] Furthermore, this embodiment can improve the security of stream ciphers, for example, and therefore contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "Develop resilient infrastructure, promote sustainable industrialization and foster innovation."

[0045] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0046] The encryption method and decryption method performed by the encryption device 1 and the decryption device 2 are realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0047] 1 Encryption device 2. Decryption device 11 Control section 12 Storage section 21 Control section 22 Memory section 111 Parameter setting section 112 Initialization processing section 113 Encryption Execution Unit 211 Parameter setting section 212 Initialization processing section 213 Decryption execution unit

Claims

1. a parameter setting unit that accepts an input of a key longer than a specified key length used in a predetermined stream encryption method, divides the portion of the key that exceeds the specified key length, and assigns the portion as a constant that is an input parameter of the stream encryption method; an initialization processing unit that initializes the stream encryption method using input parameters assigned by the parameter setting unit; an encryption execution unit that executes encryption according to the stream encryption method.

2. 2. The encryption device according to claim 1, wherein the constant is a value that is initialized as part of an internal state of the stream encryption method.

3. the stream encryption method is Rocca or Rocca-S, 2. The encryption device according to claim 1, wherein the parameter setting unit assigns a portion of a 512-bit key to each of two 128-bit constants.

4. a parameter setting unit that accepts an input of a key longer than a specified key length used in a predetermined stream encryption method, divides the portion of the key that exceeds the specified key length, and assigns the portion as a constant that is an input parameter of the stream encryption method; an initialization processing unit that initializes the stream encryption method using input parameters assigned by the parameter setting unit; 4. A decryption device comprising: a decryption execution unit that decrypts a ciphertext output by the encryption device according to claim 1, in accordance with the stream encryption method.

5. a parameter setting step of accepting an input of a key longer than a specified key length used in a predetermined stream encryption method, dividing the portion exceeding the specified key length, and assigning the divided portion as a constant that is an input parameter of the stream encryption method; an initialization step of initializing the stream encryption method using the input parameters assigned in the parameter setting step; an encryption performing step of performing encryption according to the stream cipher scheme, the encryption method being executed by a computer.

6. An encryption program for causing a computer to function as the encryption device according to any one of claims 1 to 3.

Images