Cryptographic systems, error correction methods, error correction programs

Abstract

The present invention contributes to data protection in error correction for obtaining the same random number from a shared random number sequence including an error. An encryption system that shares a random number based on a secret key between a first device and a second device, wherein: the first device and the second device have replacement means that share a replacement rule for dividing a candidate random number for sharing into data blocks having a prescribed length and replacing sequences inside the data blocks; the first device is provided with an encoding unit that applies replacement to a random number retained by the first device by using the replacement means, generates a syndrome, which is redundant data for error correction, for the data block after the replacement, and transmits the syndrome to the second device; and the second device is provided with a decoding unit that applies replacement to a random number retained by the second device by using the replacement means and performs error correction using the data block after the replacement and the syndrome, the second device transmitting the result of the error correction to the first device, applying reverse replacement to the data block after the error correction by using the replacement means, and sharing the data block between the first device and the second device.

Description

[Technical Field]

[0001] The present invention relates to a cryptographic system, an error correction method, and an error correction program. [Background Art]

[0002] In a quantum cryptographic system, key distillation is required to obtain the same secret key from a shared random number sequence containing errors obtained through a quantum channel, and error correction (reconciliation) is the core technology therefor. Since this error correction process directly handles the random numbers that form the base of the secret key, high security to prevent theft during implementation is required. Decoding of error correction codes is particularly processing-intensive, and external devices such as GPUs and FPGAs are often used, which creates many opportunities for attacks. Thus, it is desirable to have data protection measures that do not rely solely on access control.

[0003] Even if communication via a quantum channel is secured, implementation vulnerabilities may lead to information leakage. For example, a side-channel attack that focuses on power consumption measured during syndrome calculation in correction processing may be able to restore confidential information. Non-Patent Document 1 proposes countermeasures to prevent such side-channel attacks. [Prior Art Literature] [Non-Patent Literature]

[0004] [Non-Patent Document 1] Dongjun Park, et al. Single trace side-channel attack on key reconciliation in quantum key distribution system and its efficient countermeasures, ICT Express, Volume 7, Issue 1, 2021 [Summary of the Invention] [Problem to be Solved by the Invention]

[0005] Furthermore, the disclosures in the above-mentioned prior art documents are incorporated into this book by reference. The following analysis was conducted by the inventors.

[0006] Incidentally, in typical communication error correction, data is handled at higher layers as needed, so data protection in error correction processing was not sensitive. However, in quantum cryptography key distillation, error correction involves processing the secret information itself, making data protection crucial. Traditionally, physical means using hardware and access control through operational management were the main means of protection, but for stronger protection, the application of data protection technologies is desirable.

[0007] In view of the above-mentioned problems, the object of the present invention is to provide an encryption system, an error correction method, and an error correction program that contribute to data protection in error correction for obtaining identical random numbers from a shared random number sequence containing errors. [Means for solving the problem]

[0008] A first aspect of the present invention provides an encryption system in which a random number that forms the basis of a secret key is shared between a first device and a second device, wherein the first device and the second device have a substitution means that divides a candidate random number to be shared into data blocks of a predetermined length and shares a substitution rule for performing order substitutions within the data blocks, the first device includes an encoding unit that applies substitution to a random number it possesses using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device, the second device includes a decoding unit that applies substitution to a random number it possesses using the substitution means, performs error correction using the data block after substitution and the syndrome, transmits the result of the error correction to the first device, and applies inverse substitution to the data block after error correction using the substitution means to obtain a random number to be shared between the first device and the second device.

[0009] A second aspect of the present invention provides an error correction method for sharing a random number that forms the basis of a secret key between a first device and a second device, wherein the first device and the second device have a substitution means that divides a candidate random number to be shared into data blocks of a predetermined length and shares a substitution rule for performing order substitutions within the data blocks, the first device performs substitution on its own random number using the substitution means, generates a syndrome which is redundant data for error correction on the substituted data block, and transmits the syndrome to the second device, the second device performs substitution on its own random number using the substitution means, performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and performs reverse substitution on the error-corrected data block using the substitution means to obtain a random number to be shared between the first device and the second device.

[0010] A third aspect of the present invention is an error correction program that causes the first device and the second device to run in order to share a random number that forms the basis of a secret key between the first device and the second device, The first and second devices share a substitution means that divides a shared candidate random number into data blocks of a predetermined length and performs a substitution rule for permuting the order within the data blocks. The first device performs substitution on its own random number using the substitution means, generates a syndrome which is redundant data for error correction on the substituted data block, and transmits the syndrome to the second device. The second device performs substitution on its own random number using the substitution means, performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and also performs reverse substitution on the error-corrected data block using the substitution means to obtain a random number to be shared between the first and second devices. This program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as semiconductor memory, hard disk, magnetic recording medium, or optical recording medium. The present invention can also be embodied as a computer program product. [Effects of the Invention]

[0011] According to each aspect of the present invention, it is possible to provide an encryption system, an error correction method, and an error correction program that contribute to data protection in error correction for obtaining identical random numbers from a shared random number sequence containing errors. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 shows the basic configuration of key distillation in communication using quantum cryptography. [Figure 2] Figure 2 illustrates the role of syndromes in error correction. [Figure 3] Figure 3 shows the error correction procedure in key distillation. [Figure 4] Figure 4 is a schematic diagram showing the basic configuration of the cryptographic system according to the first embodiment. [Figure 5] Figure 5 shows an example of a method for configuring substitution in a substitution means. [Figure 6] Figure 6 is a system diagram showing the schematic procedure of the error correction method according to the first embodiment. [Figure 7] Figure 7 is a schematic diagram showing the basic configuration of the cryptographic system according to the second embodiment. [Figure 8] Figure 8 is a schematic diagram showing the basic configuration of the cryptographic system according to the third embodiment. [Figure 9] Figure 9 is a schematic diagram showing the basic configuration of the cryptographic system according to the fourth embodiment. [Figure 10] Figure 10 shows an example of the hardware configuration of the first and second devices. Mode for Carrying Out the Invention

[0013] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiments described below. In addition, in each drawing, the same or corresponding elements are denoted by the same reference numerals as appropriate. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationships and ratios of the respective elements may differ from those in reality. Even among the drawings, there may be portions where the dimensional relationships and ratios differ from each other.

[0014] Preparation Before describing embodiments of the present invention, key distillation in communication using quantum cryptography will be described. In quantum key distribution (QKD), a secret key can be shared by applying key distillation processing to a random number (shift key) shared via a quantum channel. This key distillation is mainly divided into two processes: error correction and privacy amplification. Error correction is a process for correcting errors between a first device and a second device to share the same random number sequence, and privacy amplification is a process for compressing the shared random number sequence such that the influence of eavesdropping becomes zero.

[0015] FIG. 1 is a diagram showing a basic configuration of key distillation in communication using quantum cryptography. As shown in FIG. 1, in key distillation in communication using quantum cryptography, a random number is transmitted from a second device (20) to a first device (10) via a quantum channel, and the first device (10) and the second device (20) obtain the same final key by performing key distillation on this random number.

[0016] As used herein, quantum cryptography refers to Quantum Key Distribution (QKD), which is a technology that securely shares a secret key between a sender and a receiver using a quantum channel (= communication based on extremely weak light at the single-photon level). The process of sharing a secret key consists of a step of sharing a random number via a quantum channel, and a post-processing step of key distillation that generates a secret key (called a final key) to be used for data encryption based on the random number (called a sifted key). By encrypting data with a one-time pad (= using a secret key of the same length as the data only once) using the final key shared via quantum cryptography, it is possible to achieve encryption that cannot be decrypted regardless of any future advances in decryption technology.

[0017] Key distillation refers to the post-processing of quantum key distribution, which is a process for generating a final key from a sifted key. As shown in FIG. 1, the key distillation process broadly includes error correction and privacy amplification. Error correction is a process for correcting errors between a first apparatus 10 and a second apparatus 20 to share the same random number sequence. The first apparatus 10 generates a syndrome, which is redundant data for error correction, from the random number it holds, and transmits the syndrome to the second apparatus. The second apparatus 20 performs error correction using the random number it holds and the syndrome. Privacy amplification is a process that compresses the random number sequence after error correction such that the influence of eavesdropping is eliminated.

[0018] Error correction is a technology for sharing the same data between a sender and a receiver even over a noisy communication channel. It consists of encoding performed by the sender side, where redundant data is added to a transmission data block, and decoding processing, where the transmission data block is estimated from the errored received data block using the redundancy. Herein, a data block combining transmission data and redundant bits obtained by encoding is referred to as a code word, and a received data block corresponding to a code word is referred to as a received word. Note that the code to be used is agreed in advance between the sender and the receiver (encoding means and decoding means are prepared based on the code to be used). In key distillation, this process is to align a sifted key with partial mismatches (errors) between the sender and the receiver to one version of the sifted key. The secret key after error correction is called a corrected key.

[0019] The correction key contains information that could potentially be obtained by an attacker via a quantum channel. The redundant data used in error correction could also be obtained by an attacker, meaning the correction key information could continue to be leaked. Confidentiality enhancement is a compression process using a universal hash function, generating a final key from the correction key where the amount of information potentially obtained by an attacker is effectively zero.

[0020] Figure 2 illustrates the role of syndrome in error correction. Error-correcting codes (linear codes) are characterized by an associated parity check matrix, and a codeword is a data block that, when multiplied by the parity check matrix, becomes all zeros. The length of the codeword and the number of columns in the parity check matrix are the same. In error-correcting codes, the syndrome is generally the bit sequence obtained by multiplying the received word by the parity check matrix. As shown in Figure 2A, if there is an error, the syndrome will not be zero, and the decoding process will estimate a bit sequence close to the received word that will result in a syndrome of zero.

[0021] Conversely, when a data block and a syndrome are given, the process of correcting the data block so that the syndrome matches can be performed using the same procedure as normal decoding, and this is called syndrome decoding. For syndrome decoding, the receiving side needs to obtain an error-free syndrome. In error correction of key distillation, as shown in Figure 2B, redundant data is generated in post-processing for the shift key shared on the quantum channel and sent via normal communication, so the redundant data can be transmitted without errors, and syndrome decoding can be applied.

[0022] A linear code is a code whose entire codeword is a linear space over a Galois field. The code is characterized by a parity check matrix, and the codeword is characterized as a sequence of symbols that, when multiplied by the parity check matrix, equals zero. Here, the Galois field GF(q) is usually set to q = 2m (binary). This is because addition in GF(2m) is XOR, and there are no carries, making it easy to handle. The decoding process is the process of finding the sequence of symbols that, when multiplied by the parity check matrix, equals zero and is closest to the received word. Below, we present examples of parity check matrices and codewords.

[0023] TIFF0007913640000001.tif50170

[0024] Figure 3 shows the error correction procedure in key distillation. The main parameters of an error-correcting code are code length and coding rate. Code length is the bit length of the codeword, and coding rate is the ratio of transmitted data to codeword. A lower coding rate (= large amount of redundant data) and a larger code length result in higher correction capability. There is also a limit to the coding rate at which correction is possible, depending on the level of noise in the communication channel. Furthermore, the coding rate can be changed by changing the code length of a single code. For example, puncturing can increase the coding rate by not transmitting some redundant data. Shortening can decrease the coding rate by fixing some of the transmitted data.

[0025] In quantum cryptography, the state of the quantum channel changes subtly depending on the distance between the sender and receiver, the optical fiber, and the environment. The final key generation rate is maximized by setting the appropriate coding rate and code length according to these conditions. Therefore, in the key distillation process, as shown in Figure 3, the first device 10 monitors the state of the quantum channel, determines a code with an appropriate coding rate and code length, and transmits this as metadata along with the syndrome to the second device 20. The second device 20 on the decryption side sets the code to be used for decryption from the metadata.

[0026] The receiving device 20 may sometimes fail to decrypt the data. The success or failure of decryption is determined by separately preparing redundant data for checking for post-decryption syndromes and error detection. The receiving device 20 transmits information about the success or failure of the received decryption to the transmitting device 10, and data blocks that failed to decrypt are discarded by both devices. Only data blocks that were successfully decrypted are used as input to enhance security.

[0027] [First Embodiment] As mentioned above, in conventional quantum cryptography communication, key distillation used error correction to share the same random number (shift key). However, because the key distillation process directly handles the random number (shift key) that forms the basis of the secret key, its implementation requires measures to prevent information theft. In normal communication error correction, encrypted data is handled as needed at the higher layer, so data protection in the error correction process was not sensitive. However, in quantum cryptography key distillation, error correction is performed on the secret information itself, making data protection crucial. For example, there are risks such as insider attacks by administrators, malware, unauthorized access using administrative privileges, side-channel attacks, and memory leaks. Furthermore, the error correction process for key distillation is particularly computationally intensive, and accelerators such as GPUs and FPGAs are also used, which broadens the opportunities for attacks. Traditionally, physical hardware measures and access control through operational management were the main means of protection, but the application of data protection technologies is desired for stronger protection. Therefore, in the error correction of key distillation in the first embodiment, random substitution is applied to the input data block.

[0028] Figure 4 is a schematic diagram showing the basic configuration of the cryptographic system according to the first embodiment. The cryptographic system shown in Figure 4 is an encryption system that shares a random number that forms the basis of the secret key between the first device 10 and the second device 20, and only the configuration related to error correction for sharing the same random number is described. Therefore, it is assumed that the cryptographic system also includes configurations related to enhanced confidentiality, which are not shown in Figure 4. In other words, the general configuration of key distillation already described is assumed to include an encryption system even if it is not directly described in Figure 4.

[0029] As shown in Figure 4, the first device 10 and the second device 20 have substitution means 11 and 21 that divide the shared candidate random numbers x and y into data blocks of a predetermined length and perform order substitutions within the data blocks, and they share the substitution rules. That is, the substitution rules in the substitution means 11 and 21 are kept secret between the sender and receiver and are securely shared in advance. Note that the substitution means 11 and 21 do not need to use a new substitution rule each time.

[0030] The first device 10 includes an encoding unit 12 that performs substitution on its own random number x using substitution means 11, generates a syndrome which is redundant data for error correction on the data block after substitution, and transmits this syndrome to the second device 20. On the other hand, the second device 20 includes a decoding unit 22 that performs substitution on its own random number y using substitution means 21, performs error correction using the data block after substitution and the syndrome, transmits the result of error correction to the first device 10, and performs reverse substitution on the data block after error correction using substitution means 21 to obtain a random number x to be shared between the first device 10 and the second device 20.

[0031] In the cryptographic system according to the first embodiment, the decryption process is performed while the substitution is still in place, so even if the memory value during the decryption process is stolen, it is possible to prevent the leakage of the original shift key information. Due to the confidential substitution, if the shift key is a random sequence, it becomes difficult for an attacker to guess the original shift key from the input to the decryption process (in key distillation, it can be expected that the shift key will be a random sequence each time). Furthermore, since the number of error bits does not change in the substitution process, the code correction capability remains unchanged.

[0032] A key feature of the cryptographic system according to the first embodiment is the introduction of random substitution on the syndrome generation side (the first device 10 side). This means that data protection in the cryptographic system according to the first embodiment requires cooperation between the sender and receiver. Furthermore, by substituting the data to be processed for error correction before processing, there is the advantage of not providing additional information to an attacker who has intercepted the quantum channel. In addition, the random substitution process has the advantage of protecting information about the position of the bits to be corrected. This information can also be protected from an attacker who has intercepted the quantum channel. This also has the effect of preventing the leakage of the shift key in the syndrome generation process.

[0033] Figure 5 shows an example of how to configure substitutions in a substitution mechanism. In a substitution mechanism, it is preferable to perform sequential substitutions within a data block corresponding to the code length, but the appropriate data block size changes depending on the quantum channel conditions. Since it is cumbersome to prepare separate substitutions for each data block size, one possible implementation method is to prepare a random substitution table for the largest code length and determine the position after substitution according to the order within that range for smaller code lengths. The example shown in Figure 5 is a method for creating a substitution table corresponding to a data block of size 6 from a substitution table corresponding to a data block of size 10. By adopting this method of preparing a random substitution table for the largest code length and determining the position after substitution according to the order within that range for smaller code lengths, it is not necessary to prepare a separate table for each code length.

[0034] Figure 6 is a system diagram showing the schematic procedure of the error correction method according to the first embodiment. As shown in Figure 6, the error correction method according to the first embodiment is an error correction method for sharing random numbers that form the basis of a secret key between a first device 10 and a second device 20. The first device 10 and the second device 20 are assumed to have permutation means 11 and 21 that share a permutation rule for dividing the candidate random numbers x and y to be shared into data blocks of a predetermined length and performing order permutations within the data blocks.

[0035] The first device 10 performs substitution on its own random number x using the substitution means 11 (step S1), generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits this syndrome to the second device 20 (step S2).

[0036] Meanwhile, the second device 20 performs substitution on its own random number y using the substitution means 21 (step S3), and performs error correction using the substituted data block and syndrome (step S4). Subsequently, the second device 20 transmits the result of the error correction to the first device 10 (step S5), and performs reverse substitution on the error-corrected data block using the substitution means 21 (step S6) to obtain a random number x to be shared between the first device 10 and the second device 20. The first device 10 discards data blocks that failed to decode according to the received error correction result (step S7).

[0037] [Second Embodiment] A known technique protects data during processing by masking it with random numbers (by adding or XORing). For example, this technique is used in cryptographic implementations to counter side-channel attacks. Furthermore, since error correction codes are linear, this mask-based protection can be naturally applied to error correction as well. Note that this random mask-based data protection process is completed on the decryption side.

[0038] Figure 7 is a schematic diagram showing the basic configuration of the cryptographic system according to the second embodiment. The cryptographic system shown in Figure 7 only describes the processing of the second device 20 (decryption side), which is related to the processing of data protection using a random mask. Therefore, it is assumed that the cryptographic system also includes configurations related to enhanced confidentiality and the first device (transmitter side), which are not shown in Figure 7. In other words, it is assumed that the cryptographic system includes the general configuration of key distillation that has already been explained, even if it is not directly shown in Figure 7.

[0039] As shown in Figure 7, the second device 20 shares with the first device 10 (not shown) a substitution rule in a substitution means 21 that divides the shared candidate random numbers x and y into data blocks of a predetermined length and performs order substitution within the data blocks. The first device 10 (not shown) also includes an encoding unit 12 that performs substitution on its own random number x using the substitution means 11, generates a syndrome which is redundant data for error correction in the resulting data blocks, and transmits this syndrome to the second device 20.

[0040] Meanwhile, the second device 20 adds a mask random number r to the replaced data block P(x), generates a mask syndrome S(r) from the mask random number r, adds it to the syndrome S(P(x)), performs error correction using the syndrome S(P(x))+S(r) obtained by adding the mask random number r to the replaced data block P(x)+r and the mask syndrome S(r), subtracts the mask random number r from the error-corrected data block P(x)+r, and then performs reverse substitution using the substitution means 21. Through this process, the second device 20 can obtain the random number x possessed by the first device 10 (not shown).

[0041] The encryption system according to the second embodiment is more secure because, in addition to the data protection of the encryption system according to the first embodiment, it also provides data protection through random mask processing. For example, if the balance of 0s and 1s in the random number y is disrupted, this information will leak even if substitution is performed, but this can also be concealed by applying a random mask.

[0042] [Third Embodiment] While substitution processing to swap bit order between the sender and receiver before key distillation has been performed conventionally, this was intended either as interleaving to mitigate burst errors or to suppress the effects of eavesdropping in quantum channels. For interleaving to mitigate burst errors, substitutions in large units spanning multiple codewords are effective, and since the purpose of suppressing the effects of eavesdropping in quantum channels is not protection during the key distillation process, substitution after processing is unnecessary.

[0043] On the other hand, the substitution process in this invention aims to prevent information from being stolen during the key distillation process. For this reason, substitution is also necessary after the process, and substitution within a codeword is more suitable than substitution across multiple codewords. Therefore, although the substitution process in this invention differs from the conventional substitution process that rearranges the bit order before key distillation, it is possible to combine this invention with the conventional substitution process before key distillation (interleaving), and each will exert its own effect.

[0044] Figure 8 is a schematic diagram showing the basic configuration of the cryptographic system according to the third embodiment. As shown in Figure 8, the first device 10 and the second device 20 obtain the shared candidate random numbers by performing substitutions across multiple codewords on the random numbers they possess. The subsequent key distillation process is the same as in the first embodiment.

[0045] Specifically, the first device 10 and the second device 20 have substitution means 11 and 21 that share a substitution rule for dividing shared candidate random numbers x and y into data blocks of a predetermined length and performing order substitutions within the data blocks. The first device 10 has an encoding unit 12 that performs substitution on its own random number x using the substitution means 11, generates a syndrome which is redundant data for error correction on the substituted data block, and transmits this syndrome to the second device 20. On the other hand, the second device 20 has a decoding unit 22 that performs substitution on its own random number y using the substitution means 21, performs error correction using the substituted data block and syndrome, transmits the result of error correction to the first device 10, and performs reverse substitution on the error-corrected data block using the substitution means 21 to obtain a random number x shared between the first device 10 and the second device 20.

[0046] Thus, the data protection of the cryptographic system according to the third embodiment can be naturally combined with the substitution process (interleaving) before key distillation, and the effects of each can be exerted independently.

[0047] [Fourth Embodiment] As already mentioned, the error correction process in key distillation is particularly computationally intensive, and accelerators such as GPUs and FPGAs are often used. The cryptographic systems according to each embodiment described above can also perform error correction by utilizing computational support from external devices.

[0048] Figure 9 is a schematic diagram showing the basic configuration of the cryptographic system according to the fourth embodiment. Although Figure 9 only shows the configuration related to the decryption process, it is assumed that the cryptographic system also includes configurations not shown in Figure 9, such as configurations related to enhancing confidentiality and the first device (transmitter). In other words, it is assumed that the cryptographic system includes the general configuration of key distillation that has already been explained, even if it is not directly shown in Figure 9.

[0049] As shown in Figure 9, the second device 20 divides the candidate random numbers y to be shared into data blocks of a predetermined length and shares the substitution rule in the substitution means 21, which performs order substitution within the data blocks, with the first device 10 (not shown). The first device 10 has an encoding unit 12 that performs substitution on its own random numbers x using the substitution means 11, generates a syndrome which is redundant data for error correction on the substituted data blocks, and transmits this syndrome to the second device 20. On the other hand, the second device 20 has a decoding unit 22 that performs substitution on its own random numbers y using the substitution means 21 and performs error correction using the substituted data blocks and syndrome, transmits the result of error correction to the first device 10, and performs reverse substitution on the error-corrected data blocks using the substitution means 21 to obtain a random number x to be shared between the first device 10 and the second device 20.

[0050] Here, the second device 20 utilizes the computational support of the external accelerator 13 in the error correction process using the replaced data blocks and syndrome. The external accelerator 13 performs decryption processing according to the control processing of the second device 20. Furthermore, the external accelerator 13 is an external device of the second device 20 and can be shared with other devices (channel 2, channel 3) without being exclusively used by the second device 20. In this case, in the cryptographic system according to the embodiment of the present invention, since the data blocks have been replaced, integrity is ensured even if the external accelerator 13 is an external device.

[0051] [Example Hardware Configuration] Figure 10 shows an example of the hardware configuration of the first and second devices. An information processing device (computer) employing the hardware configuration shown in Figure 10 can realize each of the functions of the first device 10 and the second device 20 described above. However, the hardware configuration example shown in Figure 10 is just one example of a hardware configuration that realizes each of the functions of the first device 10 and the second device 20, and is not intended to limit the hardware configuration of the first device 10 and the second device 20. The first device 10 and the second device 20 may include hardware not shown in Figure 10.

[0052] As shown in Figure 10, the hardware configuration 40 that the first device 10 and the second device 20 may employ includes, for example, a CPU (Central Processing Unit) 41, a main memory 42, an auxiliary memory 43, and an IF (Interface) unit 44, which are interconnected by an internal bus.

[0053] The CPU 41 executes each instruction included in the programs run by the first device 10 and the second device 20. The main memory 42 is, for example, RAM (Random Access Memory) and temporarily stores various programs run by the first device 10 and the second device 20 for the CPU 41 to process.

[0054] The auxiliary storage device 43 is, for example, an HDD (Hard Disk Drive) and is capable of storing various programs executed by the first device 10 and the second device 20 for the medium to long term. These programs can be provided as program products recorded on a non-transitory computer-readable storage medium. The auxiliary storage device 43 can be used to store various programs recorded on the non-transitory computer-readable storage medium for the medium to long term. The IF unit 44 provides an interface for communication between the first device 10 and the second device 20.

[0055] An information processing device employing the hardware configuration 40 described above can realize the functions of the first device 10 and the second device 20.

[0056] Some or all of the above embodiments may also be described as follows, but are not limited to the following: [Note 1] A cryptographic system in which a random number that forms the basis of a secret key is shared between a first device and a second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device includes an encoding unit that performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. The second device comprises a decoding unit that performs substitution on its own random numbers using the substitution means, and performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and performs reverse substitution on the error-corrected data block using the substitution means to obtain a random number to be shared between the first device and the second device. [Note 2] The cryptographic system described in Appendix 1, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block to which the mask random number has been added and the syndrome to which the mask syndrome has been added, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means. [Note 3] The cryptographic system described in Appendix 1, wherein the first and second devices use a substitution across multiple data blocks on their own random numbers to obtain the shared candidate random numbers. [Note 4] The second device is an encryption system according to any one of the appendices 1 to 3, which performs error correction by utilizing computational support from an external device. [Note 5] An error correction method for sharing a random number that forms the basis of a secret key between a first device and a second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. An error correction method comprising: the second device performing substitution on its own random numbers using the substitution means; performing error correction using the substituted data block and the syndrome; transmitting the result of the error correction to the first device; and performing reverse substitution on the error-corrected data block using the substitution means to obtain random numbers to be shared between the first device and the second device. [Note 6] The error correction method described in Appendix 5, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block to which the mask random number has been added and the syndrome to which the mask syndrome has been added, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means. [Note 7] The error correction method described in Appendix 5, wherein the first device and the second device perform substitutions across multiple data blocks on the random numbers they possess to obtain the shared candidate random numbers. [Note 8] The error correction method described in any one of Appendix 5 to 7, wherein the second device utilizes computational support from an external device to perform the error correction. [Note 9] An error correction program to be executed by the first device and the second device in order to share a random number that forms the basis of a secret key between the first device and the second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. An error correction program in which the second device performs substitution on its own random numbers using the substitution means, performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and performs reverse substitution on the error-corrected data block using the substitution means to obtain random numbers to be shared between the first device and the second device. [Note 10] The error correction program described in Appendix 9, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block with the mask random number added and the syndrome obtained by adding the mask syndrome, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means.

[0057] Furthermore, the disclosures of the above-mentioned patent documents and other materials cited are incorporated into this document by reference. Within the framework of the full disclosure of the present invention (including the claims), further modifications and adjustments to the embodiments or examples are possible based on the fundamental technical concept. Also, within the framework of the full disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosure elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes the full disclosure, including the claims, and various modifications and alterations that a person skilled in the art could make in accordance with the technical concept. In particular, with respect to the numerical ranges described in this document, any numerical value or sub-range included within that range should be interpreted as being specifically described, even if not otherwise stated. Furthermore, the disclosures of the above-mentioned cited documents may, if necessary, be used in part or in whole as part of the disclosure of the present invention, in accordance with the spirit of the present invention, and these may also be considered to be included in the disclosures of this application. [Explanation of Symbols]

[0058] 10 First apparatus 11,21 Substitution means 12 Encoding section 13. External accelerators 20 Second device 22 Decoding section 40 Hardware Configurations 41 CPU 42 Main storage 43 Auxiliary storage device 44 IF section

Claims

1. A cryptographic system in which a random number that forms the basis of a secret key is shared between a first device and a second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device includes an encoding unit that performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. The second device comprises a decoding unit that performs substitution on its own random numbers using the substitution means, and performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and performs reverse substitution on the error-corrected data block using the substitution means to obtain a random number to be shared between the first device and the second device.

2. The cryptographic system according to claim 1, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block to which the mask random number has been added and the syndrome to which the mask syndrome has been added, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means.

3. The cryptographic system according to claim 1, wherein the first device and the second device obtain the shared candidate random numbers by performing substitutions across a plurality of data blocks on the random numbers they possess.

4. The cryptographic system according to any one of claims 1 to 3, wherein the second device utilizes computational support from an external device to perform the error correction.

5. An error correction method for sharing a random number that forms the basis of a secret key between a first device and a second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. An error correction method comprising: the second device performing substitution on its own random numbers using the substitution means; performing error correction using the substituted data block and the syndrome; transmitting the result of the error correction to the first device; and performing reverse substitution on the error-corrected data block using the substitution means to obtain random numbers to be shared between the first device and the second device.

6. The error correction method according to claim 5, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block to which the mask random number has been added and the syndrome to which the mask syndrome has been added, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means.

7. The error correction method according to claim 5, wherein the first device and the second device perform substitutions across multiple data blocks on random numbers they possess to obtain the shared candidate random numbers.

8. The error correction method according to any one of claims 5 to 7, wherein the second device utilizes computational support from an external device to perform the error correction.

9. An error correction program to be executed by the first device and the second device in order to share a random number that forms the basis of a secret key between the first device and the second device, The first and second devices share a permutation means that divides a shared candidate random number into data blocks of a predetermined length and performs a permutation rule that permutes the order within the data block. The first device performs substitution on its own random numbers using the substitution means, generates a syndrome which is redundant data for error correction for the data block after substitution, and transmits the syndrome to the second device. An error correction program in which the second device performs substitution on its own random numbers using the substitution means, performs error correction using the substituted data block and the syndrome, transmits the result of the error correction to the first device, and performs reverse substitution on the error-corrected data block using the substitution means to obtain random numbers to be shared between the first device and the second device.

10. The error correction program according to claim 9, wherein the second device adds a mask random number to the replaced data block, generates a mask syndrome with respect to the mask random number and adds it to the syndrome, performs error correction using the replaced data block to which the mask random number has been added and the syndrome to which the mask syndrome has been added, subtracts the mask random number from the error-corrected data block and then performs reverse substitution using the substitution means.

Images