Authenticated encryption device, authenticated encryption method, and authenticated encryption program

Abstract

An initial processing unit (21) generates a secret value B from a secret key in authenticated encryption. A function F processing unit (22) repeats processing for updating the secret value B by a block cipher using the secret value B generated by the initial processing unit (21) as an input block of the block cipher. A ciphertext processing unit (23) uses the secret value B updated by the function F processing unit (22) to execute encryption processing for encrypting plaintext M and / or decryption processing for decrypting ciphertext C.

Description

Authentication encryption device, authentication encryption method, and authentication encryption program

[0001] The present disclosure relates to authenticated encryption using block ciphers.

[0002] An authenticated encryption algorithm is an encryption algorithm that simultaneously provides confidentiality and tamper detection functions. By using an authenticated encryption algorithm, two parties can communicate with each other while keeping the plaintext confidential, and the receiver can verify whether the message sent over the communication channel has been tampered with.

[0003] The authenticated encryption algorithm comprises two algorithms: an encryption function Enc and a decryption function Dec. The encryption function Enc is a function that takes a secret key K, a nonce N, a header A, and a plaintext M as input, and outputs a ciphertext C and an authenticator Tag for tampering detection. Note that a different value is used for the nonce N for each encryption, and the same value is never used unless the secret key K is changed. The decryption function Dec takes a secret key K, a nonce N, a header A, a ciphertext C, and an authenticator Tag for tampering detection as input, and outputs plaintext M if the input values ​​have not been tampered with, and outputs a value indicating that the input values ​​have been forged if they have been tampered with. Hereinafter, the value indicating that the input values ​​have been forged will be referred to as reject.

[0004] Assume that sender Alice and receiver Bob communicate using an authenticated encryption algorithm. Alice and Bob share a secret key K in advance. Sender Alice takes as input the secret key K, nonce N, header A, and plaintext M, and calculates the encryption function Enc to generate ciphertext C and an authenticator Tag for tamper detection. Sender Alice sends nonce N, header A, ciphertext C, and the authenticator Tag for tamper detection to receiver Bob. Receiver Bob takes as input the secret key K, nonce N, header A, ciphertext C, and the authenticator Tag for tamper detection, and calculates the decryption function Dec to determine that no tampering has been detected. If no tampering has been detected, receiver Bob generates plaintext M. Note that header A is a value that may be made public. Sender Alice sets the nonce N to a different value for each encryption, and does not use the same value.

[0005] The security of an authenticated encryption algorithm includes confidentiality and integrity. The definitions of confidentiality and integrity are described in Non-Patent Document 4. Confidentiality is security defined as the absence of leaking of plaintext from ciphertext. In the confidentiality security game, an attacker accesses either the encryption function Enc of the authenticated encryption algorithm or the oracle that outputs random numbers, and identifies which one he is accessing. The probability that the attacker will make the identification is called the identification probability. The lower the identification probability, the higher the confidentiality security. Integrity is security defined as the inability to tamper with public data or ciphertext. In the integrity security game, an attacker accesses the encryption function Enc and decryption function Dec of the authenticated encryption algorithm, inputs forged public data, ciphertext, and authenticator into the decryption function Dec, and aims to pass a tampering check. The probability of passing the tampering check is called the forgery probability. The lower the forgery probability, the higher the integrity security.

[0006] One method for constructing an authenticated encryption algorithm is to use a block cipher. Block cipher E is a function that takes a k-bit key component X and an n-bit input block Y as input, and outputs an n-bit output block Z. This is written as Z = E(X, Y). When key X is fixed, block cipher E becomes an n-bit permutation function. Examples of block ciphers include AES described in Non-Patent Document 2 and Skinny described in Non-Patent Document 3. AES is an abbreviation for Advanced Encryption Standard.

[0007] The operation of the authenticated encryption algorithm uses a secret value that depends on the private key and a public value that does not depend on the private key.

[0008] (d+1)-order masking, described in Non-Patent Documents 1, 4-7, etc., is an implementation method for countermeasures against side channel attacks. In (d+1)-order masking, a secret value is divided into d+1 values ​​to protect a secret key. If the secret value is v bits, the secret value is divided into d+1 v-bit values ​​in the masking implementation. This is a mechanism that makes it impossible to restore the original secret value unless all d+1 secret values ​​are obtained. In the masking implementation, the secret value is calculated while remaining divided into d+1 parts. Therefore, the smaller the size of the secret value, the smaller the masking implementation size.

[0009] The minimum size of the secret value will now be explained. The security level that the authenticated encryption algorithm wishes to achieve is assumed to be s bits, and the plaintext block size is assumed to be b bits. In addition to the s-bit secret value, a secret value is required to encrypt each b-bit plaintext block. Therefore, the minimum size is s + b bits. Many methods are designed so that the security level s is 128 bits or more. Furthermore, the plaintext block size b is a value of 1 or more.

[0010] Patent Document 1 and Non-Patent Document 8 describe authentication encryption using a block cipher. For a target security level s, the size of the secret value of this authentication encryption is 2s bits, and the plaintext block size is b = s bits. The size of the secret value is minimum only when the plaintext block size is b = s bits, and the plaintext block size cannot be in a range other than b = s bits.

[0011] Non-Patent Document 9 describes an authentication encryption using a block cipher. For a target security level s, the size of the secret value of this authentication encryption is 1.5s bits, and the plaintext block size is b = 0.5s. The plaintext block size is smallest only when b = 0.5s bits, and the plaintext block size cannot be outside the range of b = 0.5s bits.

[0012] International Publication No. 2022-215249

[0013] Hannes Gross, Stefan Mangard, and Thomas Korak. Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order. IACR ePrint 2016 / 486, 2016.National Institute of Standards and Technology (NIST). Announcing the Advanced Encryption Standard (AES). FIPS PUB 197, 2001.Christof Beierle, Jeremy Jean, Stefan Kolbl, Gregor Leander, Amir Moradi,Thomas Peyrin, Yu Sasaki, Pascal Sasdrich, and Siang Meng Sim. The SKINNY family of block ciphers and its low-latency variant MANTIS. In CRYPTO2016, pages 123-153, LNCS volume 9815, Springer, 2016.Tetsu Iwata, Keisuke Ohashi, and Kazuhiko Minematsu. Breaking and Repairing GCM Security Proofs. CRYPTO 2012, Proceedings. pages 31-49. LNCS volume 7417. Springer. 2012.Svetla Nikova, Christian Rechberger, and Vincent Rijmen. Threshold implementations against side-channel attacks and glitches. In Information and Communications Security, 8th International Conference, ICICS 2006, pages 529-545,LNCS volume 4307. Springer. 2006. Oscar Reparaz, Begul Bilgin, Svetla Nikova, Benedikt Gierlichs, and Ingrid Verbauwhede. Consolidating masking schemes. In CRYPTO 2015, LNCS volume 9215, pages 764-783, Springer, 2015. Gaetan Cassiers, Benjamin Gregoire, Itamar Levi, and Francois-Xavier Standaert. Hardware private circuits: From trivial composition to full verification. IEEE Trans. Computers, 70(10):1677-1690, 2021. Yusuke Naito, Yu Sasaki, Takeshi Sugawara. AES-LBBB: AES Mode for Lightweight and BBB-Secure Authenticated Encryption. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2021(3): 298-333 (2021). Yusuke Naito, Yu Sasaki, and Takeshi Sugawara. Secret Can Be Public: Low-Memory AEAD Mode for High-Order Masking. CRYPTO2022: page 315-345. ,

[0014] For a target security level s and a plaintext block size b, there exists an authenticated encryption scheme that uses a block cipher that minimizes the secret value only when b = s or b = 0.5s. The objective of the present disclosure is to make it possible to realize a configuration that can minimize the secret value to s + b bits when the plaintext block size b is an arbitrary value.

[0015] The authentication encryption device according to the present disclosure includes: an initial processing unit that generates a secret value B from a secret key in authentication encryption; a function F processing unit that updates the secret value B using a block cipher, with the secret value B generated by the initial processing unit as an input block of the block cipher; and a ciphertext processing unit that executes at least one of a process of encrypting a plaintext M and a process of decrypting a ciphertext C, using the secret value B updated by the function F processing unit.

[0016] In the present disclosure, the secret value B is used as an input block of the block cipher, and the secret value B is updated by the block cipher. This makes it possible to realize a configuration in which the secret value can be the minimum s+b bits, even when the plaintext block size b is an arbitrary value. By setting b<0.5s, masking implementation is performed using the block ciphers described in Non-Patent Documents 2 and 3. This makes it possible to reduce the implementation size compared to when masking implementation is performed using the methods described in Patent Document 1 and Non-Patent Documents 8 and 9.

[0017] 1 is a configuration diagram of an authentication encryption device 10 according to a first embodiment. FIG. 1 is an explanatory diagram of block cipher E according to the first embodiment. FIG. 2 is an explanatory diagram of function F according to the first embodiment. FIG. 3 is a flowchart of processing of function F according to the first embodiment. FIG. 4 is a flowchart showing processing of encryption function Enc according to the first embodiment. FIG. 5 is a flowchart of initial processing in encryption function Enc according to the first embodiment. FIG. 6 is an explanatory diagram of header processing in encryption function Enc according to the first embodiment. FIG. 7 is a flowchart of header processing in encryption function Enc according to the first embodiment. FIG. 8 is an explanatory diagram of main processing in encryption function Enc according to the first embodiment. FIG. 9 is a flowchart of main processing in encryption function Enc according to the first embodiment. FIG. 10 is an explanatory diagram of authentication processing in encryption function Enc according to the first embodiment. FIG. 11 is an explanatory diagram of main processing in decryption function Dec according to the first embodiment. FIG. 12 is a flowchart of main processing in decryption function Dec according to the first embodiment. FIG. 13 is a diagram showing an example of the configuration of an authentication encryption device 10 according to the first embodiment.

[0018] First Embodiment *** Description of Configuration *** The configuration of an authentication encryption device 10 according to the first embodiment will be described with reference to Fig. 1. The authentication encryption device 10 is a computer. The authentication encryption device 10 includes the following hardware components: a processor 11, a memory 12, a storage 13, and a communication interface 14. The processor 11 is connected to other hardware components via signal lines and controls these components.

[0019] The processor 11 is an IC that performs processing. IC stands for Integrated Circuit. Specific examples of the processor 11 include a CPU, a DSP, and a GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0020] The memory 12 is a storage device that temporarily stores data. Specific examples of the memory 12 include SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0021] The storage 13 is a storage device that stores data. A specific example of the storage 13 is an HDD. HDD is an abbreviation for Hard Disk Drive. The storage 13 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0022] The communication interface 14 is an interface for communicating with external devices. Specific examples of the communication interface 14 include Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB stands for Universal Serial Bus. HDMI stands for High-Definition Multimedia Interface.

[0023] The authentication encryption device 10 includes, as functional components, an initial processing unit 21, a function F processing unit 22, a ciphertext processing unit 23, and an authentication processing unit 24. The ciphertext processing unit 23 includes an encryption processing unit 231 and a decryption processing unit 232. The functions of each functional component of the authentication encryption device 10 are realized by software. The storage 13 stores a program that realizes the function of each functional component of the authentication encryption device 10. This program is read into the memory 12 by the processor 11 and executed by the processor 11. In this way, the function of each functional component of the authentication encryption device 10 is realized.

[0024] 1 shows only one processor 11. However, there may be a plurality of processors 11, and the plurality of processors 11 may cooperate to execute programs that realize the respective functions.

[0025] ***Description of Operation*** The operation of the authentication encryption device 10 according to the first embodiment will be described with reference to Figures 2 to 15. The operation procedure of the authentication encryption device 10 according to the first embodiment corresponds to the authentication encryption method according to the first embodiment. Furthermore, the program that realizes the operation of the authentication encryption device 10 according to the first embodiment corresponds to the authentication encryption program according to the first embodiment.

[0026] **Prerequisite Explanation** The operator shown in Equation 1 represents an exclusive OR operator.

[0027] 0 ｉ Let be an i-bit string of 0s, and ｉ Let be an i-bit string of 1s.

[0028] For a bit string X, the bit length of X is written as |X|. If X is an empty string, |X|=0.

[0029] For two bit strings X and Y, X∥Y is defined as a bit string obtained by bit-concatenating Y to the end of X.

[0030] The function f is a surjective function that takes the nonce N, the counter value ctr, and the division value w as input and outputs a c-bit value. That is, if (N, ctr, w) ≠ (N', ctr', w'), then the function f is a function such that f(N, ctr, w) ≠ f(N', ctr', w'). An example of the function f is a function where c1, c2, and c3 are c = c1 + c2 + c3, N is c1 bit, ctr is c2 bit, and w is c3 bit, and f(N, ctr, w) = N||ctr||w. In the following example, ctr and w are expressed as integers. When actually used, these are converted to bit strings.

[0031] The function ozp[i] is a function that takes a value of i bits or less as input and outputs a value of i bits. The function ozp[i] is injective for inputs of i-1 bits or less. Examples of the function ozp[i] include the following functions. For a value V of 1 bit or more and i-1 bits or less, the output of the function ozp[i](V) is a value obtained by bit-concatenating 1 after V and then concatenating a bit string of 0s after that so that the bit length is i. For an i-bit value V, the output of the function ozp[i](V) is the value V. For an empty string V, 0 ｉ Let be the output of the function ozp[i](V).

[0032] The function zp[i] is a function that takes a value of i bits or less as input and outputs an i-bit value. The function zp[i] is a function that outputs different values ​​for two different input values ​​with the same bit length. Examples of the function zp[i] include the following functions. For a value V of i-1 bits or less, the output of the function zp[i](V) is a value obtained by concatenating a bit string of 0s after V so that the bit length is i. For an i-bit value V, the output of the function zp[i](V) is the value V.

[0033] The function tr[i] is a function that outputs a predetermined i bits of the input bit string when the input is a bit string of i bits or more. An example of the function tr[i] is a function that outputs the most significant i bits or the least significant i bits of the input bit string. The function tr[i] is an injective function when the input is a bit string of 1 bit or more and i-1 bits or less. Examples of the function tr[i] are the functions given as examples of the function zp[i] or the function ozp[i].

[0034] Let b be an integer that satisfies 0<b≦n, where n is the size of the input block of the block cipher. Let t be an integer that satisfies 0<t. Let r be an integer that satisfies 0<r. Let w be an integer that satisfies t / b≦w. Let the length of the encryption key of the block cipher be k=r+c.

[0035] **Function F** The authentication encryption device 10 constructs an authentication encryption using a function F. In the function F, a block cipher E is used.

[0036] The block cipher E in the first embodiment will be described with reference to Fig. 2. The block cipher E is a function that receives a k-bit key component X and an n-bit input block Y as input, and outputs an n-bit output block Z. This block cipher E is depicted as in Fig. 2.

[0037] 3 and 4, the function F according to the first embodiment will be described. The function F receives an r-bit value T, an n-bit value B, a nonce N, a counter value ctr, and a divided value w as input, and outputs an r-bit value T' and an n-bit value B'. That is, (T', B') = F(N, ctr, w, T, B). The counter value ctr is counted for each process, and a different value is set. The function F is processed by the function F processing unit 22.

[0038] The processing of function F will be described in detail. (Step S101: B update processing) The function F processing unit 22 inputs the nonce N, the counter value ctr, and the divided value w into the function f after the value T, and combines the output value obtained to obtain the value as a key component of the block cipher E. The function F processing unit 22 also inputs the value B as the input block of the block cipher E. Then, the function F processing unit 22 updates the value B by calculating the block cipher E to generate a value B'.

[0039] (Step S102: T Update Processing) The function F processing unit 22 updates the value T by exclusive ORing the output value obtained by inputting the value B' to the function tr[r] and the value T, thereby generating the value T'.

[0040] (Step S103: Output Process) The function F processing unit 22 outputs a set of the r-bit value T' and the n-bit value B'.

[0041] **Encryption Function Enc** The encryption function Enc in the authenticated encryption realized by the authentication encryption device 10 according to the first embodiment will be described. The input values ​​of the encryption function Enc are an r+n-bit secret key K, a nonce N, a header A, and plaintext M. The header A may be an empty string. Also, the plaintext M may be an empty string.

[0042] 5, the encryption function Enc executes an initial process, a header process, a main process, and an authentication process in this order. The initial process, the header process, the main process, and the authentication process will be described below.

[0043] <Initial Processing> Initial processing in the encryption function Enc according to the first embodiment will be described with reference to Fig. 6. The initial processing in the encryption function Enc is processing for setting values ​​and the like used in processing that will be described later.

[0044] (Step S11: Key Component Setting Process) The initial processing unit 21 sets the most significant r bits of the private key K to key component K1 and the least significant n bits to key component K2. The initial processing unit 21 also sets the most significant b bits of key component K2 to key component K21 and the remaining n-b bits to key component K22. That is, K = K1 || K2, K2 = K21 || K22. The initial processing unit 21 may extract key component K1 as a predetermined r bits of the private key K and set key component K2 as the remaining n bits of the private key K. The initial processing unit 21 may also extract key component K21 as a predetermined b bits of key component K2 and set key component K22 as the remaining n-b bits of key component K2. The initial processing unit 21 sets key component K1 to value IVt and key component K2 to value IVb. The values ​​IVt and IVb are used in header processing.

[0045] (Step S12: Splitting Process) The initial processing unit 21 splits the header A and the plaintext M. Specifically, the initial processing unit 21 splits the header A into header elements A[1], A[2], ..., A[a] every n bits from the beginning. The initial processing unit 21 also splits the plaintext M into plaintext elements M[1], M[2], ..., M[m] every b bits from the beginning. If the header A is not a null string, the header elements A[1], A[2], ..., A[a-1] each have n bits, and the header element A[a] has a value of 1 bit to n bits. The header A is a value obtained by bit-concatenating the header elements A[1], A[2], ..., A[a]. If the header A is a null string, a=1 is set, and the header element A[1] is an empty string. If plaintext M is not an empty string, plaintext elements M[1], M[2], ..., M[m-1] are each b bits long, and plaintext element M[m] is a value between 1 and b bits. Plaintext M is the value obtained by bit-concatenating plaintext elements M[1], M[2], ..., M[m]. If plaintext M is an empty string, m=1, and plaintext element M[1] is an empty string.

[0046] 7 and 8, the header processing in the encryption function Enc according to the first embodiment will be described. The header processing in the encryption function Enc is a process in which, using the values ​​IVt and IVb set in the initial processing, the header elements A[1], A[2], ..., A[a] generated in the initial processing are processed to generate values ​​Ht, Hb, and a divided value dA.

[0047] (Step S21: Initial Value Setting Process) The function F processing unit 22 sets the value IVt to the value T*[0] and the value IVb to the value B*[0].

[0048] (Step S22: Function F Processing) If the value a, which is the division number of the header A, is greater than 1, the function F processing unit 22 executes the following processes (1) and (2) for each integer i, i = 1, ..., a-1, in ascending order. On the other hand, if the value a, which is the division number of the header A, is 1, the function F processing unit 22 sets the value T*[0] to the value T*[a-1] and sets the value B*[0] to the value B*[a-1]. (1) The function F processing unit 22 sets the value B*[i-1] to the exclusive OR of the value A[i] and the value B*[i-1]. (2) The function F processing unit 22 generates the value T*[i] and the value B*[i] by calculating the function F using the nonce N, the integer i, 0, the value T*[i-1], and the value B*[i-1] as inputs. Here, the value T*[0] and the value B*[0] are secret values ​​generated from a secret key in authenticated encryption. That is, the function F processing unit 22 sets a value generated using the secret value T*[i-1], the nonce N, the value i which is the counter value ctr, and the division number (here, 0) as the key component of the block cipher E. Furthermore, the function F processing unit 22 sets the secret value *B[i-1] to the input block of the block cipher E. Then, the function F processing unit 22 updates the secret value T*[i-1] and the secret value B*[i-1] using the block cipher E to generate the secret value T*[i] and the secret value B*[i].

[0049] (Step S23: Value B Update Processing) The function F processing unit 22 sets the value B*[a] to the exclusive OR of the output value obtained by inputting the value A[i] to the function ozp[n] and the value B*[a-1]. The function F processing unit 22 also sets the value T*[a-1] to the value T*[a].

[0050] (Step S24: Value dA Setting Process) The function F processing unit 22 sets the value dA depending on whether |A[a]|=n. In the first embodiment, if |A[a]|=n, the function F processing unit 22 sets the value dA to 1. If |A[a]|<n, the function F processing unit 22 sets the value dA to 2.

[0051] (Step S25: Output Value Setting Process) The function F processing unit 22 sets the value Ht to the value T*[a] and sets the value Hb to the value B*[a].

[0052] The function F processing unit 22 may update the value T[i-1] with a certain r-bit substitution P1 before step S22(1). Similarly, the function F processing unit 22 may update the value B[i-1] with a certain n-bit substitution P2 before step S22(1). Furthermore, the function F processing unit 22 may update the value T[i] with a certain r-bit substitution P1' after step S22(2). Similarly, the function F processing unit 22 may update the value B[i] with a certain n-bit substitution P2' after step S22(2). Furthermore, other operations such as addition, subtraction, and multiplication may be used instead of the exclusive OR used in the header processing.

[0053] 9 and 10, the main processing in the encryption function Enc according to the first embodiment will be described. The main processing in the encryption function Enc is a process in which, using the values ​​Ht, Hb, and dA set in the header processing, the plaintext elements M[1], M[2], ..., M[m] generated in the initial processing are processed to generate values ​​St, Sb, dM, and ciphertext C.

[0054] In the following processing, the function h is an n-bit permutation. The function h is a permutation such that, for an n-bit value S and a variable Z, Equation 2 has a unique solution for the variable Z. For example, the function h can be calculated by multiplying a generator on GF(2n), i.e., h(Z) = u·Z, where u is the generator.

[0055] (Step S31: Initial Value Setting Process) The function F processing unit 22 sets the value Ht to the value T[0] and the value Hb to the value B[0].

[0056] (Step S32: Function F Processing) If the plaintext element M[1] is not a null string, the function F processing unit 22 executes the following processes (1) to (3) for each integer i, i = 1, ..., m, in ascending order. On the other hand, if the plaintext element [1] is a null string, the function F processing unit 22 sets the value T[0] to the value T[m] and sets the value B[0] to the value B[m]. (1) The function F processing unit 22 generates the value T[i] and the value B[i] by calculating the function F using the nonce N, the integer i, the value dA, the value T[i-1], and the value B[i-1] as inputs. Here, the value T[0] and the value B[0] are secret values ​​updated in the header processing. That is, the function F processing unit 22 sets a value generated using the secret value T[i-1], the nonce N, the value i which is the counter value ctr, and the division number (here, dA) as the key component of the block cipher E. Furthermore, the function F processing unit 22 sets the secret value B[i-1] as the input block of the block cipher E. Then, the function F processing unit 22 updates the secret value T[i-1] and the secret value B[i-1] using the block cipher E to generate the secret value T[i] and the secret value B[i].

[0057] (2) The encryption processing unit 231 of the ciphertext processing unit 23 generates a cipher element C[i] using the secret value B[i] generated by the function F processing unit 22 after updating the secret value B[i-1]. Specifically, the encryption processing unit 231 sets the cipher element C[i] to the exclusive OR of the output value obtained by inputting the value B[i] to the function tr[|M[i]|], the output value obtained by inputting the value K21 to the function tr[|M[i]|], and the plaintext element M[i]. Note that when the integer i≠m, |M[i]| is b bits, so there is no need to convert the value K21 using the function tr[|M[i]|]. In other words, the same result can be achieved by directly inputting the value K21 to the exclusive OR instead of the output value obtained by inputting the value K21 to the function tr[|M[i]|].

[0058] (3) The function F processing unit 22 sets the value B[i] to the exclusive OR of the output value obtained by inputting the value B[i] to the function h and the output value obtained by inputting the output value obtained by inputting the plaintext element M[i] to the function ozp[b] and inputting the output value obtained by inputting the plaintext element M[i] to the function zp[n]. Note that when the integer i≠m, |M[i]| is b bits, so there is no need to use the function ozp[b]. In other words, it is the same as inputting the plaintext element M[i] directly to the function zp[n] instead of the output value obtained by inputting the plaintext element M[i] to the function ozp[b].

[0059] (Step S33: Output Value Setting Process) The function F processing unit 22 sets the value St to the value T[m], and sets the value Sb to the value B[m].

[0060] (Step S34: Value dM Processing) The function F processing unit 22 sets the value dm depending on whether |M[m]|=b. In the first embodiment, if |M[m]|=b, the function F processing unit 22 sets the value dM to 3. If |M[m]|<b, the function F processing unit 22 sets the value dM to 4.

[0061] (Step S35: Ciphertext Generation Process) The encryption processing unit 231 of the ciphertext processing unit 23 performs bitwise concatenation of the cryptographic elements C[1], ..., C[m] generated in step S32 (2) to generate a ciphertext C. For example, the encryption processing unit 231 sets the ciphertext C=C[1]C[2] ...C[m].

[0062] The process of step S32 (2) and the process of step S35 constitute the encryption process. In the encryption process, the encryption processing unit 231 generates a cryptographic element C[i] from the secret value B[i] generated by the function F processing unit 22 for each integer i, where i = 1, ..., m. The encryption processing unit 231 then generates a ciphertext C by encrypting the plaintext M using the cryptographic element C[i] for each integer i, where i = 1, ..., m.

[0063] The function F processing unit 22 may update the value T[i-1] with a certain r-bit substitution before step S32 (1). Similarly, the function F processing unit 22 may update the value B[i-1] with a certain n-bit substitution before step S32 (1). Furthermore, the function F processing unit 22 may update the value T[i] with a certain r-bit substitution after step S32 (3). Similarly, the function F processing unit 22 may update the value B[i] with a certain n-bit substitution after step S32 (3). Furthermore, other operations such as addition, subtraction, and multiplication may be used instead of the exclusive OR used in the main processing.

[0064] 11 and 12, the authentication process in the encryption function Enc according to the first embodiment will be described. The authentication process in the encryption function Enc is a process for generating an authenticator Tag using the values ​​St, Sb, and dM set in the main process.

[0065] (Step S41: Initial Value Setting Process) The function F processing unit 22 sets the value St to the value T'[0] and the value Sb to the value B'[0].

[0066] (Step S42: Function F Processing) The function F processing unit 22 executes the following processes (1) and (2) for each integer i, i=1,...,w, in ascending order. w is a preset value. (1) The function F processing unit 22 calculates the function F using the nonce N, the integer i, the value dM, the value T'[i-1], and the value B'[i-1] as input, thereby generating the value T'[i] and the value B'[i]. Here, the values ​​T'[0] and B'[0] are secret values ​​updated in the main processing. That is, the function F processing unit 22 sets a value generated using the secret value T'[i-1], the nonce N, the value i which is the counter value ctr, and the division number (here, dM) as the key component of the block cipher E. In addition, the function F processing unit 22 sets the secret value B'[i-1] to the input block of the block cipher E. Then, the function F processing unit 22 updates the secret value T'[i-1] and the secret value B'[i-1] using the block cipher E to generate the secret value T'[i] and the secret value B'[i].

[0067] (2) The authentication processing unit 24 sets the authentication element Tag[i] to the exclusive OR of the output value obtained by inputting the secret value B'[i] to the function tr[b] and the value K21.

[0068] (Step S43: Authenticator Generation Process) The authentication processing unit 24 generates the authenticator Tag by bit-combining the authentication elements Tag[1], ..., Tag[w] generated in step S42 (2). For example, the authentication processing unit 24 sets the authenticator Tag=tr[t](Tag[1]∥...∥Tag[w]).

[0069] **Decryption Function Dec** The decryption function Dec in the authenticated encryption realized by the authentication encryption device 10 according to the first embodiment will be described. The input values ​​of the decryption function Dec are an r+n-bit secret key K, a nonce N, a header A, a ciphertext C, and an authenticator Tag' for tamper detection. Here, the authenticator Tag' given as an input value to the decryption function Dec is the authenticator Tag generated by the encryption function Enc. To distinguish it from the authenticator Tag generated in the following description, the authenticator given as an input value to the decryption function Dec will be referred to as the authenticator Tag'.

[0070] In the decryption function Dec, similar to the encryption function Enc, the initial processing, header processing, main processing, and authentication processing are executed in this order. The initial processing, main processing, and authentication processing will be explained below. The header processing is the same as in the encryption function Enc.

[0071] <Initial Processing> Initial processing in the decoding function Dec according to the first embodiment will be described with reference to Fig. 6. The initial processing in the decoding function Dec is processing for setting values ​​and the like used in processing that will be described later.

[0072] The process in step S11 is the same as that in the case of the encryption function Enc.

[0073] (Step S12: Division Process) The initial processing unit 21 divides the header A and the ciphertext C. Specifically, the initial processing unit 21 divides the header A into header elements A[1], A[2], ..., A[a], as in the case of the encryption function Enc. The initial processing unit 21 also divides the ciphertext C into cipher elements C[1], C[2], ..., C[m] every b bits from the beginning. If the ciphertext C is not a null string, the cipher elements C[1], C[2], ..., C[m-1] each have a b bit value, and the cipher element C[m] has a value of 1 bit to b bits. The ciphertext C is a value obtained by bit-concatenating the cipher elements C[1], C[2], ..., C[m]. If the ciphertext C is a null string, m is set to 1, and the cipher element C[1] is set to a null string.

[0074] 13 and 14, the main processing in the decryption function Dec according to the first embodiment will be described. The main processing in the decryption function Dec is a processing to process the cryptographic elements C[1], C[2], ..., C[m] generated in the initial processing using the values ​​Ht, Hb, and dA set in the header processing, and to generate the values ​​St, Sb, dM, and plaintext M.

[0075] Note that, like the function h used in the main processing of the encryption function Enc, the function h in the following processing is an n-bit substitution.

[0076] The process of step S51 is the same as the process of step S31 in Fig. 10. The process of step S53 is the same as the process of step S33 in Fig. 10.

[0077] (Step S52: Function F Processing) If the cryptographic element C[1] is not an empty string, the function F processing unit 22 executes the following processes (1) to (3) for each integer i, i=1,...,m, in ascending order. Process (1) is the same as process (1) in step S32 in Fig. 10. Process (3) is the same as process (3) in step S32 in Fig. 10.

[0078] (2) The decryption processing unit 232 of the ciphertext processing unit 23 generates a plaintext element M[i] using the secret value B[i] generated by the function F processing unit 22 after updating the secret value B[i-1]. Specifically, the decryption processing unit 232 sets the plaintext element M[i] to the exclusive OR of the output value obtained by inputting the value B[i] to the function tr[|C[i]|], the output value obtained by inputting the value K21 to the function tr[|C[i]|], and the ciphertext element C[i]. Note that when the integer i≠m, |C[i]| is b bits, so there is no need to convert the value K21 using the function tr[|C[i]|]. In other words, it is the same as inputting the value K21 directly to the exclusive OR instead of the output value obtained by inputting the value K21 to the function tr[|C[i]|].

[0079] (Step S54: Value dM Processing) The function F processing unit 22 sets the value dm depending on whether or not |C[m]|=b. In the first embodiment, if |C[m]|=b, the function F processing unit 22 sets the value dM to 3. If |C[m]|<b, the function F processing unit 22 sets the value dM to 4.

[0080] (Step S55: Plaintext Generation Process) The decryption processing unit 232 of the ciphertext processing unit 23 performs bitwise concatenation of the plaintext elements M[1], ..., M[m] generated in step S52 (2) to generate plaintext M. For example, the decryption processing unit 232 sets plaintext M = M[1]M[2] ...M[m].

[0081] The process of step S52 (2) and the process of step S55 constitute the decryption process. In the decryption process, the decryption processing unit 232 generates plaintext elements M[i] from the secret value B[i] generated by the function F processing unit 22 for each integer i, where i = 1, ..., m. Then, the decryption processing unit 232 generates plaintext M by decrypting the ciphertext C using the plaintext elements M[i] for each integer i, where i = 1, ..., m.

[0082] The function F processing unit 22 may update the value T[i-1] with a certain r-bit substitution before step S52 (1). Similarly, the function F processing unit 22 may update the value B[i-1] with a certain n-bit substitution before step S52 (1). Furthermore, the function F processing unit 22 may update the value T[i] with a certain r-bit substitution after step S52 (3). Similarly, the function F processing unit 22 may update the value B[i] with a certain n-bit substitution after step S52 (3). Furthermore, other operations such as addition, subtraction, and multiplication may be used instead of the exclusive OR used in the main processing.

[0083] <Authentication Processing> The authentication processing in the decryption function Dec according to the first embodiment will be described with reference to Fig. 15. (Step S61: Authenticator Generation Processing) The authentication encryption device 10 executes the processing from step S41 to step S43 in Fig. 12 described in the authentication processing in the encryption function Enc. As a result, the authentication encryption device 10 generates an authenticator Tag.

[0084] (Step S62: Tampering Determination Process) The authentication processing unit 24 determines whether the authenticator Tag generated in step S61 matches the authenticator Tag' provided as input. If the authenticator Tag and the authenticator Tag' match, the authentication processing unit 24 proceeds to step S63. On the other hand, if the authenticator Tag and the authenticator Tag' do not match, the authentication processing unit 24 proceeds to step S64.

[0085] (Step S63: Plaintext Output Process) The authentication processing unit 24 outputs the plaintext M generated in the main process.

[0086] (Step S64: Forged Information Output Process) The authentication processing unit 24 outputs a value "reject" indicating that the information has been forged.

[0087] ***Effects of First Embodiment*** As described above, the authentication encryption device 10 according to the first embodiment updates the secret value B using a block cipher, with the secret value B as an input block of the block cipher. This realizes a configuration that can reduce the secret value to the minimum of s+b bits, even when the plaintext block size b is an arbitrary value. Specifically, the authentication encryption realized by the authentication encryption device 10 according to the first embodiment becomes an s-bit secure authentication encryption, where r is the number of bits and n is the number of bits r+n=s for a target security level s.

[0088] The authenticated encryption realized by the authenticated encryption device 10 according to the first embodiment can be used as a tamper detection algorithm by making the plaintext M and the ciphertext C null strings.

[0089] The authenticated encryption realized by the authenticated encryption device 10 according to the first embodiment may fix a random number of the same length or shorter than the nonce for one private key K of the authenticated encryption, and use the exclusive OR of that random number and the nonce as a new nonce. Furthermore, in addition to the random number for updating the nonce, a random number of the same length or shorter than the counter value for one private key K may be fixed, and the exclusive OR of that random number and each counter value may be used as a new counter value. Updating the nonce and counter value by the exclusive OR of the nonce and counter value with the random number can also ensure the multi-user security of authenticated encryption described in the following document. It is necessary to fix one random number for one key, and use a different random number each time the key is changed. Reference (Viet Tung Hoang, Stefano Tessaro, Aishwarya Thiruvengadam: The Multi-user Security of GCM, Revisited: Tight Bounds for Nonce Randomization. CCS 2018. ACM. pp. 1429-1440.) Note that the security described with reference to Non-Patent Document 4 in the background art is security for a single user.

[0090] ***Other Configurations*** <Modification 1> In the first embodiment, each functional component is realized by software. However, in Modification 1, each functional component may be realized by hardware. The differences between Modification 1 and the first embodiment will be described below.

[0091] The configuration of the authentication encryption device 10 according to Modification 1 will be described with reference to Fig. 16. When each functional component is realized by hardware, the authentication encryption device 10 includes an electronic circuit 15 instead of the processor 11, memory 12, and storage 13. The electronic circuit 15 is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.

[0092] Possible examples of the electronic circuit 15 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate Array).

[0093] Each functional component may be implemented by a single electronic circuit 15, or may be distributed across multiple electronic circuits 15. For example, as shown in FIG. 17 , the authentication encryption device 10 may be configured to include, as electronic circuits 15, an initial processing processor that performs the processing of the initial processing unit 21, a function F processing processor that performs the processing of the function F processing unit 22, a ciphertext processing processor that performs the processing of the ciphertext processing unit 23, and an authentication processing processor that performs the processing of the authentication processing unit 24. Furthermore, of the function F processing unit 22, a block cipher processor that processes the block cipher E may be provided separately from the function F processing processor. Furthermore, the ciphertext processing processor may be divided into an encryption processing processor that performs the processing of the encryption processing unit 231 and a decryption processing processor that performs the processing of the decryption processing unit 232. Furthermore, the authentication processing processor may be divided into an authenticator generation processor that generates an authenticator Tag and a tampering determination processor that performs tampering determination processing.

[0094] <Modification 2> As a modification 2, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0095] The processor 11, the memory 12, the storage 13, and the electronic circuit 15 are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0096] <Modification 3> In the first embodiment, the authentication encryption device 10 realizes both the encryption function Enc and the decryption function Dec. However, the authentication encryption device 10 may realize only one of the encryption function Enc and the decryption function Dec. When the authentication encryption device 10 realizes only one of the encryption function Enc and the decryption function Dec, the authentication encryption device 10 only needs to include the functional components necessary for realization. Specifically, when the authentication encryption device 10 realizes only the encryption function Enc, the decryption processing unit 232 of the ciphertext processing unit 23 is not necessary. Furthermore, when the authentication encryption device 10 realizes only the decryption function Dec, the encryption processing unit 231 of the ciphertext processing unit 23 is not necessary.

[0097] In addition, the word "unit" in the above description may be read as a "circuit," "step," "procedure," "process," or "processing circuit."

[0098] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Furthermore, one or more of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as needed.

[0099] 10 Authentication encryption device, 11 Processor, 12 Memory, 13 Storage, 14 Communication interface, 15 Electronic circuit, 21 Initial processing unit, 22 Function F processing unit, 23 Ciphertext processing unit, 231 Encryption processing unit, 232 Decryption processing unit, 24 Authentication processing unit.

Claims

1. An authentication encryption device comprising: an initial processing unit that generates a secret value B from a secret key in authentication encryption; a function F processing unit that updates the secret value B using the block cipher, with the secret value B generated by the initial processing unit as an input block of the block cipher; and a ciphertext processing unit that executes at least one of a process of encrypting plaintext M and a process of decrypting ciphertext C using the secret value B updated by the function F processing unit.

2. The authentication encryption device of claim 1, wherein the initial processing unit generates an r-bit key component K1 extracted from the r+n-bit private key, and generates an n-bit key component K2 remaining after the key component K1 is extracted from the private key as the private value B, and the function F processing unit updates the private value B by the block cipher using a value generated using the value T, which is the key component K1, as the key component of the block cipher.

3. The authentication encryption device according to claim 2, wherein the function F processing unit sets, in addition to the value T, a value generated using a nonce given as an input in the authenticated encryption as a key component of the block cipher.

4. The authentication encryption device according to claim 2 or 3, wherein the function F processing unit repeats a process of updating the secret value B using the block cipher, the new secret value B generated by updating the secret value B as an input block of the block cipher, and a value generated using the new secret value B and the value T as a key component of the block cipher.

5. The authentication encryption device according to any one of claims 1 to 4, wherein the function F processing unit takes a secret value B at a certain point in time as a secret value B[0] and, for each integer i, i = 1, ..., m, in ascending order, uses the secret value B[i-1] as an input block of the block cipher to update the secret value B[i-1] using the block cipher to generate a secret value B[i], and the ciphertext processing unit executes at least one of a process of encrypting a plaintext M and a process of decrypting a ciphertext C, using the secret value B[i] for each integer i, i = 1, ..., m.

6. The authentication encryption device according to claim 5, wherein the ciphertext processing unit executes at least one of an encryption process of generating a ciphertext element C[i] from the secret value B[i] for each integer i, i=1,...,m and plaintext element M[i] obtained by dividing plaintext M into m pieces, and generating a ciphertext C by encrypting the plaintext M using the ciphertext element C[i] for each integer i, i=1,...,m, and a decryption process of generating a plaintext element M[i] from the secret value B[i] for each integer i, i=1,...,m and ciphertext element C[i] obtained by dividing ciphertext C, and generating a plaintext M by decrypting the ciphertext C using the plaintext element M[i] for each integer i, i=1,...,m.

7. The ciphertext processing unit performs the encryption process for i=1 , . . . , m, the cryptographic element C[i] is generated using a key component K21 that is at least a part of the initial value of the secret value, which is the secret value generated by the initial processing unit; 7. The authentication encryption device according to claim 6, wherein for each integer i in m, the plaintext element M[i] is generated using a key component K21 that is at least a part of an initial value of the secret value that is the secret value generated by the initial processing unit.

8. The authentication encryption device according to any one of claims 1 to 7, wherein the function F processing unit further updates the secret value B by the block cipher using the secret value B used in the process of encrypting plaintext M or decrypting ciphertext C by the ciphertext processing unit as an input block of the block cipher, and the authentication encryption device further comprises an authentication processing unit that generates an authenticator Tag using the secret value B further updated by the function F processing unit.

9. The authentication encryption device according to claim 8, wherein the function F processing unit takes the secret value B used in the process of encrypting plaintext M or decrypting ciphertext C by the ciphertext processing unit as a secret value B'[0], and uses the secret value B'[i-1] as an input block of a block cipher in ascending order for each integer i, i=1,...,w, to update the secret value B'[i-1] using the block cipher to generate a secret value B'[i], and the authentication processing unit generates an authentication element Tag[i] using the secret value B'[i] for each integer i, i=1,...,w, and generates the authenticator Tag using the authentication element Tag[i] for each integer i, i=1,...,w.

10. The authentication encryption device according to claim 9, wherein the authentication processing unit generates the authentication element Tag[i] for each integer i, i=1,...,w, using a key component K21 that is at least a part of an initial value of the secret value, the secret value being generated by the initial processing unit.

11. The authentication encryption device according to any one of claims 5 to 7, wherein the function F processing unit updates the secret value B generated by the initial processing unit by a header A provided as an input in the authentication encryption, and then executes header processing to update the secret value B by the block cipher using the updated secret value B as an input block of the block cipher, and sets the secret value B at the time of update in the header processing to a secret value B[0].

12. The authentication encryption device according to claim 11, wherein the function F processing unit executes the header processing in which the secret value B generated by the initial processing unit is set to a secret value B*[0], and the function F processing unit updates the secret value B*[i-1] with a header element A[i] among header elements A[1],...,A[a] obtained by dividing the header A into a number of header elements in ascending order for each integer i, i=1,...,a-1, and then updates the secret value B*[i-1] with the block cipher using the updated secret value B*[i-1] as an input block of a block cipher to generate a secret value B*[i], and updates the secret value B*[a-1] with the header element A[a].

13. An authenticated encryption method in which a computer generates a secret value B from a secret key in authenticated encryption, the computer updates the secret value B using the block cipher with the secret value B as an input block of the block cipher, and the computer executes at least one of a process of encrypting plaintext M and a process of decrypting ciphertext C using the updated secret value B.

14. An authentication encryption program that causes a computer to function as an authentication encryption device that performs the following operations: an initial process for generating a secret value B from a secret key in authentication encryption; a function F process for updating the secret value B by the block cipher using the secret value B generated by the initial process as an input block of the block cipher; and a ciphertext process for executing at least one of a process for encrypting plaintext M and a process for decrypting ciphertext C using the secret value B updated by the function F process.

Images