Encryption device, encryption method, and program

Abstract

The purpose of this disclosure is to ensure the security in a white box model having a space-hard block cipher in stream encryption.　The present disclosure provides an encryption device that performs stream encryption, the encryption device comprising: an initialization unit that, on the basis of an initialization vector and a table pertaining to a prescribed function generated from a block cipher, generates a random internal state, in which the initialization vector and a secret key have been mixed, by referring to the table at least a certain number of times; and a pseudo random number generation unit that uses a black box model in which an intermediate value cannot be ascertained from the outside, to output a pseudo random number while updating the state from the random internal state.

Description

Encryption device, encryption method and program

[0001] The present disclosure relates to a technology for realizing high-performance encryption while ensuring security in a white-box model or a hybrid model.

[0002] A symmetric key cipher is a cryptographic device that encrypts a message M using a secret key K and uses the same key K for decryption. To construct a symmetric key cipher, a pseudorandom number (also called a "keystream") is generated from an initialization vector IV and the secret key K, and the plaintext is encrypted after being exclusive-ORed with the pseudorandom number. This method is called a "stream cipher." A cryptographic device that performs stream ciphering includes two parts: an initialization unit that mixes the initialization vector IV and the secret key K to generate a random internal state, and a pseudorandom number generation (keystream generator) unit that outputs pseudorandom numbers while updating the state from the random internal state. The initialization unit holds an update function for updating the internal state, and the pseudorandom number generation unit holds a filter function for generating pseudorandom numbers from the internal state.

[0003] As a method other than stream ciphers that constitute symmetric key ciphers, a method is called a "block cipher," in which data to be encrypted is divided into blocks of an appropriate length (e.g., 64 bits, 128 bits), and each block is encrypted individually. To calculate the block cipher, a function is prepared that is not secure enough on its own but allows for fast processing. This function is called a round function. The block cipher is calculated by repeatedly executing this round function multiple times. As an example of a block cipher, Non-Patent Document 1 discloses a space-hard block cipher. A space-hard block cipher is a block cipher method that uses a huge memory generated by expanding a short secret state for encryption. Non-Patent Document 1 discloses a space-hard block cipher called SPACE as a specific method. Figure 8 is a schematic diagram of the round function of SPACE.

[0004] As shown in Figure 8, the rth function is to sort the input into the top n a Divide into bits and other bits, and thena For bits, n a bits to (nn a ) bits to a round function F r and the output is a ) bits, and then move the whole to the left a The secret key K is the sum of the two bits of the round function F r is used to generate the round function F r is a secure block cipher E K It uses a mapping from the restricted plaintext space to the truncated ciphertext space.

[0005] The problem that space-hard block ciphers solve is to ensure security in a white-box model.

[0006] The security of symmetric key cryptography is generally discussed by determining whether or not the private key K can be decrypted when the private key K is kept secret and the ciphertext C obtained by applying the encryption device to a known or selected message M, and the message M obtained by applying the decryption device (the inverse function of the encryption device) to the known or selected ciphertext C, are given. This is a discussion based on the black box model.

[0007] On the other hand, the white-box model differs from the black-box model in that all internal calculations of the cryptographic device can be monitored and manipulated.

[0008] In a normal block cipher that directly uses a secret key K, it is extremely difficult to ensure security because an attacker in a white-box model can directly observe the secret key. On the other hand, in a space-hard block cipher, the secret key is not directly used, but the function F r This makes it possible to implement a secret key extraction attack by a white-box attacker against a space-hard block cipher without using the block cipher E K This makes it as difficult as a key recovery attack by an attacker in a black box model, thereby reducing the risk of private key leakage.

[0009] In addition to the above, the function F rThe table shows the secure block cipher E K Since the table information is generated from the above, it is not possible to compress the table information. In Non-Patent Document 1, this is called space hardness, and is presented as a countermeasure against the theft of the program itself by an attacker in a white-box model, and against code lifting attacks. The definition of space hardness introduced in Non-Patent Document 1 is shown below.

[0010] Definition 1 ((M,Z)-space hardness). The implementation of a block cipher E K is (M,Z)-space hard if it is infeasible to encrypt (decrypt) any randomly drawn plaintext (ciphertext) with probability of more than 2 －Z given any code (table) of size less than M. Also, space-hard block ciphers with various parameters have been proposed depending on the security level of space hardness. SPACE, as shown in Non-Patent Document 1, has four parameters: SPACE-8 uses a table of 3840 bytes, SPACE-16 uses 896 KB, SPACE-24 uses 192 MB, and SPACE-32 uses a table of 48 GB (here, calculations are made assuming 1 KB = 1024 bytes, 1 MB = 1024 KB, and 1 GB = 1024 MB). When the table size for each SPACE parameter is T, SPACE claims security of (T / 4, 128)-space hardness. For example, in the case of SPACE-16, the probability that a random plaintext can be encrypted with table information up to (896 / 4) = 224 KB is 2. -128 The argument is that it is less than

[0011] Furthermore, Non-Patent Document 2 proposes SPNbox as a more efficient method than SPACE, which also has four parameters, with SPNbox-8 using 256 Bytes, SPNbox-16 using 128 KB, SPNbox-24 using 48 MB, and SPNbox-32 using 16 GB tables.

[0012] Furthermore, Non-Patent Document 3 shows that code lifting of a compressed program by a white-box attacker affects security against a black-box attacker. The discussion of security against a black-box attacker after code lifting of a compressed program by a white-box attacker is called a "hybrid model." If security against a black-box attacker can be maintained even after code lifting of a compressed program by a white-box attacker, the space-hard cipher is said to be secure under the hybrid model.

[0013] Furthermore, to ensure security even in the hybrid model, some space-hard block ciphers will require revisions to their specifications, such as increasing the number of round function iterations.

[0014] As described above, space-hard block ciphers are effective as a technology for ensuring security in white-box and hybrid models.

[0015] Andrey Bogdanov, Takanori Isobe, "White-Box Cryptogra44phy Revisited: Space-Hard Ciphers," ACM CCS 2015, pages 1058-45 1069, 2015.Andrey Bogdanov, Takanori Isobe, Elmar Tischhauser, "Towards Practical Whitebox Cryptography: Optimizing Efficiency and Space Hardness". Asiacrypt 2016Yosuke Todo, Takanori Isobe, "Hybrid Code Lifting on Space-Hard Block Ciphers Application to Yoroi and SPNbox". IACR Trans. Symmetric Cryptol. 2022(3): 368-402 (2022)

[0016] However, space-hard block ciphers use a table-implemented function F r The implementation requires frequent access to the storage unit (memory).

[0017] Random access to memory typically has a very high latency. As a result, the performance of space-hard block ciphers is significantly worse than that of regular block ciphers, making them insufficient for widespread application.

[0018] The implementation performance of SPACE and SPNbox on an Intel Core i7-6700 CPU is summarized in Non-Patent Document 2. Specifically, the performance of SPACE-16 is reported to be 305.11 cpb, and the performance of SPNbox-16 is reported to be 17.59 cpb. Considering that the performance of recent symmetric key ciphers is around 0.3 to 2 cpb, it can be seen that the current Space-hard block cipher is nearly 10 times slower than ordinary symmetric key ciphers.

[0019] The main reason for the poor performance of space-hard block ciphers is that they process each block independently, so unless sufficient table lookups are performed for each block, security cannot be guaranteed in space hardness or hybrid models.

[0020] The present invention has been made in view of the above points, and has as its object to realize the security in the white-box model that the space-hard block cipher has in a stream cipher.

[0021] In order to solve the above problem, the invention of claim 1 is a cryptographic device that performs stream cipher, and includes: an initialization unit that generates a random internal state by mixing an initialization vector and a secret key by referring to a table relating to a predetermined function generated from an initialization vector and a block cipher a certain number of times; and a pseudo-random number generation unit that outputs pseudo-random numbers while updating the state from the random internal state using a black-box model in which intermediate values ​​cannot be recognized from the outside.

[0022] As described above, the present invention has the effect of realizing the security of the white-box model that the space-hard block cipher has in a stream cipher.

[0023] FIG. 1 is a functional configuration diagram of an encryption device according to an embodiment. FIG. 2 is a schematic diagram of an Update function (upper part) and a Filter function (lower part) suitable for implementing this embodiment. FIG. 3 is a diagram comparing implementation performance of seven parameters with the existing SPNbox method. FIG. 4 is a conceptual diagram showing an Update function (upper part) and a Filter function (lower part) for eight rounds of parameter 16. FIG. 5 is a conceptual diagram of an Update function (upper part) and a Filter function (lower part) for four rounds of parameter t. FIG. 6 is an electrical hardware configuration diagram of an encryption device according to an embodiment. FIG. 7 is a flowchart showing the processing or operation of an encryption device according to an embodiment. FIG. 8 is a conceptual diagram of a SPACE round function disclosed in Non-Patent Document 1.

[0024] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0025] [Functional Configuration] First, the functional configuration of the encryption device 50 according to this embodiment will be described with reference to FIG.

[0026] The encryption device 50 is a device that performs stream encryption by performing exclusive OR on a message M as plaintext and a pseudorandom number before encrypting it.

[0027] As shown in Fig. 1, the encryption device 50 has an acquisition unit 51, an initialization unit 52, a pseudo-random number generation (keystream generator) unit 53, and an output unit 54. Each of these units has a function realized by an instruction from the CPU 101 shown in Fig. 6 based on a program. The encryption device 50 also has a storage unit (memory) M realized by the RAM 104 shown in Fig. 6 or the like.

[0028] The acquisition unit 51 acquires a message M as plaintext from outside the encryption device 50 .

[0029] The initialization unit 52 stores an Update function as an example of a predetermined function for updating the internal state in the memory unit M, and generates a random internal state by mixing the initialization vector IV and the secret key K by referring to the table relating to the predetermined function generated from the initialization vector IV and the block cipher a certain number of times or more.

[0030] The pseudo-random number generation unit 53 stores a filter function in the memory unit M for generating pseudo-random numbers from an internal state, and outputs pseudo-random numbers while updating the state from a random internal state using a black box model in which intermediate values ​​cannot be recognized from the outside.

[0031] The output unit 54 performs stream encryption by exclusive ORing the plaintext message M with a pseudorandom number, encrypting it, and outputs the encrypted message.

[0032] The initialization unit 52 and the pseudo-random number generation unit 53 will be described in more detail below.

[0033] <Space-hard Stream Cipher> First, the space-hard stream cipher of this embodiment will be described.

[0034] As shown in Non-Patent Documents 1, 2, and 3, in order to ensure security in space hardness and hybrid models, a certain number of table lookups are required before an attacker can generate a ciphertext observable in the black-box model from a message selectable in the black-box model.

[0035] Here, the number of required table lookups is set to be at least T. In the case of a space-hard block cipher, each block is processed independently, so to process M bits using an n-bit block cipher, M / n blocks must be processed, and a minimum of (T × M / n) table lookups are required.

[0036] Unlike block ciphers, stream ciphers do not have a data encryption section that directly processes messages. In the case of stream ciphers, the target of attack is the function that generates the pseudorandom number (keystream) that can be observed in the black-box model, starting from the initialization vector IV, which can be selected by an attacker in a black-box model. If this function cannot be compressed, like a space-hard block cipher, a space-hard stream cipher can be realized.

[0037] To realize a space-hard stream cipher, the Update and Filter functions of the stream cipher are implemented as a secure block cipher E K This makes it difficult to compress the generated Update and Filter functions.

[0038] The initialization unit 52 of the stream cipher requires a certain number of table lookups, similar to the space-hard block cipher, due to the similarity of the structure to the block cipher.

[0039] In the pseudorandom number generator 53 of the stream cipher, an attacker cannot directly select the input of the pseudorandom number generator in a black box model, so there is no need for many table lookups as are required in the initialization unit 52 .

[0040] When a single table lookup produces an n0-bit result, a space-hard stream cipher asymptotically meets the required security requirements with (M / n0) table lookups and can encrypt an M-bit message. Typically, T / n >> 1 / n0 holds. A typical example is when T = 64, n = 128, and n0 = 16. In this case, T / n = 1 / 2 >> 1 / 16, and the number of table lookups is reduced to 1 / 8. This drastically reduces the number of table lookups required to encrypt M bits, achieving a significant performance improvement.

[0041] <Update Function> Next, the Update function that allows table reference to be performed at any time will be described.

[0042] The larger the table to be referenced, the greater the delay (latency) until the results of the table lookup are obtained. Modern CPUs require a latency of approximately 5 cycles for an L1 cache size, 10 cycles or more for an L2 cache size, several tens of cycles or more for an L3 cache size, and several hundred cycles or more for main memory.

[0043] Conventional space-hard block cipher round functions perform table lookups sequentially, i.e., the next table lookup can be started after the result of one table lookup is obtained. As a result, the performance of the implementation depends on high latency of memory access.

[0044] Although modern CPUs inevitably have high latency in accessing the memory unit M (memory), they can achieve high throughput, i.e., they can start executing another table lookup without waiting for the result of the previous table lookup.

[0045] By using the Update function, which allows table lookup to be performed continuously, it is possible to realize a stream cipher that takes advantage of the high throughput of table lookup.

[0046] Below are examples of Update and Filter functions of a stream cipher suitable for implementing this embodiment.

[0047] First, an n×n0-bit internal state that is input to the Update function is generated from the initialization vector IV as shown in Fig. 2. Fig. 2 is a schematic diagram of the Update function (top) and the Filter function (bottom) that are suitable for implementing this embodiment.

[0048] The internal state is divided into n branches, and each branch takes on an n0-bit value.

[0049] m Branches, j1,j2,...,j m Then, these m branches are mixed using the Σ function to output n1 bits, where n1≦n0. The Σ function can be a simple function, such as an exclusive OR or a truncation function.

[0050] Functions f and g are functions that take n1 bits as input and output n0 bits. The output of function f is exclusive-ORed with the first branch, and the output of function g is exclusive-ORed with the oth branch, and the latter is output as a pseudorandom number. Here, functions f and g are functions that are secure in the black-box model, K Specifically, E K It uses a mapping from the restricted plaintext space to the truncated ciphertext space.

[0051] Finally, each Branch is rotated left by one position and used as the input for the next Update function.

[0052] As a result, the space-hard stream cipher of this embodiment can significantly improve implementation efficiency compared to conventional space-hard block ciphers.

[0053] <Specific Example> Next, a specific example of this embodiment will be described.

[0054] The space-hard stream cipher of this embodiment achieves approximately 10 times the processing speed of the conventional space-hard block cipher SPNbox in the same measurement environment. Figure 3 shows an implementation comparison. Figure 3 shows a comparison of seven parameters and the implementation performance of the existing SPNbox. The measurement environment was a single core of an Intel Core i7-1185G7 with Hyperthreading and TurboBoost disabled.

[0055] Each parameter cannot be compressed further than the compression limit. When compared with the same table size, the SPNbox-16 requires 10.04 x 2048 cycles to process 2 KB, while the parameter 16 of this embodiment can process it in 1.38 x 2048 cycles.

[0056] Below is a specific example (parameter 16) that uses a 256KB table and cannot be compressed to 32KB or less. Each branch takes a 16-bit value, and its internal state is expressed by 32 16-bit values, for a total of 512 bits. The functions f and g used in parameter 16 have a 16-bit input and a 16-bit output, and are generated using the block cipher AES (Advanced Encryption Standard) as shown in (Equation 1). (g||f)(x) = msb 32 (AES K (0 112 ||x))... (Equation 1) Furthermore, by taking the same input, functions f and g can be considered to have a 16-bit input and a 32-bit output together. Figure 4 is a conceptual diagram showing the Update function (top) and Filter function (bottom) for eight stages of parameter 16.

[0057] Let the internal state of parameter 16 be s∈({0,1} 16 ) 32In this case, a 128-bit initialization vector IV is input, and the initial state of the internal state is generated as follows. Note that in the text of this specification, the symbol representing exclusive OR is written as (+). s1||s2||s3||s4||s5||s6||s7||s8 ← IV, s9||s 10 ||s 11 ||s 12 ||s 13 ||s 14 ||s 15 ||s 16 ← IV (+) C1, s 17 ||s 18 ||s 19 ||s 20 ||s 21 ||s 22 ||s 23 ||s 24 ← IV (+) C2, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30 ||s 31 ||s 32 ← IV (+) C3. Here, C1, C2, and C3 are constants.

[0058] s r Let be the output internal state of the rth Update function. In the Update function, once every eight Update functions, a function with the current round number as the key and the number of AES iterations reduced to four is applied.

[0059] s 25 r ||s 26 r ||・・・||s 32 r = A r 4 (s 25 r ||s 26 r ||・・・||s 32 r ) In addition, the following function is applied at each stage to update the internal state.

[0060] s ir+1 = s i+1 r 1≦i<32 s 32 r+1 = s1 r (+)f(s2 r (+)s9 r It is assumed that the initialization unit 52 repeatedly executes the Update function 112 times.

[0061] The internal state after the initialization is input and processing is started in the pseudo-random number generation unit 53. The pseudo-random numbers are generated in the following procedure.

[0062] ks r = s 10 r+112 (+)g(s2 r+112 (+)s9 r+112 ) After the rth pseudo-random number is generated, the Update function above is applied.

[0063] Below is 8x2 t Using a byte table, 2 t Below is a specific example (parameter t) that cannot be compressed to 1 byte or less. Specifically, t can be an integer between 17 and 32. Each branch takes a 32-bit value, and its internal state is expressed as 32 32-bit values, for a total of 1024 bits. The functions f and g used with parameter t have a 32-bit output for t-bit input, and are generated using the block cipher AES as shown in Equation 2 below.

[0064] (g||f)(x) = msb 64 (AES K (0 128-t ||x))... (Equation 2) Furthermore, by taking the same input, functions f and g can be considered to have a 64-bit output with a t-bit input. Figure 5 is a conceptual diagram of the Update function (top) and Filter function (bottom) for four stages of parameter t.

[0065] Here, the internal state of parameter t is s∈({0,1} 32 ) 32In this case, a 128-bit initialization vector IV is input, and the initial state of the internal state is generated as follows: s1||s2||s3||s4||s5||s6||s7||s8 ← IV, s9||s 10 ||s 11 ||s 12 ||s 13 ||s 14 ||s 15 ||s 16 ← IV(+)C1, s 17 ||s 18 ||s 19 ||s 20 ||s 21 ||s 22 ||s 23 ||s 24 ← IV(+)C2, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30 ||s 31 ||s 32 ← IV(+)C3, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30 ||s 31 ||s 32 ← IV(+)C4, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30 ||s 31 ||s 32 ← IV(+)C5, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30 ||s 31 ||s 32 ← IV(+)C6, s 25 ||s 26 ||s 27 ||s 28 ||s 29 ||s 30||s 31 ||s 32 ← IV(+)C7, where C1, C2, C3, C4, C5, C6, and C7 are constants.

[0066] s r is the output internal state of the rth Update function. In the Update function, once every four Update functions, the following function is applied, which reduces the number of AES iterations to four, using the current round number as the key.

[0067] s 29 r ||s 30 r ||s 31 r ||s 32 r = A r 4 (s 29 r ||s 30 r ||s 31 r ||s 32 r ) In addition, the following function is applied at each stage to update the internal state.

[0068] s i r+1 = s i+1 r 1≦i<32 s 32 r+1 = s1 r (+)f(lsb t (s2 r (+)s5 r (+)s9 r )) It is assumed that the initialization unit 52 repeatedly executes the Update function 112 times.

[0069] The internal state after initialization is input and processing is started in the pseudo-random number generation unit 53. The pseudo-random numbers are generated in the following procedure.

[0070] ks r = s 14 r＋112 (+)g(lsb t (s2 r＋112 (+)s5 r＋112 (+)s9r＋112 )) After the rth pseudo-random number is generated, the Update function above is applied.

[0071] Note that the constant table lookup of this embodiment is not limited to stream ciphers, but can be used in various applications that utilize symmetric key ciphers, such as block ciphers, message authentication codes, and authenticated ciphers.

[0072] [Hardware Configuration of Encryption Device] Next, the electrical hardware configuration of the encryption device 10 will be described with reference to Fig. 6. Fig. 6 is a diagram showing the electrical hardware configuration of the encryption device.

[0073] The encryption device 10 is a computer that includes a CPU 101 , a ROM 102 , a RAM 103 , an SSD 104 , an external device connection I / F (Interface) 105 , a network I / F 106 , a display 107 , an input device 108 , a media I / F 109 , and a bus line 110 .

[0074] Of these, the CPU 101 controls the overall operation of the encryption device 10. The ROM 102 stores programs such as IPL used to drive the CPU 101. The RAM 103 is used as a work area for the CPU 101.

[0075] The SSD 104 reads or writes various data under the control of the CPU 101. Note that instead of the SSD 104, a hard disk drive (HDD) may be used.

[0076] The external device connection I / F 105 is an interface for connecting various external devices, such as a display, a speaker, a keyboard, a mouse, a USB memory, and a printer.

[0077] The network I / F 106 is an interface for performing data communication via the communication network 100 .

[0078] The display 107 is a type of display means such as a liquid crystal display or organic electroluminescence (EL) display that displays various images.

[0079] The input device 108 is a keyboard, a pointing device, or the like, and is an example of an input means for accepting input operations such as characters, numbers, and various instructions.

[0080] The media I / F 109 controls reading and writing (storing) of data from and to a recording medium 109m such as a flash memory, etc. The recording medium 109m includes DVDs and Blu-ray Discs (registered trademarks).

[0081] The bus line 110 is an address bus, a data bus, etc. for electrically connecting the components such as the CPU 101 shown in FIG.

[0082] [Processing or Operation of the Embodiment] Next, processing or operation of the present embodiment will be described with reference to Fig. 7. Fig. 7 is a flowchart showing processing or operation of the encryption device according to the embodiment.

[0083] S11: The acquisition unit 51 acquires a message M as plaintext from outside the encryption device 50.

[0084] S12: The initialization unit 52 generates a random internal state based on the initialization vector IV and a table related to a predetermined function generated from the block cipher by referencing the table a certain number of times or more.

[0085] S13: The pseudo-random number generation unit 53 uses a black box model to output pseudo-random numbers while updating the state from a random internal state.

[0086] S14: The output unit 54 performs stream encryption by exclusive ORing the plaintext message M with the pseudorandom number, and then encrypts it, and outputs the encrypted message.

[0087] [Major Effects of the Embodiment] As described above, according to this embodiment, the security of the white-box model of the space-hard block cipher can be achieved in a stream cipher. In a stream cipher, the initialization unit 52 needs to perform sufficient table lookups, as in a block cipher, but this is not necessary in the pseudo-random number generation unit 53. As a result, the number of table lookups required to encrypt 1 byte can be significantly reduced.

[0088] Furthermore, by using an Update function that allows constant execution of table lookup, it is possible to start execution of the Update function (round function) in the r+1th stage or later before the result of the table lookup in the rth stage Update function (round function) is obtained. As a result, table lookup is constantly being executed while the encryption device 50 is running. Normally, the latency of random access to memory (storage unit M) is slow, but the throughput is fast. This means that implementation performance depends on high throughput rather than high memory access latency, and a significant performance improvement can be expected.

[0089] [Supplementary Note] The present invention is not limited to the above-described embodiment, and may have the following configurations or processes (operations).

[0090] (1) The encryption device 10 can be realized by a computer and a program, but this program can also be recorded on a (non-transitory) recording medium or provided via a communication network such as the Internet.

[0091] (2) The CPU 101 as a processor may be a single processor or may be multiple processors.

[0092] (3) In the above embodiment, the encryption device 10 performs stream encryption. However, when an Update function is used, encryption using a block encryption may be performed. The encryption device 10 may also use a Message Authentication Code (MAC).

[0093] 10 Encryption device 11 Acquisition unit 12 Initialization unit 13 Pseudo-random number generation unit 14 Output unit M Storage unit (memory)

Claims

1. A cryptographic device that performs stream cipher, comprising: an initialization unit that generates a random internal state by mixing an initialization vector and a secret key based on a table related to a predetermined function generated from an initialization vector and a block cipher by referring to the table a certain number of times or more; and a pseudo-random number generation unit that outputs pseudo-random numbers while updating the state from the random internal state using a black box model in which intermediate values ​​cannot be recognized from the outside.

2. The encryption device according to claim 1, wherein the predetermined function is an Update function that enables constant execution of reference to the table.

3. A cryptographic device that performs cryptographic processing, comprising: an initialization unit that generates a random internal state by mixing an initialization vector and a secret key based on a table related to a predetermined function generated from an initialization vector and a block cipher by referring to the table a certain number of times or more; and a pseudo-random number generation unit that outputs pseudo-random numbers while updating the state from the random internal state using a black box model in which intermediate values ​​cannot be recognized from the outside, wherein the predetermined function is an Update function that allows constant execution of reference to the table.

4. An encryption method executed by an encryption device that performs stream encryption, wherein the encryption device executes an initialization process that generates a random internal state by mixing an initialization vector and a secret key by referring to a table relating to a predetermined function generated from an initialization vector and a block encryption code a certain number of times or more, and a pseudo-random number generation process that outputs pseudo-random numbers while updating the state from the random internal state using a black box model in which intermediate values ​​cannot be recognized from the outside.

5. A program for causing a computer to execute the method according to claim 4.

Images