Apparatus, method, and program

Abstract

An apparatus according to one aspect of the present disclosure, which performs cryptographic communication with another apparatus, comprises: a cryptographic communication unit that performs cryptographic communication with the other apparatus through authenticated encryption on the basis of a master key of the cryptographic communication; and a key update unit that updates the master key in a session of the cryptographic communication.

Description

Apparatus, method, and program

[0001] The present disclosure relates to an apparatus, a method, and a program.

[0002] One of the properties required for key exchange protocols used in encrypted communications is known as forward secrecy, which is the security that "even if secret information is leaked to an attacker at some point, past ciphertexts cannot be deciphered."

[0003] Many existing studies have investigated forward secrecy in the context of public key cryptography. The main reason is that it is the basis for authenticated key exchange using public key cryptography, such as the Double Ratchet Signal protocol (Non-Patent Document 1). On the other hand, some other methods, such as the SAKE (Symmetric-key Authenticated Key Exchange) protocol (Non-Patent Document 2), achieve forward secrecy by re-sharing a master key through authenticated key exchange using symmetric key cryptography.

[0004] Joel Alwen, Sandro Coretti, and Yevgeniy Dodis. The double ratchet: Security notions, proofs, and modularization for the Signal protocol. In Yuval Ishai and Vincent Rijmen, editors, EUROCRYPT 2019, Part I, volume 11476 of LNCS, pages 129-158. Springer, Heidelberg, May 2019. Gildas Avoine, Sebastien Canard, and Loic Ferreira. Symmetric-key authenticated key exchange (SAKE) with perfect forward secrecy. In Stanislaw Jarecki, editor, CT-RSA 2020, volume 12006 of LNCS, pages 199-224. Springer, Heidelberg, February 2020.

[0005] However, existing methods such as the SAKE protocol require an authenticated key exchange protocol, which entails high computational and communication costs, to re-share the master key. Furthermore, to maintain forward secrecy, the master key must be re-shared multiple times. Therefore, existing methods such as the SAKE protocol require high costs (computational and communication costs) to achieve forward secrecy.

[0006] The present disclosure has been made in consideration of the above points, and aims to configure an encrypted communication protocol that requires low cost to achieve forward secrecy.

[0007] A device according to one aspect of the present disclosure is a device that performs encrypted communication with other devices, and has an encryption communication unit that performs encrypted communication with the other devices using authenticated encryption based on a master key for the encrypted communication, and a key update unit that updates the master key within the encrypted communication session.

[0008] It is possible to construct an encrypted communication protocol that requires low cost to achieve forward secrecy.

[0009] FIG. 1 is a diagram showing an example of an encrypted communication session using authenticated encryption. FIG. 2 is a diagram showing an example of the overall configuration of an encrypted communication system according to the present embodiment. FIG. 3 is a diagram showing an example of the hardware configuration of a device according to the present embodiment. FIG. 4 is a diagram showing an example of the functional configuration of a device according to the present embodiment. FIG. 5 is a diagram showing an example of an algorithm of an ADVNC function. FIG. 6 is a sequence diagram showing an example of encrypted communication processing in Example 1. FIG. 7 is a sequence diagram showing an example of encrypted communication processing in Example 2. FIG. 8 is a sequence diagram showing an example of encrypted communication processing in Example 3.

[0010] An embodiment of the present invention will be described below.

[0011] <Prior Art and Issues> Consider an encrypted communication session as shown in Fig. 1. In the example shown in Fig. 1, ENC is an encryption algorithm for authenticated encryption using a nonce, and DEC is a decryption algorithm. Also, fmt is a function that encodes and adjusts the input to conform to the ENC specifications (in other words, encodes and adjusts the input to a format that can be input to ENC), K is a key, CTR is a counter, N is a nonce, and A is any additional data. Note that hereinafter, key K is also called a "master key," "secret key," "session key," etc.

[0012] In this case, the sender and receiver share a key K, and the sender also holds a CTR. When a message is sent from the sender to the receiver, the sender first generates a nonce N using N←fmt(CTR), and then generates a ciphertext C of the message M using C←ENC(K, N, A, M). Next, the sender sends CTR, A, and C to the receiver, and sets CTR←CTR+1. When the receiver receives CTR, A, and C from the sender, it generates a nonce N using N←fmt(CTR), and then generates the decryption result of the ciphertext C using M'←DEC(K, N, A, C). If M'=⊥, that is, if the decryption fails, the process ends; otherwise, it obtains a message M' as the correct decryption result. The message M' obtained as the correct decryption result is passed to, for example, the application layer on the receiver.

[0013] In the encrypted communication session shown in Figure 1, the key K is not updated, so forward secrecy is not guaranteed. If the key K held by the sender and receiver is leaked, an attacker can use that key K to decrypt all ciphertexts that have been sent and received up to that point.

[0014] Roughly speaking, to achieve forward secrecy, the value of the key shared between the sender and receiver must be updated at regular intervals. The most obvious example is to periodically share a new key by running an authenticated key exchange protocol from the initial state, discard the previous key, and start a new communication session. In this way, even if the currently used key is leaked to an attacker, the attacker will not be able to decrypt past ciphertexts because they will not know the keys that were used in the past.

[0015] On the other hand, it generally takes time to share a new key from scratch. Therefore, frequent key re-sharing may result in delays in communication speed, etc. Therefore, protocols that efficiently update keys while maintaining forward secrecy are being researched. For example, existing methods such as the SAKE protocol (Non-Patent Document 2) achieve forward secrecy by re-sharing a master key through authenticated key exchange using symmetric key cryptography.

[0016] However, existing methods such as the SAKE protocol require an authenticated key exchange protocol, which entails high computational and communication costs, to re-share the master key. Furthermore, to maintain forward secrecy, the master key must be re-shared multiple times. Therefore, existing methods such as the SAKE protocol require high costs (computational and communication costs) to achieve forward secrecy.

[0017] Therefore, we propose an encrypted communication protocol (hereinafter referred to as the proposed protocol) that achieves forward secrecy by updating the key within a single communication session, rather than repeatedly exchanging the key. This eliminates the need to repeatedly execute the authenticated key exchange protocol, thereby reducing the costs (computational costs and communication costs) required to achieve forward secrecy.

[0018] <Proposed Protocols> Three encrypted communication protocols are proposed below.

[0019] LFS1: Linearly evolving key forward security in one step. LFS2: Linearly evolving key forward security in two steps. PFS1: Puncturable key forward security in one step. All three of the proposed protocols above have separate roles for the sender and receiver, and are designed to send data (i.e., messages) in one direction. If the receiver also wants to send data, they simply reverse roles and execute the same protocol (independently of the original protocol) using a different key. As will be described later, LFS2 also allows data to be sent from the receiver, but this is primarily for the purpose of controlling protocol processing, and it is designed to assume that the flow of data (messages) is essentially one-way. Furthermore, the three proposed protocols above use authenticated encryption. If this authenticated encryption is secure, the usual security requirement of "plaintext information cannot be leaked from ciphertext unless the attacker has complete knowledge of the key" can be achieved without any problems.

[0020] <Preparation> We will now explain the cryptographic techniques used as components of the three proposed protocols. Below, we will explain existing cryptographic techniques, including nonce-based authenticated encryption with associated data (AEAD), one-way function (OWF), and puncturable pseudo random function (PPRF).

[0021] <<Nonce-Based Authenticated Encryption>> The encryption function ENC of nonce-based authenticated encryption converts plaintext into ciphertext using a nonce N and a secret key K that is shared in advance and is common to encryption and decryption. Similarly, the decryption function DEC converts the ciphertext back into the original plaintext using the nonce N and the secret key K. However, if the ciphertext is random (i.e., if there is no plaintext corresponding to that ciphertext), DEC returns an error (this error is represented by the symbol ⊥).

[0022] In addition to the nonce N and the secret key K, the ENC and DEC take additional data A as input according to the secret purpose. The additional data A is not encrypted, but if a third party who does not have the key K tampers with the additional data A, the DEC will detect the tampering and return an error. In other words, if the nonce N and additional data A were used to generate the ciphertext C, the same nonce N and additional data A are required for decryption.

[0023] To summarize the above, the encryption function ENC and the decryption function DEC are expressed as follows:

[0024] ENC(K, N, A, M) = C DEC(K, N, A, C) = M / ⊥ where M is the plaintext message and C is the ciphertext.

[0025] Authenticated encryption is considered secure if it satisfies the following conditions: "To a third party who does not know the key, the ciphertext corresponding to the plaintext appears to be a purely random bit string, and it is extremely difficult to find even a single valid ciphertext (i.e., a ciphertext that does not fail to decrypt)."

[0026] <One-way function> A secure one-way function OWF is a function that satisfies the property that "when only the output Y = OWF(X) for a random input X is given, it is difficult to guess the original X." The two proposed protocols, LFS1 and LFS2, use OWF.

[0027] Punctable Pseudo-Random Function The proposed protocol PFS1 uses a puncturable pseudo-random function (PPRF) instead of OWF. The PPRF consists of two functions: an evaluation function EVAL and a puncturing function PUNCT.

[0028] The evaluation function EVAL takes a key K and an input value V as input and returns an output X = EVAL(K,V). EVAL essentially behaves like a pseudorandom function. That is, if the key K is chosen randomly and kept secret, then X = EVAL(K,V) will be an unpredictable, random value for any input value V. However, if (K,V) has previously been "punched" (see below), it returns an error, i.e., ⊥.

[0029] The puncturing function PUNCT takes a key K and an input value V as input and returns an updated key K' = PUNCT(K, V). This is the "puncturing process" described above. In other words, when the updated key and input value pair (K', V) is evaluated by the evaluation function EVAL, ⊥ is returned.

[0030] In other words, for any key K and any input values ​​V and V', a puncturable pseudorandom function has EVAL(PUNCT(K,V),V') = ⊥ if V = V', and EVAL(PUNCT(K,V),V') = EVAL(K,V') otherwise.

[0031] Based on the above preparation, the following describes an encrypted communication system 1 that executes one of the three proposed protocols.

[0032] <Example of Overall Configuration of Encrypted Communication System 1> An example of the overall configuration of the encrypted communication system 1 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the encrypted communication system 1 according to this embodiment includes a plurality of devices 10. Furthermore, each device 10 is communicably connected via a communication network 20 including, for example, the Internet.

[0033] The device 10 is a device of various types that serves as the sender or receiver of encrypted communication. Specific examples of the device 10 include, for example, a PC (personal computer), a general-purpose server, a smartphone, a tablet terminal, a wearable device, a sensor device, an industrial device, an IoT (Internet of Things) device, a game device, etc. However, these are all examples, and any device that is capable of encrypted communication with another device 10 can be used as the device 10.

[0034] Hereinafter, the device 10 on the sending side of the encrypted communication will be called the "sending device" and represented as the "sending device 10a." On the other hand, the device 10 on the receiving side of the encrypted communication will be called the "receiving device" and represented as the "receiving device 10b." Note that the same device 10 may be both the sending device 10a and the receiving device 10b with respect to other devices 10.

[0035] <Example of Hardware Configuration of Device 10> An example of the hardware configuration of the device 10 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the device 10 according to this embodiment includes an input device 11, a display device 12, an external I / F 13, a communication I / F 14, a RAM (Random Access Memory) 15, a ROM (Read Only Memory) 16, an auxiliary storage device 17, and a processor 18. Each of these pieces of hardware is connected to each other via a bus 19 so as to be able to communicate with each other.

[0036] The input device 11 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 12 is, for example, a display, a display panel, etc. Note that the device 10 does not necessarily have to have at least one of the input device 11 and the display device 12.

[0037] The external I / F 13 is an interface with an external device such as a recording medium 13 a. Examples of the recording medium 13 a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0038] The communication I / F 14 is an interface for connecting to the communication network 20. The RAM 15 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 16 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 17 is a non-volatile storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 18 is a variety of arithmetic devices such as a CPU (Central Processing Unit).

[0039] 3 is an example, and the hardware configuration of the device 10 is not limited to this. For example, the device 10 may have multiple auxiliary storage devices 17 or multiple processors 18, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0040] <Example of Functional Configuration of Device 10> Fig. 4 shows an example of the functional configuration of the device 10 according to this embodiment. As shown in Fig. 4, the device 10 according to this embodiment has a communication unit 101 and a calculation unit 102. These units are realized, for example, by processing in which one or more programs installed in the device 10 are executed by the processor 18 or the like. The device 10 according to this embodiment also has a storage unit 103. The storage unit 103 is realized, for example, by a storage area of ​​the auxiliary storage device 17 or the like.

[0041] The communication unit 101 transmits data to other devices 10 and receives data from other devices 10. The calculation unit 102 executes various calculations required for encrypted communication (e.g., updating the key K, encryption, decryption, etc.). The storage unit 103 stores the key K and the like used for encrypted communication with other devices 10. When the device 10 is a sending device 10a, the storage unit 103 also stores a message M to be encrypted.

[0042] <Encrypted Communication Processing> Below, we will explain Examples 1 to 3 of the encrypted communication processing executed by the encrypted communication system 1 according to this embodiment. Note that Example 1 explains the case where LFS1 is used as the encrypted communication protocol, Example 2 explains the case where LFS2 is used as the encrypted communication protocol, and Example 3 explains the case where PFS1 is used as the encrypted communication protocol.

[0043] First Embodiment (LFS1) ADVNC Function First, the ADVNC function used in LFS1 and LFS2 (described later) to update the master key K is defined. The ADVNC function calculates the next master key K' from the current master key K using the algorithm shown in FIG.

[0044] As shown in FIG. 5, the ADVNC function takes K, CTR, and s as input (line 1). Here, K is the current master key. CTR is a counter that indicates how many times the master key has been updated so far, and takes a value of 0 or greater. s is an integer value of 0 or greater. In the ADVNC function, after setting K'←K (line 2), lines 4 and 5 are executed for i∈[0, s−1] (line 3). Note that lines 4 and 5 are not executed if s=0.

[0045] In the fourth line, N←fmt ０ N is calculated by (CTR+i). ０ is a function that encodes and adjusts the input to conform to the OWF specifications (in other words, encodes and adjusts the input to a format that can be input to OWF).

[0046] In line 5, the next master key K' is calculated by K'←OWF(N∥K'), where ∥ represents the concatenation of bit strings.

[0047] Then, the master key K' is returned as the output of the ADVNC function (line 7), thereby obtaining the next master key K' by updating the current master key K.

[0048] Roughly speaking, the ADVNC function can be said to be a function that calculates the next master key K' by applying a one-way function OWF to the current master key K s times.

[0049] Encrypted Communication Processing The encrypted communication processing in the first embodiment (LFS1) will be described with reference to FIG. 6. In the following, the storage unit 103 of the sending device 10a stores a key K ａ and counter CTR Ｋ ａ and CTR Ｍ ａ The storage unit 103 of the receiving device 10b stores the key K ｂ and counter CTR Ｋ ｂ Here, before executing the encrypted communication process, the sending device 10a and the receiving device 10b share a master key by any method (for example, authenticated key exchange (AKD) or the like), and the key K ａ and the initial value of key K ｂ The initial value of each counter is the master key. The counter does not need to be kept secret, but the CTR is set at the time of starting the encrypted communication process. Ｋ ａ = CTR Ｋ ｂ In the following description, ENC and DEC are respectively the encryption function and the decryption function of the nonce-based AEAD.

[0050] First, the calculation unit 102 of the sending device 10a calculates N←fmt １ (CTR Ｍ ａ ) to calculate the nonce N (step S101). １ is a function that encodes and adjusts the input to conform to the ENC specifications.

[0051] Next, the calculation unit 102 of the sending device 10a calculates C←ENC(K ａ , N, A, M) (step S102), where A is the additional data and M is the message.

[0052] Next, the communication unit 101 of the sending device 10a counts up the counter CTR Ｋ ａ and counter CTR Ｍ ａ The additional data A and the ciphertext C are transmitted to the receiving device 10b (step S103).

[0053] Next, the calculation unit 102 of the sending device 10a calculates the CTR Ｍ ａ ←CTR Ｍ ａ The counter is updated to +1 (step S104). Ｍ ａ is a counter that indicates how many times the message M has been encrypted. Ｍ ａ The initial value of may be set to 0.

[0054] Next, the calculation unit 102 of the sending device 10a calculates K ａ ←ADVNC (K ａ , CTR Ｋ ａ , 1) to obtain the key K ａ is updated (step S105).

[0055] Next, the calculation unit 102 of the sending device 10a calculates the CTR Ｋ ａ ←CTR Ｋ ａ The counter is updated to +1 (step S106). Ｋ ａ is key K ａ This is a counter that indicates how many times the CTR has been updated. Ｋ ａ The initial value of may be set to 0.

[0056] On the other hand, the calculation unit 102 of the receiving device 10b counts the counter CTR Ｋ ａ and counter CTR Ｍ ａ When the additional data A and the ciphertext C are received by the communication unit 101, s←CTR Ｋ ａ -CTR Ｋ ｂ (Step S107). That is, the calculation unit 102 of the receiving device 10b calculates CTR Ｋ ａ and CTR Ｋ ｂ The difference between them is set to s.

[0057] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if s<0, and proceeds to the next step S109 if not (step S108). If s<0, this is because some abnormality has occurred.

[0058] Next, the calculation unit 102 of the receiving device 10b calculates the key K for decrypting the ciphertext C as follows: K←ADVNC(K ｂ , CTR Ｋ ｂ , s) (step S109).

[0059] Next, the calculation unit 102 of the receiving device 10b calculates N←fmt １ (CTR Ｍ ａ ) to calculate the nonce N (step S110).

[0060] Next, the calculation unit 102 of the receiving device 10b decrypts the ciphertext C by M'←DEC(K, N, A, C) (step S111).

[0061] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if M'=⊥, and proceeds to the next step S113 if not (step S112).

[0062] Next, the calculation unit 102 of the receiving device 10b calculates K ｂ ←ADVNC (K ｂ , CTR Ｋ ａ , 1) to obtain the key K ｂ is updated (step S113).

[0063] Then, the calculation unit 102 of the receiving device 10b calculates the CTR Ｋ ｂ ←CTR Ｋ ｂ The counter is updated to +1 (step S114). Ｋ ｂ is key K ｂ This is a counter that indicates how many times the CTR has been updated. Ｋ ｂ The initial value of may be set to 0.

[0064] Features of LFS1 LFS1 achieves forward secrecy by simply using the ADVNC function. The ADVNC function updates the key by calling a one-way function as a subroutine. Therefore, even if the updated key is leaked, the previous key cannot be known due to the properties of the one-way function, and forward secrecy can be achieved. Note that the sending device 10a always encrypts a message M and sends it to the receiving device 10b with the key K. ａ Note that we update

[0065] Although LFS1 can achieve forward secrecy with a relatively simple protocol, there are weaknesses around steps S108 and S109, which may result in a Denial of Service (DoS) attack. ｂ , CTR Ｋ ｂ , s) is called and the one-way function is calculated s times. However, if a malicious third party sets an exponentially large value of s and transmits it to the receiving device 10b, for example, an enormous amount of unnecessary calculations will occur in the receiving device 10b, which may prevent other processing from being performed.

[0066] Second Embodiment (LFS2) LFS2 is a protocol that can also deal with DoS attacks, which are a weakness of LFS1. In LF2, like LFS1, keys are updated using the ADVNC function.

[0067] Encrypted Communication Processing The encrypted communication processing in the second embodiment (LFS2) will be described with reference to Fig. 7. In the following, as in the first embodiment, the storage unit 103 of the sending device 10a stores the key K ａ and counter CTR Ｋ ａ and CTR Ｍ ａ The storage unit 103 of the receiving device 10b stores the key K ｂ and counter CTR Ｋ ｂ and CTR Ｍ ｂHere, before executing the encrypted communication process, the sending device 10a and the receiving device 10b share a master key by any method (for example, authenticated key exchange (AKD) or the like), and the key K ａ and the initial value of key K ｂ The initial value of each counter is the master key. The counter does not need to be kept secret, but the CTR is set at the time of starting the encrypted communication process. Ｋ ａ = CTR Ｋ ｂ In the following description, ENC and DEC are respectively the encryption function and the decryption function of the nonce-based AEAD.

[0068] First, the calculation unit 102 of the sending device 10a calculates N←fmt １ (CTR Ｍ ａ ) to calculate the nonce N (step S201).

[0069] Next, the calculation unit 102 of the sending device 10a calculates C←ENC(K ａ , N, A, M) (step S202).

[0070] Next, the communication unit 101 of the sending device 10a counts up the counter CTR Ｋ ａ and counter CTR Ｍ ａ The additional data A and the ciphertext C are transmitted to the receiving device 10b (step S203).

[0071] The calculation unit 102 of the receiving device 10b calculates the counter CTR Ｋ ａ and counter CTR Ｍ ａ When the additional data A and the ciphertext C are received by the communication unit 101, s←CTR Ｋ ａ -CTR Ｋ ｂ (step S204).

[0072] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if s is not included in [0, 1], and proceeds to the next step S206 (step S205). That is, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if s is neither 0 nor 1, and proceeds to the next step S206 if s is 0 or 1.

[0073] Next, the calculation unit 102 of the receiving device 10b calculates the key K for decrypting the ciphertext C as follows: K←ADVNC(K ｂ , CTR Ｋ ｂ , s) (step S206).

[0074] Next, the calculation unit 102 of the receiving device 10b calculates N←fmt １ (CTR Ｍ ａ ) to calculate the nonce N (step S207).

[0075] Next, the calculation unit 102 of the receiving device 10b decrypts the ciphertext C by M'←DEC(K, N, A, C) (step S208).

[0076] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if M'=⊥, and proceeds to the next step S210 if not (step S209).

[0077] Next, the calculation unit 102 of the receiving device 10b calculates K ｂ ←K, CTR Ｋ ｂ ←CTR Ｋ ａ (Step S210). As a result, if s>0 (i.e., s=1), the key K ｂ and counter CTR Ｋ ｂ will be updated.

[0078] Next, the calculation unit 102 of the receiving device 10b calculates N ＊ ←fmt ２ (CTR Ｍ ｂ ) by using nonce N ＊ (Step S211). ２is a function that encodes and adjusts the input to conform to the ENC specifications.

[0079] Next, the calculation unit 102 of the receiving device 10b calculates C ＊ ←ENC (K ｂ , N ＊ , A ＊ , M ＊ ) to obtain the ciphertext C ＊ (Step S212). ＊ indicates additional data, M ＊ is the message.

[0080] Next, the communication unit 101 of the receiving device 10b counts up the counter CTR Ｍ ｂ and additional data A ＊ and message M ＊ and transmits the above to the transmitting device 10a (step S213).

[0081] Next, the calculation unit 102 of the receiving device 10b calculates the CTR Ｍ ｂ ←CTR Ｍ ｂ The counter is updated to +1 (step S214). Ｍ ｂ is the message M ＊ This is a counter that indicates how many times encryption has been performed so far. Ｍ ｂ The initial value of may be set to 0.

[0082] The calculation unit 102 of the sending device 10a calculates the counter CTR Ｍ ｂ and additional data A ＊ and message M ＊ When the communication unit 101 receives the ＊ ←fmt ２ (CTR Ｍ ｂ ) by using nonce N ＊ is calculated (step S215).

[0083] Next, the calculation unit 102 of the sending device 10a calculates M ＊ '←DEC (K ａ , N ＊ , A ＊ , C ＊) to obtain the ciphertext C ＊ is decoded (step S216).

[0084] Next, the calculation unit 102 of the sending device 10a calculates M ＊ If '=⊥, the encrypted communication process is terminated (step S217).

[0085] key K ａ When updating K ａ ←ADVNC (K ａ , CTR Ｋ ａ , 1) to obtain the key K ａ After updating (step S218), Ｋ ａ ←CTR Ｋ ａ The counter is updated to +1 (step S219). ａ Whether to update the key K ａ If flg=1, the key K ａ otherwise, update the key K ａ In this case, the value of the flag flg is updated to flg←0 after step S219. ａ When updating every time, flg←1 is updated after step S217. ａ If it is not updated every time, after step S217, it is updated as follows, flg←1, as necessary.

[0086] Characteristics of LFS2 In LFS2, in order to prevent DoS attacks that can occur in LFS1, if s≠0,1 when the receiving device 10b receives the ciphertext C, the processing is immediately terminated. Also, in order to ensure that s=0,1 always holds when legitimate devices 10 communicate with each other, after the sending device 10a sends the ciphertext C, the receiving device 10b always sends back the ciphertext C. ＊ Only after receiving this response can the sending device 10a execute the processes from step S215 onwards.

[0087] In LFS2, after the sending device 10a sends the ciphertext C, it does not necessarily need to send the key K ａ There is no need to update the same key K ａ Another message can be encrypted and sent using the same key K. ａ , the ciphertext C may be computed using the same message M but with different additional data A.

[0088] Third Embodiment (PFS1) PFS1 differs from LFS1 and LFS2 in that the key is updated using a puncturable pseudorandom function PPRF.

[0089] Encryption Communication Processing The encryption processing in the third embodiment (PFS1) will be described with reference to Fig. 8. In the following, as in the first embodiment, the key K ａ and counter CTR Ｋ ａ and CTR Ｍ ａ The storage unit 103 of the receiving device 10b stores the key K ｂ Here, before executing the encrypted communication process, the sending device 10a and the receiving device 10b share a master key by any method (for example, authenticated key exchange (AKD) or the like), and the key K ａ and the initial value of key K ｂ The initial values ​​of all are assumed to be the master key. The counter does not need to be kept secret. In the following, ENC and DEC are respectively the encryption function and decryption function of the nonce-based AEAD. Furthermore, EVAL and PUNCT are respectively the evaluation function and puncturing function that constitute the puncturable pseudorandom function PPRF.

[0090] First, the calculation unit 102 of the sending device 10a calculates K←EVAL(K ａ , fmt ３ (CTR Ｋ ａ )) to calculate the encryption key K (step S301). ３ is a function that encodes and adjusts the input to conform to the EVAL specifications (in other words, encodes and adjusts the input to a format that can be input to EVAL).

[0091] Next, the calculation unit 102 of the sending device 10a calculates N←fmt ４ (CTR Ｍ ａ ) to calculate the nonce N (step S302). ４ is a function that encodes and adjusts the input to conform to the ENC specifications.

[0092] Next, the calculation unit 102 of the sending device 10a calculates the ciphertext C by C←ENC(K, N, A, M) (step S303), where A is the additional data and M is the message.

[0093] Next, the communication unit 101 of the sending device 10a counts up the counter CTR Ｋ ａ and counter CTR Ｍ ａ The additional data A and the ciphertext C are transmitted to the receiving device 10b (step S304).

[0094] Next, the calculation unit 102 of the sending device 10a calculates the CTR Ｍ ａ ←CTR Ｍ ａ The counter is updated to +1 (step S305).

[0095] Next, the calculation unit 102 of the sending device 10a calculates K ａ ←PUNCT (K ａ , fmt ３ (CTR Ｋ ａ )) to obtain the key K ａ is updated (step S306).

[0096] Next, the calculation unit 102 of the sending device 10a calculates the CTR Ｋ ａ ←CTR Ｋ ａ The counter is updated to +1 (step S307).

[0097] On the other hand, the calculation unit 102 of the receiving device 10b counts the counter CTR Ｋ ａ and counter CTR Ｍ ａWhen the additional data A and the ciphertext C are received by the communication unit 101, K←EVAL(K ｂ , fmt ３ (CTR Ｋ ａ )) to calculate the decryption key K (step S308).

[0098] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if K=⊥, and proceeds to the next step S310 if not (step S309).

[0099] Next, the calculation unit 102 of the receiving device 10b calculates N←fmt ４ (CTR Ｍ ａ ) to calculate the nonce N (step S310).

[0100] Next, the calculation unit 102 of the receiving device 10b decrypts the ciphertext C by M'←DEC(K, N, A, C) (step S311).

[0101] Next, the calculation unit 102 of the receiving device 10b ends the encrypted communication process if M'=⊥, and proceeds to the next step S313 if not (step S312).

[0102] Then, the calculation unit 102 of the receiving device 10b calculates K ｂ ←PUNCT (K ｂ , fmt ３ (CTR Ｋ ａ )) to obtain the key K ｂ is updated (step S313).

[0103] Characteristics of PFS1 LFS1 has the disadvantage of being vulnerable to certain types of DoS attacks, and although LFS2 overcomes the disadvantages of LFS1, it has the disadvantage that the sending device 10a cannot send the next message or update the key until the receiving device 10b sends a response. To solve all of these disadvantages, PFS1 uses a puncturable pseudorandom function PPRF for key update instead of a one-way function OWF (more precisely, an ADVNC function using a one-way function OWF).

[0104] In PFS1, the master key (i.e., key K ａ, key K ｂ ), encryption and decryption are performed using a subkey K derived by EVAL from the master key and counter. The master key is updated by PUNCT. Due to the properties of PPRF, even if EVAL tries to derive a subkey K corresponding to the previous ciphertext and counter using the key updated by PUNCT, EVAL returns an error. As a result, the previous ciphertext can no longer be decrypted, and forward secrecy is guaranteed.

[0105] In PFS1, for example, even if the sending device 10a updates the master key multiple times and transmits a large amount of ciphertext to the receiving device 10b before the receiving device 10b finishes processing, the receiving device 10b can correctly decrypt the ciphertext due to the properties of PPRF. In LFS2, the sending device 10a cannot transmit the next ciphertext until the receiving device 10b has completed processing one ciphertext and responded. However, in PFS1, a response from the receiving device 10b is not required, and the sending device 10a does not need to worry about the processing power of the receiving device 10b or delays in data transmission. Furthermore, even if the receiving device 10b decrypts a later-transmitted ciphertext and updates the key, the properties of PPRF ensure that the previously transmitted ciphertext can be correctly decrypted while maintaining forward secrecy. Furthermore, DoS attacks like those against LFS1 are ineffective, thus solving the shortcomings of both LFS1 and LFS2.

[0106] <Summary> As described above, the encrypted communication system 1 according to this embodiment can achieve forward secrecy by updating the key within a single communication session when encrypted communication is performed between the sending device 10 a and the receiving device 10 b. This eliminates the need to repeatedly execute the authenticated key exchange protocol to re-exchange the key, and makes it possible to achieve forward secrecy at low cost (low computational cost and low communication cost) using symmetric key cryptography.

[0107] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0108] REFERENCE SIGNS LIST 1 Encrypted communication system 10 Device 11 Input device 12 Display device 13 External I / F 13a Recording medium 14 Communication I / F 15 RAM 16 ROM 17 Auxiliary storage device 18 Processor 19 Bus 101 Communication unit 102 Calculation unit 103 Storage unit 20 Communication network

Claims

1. A device that performs encrypted communication with other devices, the device having: an encryption communication unit that performs encrypted communication with the other devices using authenticated encryption based on a master key for the encrypted communication; and a key update unit that updates the master key within a session of the encrypted communication.

2. The device of claim 1, wherein the key updating unit updates the master key based on a one-way function, or updates the master key based on a punching function of a punchable pseudorandom function.

3. A method in which a device that performs encrypted communications with another device executes an encrypted communications procedure for performing encrypted communications with the other device using authenticated encryption based on a master key for the encrypted communications, and a key update procedure for updating the master key within the encrypted communications session.

4. A program that causes a device that performs encrypted communication with another device to execute an encrypted communication procedure for performing encrypted communication with the other device using authenticated encryption based on a master key for the encrypted communication, and a key update procedure for updating the master key within the encrypted communication session.

Images