Encryption device, encryption method, encryption program, decryption device, decryption method, and decryption program

Abstract

In the present invention, an encryption processing unit (11): receives, as inputs, an n-bit plaintext P having at least 256 bits and an m-bit private key K no more than n-bits and having at least 256 bits; repeatedly executes a base function including a non-linear layer and a linear layer and a one-byte unit shuffle operation; and thereby generates an n-bit ciphertext C obtained by encrypting the plaintext P.

Description

Encryption device, encryption method, encryption program, decryption device, decryption method, and decryption program

[0001] The present disclosure relates to wide block ciphers with large input data and secret keys.

[0002] A method in which plaintext is encrypted using a secret value called a private key and then decrypted using the same private key used for encryption is called a symmetric key encryption.A type of symmetric key encryption is known as a block cipher.

[0003] Block ciphers are a method of dividing data to be encrypted into fixed-length plaintexts called blocks using a secret key shared by a sender and a receiver, and encrypting each block individually. Typical block ciphers include AES, SKINNY, and MIDORI. AES stands for Advanced Encryption Standard. In block ciphers, a block is encrypted by applying a function called a round function to the block multiple times. The number of times a round function is executed is called the number of rounds.

[0004] Recently, with the development of quantum computers, there is concern that the security of block ciphers will decline in the near future. The security of block ciphers is ensured by computational security based on the fact that the time required for a full search of a secret key is enormous, and it is not possible to identify the secret key in a realistic time. For example, it takes a maximum of 2 １２８ However, using a search algorithm that can be run on a quantum computer, ６４ It is possible to identify a 128-bit secret key in just 2 calculations. １２８ It is impossible to complete the calculation in a realistic time, but ６４ The calculation can be performed in a realistic time by using a huge amount of computational resources. However, since most of the block ciphers currently in use use secret keys of 128 bits or less, there are concerns that security may be reduced.

[0005] Furthermore, when a certain amount of data is encrypted, two or more different plaintexts that generate the same ciphertext under a single secret key may be generated. This is known to provide a clue for an attacker to identify the secret information. The amount of data that generates two or more different plaintexts depends on the block length. Increasing the block length makes it extremely unlikely that such a plaintext will be identified. It is also known that searching for multiple plaintexts like this can be accelerated using search algorithms that can be run on quantum computers.

[0006] Therefore, methods are being considered to improve the system by increasing the secret key length and block length so that sufficient security can be maintained even against analysis using a quantum computer. A wide block cipher is a block cipher with a secret key length and block length longer than that of a general block cipher. The block length and key length of a general block cipher are 128 bits. Therefore, here, a block cipher with a block length and secret key length of 256 bits or more is defined as a wide block cipher.

[0007] Non-Patent Document 1 describes the Pholkos-512 cipher, which is a high-speed wide block cipher that is intended for software implementation. Pholkos-512 is a method that receives 512-bit blocks and a 256-bit secret key as input and generates a 512-bit ciphertext. In Pholkos-512, the round function consists of a process that executes four two-round AES ciphers in parallel, and a shuffle operation on the output in 4-byte units. The shuffle operation is a position exchange process.

[0008] J. Bossert, E. List, S. Lucks and S. Schmitz, “Pholkos - Efficient Large-State Tweakable Block Ciphers from the AES Round Function,” in Cryptographers' Track at the RSA Conference. Cham: Springer International Publishing, 2022.

[0009] In block ciphers, the more rounds there are, the better the data is shuffled and the higher the security. On the other hand, the more rounds there are, the more operations are required due to nonlinear transformations and linear changes in the round function, resulting in a slower execution speed. Therefore, the number of rounds must be set to the minimum value that ensures security. In addition, to ensure high processing performance, it is also important to reduce the number of operations per round.

[0010] Because wide block ciphers have a large block length, it is more difficult to shuffle data sufficiently than with ordinary block ciphers. Here, shuffling means creating a dependency between one input bit and several output bits. When one input bit is changed, the greater the number of output bits that are determined depending on the state of that input bit, the higher the shuffling performance can be said to be. Generally, as the block length increases, the number of output bits increases, and therefore, to provide sufficient shuffling performance, a larger number of rounds than with ordinary block ciphers is required. Therefore, in order to reduce the number of rounds in wide block ciphers, it is necessary to design a round function that can provide higher shuffling performance than ordinary block ciphers.

[0011] The Pholkos-512 cipher includes a process of multiple executions of a step function consisting of two rounds of AES and a shuffle in 4-byte units. Each AES round function within the two-round AES takes as input the output of the previous process and a round key generated from the secret key. The reason for adopting two-round AES in the Pholkos-512 cipher is that the security of two-round AES has been analyzed in detail, making it easy to estimate the level of security that can be ensured by using it during design. In addition, the four-byte shuffling process is adopted because the difficulty of security analysis does not change even when combined with the parallel execution results of two-round AES. The number of rounds in the Pholkos-512 cipher is set to 10 to ensure security.

[0012] The round functions of the Pholkos-512 cipher can be implemented with a small number of instructions by using an instruction set for executing the AES round functions, which are installed in many recent CPUs, and SIMD instructions for performing shuffle operations. CPU stands for Central Processing Unit. However, because a 4-byte shuffle is used as a linear transformation, the diffusion performance is insufficient. This increases the number of rounds, which can result in a decrease in performance of the encryption process. Furthermore, the Pholkos-512 cipher includes a process in which a portion of the round key generated from the secret key is input to all AES round functions in the round function. This process generates extra calculations, which can cause a decrease in processing performance, especially the processing performance of the decryption process.

[0013] An object of the present disclosure is to make it possible to realize a wide block cipher using a round function with higher diffusion performance.

[0014] The encryption device according to the present disclosure includes an encryption processing unit that receives as input an n-bit plaintext P, which is 256 bits or more, and an m-bit secret key K, which is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffling operation in byte units, to generate an n-bit ciphertext C by encrypting the plaintext P.

[0015] In the present disclosure, the diffusion performance of the round function is improved by using a shuffle operation in byte units, and therefore it is possible to realize a wide block cipher using a round function with high diffusion performance.

[0016] 1 is a configuration diagram of an encryption device 1 according to a first embodiment. 2 is a configuration diagram of an encryption processing unit 11 according to the first embodiment. 3 is a configuration diagram of a decryption device 2 according to the first embodiment. 4 is a configuration diagram of a decryption processing unit 21 according to the first embodiment. 5 is a hardware configuration diagram of the encryption device 1 and the decryption device 2 according to the first embodiment. 6 is a flowchart of processing by an encryption function execution unit 111 according to the first embodiment. 7 is an explanatory diagram of a round function 41 according to the first embodiment. 8 is an explanatory diagram of a base function 43 according to the first embodiment. 9 is an explanatory diagram of a byte-unit shuffle operation 44 according to the first embodiment. 10 is an explanatory diagram of a round function 42 for the final round according to the first embodiment. 11 is a flowchart of processing by a key scheduling unit 112 according to the first embodiment. 12 is an explanatory diagram of a key updating function 46 according to the first embodiment. 13 is a flowchart of processing by a decryption function execution unit 211 according to the first embodiment. 14 is an explanatory diagram of a decryption round function 48 according to the first embodiment. 15 is an explanatory diagram of a decryption base function 50 according to the first embodiment. 16 is an explanatory diagram of a decryption round function 49 for the final round according to the first embodiment. 17 is a diagram showing an example of the configuration of an encryption processing unit 11 according to the first embodiment. 18 is a diagram showing an example of the configuration of a decryption processing unit 21 according to the first embodiment. 1 is an explanatory diagram of a method for implementing a round function 41 according to the first embodiment; 2 is an explanatory diagram of a method for implementing a decryption round function 48 according to the first embodiment;

[0017] First Embodiment. ***Description of Configuration*** The configuration of an encryption device 1 according to the first embodiment will be described with reference to FIG. 1 . The encryption device 1 is a calculation device that receives as input an n-bit plaintext P, where P is 256 bits or more, and an m-bit secret key K, where K is n bits or less and 256 bits or more, and outputs an n-bit ciphertext C. In the first embodiment, a case where n = 512 and m = 256 will be described as an example. That is, in the first embodiment, the encryption device 1 is a calculation device that receives as input a 512-bit plaintext P and a 256-bit secret key K, and outputs a 512-bit ciphertext C. However, n and m are not limited to the above values. For example, the encryption device 1 can also be applied to a case where n = 384 and m = 256. The encryption device 1 includes a control unit 10 and a storage unit 12. The control unit 10 receives input of the plaintext P and the secret key K. The control unit 10 includes an encryption processing unit 11. The encryption processing unit 11 generates round keys and performs encryption. The storage unit 12 stores a secret key K and a round key K generated from the secret key K. ０ ~K Ｒ and the ciphertext C.

[0018] The configuration of the encryption processing unit 11 according to the first embodiment will be described with reference to Fig. 2. The encryption processing unit 11 includes an encryption function execution unit 111 and a key scheduling unit 112. The encryption function execution unit 111 executes a round key K generated by the key scheduling unit 112. ０ ~K Ｒ and plaintext P as input to generate ciphertext C. The key scheduling unit 112 receives secret key K as input and generates R+1 round keys K ０ ~K Ｒ Generate.

[0019] The configuration of the decryption device 2 according to the first embodiment will be described with reference to FIG. 3 . The decryption device 2 is a calculation device that decrypts the ciphertext C encrypted and generated by the encryption device 1. The decryption device 2 receives as input the n-bit ciphertext C generated by the encryption device 1 and an m-bit secret key K, which is equal to or less than n bits but equal to or greater than 256 bits, and outputs an n-bit plaintext P. In the first embodiment, a case where n = 512 and m = 256 will be described as an example. That is, in the first embodiment, the decryption device 2 receives as input the 512-bit ciphertext C generated by the encryption device 1 and the 256-bit secret key K, and outputs the 512-bit plaintext P. Here, the secret key K is the same as the secret key K received as input by the encryption device 1. The configuration of the decryption device 2 is basically the same as that of the encryption device 1. The decryption device 2 includes a control unit 20 and a storage unit 22. The control unit 20 receives the ciphertext C and the secret key K as input. The control unit 20 includes a decryption processing unit 21. The decryption processing unit 21 performs a process of generating a round key and a process of decryption. The storage unit 22 stores a secret key K and a round key K generated from the secret key K. ０ ~K Ｒ and the plaintext P.

[0020] The configuration of the decryption processing unit 21 according to the first embodiment will be described with reference to Fig. 4. The decryption processing unit 21 includes a decryption function execution unit 211 and a key scheduling unit 212. The decryption function execution unit 211 executes the round key K generated by the key scheduling unit 212. ０ ~K Ｒ and the ciphertext C as input, and generates plaintext P. Similarly to the key scheduling unit 112, the key scheduling unit 212 receives the secret key K as input, and generates R+1 round keys K ０ ~K Ｒ Generate.

[0021] The hardware configuration of the encryption device 1 and the decryption device 2 according to the first embodiment will be described with reference to Fig. 5. The encryption device 1 and the decryption device 2 are computers. The encryption device 1 and the decryption device 2 include the following hardware: a processor 31, a memory 32, a storage 33, and a communication interface 34. The processor 31 is connected to other hardware via signal lines and controls the other hardware.

[0022] The processor 31 is an IC that performs processing. IC stands for Integrated Circuit. Specific examples of the processor 31 include a CPU, a DSP, and a GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0023] The memory 32 is a storage device that temporarily stores data. Specific examples of the memory 32 include SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0024] The storage 33 is a storage device that stores data. A specific example of the storage 33 is an HDD. HDD is an abbreviation for Hard Disk Drive. The storage 33 may also be a portable recording medium such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0025] The communication interface 34 is an interface for communicating with external devices. Specific examples of the communication interface 34 include Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB stands for Universal Serial Bus. HDMI stands for High-Definition Multimedia Interface.

[0026] The control unit 10 of the encryption device 1 and the control unit 20 of the decryption device 2 are realized by software. In the encryption device 1, a program that realizes the functions of the control unit 10 is stored in the storage 33. In the decryption device 2, a program that realizes the functions of the control unit 20 is stored in the storage 33. This program is read into the memory 32 by the processor 31 and executed by the processor 31. In this way, the functions of the control unit 10 and the control unit 20 are realized.

[0027] The encryption device 1 and the decryption device 2 may be implemented in one device.

[0028] ***Description of Operation*** The operations of the encryption device 1 and decryption device 2 according to the first embodiment will be described with reference to Figs. 6 to 20. The operation procedure of the encryption device 1 according to the first embodiment corresponds to the encryption method according to the first embodiment. Furthermore, the program that realizes the operation of the encryption device 1 according to the first embodiment corresponds to the encryption program according to the first embodiment. The operation procedure of the decryption device 2 according to the first embodiment corresponds to the decryption method according to the first embodiment. Furthermore, the program that realizes the operation of the decryption device 2 according to the first embodiment corresponds to the decryption program according to the first embodiment.

[0029] Here, it is assumed that the encryption device 1 and the decryption device 2 share a private key K in advance, and that the private key K is stored in the memory unit 12 of the encryption device 1 and the memory unit 22 of the decryption device 2.

[0030] The processing of the encryption function execution unit 111 according to the first embodiment will be described with reference to Fig. 6. When plain text P is input to the control unit 10, the processing starts.

[0031] (Step S11: 0th Round Processing) In the 0th round processing, the encryption function execution unit 111 performs the 0th round processing by encrypting the input plain text P and the round key K ０ The exclusive OR (XOR) of the input value X ０ Then, the encryption function execution unit 111 sets the number of rounds r to 1, and the process proceeds to step S12.

[0032] (Step S12: r-th round processing) In the r-th round processing, the encryption function execution unit 111 performs the r-th round processing on the input value X ｒ－１ and the rth round key K ｒ The encryption function execution unit 111 executes the round function 41 using the input value X ｒ Generate.

[0033] (Step S13: Round Number Determination Process) The encryption function execution unit 111 determines whether the round number r is smaller than R-1. If the round number r is smaller than R-1, the encryption function execution unit 111 proceeds to step S14. On the other hand, if the round number r is not smaller than R-1, the encryption function execution unit 111 proceeds to step S15.

[0034] (Step S14: Increment Process) The encryption function execution unit 111 adds 1 to the number of rounds r. Then, the encryption function execution unit 111 returns the process to step S12.

[0035] The processing from step S12 to step S14 is performed from the 1st round to the R-1th round. In the R-1th round, the input value X Ｒ－１ is generated.

[0036] (Step S15: Final Round Processing) As the final Rth round processing, the encryption function execution unit 111 performs the input value X obtained in the R-1th round processing. Ｒ－１ and the Rth round key K Ｒ The encryption function execution unit 111 executes the round function 42 for the final round using the above-mentioned inputs.

[0037] (Step S16: Output Process) The encryption function execution unit 111 outputs the ciphertext C generated in step S15.

[0038] With reference to FIG. 7, the round function 41 according to the first embodiment will be described. The round function 41 is composed of a nonlinear transformation and a linear transformation. In the round function 41, a base function 43 including a nonlinear layer and a linear layer is executed as the nonlinear transformation. The nonlinear layer is a process of applying 8-bit S-boxes (Substitution-boxes) in parallel. The linear layer is a process of mixing and diffusing data. In the first embodiment, the base function 43 based on a two-round round function used in AES encryption is executed as the nonlinear transformation. In addition, in the round function 41, a byte-by-byte shuffle operation 44 is executed as the linear transformation. An input value X to the round function 41 is ｒ－１ is divided into a plurality of sub-blocks of n' bits, each of which is shorter than n bits. ｒ－１ is divided into four sub-blocks of 128 bits each. Here, the first sub-block is from bit 511 to bit 384, the second sub-block is from bit 383 to bit 256, the third sub-block is from bit 255 to bit 128, and the fourth sub-block is from bit 127 to bit 0. Then, the base function 43 is applied to each sub-block, and the output value Y ｒ－１ is generated.

[0039] The base function 43 according to the first embodiment will be described with reference to FIG. 8 . The base function 43 is configured using a SubBytes process, a ShiftRows process, a MixColumns process, and an AddRoundKey process, which are used in AES encryption. The SubBytes process is a process that configures a nonlinear layer and permutes input bits based on an 8-bit S-box. The ShiftRows process is a process that configures a linear layer and represents the input as a matrix and shifts it row by row. The MixColumns process is a process that configures a linear layer and represents the input as a matrix and multiplies each column by an MDS matrix to mix and diffuse the data. MDS stands for Multi-Dimensional Scaling. The AddRoundKey process is a process that combines a round key with a sub-block of ciphertext using an XOR. Specifically, the base function 43 is composed of a first round process and a second round process. The first round process is a process in which a SubBytes process, a ShiftRows process, a MixColumns process, and an AddRoundKey process are executed in that order. The second round process is a process in which a SubBytes process, a ShiftRows process, and a MixColumns process are executed in that order, without executing an AddRoundKey process.

[0040] In the AddRoundKey operation, the round key is XORed into the sub-block, where the base function 43 is ｒ－１ The four sub-blocks X ｒ－１ １ , X ｒ－１ ２ , X ｒ－１ ３ , X ｒ－１ ４ The rth round key K ｒ =K ｒ １ ||K ｒ ２ ||K ｒ ３ ||K ｒ ４ Here, "||" represents the concatenation operator. ｒ １ , Kｒ ２ , K ｒ ３ , K ｒ ４ Each of the 128-bit round keys K ｒ Sub-block K of ｒ １ , K ｒ ２ , K ｒ ３ , K ｒ ４ is the sub-block X ｒ－１ １ , X ｒ－１ ２ , X ｒ－１ ３ , X ｒ－１ ４ In FIG. 7, sub-block K ｒ １ is sub-block X ｒ－１ １ Sub-block K ｒ ２ is sub-block X ｒ－１ ２ Sub-block K ｒ ３ is sub-block X ｒ－１ ３ Sub-block K ｒ ４ is sub-block X ｒ－１ ４ is XORed with.

[0041] The four 128-bit output values ​​Y after the basis function 43 is applied ｒ－１ １ , Y ｒ－１ ２ , Y ｒ－１ ３ , Y ｒ－１ ４are input to the byte-wise shuffle operation 44. As shown in FIG. 9, the byte-wise shuffle operation 44 shuffles the positions of the bytes. In FIG. 9, the initial byte positions are shown in the upper row, and the destination byte positions are shown in the lower row. The values ​​rearranged by the byte-wise shuffle operation 44 are concatenated to form the 512-bit input value X ｒ becomes.

[0042] The round function 42 for the final round according to the first embodiment will be described with reference to Fig. 10. The round function 42 for the final round includes only a base function 43 and does not include a byte-wise shuffle operation 44. The input value X Ｒ－１ is the input value X to the round function 41 ｒ－１ Similarly, the base function 43 is applied to each sub-block to obtain the output value Y Ｒ－１ After the base function 43 is applied, the four 128-bit output values ​​Y Ｒ－１ １ , Y Ｒ－１ ２ , Y Ｒ－１ ３ , Y Ｒ－１ ４ are concatenated to generate the ciphertext C.

[0043] The process of the key scheduling unit 112 according to the first embodiment will be described with reference to Fig. 11. (Step S21: Key Expansion Process) The key scheduling unit 112 receives a 256-bit secret key K as input and expands the secret key K through key expansion process to generate a 512-bit round key K. ０ The key expansion process generates the private key K=K ０ ||K １ When this is done, K ０ =K ０ ||K １ ||K ０ ||K １ This is a process of calculating the following.

[0044] (Step S22: Round Number Initialization Process) The key scheduling unit 112 sets the round number r to 1.

[0045] (Step S23: Key Update Processing) The key scheduling unit 112 updates the round key K ｒ－１ is input, the key update function 46 is executed to obtain the rth round key K ｒ Generate.

[0046] (Step S24: Key Output Processing) The key scheduling unit 112 outputs the round key K generated in step S23. ｒ Output.

[0047] (Step S25: Round Number Determination Process) The key scheduling unit 112 determines whether the round number r is smaller than R. If the round number r is smaller than R, the key scheduling unit 112 proceeds to step S25. On the other hand, if the round number r is not smaller than R, the key scheduling unit 112 ends the process.

[0048] (Step S26: Increment Process) The key scheduling unit 112 adds 1 to the number of rounds r, and then returns the process to step S23.

[0049] The processes from step S23 to step S26 are performed from the 1st round to the Rth round. Then, a round key K ｒ For each integer r in r=1,...,R, a round key K ｒ Each of these is 512 bits.

[0050] The key scheduling unit 112 stores each round key as a data structure such as an array in the storage unit 12. This makes it possible to omit the execution of the key update function 46 when reusing the same secret key K.

[0051] The key update function 46 according to the first embodiment will be described with reference to Fig. 12. The key update function 46 is configured using an AES round function 45 for the final round and a byte-by-byte shuffle operation 44. The AES round function 45 for the final round performs the same processing as the final round processing of the existing AES. The round key K ｒ－１is divided into four sub-blocks of 128 bits each. Here, the first sub-block refers to bits 511 to 384, the second sub-block to bits 383 to 256, the third sub-block to bits 255 to 128, and the fourth sub-block to bits 127 to 0. Then, the AES round function 45 for the final round is applied to each sub-block. Then, the four 128-bit outputs after the AES round function 45 for the final round is applied are input to a byte-wise shuffle operation 44, and a 512-bit value is obtained. A round constant calculation process 47 is executed on the obtained 512-bit value. In the round constant calculation process 47, a round constant C is calculated for the 512-bit value. ｒ This results in a 512-bit round key K ｒ is obtained.

[0052] Round Constant C ｒ is derived from the decimal part of pi. ｒ is given by the following formula: C ｒ = LSB ５１２ ((π-3) <<(512*r)) where LSB ５１２ is a function that truncates all but the most significant 512 bits. By this process, the decimal part of π is cut out in 512-bit increments, and the round constant C ｒ This becomes:

[0053] The process of the decryption function execution unit 211 according to the first embodiment will be described with reference to Fig. 13. When the ciphertext C is input to the control unit 20, the process starts.

[0054] (Step S31: 0th round processing) The decryption function execution unit 211 converts the ciphertext C into an input value X Ｒ , and the number of rounds r is set to 1, and the process proceeds to step S32.

[0055] (Step S32: r-th round processing) As the r-th round processing, the decryption function execution unit 211 performs the r-th round processing on the input value X Ｒ－（ｒ－１） and the rth round key K Ｒ－（ｒ－１）The decryption round function 48 is executed using the input value X Ｒ－ｒ Generate.

[0056] (Step S33: Round Number Determination Process) The decryption function execution unit 211 determines whether the round number r is smaller than R-1. If the round number r is smaller than R-1, the decryption function execution unit 211 proceeds to step S34. On the other hand, if the round number r is not smaller than R-1, the decryption function execution unit 211 proceeds to step S35.

[0057] (Step S34: Increment Process) The decryption function execution unit 211 adds 1 to the number of rounds r. Then, the decryption function execution unit 211 returns the process to step S32.

[0058] The processing from step S32 to step S34 is performed from the 1st round to the R-1th round. In the R-1th round, the input value X １ is generated.

[0059] (Step S35: Final Round Processing) As the final Rth round processing, the decryption function execution unit 211 performs the input value X obtained in the R-1th round processing. １ and the round key K １ The decryption round function 49 for the final round is executed using the input value X ０ Generate.

[0060] (Step S36: Plaintext Generation Process) The decryption function execution unit 211 generates the input value X ０ and the round key K Ｒ The decryption function execution unit 211 calculates the exclusive OR (XOR) of the above as the plaintext P. In this way, the decryption function execution unit 211 generates the plaintext P.

[0061] (Step S37: Output Process) The decryption function execution unit 211 outputs the plaintext P generated in step S35.

[0062] The decryption round function 48 according to the first embodiment will be described with reference to Fig. 14. The decryption round function 48 is composed of a nonlinear transformation and a linear transformation. In the decryption round function 48, a decryption base function 50 is executed as the nonlinear transformation. In the first embodiment, the decryption base function 50, which is based on the two-round decryption round function used in AES encryption, is executed as the nonlinear transformation. In addition, in the round function 41, a decryption shuffle operation 51 in byte units is executed as the linear transformation.

[0063] Input value X to the decryption round function 48 Ｒ－（ｒ－１） is divided into a plurality of sub-blocks of n' bits, each of which is shorter than n bits. Ｒ－（ｒ－１） is divided into four sub-blocks of 128 bits each. Here, the first sub-block is from bits 511 to 384, the second sub-block is from bits 383 to 256, the third sub-block is from bits 255 to 128, and the fourth sub-block is from bits 127 to 0. Then, the decoding base function 50 is applied to each sub-block, and the output value Y Ｒ－（ｒ－１） is generated.

[0064] The decryption base function 50 according to the first embodiment will be described with reference to Fig. 15 . The decryption base function 50 is configured using an InvSubBytes operation, an InvShiftRows operation, an InvMixColumns operation, and an AddRoundKey operation, which are used in AES encryption. The InvSubBytes operation, the InvShiftRows operation, and the InvMixColumns operation are inverse operations of the SubBytes operation, the ShiftRows operation, and the MixColumns operation, respectively. Specifically, the decryption base function 50 is configured from a first round operation and a second round operation. The first round of processing involves sequentially executing an InvMixColumns process, an InvShiftRows process, and an InvSubBytes process, without executing an AddRoundKey process.The second round of processing involves sequentially executing an InvMixColumns process, an AddRoundKey process, an InvShiftRows process, and an InvSubBytes process.

[0065] In the AddRoundKey operation, a round key is XORed with the sub-block. Here, as shown in FIG. 14, Ｒ－ｒ InvMixColumns is applied to InvMC (K Ｒ－（ｒ－１） ) is generated. Ｒ－（ｒ－１） ) = K Ｒ－（ｒ－１） １ ||K Ｒ－（ｒ－１） ２ ||K Ｒ－（ｒ－１） ３ ||K Ｒ－（ｒ－１） ４ Let's say. Ｒ－（ｒ－１） １ , K Ｒ－（ｒ－１） ２ , K Ｒ－（ｒ－１） ３ , K Ｒ－（ｒ－１） ４ Each of the sub-blocks K is 128 bits. Ｒ－（ｒ－１） １ , K Ｒ－（ｒ－１） ２ , K Ｒ－（ｒ－１） ３ , K Ｒ－（ｒ－１） ４is the sub-block X Ｒ－（ｒ－１） １ , X Ｒ－（ｒ－１） ２ , X Ｒ－（ｒ－１） ３ , X Ｒ－（ｒ－１） ４ In FIG. 14, sub-block K Ｒ－（ｒ－１） １ is sub-block X Ｒ－（ｒ－１） １ Sub-block K Ｒ－（ｒ－１） ２ is sub-block X Ｒ－（ｒ－１） ２ Sub-block K Ｒ－（ｒ－１） ３ is sub-block X Ｒ－（ｒ－１） ３ Sub-block K Ｒ－（ｒ－１） ４ is sub-block X Ｒ－（ｒ－１） ４ is XORed with.

[0066] The four 128-bit output values ​​Y after the decoding basis function 50 is applied Ｒ－（ｒ－１） １ , Y Ｒ－（ｒ－１） ２ , Y Ｒ－（ｒ－１） ３ , Y Ｒ－（ｒ－１） ４ are input to a byte-by-byte decryption shuffling operation 51. In the byte-by-byte decryption shuffling operation 51, the positions are swapped in the opposite manner to that of the byte-by-byte shuffling operation 44. That is, the positions are swapped such that the bottom row in FIG. 9 is the initial byte position and the top end is the destination byte position.

[0067] The decryption round function 49 for the final round according to the first embodiment will be described with reference to Fig. 16. The decryption round function 49 for the final round differs from the decryption round function 48 in that it includes only the decryption base function 50 and does not include the byte-wise decryption shuffle operation 51. The input value X １ is the input value X to the decryption round function 48 Ｒ－（ｒ－１）Similarly, the image is divided into four sub-blocks of 128 bits each. Then, the decoding base function 50 is applied to each sub-block to obtain the output value Y １ After the decoding basis function 50 is applied, the four 128-bit output values ​​Y １ １ , Y １ ２ , Y １ ３ , Y １ ４ are concatenated to the input value X ０ is generated.

[0068] A security evaluation of this method, described below, has shown that it is secure when the round number R is ≥ 3. In other words, in actual use, a round number R > 3 is currently sufficiently secure, so setting the round number R to 4 or greater makes realistic attacks impossible. The round number is generally set to twice the number of rounds of a known (identification) attack plus the number of rounds that can potentially be extended by a key recovery attack using an identifier. Since identifiers up to round number R = 3 have been found in this method, doubling this to 6 results in 6. Furthermore, since the number of rounds is generally limited to about 2 rounds, it is desirable to set the round number R = 8 = 6 + 2. In other words, taking into account the security evaluation results of this method, described below, and unknown attacks, it is desirable to set the round number R to 8. However, it is possible to reduce or increase it depending on the application. Furthermore, by incorporating the encryption and decryption functions of this method, set to any round number R, into another encryption scheme, etc., it can be used as a transformation to improve security.

[0069] When the number of rounds R is 8, the specific configuration of the encryption processing unit 11 according to the first embodiment is as shown in Fig. 17. When the number of rounds R is 8, the specific configuration of the decryption processing unit 21 according to the first embodiment is as shown in Fig. 18.

[0070] ***Explanation of Security*** The security of the wide block cipher according to embodiment 1 will be described. Security against four attack methods known as powerful attacks against block ciphers: differential attack, linear attack, impossible differential attack, and integral attack will be described. First, security against differential attack and linear attack, known as the most effective attack methods against block ciphers, will be described.

[0071] Hereinafter, the function given by the encryption function execution unit 111 when using the secret key K is referred to as EK. ｉｎ When the plain text P and the formula 1 are encrypted, the output difference Δ ｏｕｔ This is a method for efficiently identifying a secret key by using an input / output difference such that the following equation (2) is satisfied with a high probability.

[0072] A certain input difference Δ in output difference Δ ｏｕｔ The probability that the input difference Δ ｉｎ and output difference Δ ｏｕｔ and are constants. The differential probability DP is given by the following equation 3. Calculating the differential probability DP for the entire encryption process is difficult in a realistic amount of time. Therefore, differential attack resistance is evaluated using the differential characteristic probability DCP, which is an approximation of the differential probability DP obtained by multiplying the differential probability of the S-box to which the difference is input. Here, the AES base function SubBytes uses the same S-box as the S-box used in AES, and the differential probability of this S-box is 2 －６ The S-box to which the difference is input is called an active S-box. If the number of active S-boxes is #AS, the differential characteristic probability DCP of this method is given by equation 4. DCP (2 －６ ) ＃ＡＳ ) <2 －２５６If this condition is satisfied, the amount of data required to recover the private key will be 2256 or more. Therefore, a cost greater than that of a full search of a 256-bit private key will be required. Therefore, security is achieved if #AS≧43 or more. The present invention satisfies #AS≧43 after applying the round function in the third round. Therefore, the present invention can achieve sufficient security against differential attacks in three rounds.

[0073] A linear attack is an attack that exploits the bias in the linear correlation of an encryption function. A linear approximation for plaintext P and ciphertext C can be expressed as Equation 5. Here, α and β are the input linear mask and the output linear mask, respectively. ・ represents an inner product. The linear approximation shown in Equation 5 is Ｋ is sufficiently secure, that is, when it is difficult to distinguish from a completely random permutation, the probability of becoming 0 and the probability of becoming 1 approach 1 / 2 for all input / output linear masks. However, E Ｋ When the linear approximation is not sufficiently secure, there exists an input / output linear mask that causes a bias in the linear approximation. A linear attack is a method for efficiently searching for a secret key by utilizing the bias in the probability that can be observed using such an input / output mask. In a linear attack, it is necessary to search for an input / output linear mask that maximizes the linear probability LP calculated using the bias. However, it is difficult to search for an input / output linear mask that maximizes the linear probability for a pair of ciphertext and plaintext. Therefore, in general, the linear probability for one S-box is calculated, and as in a differential attack, the S-box into which the linear mask is input is designated as the active S-box, and the overall linear probability is approximated by the linear characteristic probability LCP, which is the value obtained by multiplying the linear probabilities of the S-boxes by the number of active S-boxes. Therefore, as with a differential attack, security against a differential attack can be evaluated using #AS. In this invention, an AES S-box is used, and the LP of the AES S-box is 2 －６ Therefore, the LCP of this method is given by Equation 6. Similar to the security against differential attacks, the LCP is (2 －６ ) ＃ＡＳ <2 －２５６ ) is satisfied, the amount of data required to recover the private key is 2 ２５６or more. Therefore, a cost greater than that of a full search of a 256-bit secret key is required. Therefore, similar to a differential attack, security is achieved against a linear attack if #AS≧43 or more, and #AS≧43 is satisfied after the application of the round function in the third round. Therefore, the present invention can achieve sufficient security against linear attacks in three rounds.

[0074] Next, we will explain the security against an impossible differential attack. An impossible differential attack is a Δ ｉｎ and Δ ｏｕｔ This is an attack that exploits the property that the secret key does not come from the correct secret key. An impossible differential attack reduces the number of secret keys that need to be searched by removing non-secret keys from the secret key search space, thereby efficiently identifying the secret key. Δ when DP=0 ｉｎ and Δ ｏｕｔ A pair of and is called an impossible differential. In order to achieve security against impossible differential attacks, it is necessary to set the number of rounds so that impossible differentials do not exist. In this method, after applying the round function in the third round, impossible differentials no longer exist. Therefore, this method is secure against impossible differential attacks in three rounds.

[0075] Next, security against integral attacks will be described. An integral attack is an attack that uses a property called the integral property. The integral property is a property that the sum of some intermediate states after multiple rounds of encryption of all plaintexts belonging to a specific plaintext set becomes zero for all secret keys. To achieve security against integral attacks, it is necessary to identify the number of rounds at which the integral property disappears and set a round number greater than that number of rounds. The integral property of this method disappears after applying the round function in the third round. Therefore, this method is secure against integral attacks in three rounds.

[0076] ***Description of Implementation Method*** This section explains the software implementation of this method. This method is based on implementation using SIMD instructions, a set of instructions that can manipulate values ​​stored in registers as vectors. Many recent x86_64 CPUs support AES-NI, a set of SIMD instructions that support AES encryption round functions and key generation. In addition, many arm64 CPUs support SIMD instructions that execute AES encryption round functions. This method is implemented in software using these instructions and several other instructions that perform byte-level swapping, enabling high-speed encryption and decryption.

[0077] First, the software implementation method for x86_64 will be described. AES-NI supported by x86_64 includes AESENC, AESENCLAST, AESDEC, AESDECLAST, and AESIMC. AESENC executes the encryption round function 41. AESENCLAST executes the encryption round function 42 for the final round. AESDEC executes the decryption round function 48. AESDECLAST executes the decryption round function 49 for the final round. AESIMC executes the inverse operation of MixColumns. The latency when executing one AESENC is 3, and the throughput is 1. Latency is the number of cycles required for execution, and throughput is the number of cycles of wait time required when issuing the same instruction consecutively. However, recent x86_64 CPUs are equipped with two arithmetic ports capable of executing AES-NI instructions, so the throughput per AESENC when executing two or more AESENCs is 0.5.

[0078] The block to be processed is held using four 128-bit xmm registers, which are SIMD-specific registers. Therefore, the input to the round function 41 is always divided into 128-bit blocks, so there is no need to implement division into subblocks. A base function 43 is applied to each xmm register holding a 128-bit subblock of the 512-bit block input to the round function 41. Four base functions 43 are executed in parallel. Each base function 43 can be implemented by executing AESENC twice consecutively. The byte-level shuffle operation 44 is implemented using unpack, an instruction class that performs shuffle operations for SIMD instructions. Among the unpack instructions, PUNPCKHBW and PUNPCKLBW, which perform byte-level operations, are used. By executing these instructions in the order shown in the figure, byte-level shuffling according to the rules shown in the figure can be achieved.

[0079] The implementation of the decryption process requires the implementation of a decryption base function 50 and a byte-wise decryption shuffle operation 51. The implementation of the AES decryption base function can be implemented by using AESDEC, AESDECLAST, and AESIMC, and executing instructions in the order shown in the figure. The round key is input by AddRoundKey executed by AESDEC.

[0080] Similarly, in the key update function 46, the round keys are stored in four xmm registers. The XOR of the round constant uses an XOR instruction in units of xmm registers. The matrix M can also be implemented using only an XOR instruction in units of xmm registers. The multiplication process of matrix M can be implemented using an XOR instruction for six xmm registers. In the decryption process, InvMixColumns is used when updating the key, so one AESIMC instruction is also required.

[0081] Furthermore, in a CPU equipped with AVX512, it is possible to implement four parallel executions of the base function 43 and the decoding base function 50 with a single instruction of the built-in function _m512i_mm512_aesenc_epi128(_m512ia, _m512i RoundKey).

[0082] Next, we will explain the software implementation method for arm64. In arm64, the block to be processed is held using four 128-bit NEON registers. Therefore, as with x86_64, the input to the round function 41 is always divided into 128-bit blocks, so there is no need to implement division into sub-blocks.

[0083] ARM64 supports a SIMD instruction set called NEON. NEON can also be equipped with a cryptography-related instruction set (NEON Crypto) as an extended instruction. Many recent ARM64-based CPUs are equipped with NEON Crypto. NEON Crypto includes instructions for executing AES round functions. Specifically, NEON Crypto provides AESE, AESMC, AESD, and AESIMC. AESE executes AddRoundKey, ShiftRows, and SubByte in that order. AESMC executes MixColumns. AESD executes AddRoundKey, InvShiftRows, and InvSubBytes in this order. AESIMC executes InvMixColumns.

[0084] The encryption base function 43 can be implemented by executing instructions in the order AESE, AESMC, AESE, AESMC. The byte-wise shuffle operation 44 can be implemented by executing a VST instruction to store all data held in the four NEON registers that store the outputs of the base function 43 into a single 64-element unsigned char array, and then applying a VLD4Q instruction that loads the data byte-wise into the four NEON registers in a special order. Therefore, the encryption round function 41 is implemented as shown in FIG. 19.

[0085] The decryption base function 50 can be implemented by executing instructions in the order AESIMC, AESD, AESIMC, AESD. The byte-wise decryption shuffle operation 51 can be implemented by using a VST4Q instruction that stores the values ​​stored in four NEON registers in a special order, byte by byte, into a single 64-element unsigned char array, and then applying a VLD instruction that loads the elements of the array into the four NEON registers in 128-bit increments. Thus, the decryption round function 48 is implemented as shown in FIG.

[0086] Here, the implementation methods for x86_64 and arm64 have been described, but this is not limited to these, and the implementation is also expected to increase processing speed and throughput in environments equipped with dedicated AES arithmetic circuits or other information processing devices with similar instruction sets.

[0087] ***Effects of First Embodiment*** As described above, the encryption system including the encryption device 1 and the decryption device 2 according to the first embodiment improves the diffusion performance of the round functions by using a shuffle operation in byte units. Therefore, it is possible to realize a wide block cipher using a round function with high diffusion performance.

[0088] Furthermore, the cryptographic system including the encryption device 1 and the decryption device 2 according to the first embodiment reduces the number of times the round key is input. Specifically, the round function 41 and the round function 42 for the final round require one round key input. This reduces the occurrence of unnecessary calculations and makes it possible to maintain high processing performance. Note that in the round functions of the Pholkos-512 cipher, the AddRoundKey process is executed twice in the round functions. In other words, the round key is input twice in the round functions.

[0089] Furthermore, the encryption system including the encryption device 1 and the decryption device 2 according to the first embodiment can be implemented with the same number of instructions as the round functions of the Pholkos-512 encryption.

[0090] From the above, the cryptographic system including the encryption device 1 and the decryption device 2 according to the first embodiment can realize a wide block cipher that takes into consideration both the diffusion performance and the processing performance when implemented in software.

[0091] The block cipher algorithm to which the present invention can be applied is not limited to AES. For example, the present invention can also be applied to an algorithm called LED, which uses a round function with the same structure as AES. Whether the present invention can be applied or not can be determined by whether security is ensured after application.

[0092] ***Other Configurations*** <Modification 1> In the first embodiment, each functional component is realized by software. However, in Modification 1, each functional component may be realized by hardware. The differences between Modification 1 and the first embodiment will be described below.

[0093] When each functional component is realized by hardware, the encryption device 1 includes an electronic circuit instead of the processor 31, the memory 32, and the storage 33. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 12, and the storage 13.

[0094] Possible electronic circuits include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, and an FPGA. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by a single electronic circuit, or each functional component may be distributed across multiple electronic circuits.

[0095] <Modification 2> As a modification 2, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0096] The processor 31, the memory 32, the storage 33, and the electronic circuitry are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0097] Furthermore, the term "unit" in the above description may be read as a "circuit," "step," "procedure," "process," or "processing circuit."

[0098] The various aspects of the present disclosure are described below as appendices. (Appendix 1) An encryption device including an encryption processing unit that receives as input an n-bit plaintext P of 256 bits or more and an m-bit secret key K of n bits or less but 256 bits or more, and generates an n-bit ciphertext C by encrypting the plaintext P by repeatedly executing a base function including a nonlinear layer and a linear layer and a shuffling operation in byte units. (Supplementary Note 2) The encryption device according to Supplementary Note 1, wherein the base function is configured by a first round of processing in which the SubBytes processing, the ShiftRows processing, the MixColumns processing, and the AddRoundKey processing are executed in order using the SubBytes processing, the ShiftRows processing, the MixColumns processing, and the AddRoundKey processing used in the AES encryption, and a second round of processing in which the SubBytes processing, the ShiftRows processing, and the MixColumns processing are executed in order without executing the AddRoundKey processing. (Supplementary Note 3) The encryption processing unit converts a value obtained from the plaintext P into an input value X ０ For each integer r, r=1, . . . , R−1, determined using the number of rounds R, the input value X ｒ－１ After executing the base function with input, the shuffle operation is performed to obtain the n-bit input value X ｒ and the input value X Ｒ－１ The encryption device according to claim 1 or 2, wherein the encryption processing unit executes the base function using an input of X to generate the ciphertext C. (Supplementary Note 4) The encryption processing unit executes the input value X for each integer r of r=1, . ｒ－１ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y ｒ－１ and generates an output value Y ｒ－１ to perform the shuffle operation on the n-bit value obtained from ｒ(Supplementary Note 5) The encryption device according to Supplementary Note 3, wherein the encryption processing unit generates the input value X Ｒ－１ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y Ｒ－１ and generates an output value Y Ｒ－１ (Supplementary Note 6) An encryption method in which a computer takes as input an n-bit plaintext P of 256 bits or more and an m-bit secret key K of n bits or less but 256 bits or more, and repeatedly executes a base function including a non-linear layer and a linear layer, and a shuffle operation in 1-byte units, to generate an n-bit ciphertext C by encrypting the plaintext P. (Supplementary Note 7) An encryption program that causes a computer to function as an encryption device that performs an encryption process in which an n-bit plaintext P of 256 bits or more and an m-bit secret key K of n bits or less but 256 bits or more are input, and repeatedly executes a base function including a non-linear layer and a linear layer, and a shuffle operation in 1-byte units, to generate an n-bit ciphertext C by encrypting the plaintext P. (Supplementary Note 8) A decryption device comprising: a decryption processing unit that receives as input an n-bit ciphertext C, which is 256 bits or more, and an m-bit secret key K, which is n bits or less but 256 bits or more, and repeatedly executes a base function including a non-linear layer and a linear layer, and a shuffling operation in byte units, to generate an n-bit plaintext P by decrypting the ciphertext C. (Supplementary Note 9) The decryption device according to Supplementary Note 8, wherein the base function uses an InvMixColumns process, an InvShiftRows process, an InvSubBytes process, and an AddRoundKey process used in AES encryption, and is configured by a first round of processing in which the InvMixColumns process, the InvShiftRows process, and the InvSubBytes process are executed in that order without executing the AddRoundKey process, and a second round of processing in which the InvMixColumns process, the AddRoundKey process, the InvShiftRows process, and the InvSubBytes process are executed in that order. (Supplementary Note 10) The decryption processing unit is configured by: ＲFor each integer r, r=1, . . . , R−1, determined using the number of rounds R, the input value X Ｒ－（ｒ－１） After executing the base function with input, the shuffle operation is performed to obtain the n-bit input value X Ｒ－ｒ and the input value X １ The decryption device according to claim 8 or 9, which executes the base function using an input of X to generate the plaintext P. (Supplementary Note 11) The decryption processing unit executes the base function using the input value X for each integer r of r=1, . Ｒ－（ｒ－１） is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y Ｒ－（ｒ－１） and generates an output value Y Ｒ－（ｒ－１） to perform the shuffle operation on the n-bit value obtained from Ｒ－ｒ (Supplementary Note 12) The decoding device according to Supplementary Note 10, wherein the decoding processing unit generates the input value X １ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y １ and generates an output value Y １ (Supplementary Note 13) A decryption method in which a computer receives as input an n-bit ciphertext C of 256 bits or more and an m-bit secret key K of n bits or less but 256 bits or more, and repeatedly executes a base function including a non-linear layer and a linear layer, and a shuffle operation in 1-byte units, to generate an n-bit plaintext P decrypted from the ciphertext C. (Supplementary Note 14) A decryption program that causes a computer to function as a decryption device that performs a decryption process in which an n-bit ciphertext C of 256 bits or more and an m-bit secret key K of n bits or less but 256 bits or more are input, and repeatedly executes a base function including a non-linear layer and a linear layer, and a shuffle operation in 1-byte units, to generate an n-bit plaintext P decrypted from the ciphertext C.

[0099] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Furthermore, one or more of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as needed.

[0100] REFERENCE SIGNS LIST 1 encryption device, 10 control unit, 11 encryption processing unit, 111 encryption function execution unit, 112 key scheduling unit, 12 memory unit, 2 decryption device, 20 control unit, 21 decryption processing unit, 211 decryption function execution unit, 212 key scheduling unit, 22 memory unit, 31 processor, 32 memory, 33 storage, 34 communication interface, 41 round function, 42 round function for final round, 43 base function, 44 byte-unit shuffle operation, 45 AES round function for final round, 46 key update function, 47 round constant calculation process, 48 ​​decryption round function, 49 decryption round function for final round, 50 decryption base function, 51 byte-unit decryption shuffle operation, 52 decryption base function for final round.

Claims

1. An encryption device having an encryption processing unit that receives as input an n-bit plaintext P that is 256 bits or more and an m-bit secret key K that is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffling operation in byte units, to generate an n-bit ciphertext C by encrypting the plaintext P.

2. The encryption device according to claim 1, wherein the base function is configured with a first round of processing that uses the SubBytes processing, ShiftRows processing, MixColumns processing, and AddRoundKey processing used in AES encryption, and executes the SubBytes processing, ShiftRows processing, MixColumns processing, and AddRoundKey processing in that order, and a second round of processing that executes the SubBytes processing, ShiftRows processing, and MixColumns processing in that order, without executing the AddRoundKey processing.

3. The encryption processing unit converts the value obtained from the plaintext P into an input value X ０ and r=1, which is determined using the number of rounds R. ， For each integer r in . . . , R-1, the input value X ｒ－１ After executing the base function with input, the shuffle operation is performed to obtain the n-bit input value X ｒ and the input value X Ｒ－１ 3. The encryption device according to claim 1, wherein the encryption device generates the ciphertext C by executing the base function using the input 4. The encryption processing unit calculates the input value X for each integer r where r=1, . . . , R-1. ｒ－１ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y ｒ－１ and generates an output value Y ｒ－１ to perform the shuffle operation on the n-bit value obtained from ｒ 4. The encryption device according to claim 3, wherein the encryption device generates:

5. The encryption processing unit converts the input value X Ｒ－１ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y Ｒ－１ and generates an output value Y Ｒ－１ 5. The encryption device according to claim 3, wherein the encrypted text C is generated from 6. An encryption method in which a computer receives as input an n-bit plaintext P, which is 256 bits or more, and an m-bit secret key K, which is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffle operation in byte units, to generate an n-bit ciphertext C by encrypting the plaintext P.

7. An encryption program that causes a computer to function as an encryption device that performs an encryption process that takes as input an n-bit plaintext P that is 256 bits or more and an m-bit secret key K that is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffle operation in byte units, to generate an n-bit ciphertext C that encrypts the plaintext P.

8. A decryption device having a decryption processing unit that receives as input an n-bit ciphertext C that is 256 bits or more and an m-bit secret key K that is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffling operation in byte units, to generate an n-bit plaintext P by decrypting the ciphertext C.

9. The decryption device according to claim 8, wherein the base function is configured by a first round of processing that uses an InvMixColumns process, an InvShiftRows process, an InvSubBytes process, and an AddRoundKey process used in AES encryption, and that executes an InvMixColumns process, an InvShiftRows process, and an InvSubBytes process in that order without executing an AddRoundKey process, and a second round of processing that executes an InvMixColumns process, an AddRoundKey process, an InvShiftRows process, and an InvSubBytes process in that order.

10. The decryption processing unit converts the ciphertext C into an input value X Ｒ and r=1, which is determined using the number of rounds R. ， For each integer r in . . . , R-1, the input value X Ｒ－（ｒ－１） After executing the base function with input, the shuffle operation is performed to obtain the n-bit input value X Ｒ－ｒ and the input value X １ 10. The decryption device according to claim 8, wherein the plaintext P is generated by executing the base function using the input 11. The decoding processing unit decodes the input value X for each integer r, r=1, . . . , R-1. Ｒ－（ｒ－１） is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y Ｒ－（ｒ－１） and generates an output value Y Ｒ－（ｒ－１） to perform the shuffle operation on the n-bit value obtained from Ｒ－ｒ The decoding device according to claim 10, wherein the decoding device generates:

12. The decoding processing unit decodes the input value X １ is divided into a plurality of sub-blocks of n' bits each shorter than n bits, and the base function is executed in parallel for each sub-block to generate an n'-bit output value Y １ and generates an output value Y １ 12. The decryption device according to claim 10, wherein the plaintext P is generated from 13. A decryption method in which a computer receives as input an n-bit ciphertext C, which is 256 bits or more, and an m-bit secret key K, which is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffle operation in byte units, to generate an n-bit plaintext P by decrypting the ciphertext C.

14. A decryption program that causes a computer to function as a decryption device that performs a decryption process that takes as input an n-bit ciphertext C that is 256 bits or more and an m-bit secret key K that is n bits or less but 256 bits or more, and repeatedly executes a base function including a nonlinear layer and a linear layer, and a shuffling operation in byte units, to generate an n-bit plaintext P by decrypting the ciphertext C.

Images