Encryption apparatus, decryption apparatus, encryption system, encryption method, encryption program, decryption method, and decryption program

Abstract

This encryption apparatus comprises an initialization unit (120), an associated data processing unit (130), an encryption unit (140), and a finalization unit (150). The initialization unit (120) initializes, using a secret key (K) of a common key encryption, an internal state (S) of a round function comprising a cryptographic function that is configured by using a non-linear function and a linear function that is composed of a matrix operation in which the number of branches is six or more. The associated data processing unit (130) applies the round function to the internal state (S) and associated data (AD) multiple times. The encryption unit (140) generates a ciphertext (C) by using the cryptographic function, the internal state (S), and a plaintext (M). After the ciphertext (C) is generated, the encryption unit (140) applies the round function to the internal state (S) and the plaintext (M) multiple times. The finalization unit (150) applies the round function to the internal state (S) and the secret key (K) five or more times, and generates an authentication tag (T) for authenticating the ciphertext (C) on the basis of the internal state (S).

Description

Encryption device, decryption device, encryption system, encryption method, encryption program, decryption method, and decryption program

[0001] This disclosure relates to an encryption device, a decryption device, an encryption system, an encryption method, an encryption program, a decryption method, and a decryption program.

[0002] An encryption method that encrypts (conceals) plaintext using a secret key, which is confidential information, and decrypts it using the same secret key used for encryption, is called a symmetric-key encryption method. In particular, authenticated encryption is known as a method that not only conceals the plaintext but also outputs an authentication tag in addition to the ciphertext to guarantee that the ciphertext, which is the encrypted plaintext, has not been tampered with by an attacker during transmission.

[0003] There are two main ways to construct authenticated ciphers. The first method involves extending the input, called the cryptographic mode, to an arbitrary length in a block cipher and applying an external algorithm to generate an authentication tag. In a block cipher, a fixed-length plaintext is used to generate ciphertext of the same size. The second method involves designing an authenticated cipher from scratch that accepts plaintext of arbitrary length and generates an authentication tag. The second method makes it possible to design authenticated ciphers with superior implementation performance (encryption speed, circuit size, etc.). For this reason, many authenticated ciphers are now designed using the second method.

[0004] In particular, regarding the design of authenticated cryptography in recent years, almost all processors currently installed in computers and smartphones support instruction sets capable of high-speed execution of the AES round function, which is the US standard block cipher. For this reason, many methods have been proposed that utilize the AES round function as an internal component of authenticated cryptography. AES is an abbreviation for Advanced Encryption Standard. In the prior art shown in Non-Patent Document 1, authenticated cryptography is designed using the above method, and encryption processing speeds of 100 Gbps (bits per second) or more are achieved in software.

[0005] Kosei Sakamoto, Fukang Liu, Yuto Nakano, Shinsaku Kiyomoto, Takanori Isobe. , “Rocca: An Efficient AES-based Encryption Scheme for Beyond 5G”, IACR Transactions on Symmetric Cryptology Vol. 2021(2), 2021, pp. 1-30

[0006] The prior art described in Non-Patent Document 1 proposes an ultra-high-speed authentication encryption scheme intended for application to future 6G (Beyond 5G) systems, and employs an authentication encryption method called the Sponge-Duplex type, as shown in Figure 1. 6G is an abbreviation for 6th Generation. 5G is an abbreviation for 5th Generation. Because the Sponge-Duplex type authentication encryption has a repeating structure, the overall processing speed of the authentication encryption is determined by the execution speed of the round function shown in Figure 2. Therefore, in Non-Patent Document 1, in order to increase the processing speed, the round function shown in Figure 1 is composed only of an AES round function and exclusive OR (XOR), which can be implemented at high speed in software. With this configuration, an encryption processing speed of 100 Gbps or more can be achieved in software. In Figure 2, the area inside the dashed line shows the contents of one round function. In Figure 2, the rightward arrows show how the round function is repeatedly executed. Furthermore, Non-Patent Document 1 discloses a configuration that guarantees sufficient security against "key recovery attacks" and "forgery attacks" by examining various combinations of the positions of AES and XOR inside the round function shown in Figure 2 and the substitution process of the values ​​indicated by each block. A "key recovery attack" is an attack in which an attacker recovers the private key. A "forgery attack" is an attack in which an attacker, without possessing information about the private key, generates an authentication tag identical to an authentication tag generated from a specific plaintext, but from plaintext different from the specific plaintext.

[0007] Generally, in symmetric-key cryptography, there is a trade-off between processing performance and security. Specifically, increasing the number of operations within the encryption increases security, but processing performance decreases because processing must be performed for each additional operation. To avoid this decrease in processing performance, a common technique is to improve security by performing each operation in a finer unit, as shown in Figures 3 and 4, thereby increasing the degree of data assimilation and thus reducing the number of operations required for encryption. However, evaluating or proving the security of symmetric-key cryptography is generally complex and requires significant computing resources. Therefore, when designing a new encryption method, it is necessary to design an encryption method that can be evaluated for security by combining operations such as byte-level operations. Conventional methods avoid excessive complexity in security evaluation by using AES, a block cipher composed of byte-level operations.

[0008] In software implementations, the AES round function is highly efficient due to its fast execution using dedicated instructions, resulting in excellent implementation performance. However, this is not the case in hardware implementations. To design a better configuration in terms of circuit size and power consumption performance in hardware implementations, it is possible to use calculations at a finer level, as explained above. However, Sponge-Duplex type authenticated cryptography has a large internal state length. Therefore, security evaluation becomes excessively complex, leading to challenges such as the inability to prove security.

[0009] In designing a symmetric-key cryptosystem, it is necessary to search for parameters that satisfy security requirements from among countless cryptographic parameters. Specific examples of cryptographic parameters include the number of blocks, the destinations of arrows extending from the blocks, the size of the S-box, the size of the matrix, and the permutation operations within the cryptographic function. Therefore, reducing the cost of evaluating the security of the designed cryptographic scheme is one of the most important aspects of cryptographic design.

[0010] This disclosure aims to provide an authenticated cryptography for hardware implementations that ensures security and has relatively low power consumption. Furthermore, this disclosure aims to provide an authenticated cryptography that allows for relatively easy security evaluation.

[0011] The encryption device according to this disclosure comprises: an initialization unit that initializes the internal state of a round function, which has a cryptographic function composed of a nonlinear function and a linear function consisting of a matrix operation with six or more branches, using a secret key of a symmetric key encryption; an associated data processing unit that applies the round function multiple times to the internal state of the round function and associated data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; an encryption unit that generates the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext, and after the generation of the ciphertext, applies the round function multiple times to the internal state of the round function and the plaintext; and a finalization unit that applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function, wherein the encryption unit applies the cryptographic function once or more to each plaintext block of a plurality of plaintext blocks generated by dividing the plaintext when generating the ciphertext.

[0012] According to this disclosure, the initialization unit initializes the internal state of the round function using the secret key of a symmetric-key cryptography. The related data processing unit applies the round function multiple times to the internal state of the round function and related data related to the generation of an authentication tag. The encryption unit applies the round function multiple times to the internal state of the round function and the plaintext when generating ciphertext. The finalization unit applies the round function five or more times to the internal state of the round function and the secret key to generate an authentication tag. Here, regarding the cryptographic function, as a result of searching for the optimal combination of S-box (nonlinear function) and matrix operations, a cryptographic function was obtained that is composed of a linear function consisting of matrix operations with six or more branches. Furthermore, this disclosure employs the Sponge-Duplex type. Moreover, the processing of the encryption device according to this disclosure may be implemented in hardware. Accordingly, this disclosure makes it possible to provide an authentication cryptography for hardware implementation that ensures security and has relatively low power consumption. Furthermore, this disclosure makes it possible to provide an authentication cryptography that can be relatively easily evaluated for security.

[0013] A diagram illustrating an authentication encryption method called Sponge-Duplex. A diagram illustrating a round function related to the prior art. A diagram illustrating data agitation performance and the difficulty of security evaluation in a symmetric-key encryption method. A diagram illustrating data agitation performance and the difficulty of security evaluation in a symmetric-key encryption method. A diagram showing an example configuration of the encryption system 90 according to Embodiment 1. A diagram showing an example configuration of the encryption processing unit 11 according to Embodiment 1. A diagram showing an example configuration of the round function 101 according to Embodiment 1. A diagram showing an example configuration of the initialization unit 120 according to Embodiment 1. A diagram showing an example configuration of the related data processing unit 130 according to Embodiment 1. A diagram showing an example configuration of the encryption unit 140 according to Embodiment 1. A diagram showing an example configuration of the finalization unit 150 according to Embodiment 1. A diagram showing an example configuration of the decryption processing unit 21 according to Embodiment 1. A diagram showing an example configuration of the decryption unit 230 according to Embodiment 1. A schematic diagram of the cryptographic function 102 according to Embodiment 1. A diagram showing an example hardware configuration of the encryption device 1 according to Embodiment 1. A flowchart showing the operation of the encryption device 1 according to Embodiment 1. A flowchart showing the encryption process according to Embodiment 1. A flowchart showing the decryption process according to Embodiment 1. A diagram showing an example of the ApplyBox 103 according to Embodiment 1. A diagram showing an example of the Permutation 105 according to Embodiment 1. A diagram showing an example of the hardware configuration of the encryption device 1 according to a modified example of Embodiment 1.

[0014] In the description and drawings of the embodiments, the same elements and corresponding elements are denoted by the same reference numeral. The descriptions of elements denoted by the same reference numeral are omitted or simplified as appropriate. The arrows in the figures mainly indicate the flow of data or processing. Also, "part" may be read as "circuit," "device," "equipment," "process," "step," "procedure," "processing," or "circuitry" as appropriate. The functions of each part of each device may be realized by firmware, software, hardware, or a combination thereof.

[0015] Embodiment 1. This embodiment will be described in detail below with reference to the drawings. Note that the specific bit lengths and other specifications described below are basically just examples of this embodiment. Therefore, it is not necessary to use the described bit lengths and other specifications when implementing this embodiment.

[0016] ***Explanation of the Configuration*** Figure 5 shows a configuration example of an encryption system 90 according to the present embodiment. As shown in Figure 5, the encryption system 90 includes an encryption device 1 and a decryption device 2. The encryption device 1 is an arithmetic device that outputs a ciphertext of the same length as the plaintext and a 128-bit authentication tag by inputting a 128-bit nonce (initialization vector) and a 256-bit secret key for an arbitrary-length plaintext and arbitrary-length unencrypted associated data. Also, the ciphertext generated by the encryption device 1 can be decrypted by inputting the same 128-bit nonce, 256-bit secret key, and associated data that were input to the encryption device 1 to the decryption device 2. The decryption device 2 can generate an authentication tag by inputting the same 128-bit nonce, 256-bit secret key, and associated data that were input to the encryption device 1, and the received ciphertext. By comparing the authentication tag generated by the decryption device 2 with the authentication tag generated by the encryption device 1, it is possible to detect tampering of the ciphertext by a third party on the communication line. Here, when the authentication tag generated by the decryption device 2 and the authentication tag generated by the encryption device 1 have the same value, the integrity of the ciphertext received by the decryption device 2 is guaranteed. Note that the encryption device 1 and the decryption device 2 may be implemented in one device. The encryption system 90 handles a so-called Sponge-Duplex type authenticated cipher. The Sponge-Duplex type authenticated cipher is an authenticated cipher having a repetitive structure.

[0017] As shown in Figure 5, the encryption device 1 includes a control unit 10, an encryption processing unit 11, and a storage unit 12. The control unit 10 performs processing for receiving inputs such as a plaintext M, associated data AD, a secret key K, and a nonce N. The encryption processing unit 11 performs encryption processing and generation of an authentication tag T. The storage unit 12 is used to hold the secret key K, the associated data AD, the generated ciphertext C, and the generated authentication tag T.

[0018] Figure 6 shows an example configuration of the encryption processing unit 11. As shown in Figure 6, the encryption processing unit 11 consists of a padding processing unit 110, an initialization unit 120, an associated data processing unit 130, an encryption unit 140, and a finalization unit 150. The encryption processing unit 11 is composed of an internal state of 1152 bits, which is divided and held in nine internal states of 128 bits each. The nine internal states are updated in the initialization unit 120, the associated data processing unit 130, the encryption unit 140, and the finalization unit 150 by the round function 101 shown in Figure 7. Note that the round function 101 shown below is just one example, and it is not necessary to use the same number of blocks and substitutions as below. The round function 101 shown in Figure 7 is an example of a round function that has 128 bits or more of security against internal collisions. Other round functions may be used as round functions that have 128 bits or more of security against internal collisions. The round function 101 shown in Figure 7 is an example of a round function that has 128 bits or more of security against key recovery attacks. Other rounding functions may be used as rounding functions that provide 128 bits or more of security against key recovery attacks.

[0019] The round function 101 comprises a cryptographic function 102. The round function 101 may have 128 bits or more of security against internal collisions with pairs of different ciphertexts. The round function 101 may have 128 bits or more of security against key recovery attacks with respect to the secret key K. The round function 101 may consist of parallel execution of the cryptographic function 102 and an exclusive OR operation. The round function 101 may consist of nine 128-bit blocks. In the round function 101, the cryptographic function 102 may be applied to the value of each 128-bit block of the round function 101. The value of each 128-bit block to which the cryptographic function 102 is applied may be input to an exclusive OR operation between the value of another 128-bit block of the round function 101 or an input to the round function 101. The said round function 101 is an example of a round function that has 128 bits or more of security against key recovery attacks. By applying the round function 101 five or more times in the initialization unit 120, security of 128 bits or more is ensured against key recovery attacks. When the number of blocks in the round function 101 is m (where m is an integer of 2 or more), the value of the nth block (where n is an integer between 1 and m) in the round function 101 is input to the {(n+1) mod m}th cryptographic function, and the value of the nth block, which is one or more blocks among the blocks in the round function 101, may be input to an exclusive OR other than the {(n+1) mod m}th. The round function 101 is an example of a round function that has security of 128 bits or more against key recovery attacks. By applying the round function 101 five or more times in the initialization unit 120, security of 128 bits or more is ensured against key recovery attacks.

[0020] The cryptographic function 102 is a cryptographic function with an input / output bit length of 128 bits. The cryptographic function 102 is configured using a non-linear function and a linear function consisting of a matrix operation with a branch number of 6 or more. The cryptographic function 102 may have a 16×16 matrix operation. The cryptographic function 102 may have a matrix operation with a branch number of 8. The cryptographic function 102 may be composed of a 4-bit S-box where each of the maximum differential probability and the maximum linear probability is 2^(-2), and a 16×16 matrix operation with a branch number of 8. Each of the exclusive ORs with the cryptographic function 101 may be circuit-implemented.

[0021] Hereinafter, S and X ０ and X １ and X ２ Define the process of updating nine 128-bit states by applying a round function having S and X and X and X as inputs as shown in [Equation 1]. Here, S represents nine 128-bit states, and each of X ０ and X １ and X ２ is a 128-bit value input to the round function 101.

[0022]

[0023] The padding processing unit 110 performs padding processing on each of the plaintext M and the associated data AD. As a specific example, the padding processing unit 110 adds 0 or 1 to the bit sequence indicating each of the plaintext M and the associated data AD so that the bit length of each of the input plaintext M and the associated data AD becomes a multiple of 384. Here, let the length of the input associated data AD be a bits and the length of the input plaintext M be m bits. At this time, each of a ｐ and m ｐ becomes as shown in [Equation 2]. Here, a ｐ is the length of the bit sequence padded to the associated data AD. m ｐ is the length of the bit sequence padded to the plaintext M. The notation "n % m" represents the remainder when n is divided by m. The added a ｐ bits and m <x ｐEach bit is assigned, for example, 0x100...0 in hexadecimal.

[0024]

[0025] Figure 8 shows an example configuration of an initialization unit 120 that performs preprocessing related to the secret key K and the nonce N. The initialization unit 120 initializes the internal state S of the round function 101 using the secret key K. The initialization unit 120 may also initialize the internal state S of the round function 101 using the secret key K and a 128-bit nonce N which corresponds to an initialization vector. The secret key K is the secret key of a symmetric key cryptography. The bit length of the secret key K may be 256 bits.

[0026] First, the initialization unit 120 generates two blocks of key-dependent values ​​from the secret key K. Here, as an example, the initialization unit 120 generates K consisting of the upper 128 bits of the 256-bit secret key K. ０ And the lower 128 bits of the private key K １ Each of these is generated as shown in [Equation 3]. Here, "||" is the bit string concatenation operator. K ０ and K １ Each of these is sometimes referred to as a 128-bit secret key.

[0027]

[0028] Next, the initialization unit 120 processes the divided 128-bit secret key K ０ and K １ The 128-bit nonce N is loaded into the nine internal states S (S[0] to S[8]) of the round function 101, as shown in [Equation 4]. Here, Z ０ and Z １ and Z ２ Each of these is a distinct arbitrary 128-bit constant value. The "0" on the right side indicates that all 128 bits are set to 0.

[0029]

[0030] Next, the initialization unit 120 R(S, Z ０ , Z １ , Z ２Apply the formula 20 times. Note that while the number of applications is set to 20 here, the number of applications can be changed depending on the required safety and implementation performance. Also, applying it 5 times or more is acceptable.

[0031] Next, the initialization unit 120, as shown in [Equation 5], sets each of the nine 128-bit internal states and K ０ or K １ The nine 128-bit internal states are updated by performing an XOR operation on them. Note that [Equation 5] is an example of the update process. In the update process, it is sufficient to calculate the exclusive OR of one or more values ​​in each block and the value of the secret key.

[0032]

[0033] Figure 9 shows an example configuration of the related data processing unit 130 that processes related data AD. The related data processing unit 130 applies the round function 101 multiple times to the internal state S and related data AD. Specifically, the related data processing unit 130 inputs related data AD to the values ​​of each block by applying the round function 101 multiple times to the related data AD that has undergone padding processing, using the exclusive OR operation. Here, related data AD is data that is transmitted as is without encryption, and a concrete example is the header in packet communication. Although related data AD is not encrypted, it is related to the generation of the authentication tag T. Therefore, if the ciphertext C or related data AD is tampered with, the recipient can detect the tampering.

[0034] First, the related data processing unit 130 is padded by the padding processing unit 110 (a + a ｐ The associated data AD, which has been converted to bits, is divided into 128-bit blocks as shown in [Equation 6].

[0035]

[0036] Next, the related data processing unit 130 R(S, AD ３ｊ AD ３ｊ＋１ AD ３ｊ＋２ ) to ((a + a ｐApply this ) / 128 times. Note that here 0 <= j < a ｐ <384.

[0037] Figure 10 shows an example configuration of an encryption unit 140 that generates ciphertext C from plaintext M. The encryption unit 140 generates ciphertext C by encrypting the plaintext M using a cryptographic function 102, the internal state S of the round function 101, and the plaintext M. When generating ciphertext C, the encryption unit 140 applies the cryptographic function 102 once or more to each of the multiple plaintext blocks generated by dividing the plaintext M. Furthermore, after generating ciphertext C, the encryption unit 140 applies the round function 101 multiple times to the internal state S of the round function 101 and the plaintext M. Specifically, the encryption unit 140 applies the round function 101 multiple times to the padded plaintext M so that the plaintext M is input to the values ​​of each block by exclusive OR, and generates ciphertext C with the same length as the input plaintext M.

[0038] First, the encryption unit 140 is padded by the padding processing unit 110 (m + m ｐ The plaintext M, which has been converted to bits, is divided into 128-bit blocks as shown in [Equation 7].

[0039]

[0040] Next, the encryption unit 140 generates a ciphertext block Cx using the ciphertext generation unit 141 shown in Figure 10, as shown in [Equation 8], and updates the round function 101 ((m + m ｐ The function is applied ) / 128 times. Here, F is the cryptographic function 102. F will be described in detail later. Note that when multiple ciphertext blocks are generated by applying the round function once, as shown in [Equation 8], the ciphertext generation unit 141 is restricted from using the same internal state S[X] more than twice. The generated ciphertext block Cx is sent to the recipient of the ciphertext block Cx as soon as it is generated.

[0041]

[0042] Figure 11 shows an example configuration of the finalization unit 150 that generates the authentication tag T. The finalization unit 150 applies the round function 101 multiple times to the internal state S of the round function 101 and the secret key K, and generates an authentication tag T for authenticating the ciphertext C based on the internal state S of the round function 101.

[0043] First, the finalization unit 150, as shown in [Equation 9], sets each of the nine 128-bit internal states and K ０ or K １ Each internal state S is updated by performing an XOR operation on the two values. Note that [Equation 9] is an example of the update process. In the update process, it is sufficient to calculate the exclusive OR of one or more values ​​in each block and the value of the secret key.

[0044]

[0045] Next, the final processing unit 150 is R(S,K ０ , Z ０ , K １ Apply ) 20 times. Note that R(S,K ０ , Z ０ , K １ The application of the law is acceptable if it is applied five or more times.

[0046] Next, the finalization unit 150, as shown in [Equation 10], processes each of the nine 128-bit internal states and K ０ or K １ Each internal state S is updated by performing an XOR operation on the two values. Note that [Equation 10] is an example of the update process. In the update process, it is sufficient to calculate the exclusive OR of one or more values ​​from each block and the value of the secret key.

[0047]

[0048] Next, the finalization unit 150 generates an authentication tag T by performing an XOR operation on all nine 128-bit internal states, as shown in [Equation 11].

[0049]

[0050] The following describes an example configuration of the decryption device 2. The configuration of the decryption device 2 is basically the same as that of the encryption device 1. However, the decryption device 2 includes a control unit 20 instead of a control unit 10, and a storage unit 22 instead of a storage unit 12. The control unit 20 includes a decryption processing unit 21 instead of an encryption processing unit 11.

[0051] Figure 12 shows an example configuration of the decryption processing unit 21. As shown in Figure 12, the decryption processing unit 21 consists of an initialization unit 210, an associated data processing unit 220, a decryption unit 230, a finalization unit 240, a padding processing unit 250, and an authentication tag verification unit 260. Here, the initialization unit 210, the associated data processing unit 220, and the finalization unit 240 are the same as the initialization unit 120, the associated data processing unit 130, and the finalization unit 150 in the encryption processing unit 11, respectively. The decryption unit 230, the padding processing unit 250, and the authentication tag verification unit 260 will be described below. The decryption processing unit 21 uses the same round function 101 as the encryption processing unit 11.

[0052] Figure 13 shows an example of the configuration of the decryption unit 230. As shown in Figure 13, the decryption unit 230 corresponds to the part of the encryption unit 140 in which the relationship between the plaintext M and the ciphertext C is reversed. Therefore, the plaintext generation unit 231 decrypts the plaintext M as shown in [Equation 12]. The decrypted plaintext M is output by the authentication tag verification unit 260. The decryption unit 230 decrypts the plaintext M using the ciphertext C generated by the encryption process performed by the encryption unit 140, the cryptographic function 102, and the internal state S of the round function 101. Furthermore, after decrypting the plaintext M, the decryption unit 230 applies the round function 101 multiple times to the internal state S of the round function 101 and to the plaintext M.

[0053]

[0054] The authentication tag verification unit 260 compares the received authentication tag T (an authentication tag generated by the encryption processing unit 11) with the authentication tag T' generated by the finalization unit 240. If the two authentication tags match, i.e., T = T', the integrity of the ciphertext C and associated data AD is guaranteed. Therefore, the authentication tag verification unit 260 outputs the plaintext M decrypted by the decryption unit 230 and the associated data AD after the padding processing by the padding processing unit 250 has been applied to both the plaintext M and the associated data AD. If the two authentication tags do not match, the authentication tag verification unit 260 outputs an error code ⊥ without outputting the plaintext M.

[0055] Next, we will describe the cryptographic function 102 used in the round function 101. The cryptographic function described here is the function represented by F inside the round function 101 shown in Figure 7. Figure 14 shows an overview of the cryptographic function 102. The cryptographic function 102 consists of a linear function and a nonlinear function. In Figure 14, ApplySbox 103 is a nonlinear function, and MatrixMul 104 and Permutation 105 are linear functions, respectively. ApplySbox 103 represents the parallel application of S-boxes. MatrixMul 104 applies one or more binary matrix operations in parallel, with six or more branches. Permutation 105 applies value shuffling (reordering) so that the output of each matrix operation becomes dependent on subsequent round function applications when two or more matrix operations are applied. Here, dependencies can be introduced into each output by applying an arbitrary shuffle. Therefore, the type of shuffle does not matter. In the following detailed explanation, specific values ​​are given for bit length, the number of S-boxes to apply in parallel, matrix size, and the number of applications. However, these specific values ​​are just examples of the embodiment, and it is not necessary to use these specific values.

[0056] The nonlinear function of the cryptographic function 102 may consist of a nonlinear layer that applies m / n S-boxes in parallel when a matrix operation is applied, where the processing unit is m bits and the size of each element is n bits. Here, m is an integer between 32 and 512, and n is an integer between 3 and 8. As a specific example, in Figure 14, the cryptographic function 102 divides the 128-bit input into 32 4-bit cells and performs operations on them in units of 4 bits. Subsequently, the cryptographic function 102 updates the 128-bit input state as shown in [Equation 13] using ApplySbox 103, which consists of 32 parallel applications of 4-bit S-boxes, MatrixMul 104, which consists of two 16x16 binary matrix operations, and Permutation 105, which performs nibble (4-bit) unit substitutions.

[0057]

[0058] Let's explain each operation. ApplySbox103 is an operation that applies 32 4-bit input / output S-boxes in parallel, where both the differential probability and linear probability, which are criteria for evaluating the security of symmetric-key cryptography as described later, are 2^(-2). MatrixMul104 is an operation that applies 16x16 binary matrices in parallel, where the number of branches is 8 and the size of the matrix elements is 4 bits, which are criteria for evaluating the security of symmetric-key cryptography as described later. Note that for the 32 4-bit S-boxes and 2 16x16 binary matrices used in ApplySbox103 and MatrixMul104, different S-boxes and matrices can be applied in parallel as long as they possess the above security characteristics. Permutation105 is an operation that replaces 32 cells.

[0059] Figure 15 shows an example of the hardware configuration of the encryption device 1 according to this embodiment. The encryption device 1 consists of a computer. The encryption device 1 may consist of multiple computers.

[0060] As shown in the figure, the encryption device 1 is a computer equipped with hardware such as a processor 51, memory 52, auxiliary storage device 53, input / output interface (IF) 54, and communication device 55. These hardware components are appropriately connected via signal lines 59.

[0061] The processor 51 is an IC (Integrated Circuit) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 51 include a CPU (Central Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit). The encryption device 1 may have multiple processors that replace the processor 51. The multiple processors share the role of the processor 51.

[0062] Memory 52 is typically a volatile storage device, specifically RAM (Random Access Memory). Memory 52 is also called main memory. Data stored in memory 52 is saved to auxiliary storage device 53 as needed.

[0063] The auxiliary storage device 53 is typically a non-volatile storage device, specifically a ROM (Read Only Memory), HDD (Hard Disk Drive), or flash memory. Data stored in the auxiliary storage device 53 is loaded into the memory 52 as needed. The memory 52 and the auxiliary storage device 53 may be configured as an integrated unit.

[0064] Input / Output IF54 is a port to which input and output devices are connected. A specific example of an input / output IF54 is a USB (Universal Serial Bus) terminal. Specific examples of input devices include a keyboard and mouse. Specific examples of output devices include a display.

[0065] The communication device 55 is a receiver and a transmitter. Specific examples of the communication device 55 include a communication chip or a NIC (Network Interface Card).

[0066] Each part of the encryption device 1 may use the input / output IF 54 and the communication device 55 as appropriate when communicating with other devices.

[0067] The auxiliary storage device 53 stores the encryption program. The encryption program is a program that enables the computer to implement the functions of each part of the encryption device 1. The encryption program is loaded into memory 52 and executed by the processor 51.

[0068] Data used when executing the encryption program, and data obtained by executing the encryption program, are appropriately stored in the storage device. Each part of the encryption device 1 makes appropriate use of the storage device. The storage device consists of, as a specific example, memory 52, auxiliary storage device 53, registers in the processor 51, and at least one of the cache memory in the processor 51. Note that the terms data and information may have the same meaning. The storage device may be independent of the computer. The functions of memory 52 and auxiliary storage device 53 may be implemented by other storage devices.

[0069] Any program described herein may be recorded on a computer-readable non-volatile recording medium. Specific examples of non-volatile recording media include optical discs or flash memory. Any program described herein may be provided as a program product. The hardware configuration of the decryption device 2 may be the same as that of the encryption device 1. The auxiliary storage device of the computer implementing the decryption device 2 may store the decryption program. The decryption program is a program that causes the computer to implement the functions of each part of the decryption device 2.

[0070] ***Explanation of Operation*** The operating procedure of encryption device 1 corresponds to the encryption method. The program that implements the operation of encryption device 1 corresponds to the encryption program. The operating procedure of decryption device 2 corresponds to the decryption method. The program that implements the operation of decryption device 2 corresponds to the decryption program.

[0071] Figure 16 is a flowchart illustrating an example of the basic operation of the encryption device 1. This operation will be explained using Figure 16.

[0072] (Step S101) If the length of the input related data AD and the length of the input plaintext M are not both multiples of (number of plaintext blocks input in one round of the round function × block size), the padding processing unit 110 performs padding by adding an arbitrary bit sequence to the end of the related data AD and the plaintext M so that they become the bit lengths specified above.

[0073] (Step S102) The initialization unit 120 initializes the value of each block with the nonce N and the secret key K, and then updates the value of each block by applying the round function 101 multiple times.

[0074] (Step S103) The related data processing unit 130 inputs the related data AD, which has been padded, by applying the round function 101 multiple times.

[0075] (Step S104) The encryption unit 140 receives the padded plaintext M by applying the round function 101 multiple times. At this time, a ciphertext C with the same length as the length of the input plaintext M is output when the round function is applied.

[0076] (Step S105) The finalization unit 150 updates the value of each block by applying the round function 101 multiple times. Then, the finalization unit 150 generates an authentication tag T from the value of each state.

[0077] The encryption process is shown in Figure 17, and the decryption process is shown in Figure 18. The authentication encryption method proposed in this embodiment can provide two modes: an encryption mode without authentication functionality and an authentication encryption mode with authentication functionality. The only difference between the two modes is whether or not an authentication tag T is generated and the ciphertext is authenticated. Therefore, in the encryption mode that does not generate an authentication tag T, the finalization unit 150 in the encryption processing unit 11 is omitted, and the finalization unit 240 and the authentication tag verification unit 260 in the decryption processing unit 21 are omitted. In addition, the ciphertext C and related data AD, which have been padded by the padding processing unit 250, are output as is.

[0078] Furthermore, as possible embodiments, in both encryption mode and authentication encryption mode, there are cases where both plaintext M and related data AD are input, and cases where only one of the plaintext M or related data AD is input and processed. In the latter case, processing corresponding to only one of the plaintext M or related data AD is performed. That is, when only plaintext M is input from plaintext M and related data AD, the related data processing unit 130 of the encryption processing unit 11 and the related data processing unit 220 of the decryption processing unit 21 are omitted. Also, when only related data AD is input from plaintext M and related data AD, the encryption unit 140 of the encryption processing unit 11 and the decryption unit 230 of the decryption processing unit 21 are omitted. Note that in encryption mode, the case where only related data AD is input from plaintext M and related data AD is not envisioned.

[0079] Examples of constants used in the initialization unit 120 (210) and the finalization unit 150 (240) include the case shown in [Equation 14].

[0080]

[0081] As an example of the cryptographic function 102, for ApplySbox 103, a 4-bit table lookup as shown in Figure 19 can be considered. For MatrixMul 104, the parallel application of matrices as shown in [Equation 15] can be considered.

[0082]

[0083] For Permutation 105, a 4-bit unit substitution as shown in Figure 20 is possible. The table in Figure 20 shows the nibble Y of the internal state S. ｘ This represents the position of the nibble before and after it moves due to shuffling. Here, the index indicates the position of the nibble.

[0084] ***Explanation of the effects of Embodiment 1*** Conventional methods always used AES as the cryptographic function inside the round function. In contrast, in this embodiment, the cryptographic function inside the round function was redesigned from scratch for low power consumption. Here, power consumption performance was determined based on circuit size and delay.

[0085] In this embodiment, both low power consumption and high throughput are achieved by adopting a Sponge-Duplex type (i.e., an authenticated cryptographic scheme that uses the same round function and has a repeating structure of the round function). In Sponge-Duplex type authenticated cryptography, throughput tends to increase as latency decreases, and power consumption performance can be measured based on the level of latency. Furthermore, in this embodiment, as an additional value, quantum-resistant security is achieved by providing 256 bits of security.

[0086] In this embodiment, when designing a cryptographic function, the optimal combination of an S-box (nonlinear function) and a matrix operation was searched for when constructing the cryptographic function. The candidate S-box for the nonlinear layer is one that possesses optimal cryptographic properties and has the minimum delay. The candidate matrix for the linear layer is a binary matrix that possesses optimal cryptographic properties and has the minimum circuit size and delay. A binary matrix is ​​a matrix in which each element is either 0 or 1.

[0087] As a result of searching for the optimal combination, a cryptographic function was found that is constructed using a linear function consisting of matrix operations with six or more branches. By using a linear function consisting of matrix operations with a larger number of branches compared to conventional methods, the propagation performance, one of the cryptographic security metrics, is improved. As a result, the security that the cryptographic function can guarantee is higher compared to AES used in conventional methods. Consequently, the internal processing of the cryptographic function can be reduced and latency is lowered. As a result, it is possible to achieve both relatively low power consumption and relatively high throughput while maintaining sufficient security.

[0088] Another feature of the cryptographic function discovered through the search is that it involves a 16x16 matrix operation. The 16x16 matrix operation is the smallest matrix operation with a number of branches greater than the 5 branches used in conventional methods. Therefore, this other feature allows for the smallest possible circuit implementation size for the matrix alone, enabling a configuration with reduced power consumption.

[0089] Furthermore, a preferred example is one having a 16x16 arithmetic matrix with 8 branches. When the number of branches is 8, the implementation circuit size and delay performance per branch are minimized compared to binary matrices of other sizes. Therefore, according to this preferred example, the gains in terms of power consumption and throughput can be maximized while maintaining sufficient safety. Also, from a safety standpoint, based on the above, it was confirmed that the round function only needs to have 128 bits or more of security against internal collisions.

[0090] Furthermore, in terms of substitutability with AES, when considering a cryptographic function that uses a 256-bit secret key and a 128-bit nonce (initialization vector) and has 128 bits for input and output, it was confirmed that the round function according to this embodiment satisfies the security and low power consumption described below if it is configured to consist of nine 128-bit blocks. Note that the number of blocks being nine is a preferred example, and the number of blocks is not necessarily limited to nine.

[0091] A feature of this embodiment, not found in the prior art, is that a cryptographic function is applied to the values ​​of all 128-bit blocks of the round function, and then an exclusive OR operation is applied. Another feature of this embodiment, not found in the prior art, is that when the number of blocks in the round function is m, the value of the nth block in the round function is input to the {(n+1) mod m}th cryptographic function, and the value of one or more blocks from the m blocks in the round function is input to an exclusive OR operation other than the {(n+1) mod m}th.

[0092] According to this embodiment, by adopting the above configuration, it is possible to design a cryptographic substitution that has the same level of security as AES, which was used as a cryptographic substitution inside the round function in conventional methods, while also being low-circuit-scale and low-latency. Therefore, according to this embodiment, it is possible to realize authenticated cryptography that maintains security, consumes relatively little power, and has relatively high throughput.

[0093] The security of this embodiment is described below. Here, we describe the security against forgery attacks, which are the most effective attack method against Sponge-Duplex type authentication encryption. Forgery attacks are attacks in which an attacker who does not have the information of the secret key generates an authentication tag identical to the authentication tag generated from arbitrary plaintext (which may also be ciphertext) or related data, but from plaintext (ciphertext) or related data different from the one used during encryption. In Sponge-Duplex type authentication encryption, particular attention must be paid to the security against forgery attacks using internal collisions. An internal collision is an attack method that takes advantage of the characteristic that when two pairs of different ciphertexts are decrypted with the same secret key, nonce, and related data, if the internal states corresponding to each ciphertext output from the decryption unit 230 are the same, then the states in the finalization unit 240 thereafter will also all be the same, and the same tag will be generated. Therefore, the attacker aims to find pairs of plaintexts in which the internal states output from the decryption unit 230 will be the same with a relatively high probability. Here, for a ciphertext pair (C, C'), the difference value of the ciphertext pair is defined as shown in [Equation 16].

[0094]

[0095] Furthermore, the combined value of each block after the decryption unit 230 is applied is represented as [Number 17]. In this case, the attacker's objective is equivalent to finding the difference between ciphertext pairs that result in [Number 18] with a relatively high probability.

[0096]

[0097] Here, the nonce, the secret key, and the associated data are identical within the ciphertext pair. Therefore, the difference value of each block input to the decryption unit 230 is 0. Also, as described above, a specific difference value Δ is assigned to a certain function Func(). ｉｎ When given a specific difference value Δ ｏｕｔ The probability of an event occurring is called the difference probability DP. DP is given as shown in [Equation 19].

[0098]

[0099] In this embodiment, the authentication tag is 128 bits. Therefore, the probability that the authentication tags generated from randomly selected ciphertext pairs coincidentally is 2. －１２８ This probability represents the security boundary against forgery attacks, which can be theoretically guaranteed. Therefore, the attacker's goal is to generate ciphertext pairs in which the authentication tags match with a probability higher than this probability. Consequently, if it can be guaranteed that [number 20] is satisfied for any ciphertext pair, the probability that the authentication tags always match for any ciphertext pair will be lower than the probability that the authentication tags match by chance. Therefore, in this case, it can be said that it is secure against forgery attacks.

[0100]

[0101] It is practically impossible to evaluate the difference probability for all ciphertext pairs. Therefore, we focus only on the nonlinear function that generates the difference probability and perform the evaluation using the difference characteristic probability DCP, which is an approximation of the difference probability, and the difference value truncated to the size of the S-box, obtained by multiplying the difference probability of the S-box into a value obtained by the difference input. However, this embodiment employs a 4-bit S-box, which is smaller than the size of existing technologies. Therefore, there is a problem that the computational cost required for security evaluation is enormous, even when using truncated differences.

[0102] The authentication encryption according to this embodiment is configured to avoid the above-mentioned problems. Therefore, this embodiment provides a configuration that can prove security against forgery attacks. Specifically, security against forgery attacks is proven by first evaluating the maximum difference probability of the cryptographic function 102, and then deriving an upper bound on the difference characteristic probability of the entire cryptographic processing unit based on the evaluation result. Of the ApplySbox 103, MatrixMul 104, and Permutation 105 used in the cryptographic function 102, MatrixMul 104 and Permutation 105 are linear functions, so the difference value propagates with probability 1 and the difference probability does not decrease. For ApplySbox 103, when a pair of non-equal values ​​is input, the difference probability decreases because it propagates probabilistically.

[0103] Here, the maximum difference probability of S-box for any input difference value is 2 －２ Therefore, each time the number of S-boxes into which the difference is input (referred to here as the active S-box) increases by one, the maximum difference characteristic probability of the cryptographic function 102 increases by 2. －２ It decreases. Also, since MatrixMul104 has 8 branches, unless no difference values ​​are input to the input, at least 8 elements of the 16 input elements and 16 output elements will have difference values. Here, an arbitrary m x n matrix M ｍｎThe number of branches is defined by the minimum total number of input / output elements that have non-zero difference values, which can be guaranteed when a non-zero difference value is input. Therefore, there are always 8 or more active S-boxes in the ApplySbox 103 before and after MatrixMul 104. Thus, when a difference value is input to the cryptographic function 102, the cryptographic function 102 has at least 2 －１６ (2 －２×８ ) can guarantee the difference probability.

[0104] In this embodiment, security against forgery attacks can be evaluated by counting the cryptographic functions 102 (referred to here as active cryptographic functions) to which non-zero difference values ​​are input. Therefore, according to this embodiment, security evaluation can be performed relatively quickly because a state-based (128-bit) security evaluation can be applied instead of the cell-based security evaluation performed in conventional methods. Security evaluation against forgery attacks can be performed by deriving a lower bound on the total number of cryptographic functions 102 (referred to here as active cryptographic functions) to which differences are input in the decryption unit 230. Specifically, for each active cryptographic function, 2 －１６ The difference probability can be guaranteed. Therefore, if we can guarantee eight or more active cryptographic functions, then 2 －１２８ (2 －１６×８ This can guarantee that the data is secure and also guarantee security against forgery attacks. In this embodiment, the round function 101 used can always guarantee eight or more active cryptographic functions for any difference between ciphertext pairs. Therefore, the configuration according to this embodiment is secure against forgery attacks.

[0105] ***Other Configurations*** <Modification 1> Figure 21 shows an example of the hardware configuration of the encryption device 1 according to this modification. The encryption device 1 includes a processor 51, a processor 51 and memory 52, a processor 51 and auxiliary storage device 53, or a processor 51, memory 52 and auxiliary storage device 53, with a processing circuit 58 instead. The processing circuit 58 is hardware that realizes at least a part of each part of the encryption device 1. The processing circuit 58 may be dedicated hardware, or it may be a processor that executes a program stored in memory 52.

[0106] If the processing circuit 58 is dedicated hardware, specific examples of the processing circuit 58 include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The encryption device 1 may also include multiple processing circuits that substitute for the processing circuit 58. The multiple processing circuits share the role of the processing circuit 58.

[0107] In the encryption device 1, some functions may be implemented by dedicated hardware, while the remaining functions may be implemented by software or firmware.

[0108] The processing circuit 58 can be implemented, in specific examples, by hardware, software, firmware, or a combination thereof. The processor 51, memory 52, auxiliary storage device 53, and processing circuit 58 are collectively referred to as the "processing circuitry." In other words, the functions of each functional component of the encryption device 1 are implemented by the processing circuitry. The hardware configuration of the decryption device 2 may also be the same as this modified example.

[0109] ***Other Embodiments*** Although Embodiment 1 has been described, multiple parts of this embodiment may be combined and implemented. Alternatively, this embodiment may be implemented partially. Furthermore, this embodiment may be modified in various ways as needed, and may be implemented as a whole or in any combination. Note that the embodiments described above are essentially preferred examples and are not intended to limit this disclosure, its applications, or the scope of use. Procedures described using flowcharts, etc., may be modified as appropriate.

[0110] 1 Encryption device, 10 Control unit, 11 Encryption processing unit, 12 Storage unit, 101 Round function, 102 Cryptographic function, 103 ApplySbox, 104 MatrixMul, 105 Permutation, 110 Padding processing unit, 120 Initialization unit, 130 Related data processing unit, 140 Encryption unit, 141 Ciphertext generation unit, 150 Finalization unit, 2 Decryption device, 20 Control unit, 21 Decryption processing unit, 22 Storage unit, 210 Initialization unit, 220 Related data processing unit, 230 Decryption unit, 231 Plaintext generation unit, 240 Finalization unit, 250 Padding processing unit, 260 Authentication tag verification unit, 51 Processor, 52 Memory, 53 Auxiliary storage device, 54 Input / Output IF, 55 Communication device, 58 Processing circuit, 59 Signal line, 90 Cryptographic system, AD-related data, C ciphertext, K private key, M plaintext, N nonce, S internal state, T authentication tag.

Claims

1. An encryption device comprising: an initialization unit that initializes the internal state of a round function, which comprises a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using a secret key of a symmetric key encryption; an association data processing unit that applies the round function multiple times to the internal state of the round function and association data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; an encryption unit that generates the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext, and after the generation of the ciphertext, applies the round function multiple times to the internal state of the round function and the plaintext; and a finalization unit that applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function, wherein the encryption unit applies the cryptographic function once or more to each plaintext block of a plurality of plaintext blocks generated by dividing the plaintext when generating the ciphertext.

2. The cryptographic device according to claim 1, wherein the cryptographic function has a 16x16 matrix operation.

3. The cryptographic device according to claim 1 or 2, wherein the cryptographic function has a matrix operation with 8 branches.

4. The encryption device according to any one of claims 1 to 3, wherein the rounding function has 128 bits or more of security against internal collisions with respect to pairs of different ciphertexts.

5. The cryptographic device according to any one of claims 1 to 4, wherein the round function has 128 bits or more of security against key recovery attacks relating to the private key.

6. The cryptographic device according to any one of claims 1 to 5, wherein the round function is composed of nine 128-bit blocks.

7. The cryptographic device according to claim 6, wherein in the round function, the cryptographic function is applied to the value of each 128-bit block of the round function, and the value of each 128-bit block to which the cryptographic function is applied is input to the exclusive OR of the value of another 128-bit block of the round function or the input to the round function.

8. The cryptographic device according to any one of claims 1 to 5, wherein, when the number of blocks in the round function is m (where m is an integer of 2 or more), the value of the nth block (where n is an integer of 1 or more and less than or equal to m) in the round function is input to the {(n+1) mod m}th cryptographic function, and the value of the nth block, which is each block of one or more blocks in the round function, is input to an exclusive OR other than the {(n+1) mod m}th.

9. The cryptographic device according to claim 7 or 8, wherein each of the cryptographic function and the exclusive OR is implemented in a circuit.

10. The encryption device according to any one of claims 1 to 5, wherein the nonlinear function is configured by a nonlinear layer that applies m / n S-boxes in parallel when a matrix operation is applied in which the processing unit is m bits (where m is an integer between 32 and 512) and the size of each element is n bits (where n is an integer between 3 and 8).

11. The cryptographic device according to any one of claims 1 to 10, wherein the bit length of the input and output of the cryptographic function is 128 bits, and the cryptographic function comprises a 4-bit S-box where the maximum difference probability and the maximum linear probability are each 2^(-2), and a 16x16 matrix operation with 8 branches.

12. The cryptographic device according to any one of claims 1 to 11, wherein the bit length of the secret key is 256 bits, the initialization unit initializes the internal state of the round function using the secret key and a 128-bit nonce corresponding to an initialization vector, and the round function consists of parallel execution of the cryptographic function and an exclusive OR operation.

13. A decryption device comprising: an initialization unit that initializes the internal state of a round function, which comprises a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using a secret key of a symmetric key cryptography; an associated data processing unit that applies the round function multiple times to the internal state of the round function and associated data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; a decryption unit that generates the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext, and after the generation of the ciphertext, decrypts the plaintext using the ciphertext generated by the execution of an encryption process that applies the round function multiple times to the internal state of the round function and the plaintext, the cryptographic function, and the internal state of the round function, and after the decryption of the plaintext, applies the round function multiple times to the internal state of the round function and the plaintext; and a finalization unit that applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function. A decryption device in which, when generating the ciphertext in the encryption process, the cryptographic function is applied once or more to each of the multiple plaintext blocks generated by dividing the plaintext.

14. An encryption system comprising an encryption device according to any one of claims 1 to 12 and a decryption device according to claim 13.

15. An encryption method comprising: an initialization unit of a computer encryption device initializing the internal state of a round function comprising a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using a secret key of a symmetric key encryption; an associated data processing unit of the encryption device applying the round function multiple times to the internal state of the round function and associated data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; an encryption unit of the encryption device generating the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext; applying the round function multiple times to the internal state of the round function and the plaintext after the generation of the ciphertext; and a finalization unit of the encryption device applying the round function five or more times to the internal state of the round function and the secret key, and generating the authentication tag based on the internal state of the round function, wherein the encryption unit applies the cryptographic function once or more to each plaintext block of a plurality of plaintext blocks generated by dividing the plaintext when generating the ciphertext.

16. An encryption program that causes a computer to function as an encryption device, comprising: an initialization process that initializes the internal state of a round function, which comprises a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using a secret key of a symmetric key encryption; related data processing that applies the round function multiple times to the internal state of the round function and related data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; an encryption process that generates the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext, and after the generation of the ciphertext, applies the round function multiple times to the internal state of the round function and the plaintext; and a finalization process that applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function, wherein in the encryption process, when generating the ciphertext, the cryptographic function is applied once or more to each plaintext block of a plurality of plaintext blocks generated by dividing the plaintext.

17. The initialization unit of the decryption device, which is a computer, initializes the internal state of a round function, which comprises a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using the secret key of a symmetric key encryption; the related data processing unit of the decryption device applies the round function multiple times to the internal state of the round function and related data related to the generation of an authentication tag for authenticating the ciphertext generated by encrypting the plaintext; the decryption unit of the decryption device generates the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext; after the generation of the ciphertext, decrypts the plaintext using the ciphertext generated by executing an encryption process that applies the round function multiple times to the internal state of the round function and the plaintext, the cryptographic function, and the internal state of the round function; and after the decryption of the plaintext, applies the round function multiple times to the internal state of the round function and the plaintext. A decryption method in which the finalization unit of the decryption device applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function, wherein in the encryption process, when generating the ciphertext, the cryptographic function is applied once or more to each of the plurality of plaintext blocks generated by dividing the plaintext.

18. A decryption program that causes a computer to function as a decryption device, comprising: an initialization process that initializes the internal state of a round function, which comprises a cryptographic function composed of a nonlinear function and a linear function consisting of matrix operations with six or more branches, using a secret key of a symmetric key cryptography; related data processing that applies the round function multiple times to the internal state of the round function and related data related to the generation of an authentication tag for authenticating a ciphertext generated by encrypting plaintext; generating the ciphertext using the cryptographic function, the internal state of the round function, and the plaintext; decrypting the plaintext using the ciphertext generated by executing an encryption process that applies the round function multiple times to the internal state of the round function and the plaintext after the generation of the ciphertext, the cryptographic function, and the internal state of the round function; and a decryption process that applies the round function multiple times to the internal state of the round function and the plaintext after the decryption of the plaintext; and a finalization process that applies the round function five or more times to the internal state of the round function and the secret key, and generates the authentication tag based on the internal state of the round function. A decryption program in which, when generating the ciphertext in the encryption process, the cryptographic function is applied once or more to each of the multiple plaintext blocks generated by dividing the plaintext.

Images