JP2009169287A - Encryption processing device, decryption processing device, and program - Google Patents

Abstract

A method of providing resistance to power difference analysis by incorporating conversion processing that only a designer can know without performing table reconstruction with an encryption key when performing encryption processing by table reference Realize.
In an initial key addition process 101-103 or key addition process 110-112, etc., an extended key and input data generated from an encryption key are input to a key schedule unit, and the expanded key and input data are made to correspond to each other. By using a table that reflects the calculation results, it is possible to perform the addition process between the expanded key and the input data, the injection conversion process of the data after the addition process, etc. by one-time table reference. It is not necessary to reconstruct a table for each key, and it is possible to provide resistance to power difference analysis by incorporating a conversion process that only the designer can know.
[Selection] Figure 1

Description

  The present invention relates to an apparatus for processing a cryptographic algorithm.

When encryption is executed on a system, there is a method of observing a change in power consumption of the system being executed and estimating an encryption key that is secret information used for encryption processing (for example, Non-Patent Document 1).
This method is called power analysis.
For power analysis, it is necessary to implement encryption so that the encryption key cannot be estimated even if analysis is performed.

Several methods have been proposed as countermeasures against such analysis (for example, Patent Documents 1 and 2).
In addition, there is a table network implementation in which a portion that is vulnerable to power analysis is constructed only by table reference (for example, Non-Patent Document 2).
By applying a conversion process that only the designer can know to the table, it is possible to provide resistance to the conventional power difference analysis.
JP 2005-134477 A JP 2002-31826 A P. Kocher, J. et al. Jaffe, B.J. Jun, “Differential Power Analysis”, Advances in Cryptology: Proceedings of CRYPTO'99 Springer-Verlag, pp. 388-397, 1999 S. Chow, P.A. Eisen, H.M. Johnson, P.M. C. Oorschot, “White-Box Cryptography and an AES Implementation”, Advances in Cryptology: Proceedings of SAC 2002 Springer-Verlag, 2002

However, according to Patent Documents 1 and 2, a plurality of scramble processes are prepared in advance, and the scramble process to be applied is switched by a random number or an encryption key in the course of the encryption process.
In this case, redundant resources are required for the prepared scramble circuits. The difficulty of analysis depends only on the type of table to be prepared, and sufficient complexity cannot be obtained for the required resources.

On the other hand, in the table network implementation, a designer can arbitrarily design a table under a certain condition, and the types of tables that can be designed are sufficiently large, so that conventional power analysis can be made difficult.
However, in the conventional table network implementation, since the extended key generation process is also included in the table, it is necessary to prepare different tables for all the extended keys, which consumes a large amount of memory.

  Further, it is necessary to reconstruct the table every time a different secret key is used, and the calculation is very expensive. Furthermore, by attacking the table construction process, there is a risk that the conversion process that can be known only by the secret key or the designer may be analyzed.

  One of the main objects of the present invention is to solve the above-described problems, and does not require reconstruction of a table with a secret key and incorporates a conversion process that only a designer can know. One of the main purposes is to realize a method for providing tolerance to the power difference analysis.

The cryptographic processing apparatus according to the present invention includes:
Enter the extended key generated from the encryption key outside, input the input data,
A key addition processing unit is provided that performs addition processing of the input extended key and input data by referring to a table.

  In the present invention, an expansion key generated from an encryption key is input externally, and a table reflecting a calculation result corresponding to the expansion key is used to perform an addition process of the expansion key and input data, etc. The table can be referred to once, and it is not necessary to reconstruct the table with the encryption key, and it is possible to provide resistance to power difference analysis by incorporating a conversion process that only the designer can know.

Embodiment 1 FIG.
FIG. 1 shows the overall flow of cryptographic processing according to the present embodiment.
FIG. 1 shows an example of a cipher with a SPN (Substitution Permutation Network) structure, but it can be applied to any cipher including a cipher with a Feistel structure by combining the processes described below.

  As an assumption of the encryption process shown in FIG. 1, the expanded keys 123 to 131 are generated from the encryption key in advance by the key schedule process.

Further, m × n-bit plaintext data 122 (hereinafter also simply referred to as plaintext) is decomposed into n bits, and each plaintext and expanded keys 123 to 125 are input to initial key addition processes 101 to 103.
The outputs of the initial key addition processes 101 to 103 are input to the nonlinear conversion processes 104 to 106.
The linear conversion processes 107 to 109 receive the outputs of the plurality of nonlinear conversion processes 104 to 106 and obtain an n-bit output.
The outputs of the linear transformation processes 107 to 109 are input to the key addition processes 110 to 112 and added with the expanded keys 126 to 128.
Thereafter, the nonlinear conversion process, the linear conversion process, and the key addition process are repeated. Outputs of the final key addition processing 116 to 118 are input to final conversion processing 119 to 121, and the concatenation of the outputs becomes ciphertext data 132 (hereinafter also simply referred to as ciphertext).

  FIG. 14 shows functional blocks of the cryptographic processing apparatus 1 that implements the processes shown in FIG.

In FIG. 14, the key schedule unit 11 generates expanded keys 123 to 131 from the encryption key.
In the present embodiment, any method may be used for generating the extended keys 123 to 131 in the key schedule unit 11.
The extended keys 123 to 131 generated by the key schedule unit 11 have an n-bit bit length (the same bit length as that of the divided plaintext).

The cryptographic processing unit 12 performs the cryptographic processing shown in FIG.
That is, the cryptographic processing is performed by each element included in the cryptographic processing unit 12 repeating the processing according to the processing order of FIG.

  The plaintext dividing unit 1210 divides the input m × n-bit plaintext 122 into n bits.

The initial key addition processing unit 1220 performs the initial key addition processing 101 to 103 in FIG.
As shown in FIG. 1, the initial key addition processing unit 1220 receives the expanded keys 123 to 125 generated from the encryption key in the key schedule unit 11 and inputs the divided plaintext as input data. Is divided at a predetermined division position to be two or more divided expanded keys, and the input data (divided plaintext) is divided at the same division position as the expanded key to be two or more divided input data, Addition processing with divided input data (hereinafter, also simply referred to as divided input) and injection conversion processing of data after the addition processing are performed by one table reference.
Details of the initial key addition processing unit 1220 will be described later with reference to FIG.
The initial key addition processing unit 1220 does not include the bijection inverse transformation process, but the input data is plaintext, but the division of the extended key, the division of the input data, the addition process, and the injection The initial key addition processing unit 1220 is an example of the key addition processing unit in common with a key addition processing unit 1250 described later in that the inverse conversion process is performed by referring to the table once.

The nonlinear transformation processing unit 1230 receives data output from the initial key addition processing unit 1220 or a key addition processing unit 1250 described later, and the injective transformation of the initial key addition processing unit 1220 or the key addition processing unit 1250 for the input data. The process inverse transform process, the nonlinear transform process for the data after the inverse transform process, and the bijective transform process for the data after the nonlinear transform process are performed by one table reference.
More specifically, the nonlinear transformation processing unit 1230 divides the expanded key and input data in the initial key addition processing unit 1220 or the key addition processing unit 1250 from the inverse transformation processing, the nonlinear transformation processing, and the data after the nonlinear transformation processing. The process of dividing at the same division position as the position, the bijection transformation process for each divided data, and the process of connecting the data after the bijection inverse transformation process are performed by referring to the table once.
The bijection conversion process performed by the nonlinear conversion processing unit 1230 is a bijection conversion process that is additive to the exclusive OR operation.
Details of the nonlinear conversion processing unit 1230 will be described later with reference to FIG.

The linear transformation processing unit 1240 receives the data output from the nonlinear transformation processing unit 1230, performs linear transformation processing on the input data, and outputs the data after the linear transformation processing to the key addition processing unit 1250.
Details of the linear transformation processing unit 1240 will be described later with reference to FIG.

The key addition processing unit 1250 receives the data output from the linear conversion processing unit 1240, and inputs the expanded keys 126 to 127 and the like.
The input data input from the linear conversion processing unit 1240 is data after the bijection conversion processing is performed by the nonlinear conversion processing unit 1230.
Then, the key addition processing unit 1250 enlarges the input data after the bijection inverse transformation processing for performing the inverse transformation of the bijection transformation processing by the nonlinear transformation processing unit 1230 on the input data and the input data after the bijection inverse transformation processing. The addition process with the key and the injection conversion process of the data after the addition process are performed by referring to the table once.
More specifically, the key addition processing unit 1250 inputs the extended key having the same number of bits and the input data, divides the input extended key at a predetermined division position to obtain two or more divided extended keys, and the input input The data is divided into two or more pieces of divided input data by dividing the data at the same division position as the extended key, and further, a bijection inverse transform process for the divided input data, a divided input data after the bijective inverse transform process, and a divided expanded key And the injection conversion process of the data after the addition process are performed by referring to the table once.
Details of the key addition processing unit 1250 will be described later with reference to FIG.

The final conversion processing unit 1260 receives the data output from the key addition processing unit 1250, performs the inverse conversion processing of the injection conversion processing of the key addition processing unit 1250 on the input data, and the data after the inverse conversion processing Are output as divided ciphertext data (n bits).
Details of the final conversion processing unit 1260 will be described later with reference to FIG.

  The ciphertext concatenation unit 1270 concatenates the n-bit ciphertext data output from the final conversion processing unit 1260 into m × n-bit ciphertext data, and outputs m × n-bit ciphertext data.

FIG. 2 shows the configuration of the initial key addition processing unit 1220.
In FIG. 2, the input 205 and the expanded key 206 are added (key addition).
The content of the addition process is determined by the encryption algorithm. The addition process is, for example, an exclusive OR operation.
Further, the injection conversion process is performed on the output.

First, the initial key addition processing unit 1220 divides the n-bit input 205 and the extended key 206.
The number and size of division may be arbitrarily divided as long as the total is n bits.
However, the paired split input and split extended key must be the same size.
FIG. 2 shows an example in which an n1 bit split input 207 and split extended key 209 are split into an n2 bit split input 208 and split extended key 210.

The divided input 207 and the divided expanded key 209 are input to the table 201, and a table output 211 is obtained.
Similarly, the divided input 208 and the divided expanded key 210 are input to the table 202, and a table output 212 is obtained.
By the addition process 215, the table output 211 and the table output 212 are added to obtain an output 216.

The contents of the table 201 will be described. The contents of the table 202 are the same as the table 201.
With respect to the table 201, the divided input 207 and the divided expanded key 209 are added by the addition process 213, and the output is converted into an n-bit table output 211 by the injection conversion process 203.
The table 201 and the table 202 are calculated in advance corresponding to the divided input and the divided expanded key, and stored in the storage area in association with the initial key addition processing unit 1220.
That is, an output value is calculated in advance for each pattern of the split input and split extended key pair, the calculation result is described in the table 201 and the table 202, and stored in association with the initial key addition processing unit 1220. Store in the area.
For example, when the plaintext data (m × n bits) is 32 bits, when m = 4, n = 8 bits, and when n1 = n2 = 4 bits, a 4-bit divided expanded key And output values for all combinations of 4-bit divided inputs are calculated and described in the table 201 and the table 202.
Note that the injection conversion processing 203 receives n1 bits and outputs a predetermined n-bit output.

With respect to the conditions of the injection conversion processing 203, the injection conversion processing 204, and the addition processing 215, the input of the injection conversion processing 203 is x1, the output is f ₁ (x1), the input of the injection conversion processing 204 is x2, and the output is f ₂ (x2), when the addition process 215 is displayed as “+”, the map f (x) = f ₁ (x1) + f ₂ (x2) of x = x1 || x2 is determined to be a bijective map. To do. However, “||” indicates data connection.

  Examples of the injection conversion process 203, the injection conversion process 204, and the addition process 215 will be described below.

Example 1:
Given an n × n regular matrix Z on GF (2), an n1 × n matrix A and an n2 × n matrix B satisfying Equation 1 are generated. In addition, n-bit fixed values c1 and c2 are also generated.
The injection conversion process 203 obtains the output y by Expression 2, and the injection conversion process 204 obtains the output y by Expression 3.
The addition process 215 is a bitwise exclusive OR.

Example 2:
A bijective transformation E of n1 × n1 and a bijective transformation F of n2 × n2 are given. In addition, an n2 bit constant c3 and an n1 bit constant c4 are provided.
The injection conversion process 203 obtains the output y by Expression 4, and the injection conversion process 204 obtains the output y by Expression 5.
The addition process 215 is a bitwise exclusive OR.

Note that Example 1 and Example 2 may be combined.
For example, the injection conversion process 203 of the table 201 may be performed using Expression 2 of Example 1, and the injection conversion process 204 of the table 202 may be performed using Expression 5 of Example 2.
In addition, the injection conversion process 203 of the table 201 may be performed using Expression 4 of Example 2, and the injection conversion process 204 of the table 202 may be performed using Expression 3 of Example 1.

As described above, the initial key addition processing unit 1220 inputs the extended key generated by the key schedule unit 11 and prepares a table prepared in advance for the combination of the divided extended key and the divided input obtained by dividing the input extended key. Is used to perform addition processing and injective transformation processing.
That is, the extended key generation process is performed by the external key schedule unit 11, and the table referred to by the initial key addition processing unit 1220 does not include the extended key generation process. There is no need to update.

  FIG. 3 shows the configuration of the nonlinear conversion processing unit 1230. FIG. 3 shows cryptographic non-linear conversion processing.

  Input 306 is input to table 301 to obtain output 307.

The contents of the table 301 will be described.
Input data is converted by an inverse conversion process 302.
The inverse conversion process 302 corresponds to the injection conversion process 203 and the injection conversion process 204 of the initial key addition processing unit 1220 (or the injection conversion process 505 and the injection conversion process 506 of the key addition processing unit 1250). 2 to obtain the inverse transformation for the output 216 of 2 (or the output 509 of FIG. 5). The inverse transformation for Examples 1 and 2 is shown below.

Inversion of example 1:
In the inverse transformation process 302, Formula 6 is calculated. However, Z ⁻¹ is an inverse matrix of the matrix Z shown in Equation 1.

Inversion of example 2:
In the inverse conversion process 302, Equation 7 is calculated. However, E ⁻¹ and F ⁻¹ are bijective transformation E and F inverse matrices. “>> n2” indicates left shift of n2 bits, and “· n1” indicates extraction of lower n1 bits of data.

  The output of the inverse transformation process 302 is input to the nonlinear transformation process 303. The non-linear transformation process 303 is determined by a cryptographic algorithm.

The output of the non-linear transformation process 303 is divided into a plurality of parts, and a bijective transformation process is performed on each of them. The bijective transformation processes f ₁ (x ₁ ), f ₂ (x ₂ ),..., F _n (x _n ) are selected so as to satisfy the additivity with respect to the linear transformation processes 107 to 109 in FIG. To do.
Specifically, when the linear transformation process is y = y ₁ ‖y ₂ ‖... ‖Y _n = f _L (x ₁ , x ₂ ,..., X _n ), the expression 8 is satisfied. select.
However, _{y i} shall meet Equation 9. In Equation 9, | y _i | indicates the bit length of y _i .
The data subjected to the bijective transformation process are concatenated and output.
The table 301 is calculated in advance and stored in the storage area in association with the nonlinear transformation processing unit 1230.
That is, an output value is calculated in advance for each pattern of input data, and the calculation result is described in the table 301 and stored in the storage area in association with the nonlinear transformation processing unit 1230.

  An example of the bijection conversion process 304 and the bijection conversion process 305 in the case where the linear conversion processes 107 to 109 are exclusive OR in units of bits is shown below.

Example 1:
An n1 × n1 regular matrix G and an n2 × n2 regular matrix H on GF (2) are generated. In addition, a fixed value c1 of n1 bits and a fixed value c2 of n2 bits are also generated. The bijection conversion process 304 obtains the output y by Expression 10, and the bijection conversion process 305 obtains the output y by Expression 11.

Example 2:
Give elements k, l of Galois extension GF (2 ⁿ¹ ) and elements m, n of GF (2 ⁿ² ). In the bijection conversion process 204, the output y is obtained from Expression 12, and in the bijection conversion process 205, the output y is obtained from Expression 13. However, “·” indicates multiplication on the Galois extension field, and “+” indicates addition on the Galois extension field.

Example 3:
Positive integers p (1 ≦ p <n1) and q (1 ≦ q <n2) are given. In the bijection conversion process 204, the output y is obtained from Expression 14, and in the bijection conversion process 205, the output y is obtained from Expression 15.

Examples 1 to 3 may be combined.
Next, FIG. 4 shows a configuration of the linear conversion processing unit 1240.
The content of the linear transformation process 401 is determined by an encryption algorithm. A plurality of n-bit inputs 402-404 are obtained and an n-bit output 405 is generated.
The linear transformation process 401 is, for example, an exclusive OR operation.

FIG. 5 shows the configuration of the key addition processing unit 1250.
In FIG. 5, the input 507 and the expanded key 508 are added (key addition). The content of the addition process is determined by the encryption algorithm. The addition process is, for example, an exclusive OR operation process.
Further, the injection conversion process is performed on the output.

First, the n-bit input 507 and the expanded key 508 are divided into a divided input 509, a divided input 510, a divided expanded key 511, and a divided expanded key 512, respectively.
The division method is the same as the division method in FIG.

A divided input 509 and a divided expanded key 511 are input to the table 501 to obtain a table output 513.
Similarly, a divided input 510 and a divided expanded key 512 are input to the table 502, and a table output 514 is obtained.
The addition process 517 adds the table output 513 and the table output 514 to obtain an output 509.

The contents of the table 501 will be described. The contents of the table 502 are the same as the table 501.
With respect to the table 501, the division input 509 is input to the bijective inverse transformation process 503. The bijective inverse transformation process 503 is an inverse transformation process of the bijective transformation process 304 of FIG.
The output of the bijective inverse transformation process 503 and the divided expanded key 511 are added by the addition process 515, and the output becomes an n-bit table output 513 by the bijection transformation process 505.
The injection conversion process 505 is equivalent to the injection conversion process 203 of FIG.
The table 501 and the table 502 are calculated in advance in association with the divided input and the divided expanded key, and are stored in the storage area in association with the key addition processing unit 1250.
That is, the output value is calculated in advance for each pattern of the split input and split extended key pair, the calculation result is described in the table 501 and the table 502, and the storage area is associated with the key addition processing unit 1250. To store.

As described above, the key addition processing unit 1250 inputs the extended key generated by the key schedule unit 11 and prepares a table prepared in advance for the combination of the divided extended key obtained by dividing the input extended key and the divided input. Using this, bijective inverse transformation processing, addition processing, and bijection transformation processing are performed.
That is, the extended key generation process is performed by the external key schedule unit 11, and the table referred to by the key addition processing unit 1250 does not include the extended key generation process, so the table is updated corresponding to the encryption key. There is no need to do.

  FIG. 6 shows the configuration of the final conversion process. This process is performed immediately before the ciphertext is output.

Input 603 is input to table 601 to obtain output 604.
The inverse transformation process 602 is the same as the inverse transformation process 302 in FIG.
The table 601 is calculated in advance and stored in association with the final conversion processing unit 1260.

The decryption process can also be performed in the same manner as the encryption process. However, the expanded keys 123 to 131 (FIG. 1), the addition processes 213 and 214 (FIG. 2), the nonlinear conversion process 303 (FIG. 3), the linear conversion process 401 (FIG. 4), and the addition processes 515 and 516 (FIG. 5) Complies with the decryption algorithm. At the time of decryption, the input is ciphertext in FIG. 1, and plaintext is output.
That is, the decryption processing device corresponding to the encryption processing device according to the present embodiment can be configured by the procedure described in the present embodiment and the configuration shown in FIGS. 1 to 6 and 14. In the decryption processing apparatus, the input is ciphertext and the output is plaintext. Further, the decryption key used for generating the expanded key is the same as the encryption key.

Here, an example of the effect according to the present embodiment will be described.
The injection conversion process and the bijection conversion process in FIGS. 2, 3, 5, and 6 can be arbitrarily selected by the designer within a range that satisfies a predetermined condition.
Therefore, even if the attacker knows the cryptographic algorithm, the output of each component cannot be predicted. Thereby, tolerance can be given to the conventional power difference analysis.

Further, unlike the prior art, it is not necessary to recalculate the table with the encryption key, so that the calculation cost can be reduced.
Furthermore, the table size can be reduced by dividing the input in the key adding unit.

  As described above, according to the cryptographic processing apparatus according to the present embodiment, the extended key generated from the cryptographic key is input externally, and the table reflecting the calculation result corresponding to the extended key is used. Addition of extended key and input data, etc. can be performed with a single table reference, and it is not necessary to reconstruct the table with the encryption key. It can be made resistant to analysis.

Embodiment 2. FIG.
In the first embodiment, the key addition is performed by referring to the table by connecting the divided input and the divided extended key, but in this embodiment, the table reference is performed without connecting the divided input and the divided extended key. Show.

FIG. 7 shows an embodiment in the table 201 in FIG.
The same can be applied to the table 202.
The table 701 is an equivalent table to the table 201.
Specifically, in the table 701, a table is created by concatenating the divided expanded key 209 with the upper bits and the divided input 207 with the lower bits.
That is, the table 701 used by the initial key addition processing unit 1220 according to the present embodiment is a table that includes a plurality of table addresses, and shows calculation results after addition processing and injection conversion processing for each table address. .
Note that the injection conversion process 702 is the same as the injection conversion process 203 of FIG.
The addition process 708 is the same as the addition process 213 in FIG.

An address calculation process 703 calculates a reference table address 707 (upper bits of the table address) with the divided expanded key 705 as an input. Specifically, the divided expanded key 705 is shifted left by n1 bits, the result is added to the head address of the table 701, and the result is used as a reference table address 707.
The address calculation process 703 may be calculated at the key schedule stage.

Further, the division input 704 is set to the lower bits of the table address, and the table value of the corresponding table address is referred to based on the reference table address 707 to obtain the table output 706.
Specifically, the reference table address 707 and the divided input 704 are concatenated, and the table value of the resulting address is referenced.

  As described above, in the present embodiment, the initial key addition processing unit 1220 converts the divided extended key using a part of the table, and indicates any table address from the divided extended key and the divided input data after conversion. A value is calculated, the calculation result indicated by the table address that matches the calculated value is obtained from the table, and the addition process of the divided extended key and the divided input data and the injection conversion process of the data after the addition process are 1 This is done by referring to the table once.

FIG. 8 shows an embodiment in the table 501 in FIG.
The same applies to the table 502.
The table 801 is an equivalent table to the table 501.
Specifically, in the table 801, a table is created by concatenating the divided expanded key 511 with the upper bits and the divided input 509 with the lower bits.
That is, the table 801 used by the key addition processing unit 1250 according to the present embodiment includes a plurality of table addresses, and the calculation after the bijection inverse transformation process, the addition process, and the injection transformation process is performed on each table address. It is a table which shows a result.
The bijective inverse transformation process 802 is the same as the bijective inverse transformation process 503 in FIG.
Also, the injection conversion process 803 is the same as the injection conversion process 505 of FIG.
The addition process 809 is the same as the addition process 515 in FIG.

The address calculation process 804 receives the divided expanded key 805 and calculates a reference table address 807 (upper bits of the table address).
Specifically, the divided expanded key 805 is shifted n1 bits to the left, the result is added to the top address of the table 801, and the result is used as the reference table address 807.
The address calculation process 804 may be calculated at the key schedule stage.

Further, the division input 806 is used as the lower bits of the table address, and the table value of the corresponding table address is referenced based on the reference table address 807 to obtain a table output 808.
Specifically, the reference table address 807 and the divided input 806 are concatenated, and the table value of the resulting address is referenced.

  As described above, in this embodiment, the key addition processing unit 1250 converts the divided extended key using a part of the table, and indicates a table address from the converted divided extended key and the divided input data. The calculation result shown in the table address that matches the calculated value is obtained from the table, and the bijection inverse transformation process for the divided input data of the input data after the bijection transformation process and the bijection The addition process of the divided input data after the inverse conversion process and the divided extended key and the injection conversion process of the data after the addition process are performed by one table reference.

The key addition processing unit at the time of decryption can be performed in the same manner as the key addition processing unit 1250 at the time of encryption. However, the divided expanded key 805 and the addition process 809 (FIG. 8) conform to the decryption algorithm.
That is, the decryption processing device corresponding to the cryptographic processing device according to the present embodiment can be configured by the procedure described in the present embodiment and the configuration shown in FIGS. 7, 8, and 14. In the decryption processing apparatus, the input is ciphertext and the output is plaintext. Further, the decryption key used for generating the expanded key is the same as the encryption key.

Here, an example of the effect according to the present embodiment will be described.
In the present embodiment, not only the effects shown in the first embodiment can be obtained, but also the calculation depending on the encryption key can be incorporated into the key schedule unit.
In addition, since the encryption key body is not used in the encryption operation process, more secure encryption operation can be performed.

Embodiment 3 FIG.
In Embodiments 1 and 2, four types (table 201, table 202, table 501, and table 502) are prepared for key addition processing, but in this embodiment, a method of using three types of tables is shown.

FIG. 9 shows the overall flow of the cryptographic processing according to the present embodiment.
FIG. 9 shows an example of the SPN structure cipher, but the present invention can be applied to any cipher including the Feistel structure cipher by combining the processes described below.
9 is different from FIG. 1 in that the initial key addition processes 101 to 103 in FIG. 1 are the initial conversion processes 933 to 935.
Other processes are the same as those shown in FIG.

  In FIG. 9, the expanded keys 923 to 931 are generated from the encryption key by key schedule processing in advance.

The m × n-bit plaintext 122 is decomposed into n bits, and each plaintext is input to the initial conversion processes 933 to 935.
The output and the expanded keys 923 to 925 are input to the key addition processing 901 to 903.
Outputs of the key addition processes 901 to 903 are input to the nonlinear conversion processes 904 to 906.
Linear conversion processing 907 to 909 obtains an n-bit output by using outputs of the plurality of nonlinear conversion processing 904 to 906 as inputs.
The outputs of the linear transformation processes 907 to 909 are input to the key addition processes 910 to 912 and added with the expanded keys 926 to 928. Thereafter, the nonlinear conversion process, the linear conversion process, and the key addition process are repeated.
The output of the final key addition processing 916 to 918 is input to the final conversion processing 919 to 921, and the output concatenated becomes the ciphertext 932.

FIG. 15 shows a configuration example of the cryptographic processing apparatus 1 according to the present embodiment.
The initial conversion processing unit 1280 performs initial conversion processing 933 to 935 shown in FIG.
Details of the processing of the initial conversion processing unit 1280 will be described later, but the initial conversion processing unit 1280 inputs plaintext data, divides the input plaintext data, bijection conversion processing for each divided data, The process of connecting the data after the bijection conversion process is performed by referring to the table once.
The bijection conversion process performed by the initial conversion processing unit 1280 is a bijection conversion process that is additive to the exclusive OR operation.
15 is the same as the configuration shown in FIG. 14 except that an initial conversion processing unit 1280 is arranged instead of the initial key addition processing unit 1220.

FIG. 10 shows a configuration example of the initial conversion processing unit 1280.
The initial conversion processing unit 1280 in FIG. 10 converts plaintext as an initial process of encryption.

  The input 1004 is converted into an output 1009 by the table 1001.

The contents of the table 1001 will be described.
The input 1004 is divided into an n1 bit divided input 1005 and an n2 bit divided input 1006.
The division method is the same as the key addition process.
The bijection conversion processing 1002 outputs a table output 1007 from the divided input 1005. The bijection conversion processing 1003 outputs a table output 1008 from the divided input 1006. The table output 1007 and the table output 1008 are connected to become an output 1009.

  The key addition process, nonlinear conversion process, linear conversion process, and final conversion process are the same as those in the first embodiment.

The decryption process can also be performed in the same manner as the encryption process. However, the expanded keys 923 to 931 (FIG. 9), the non-linear conversion process 303 (FIG. 3), the linear conversion process 401 (FIG. 4) and the addition processes 515 and 516 (FIG. 5) conform to the decryption algorithm. At the time of decryption, in FIG. 9, the input is ciphertext and plaintext is output.
That is, the decryption processing device corresponding to the encryption processing device according to the present embodiment can be configured by the procedure described in the present embodiment and the configuration illustrated in FIGS. 9, 10, and 15. In the decryption processing apparatus, the input is ciphertext and the output is plaintext. Further, the decryption key used for generating the expanded key is the same as the encryption key.

Here, an example of the effect according to the present embodiment will be described.
By performing the initial conversion process of FIG. 10, not only the effects shown in the first embodiment can be obtained, but in the first embodiment, a total of four tables are required for the initial key addition process and the key addition process. In this embodiment, the initial conversion process and the key addition process can be implemented with a total of three tables.
Therefore, one table can be reduced in total, and the memory usage can be reduced.

Embodiment 4 FIG.
In the first to third embodiments, no conversion processing is performed on the expanded key after the schedule, but in this embodiment, a method of converting the expanded key at the time of key scheduling is shown.
This embodiment is used in combination with the first to third embodiments.

FIG. 11 shows the key schedule unit 11 in the present embodiment.
The key schedule process 1101 generates expanded keys 1109 to 1111 from the encryption key 1108.
The key schedule processing 1101 conforms to the encryption algorithm to be implemented.
Each expanded key 1109 to 1111 is divided and converted by bijective conversion processing 1102 to 1107 for each. The converted expanded keys are combined to become converted expanded keys 1112 to 1114.

  As described above, the key schedule unit 11 according to the present embodiment performs a bijection conversion process on the extended key obtained from the encryption key, and outputs the expanded key after the bijection conversion process as a conversion extended key. .

  In FIG. 11, the key schedule process and the bijection conversion process are described separately, but the bijection conversion process may be incorporated in the key schedule process so as to have the same effect.

FIG. 12 shows an initial key addition processing unit 1220 in the present embodiment.
FIG. 12 is the same as FIG. 2 except that bijective inverse transformation processes 1216 and 1217 are added.
The bijection inverse transformation processes 1216 and 1217 are inverse transformations with respect to the bijection transformation process when the conversion expansion key 1206 is generated in the key schedule unit 11 of the present embodiment.

In other words, in the present embodiment, the initial key addition processing unit 1220 receives the converted expanded key 1206 from the key schedule unit 11 and also inputs plaintext as input data 1205.
Also, the conversion expansion key 1206 is divided at a predetermined division position to obtain two or more division expansion keys, and the input data 1205 is divided at the same division position as the conversion expansion key to obtain two or more division input data.
Then, the bijection inverse transformation processes 1216 and 1217 for performing the inverse transformation of the bijection transformation process by the key schedule unit 11 on the divided augmentation key, and the divided transformation expansion key and the divided input data after the bijection inverse transformation process Addition processing 1213 and 1214 and injection conversion processing 1203 and 1204 are performed by referring to the table once.

FIG. 13 shows a key addition processing unit 1250 in the present embodiment.
FIG. 13 is the same as FIG. 5 except that bijective inverse transformation processes 1318 and 1319 are added.
The bijection inverse transformation processes 1318 and 1319 are inverse transformations with respect to the bijection transformation process when the transformation expansion key 1308 is generated in the key schedule unit 11 of the present embodiment.

In other words, in the present embodiment, the key addition processing unit 1250 receives the converted expanded key 1308 from the key schedule unit 11 and also receives the input data 1307.
Further, the conversion expansion key 1308 is divided at a predetermined division position to obtain two or more division expansion keys, and the input data 1307 is divided at the same division position as the conversion expansion key to obtain two or more division input data.
Then, the bijection inverse transformation processes 1318 and 1319 (first bijection inverse transformation process) for performing the inverse transformation of the bijection transformation process by the key schedule unit 11 on the divided expanded key, and the divided input data A bijection inverse transformation process 1303, 1304 (second bijection inverse transformation process) for performing an inverse transformation of the bijection transformation process by the nonlinear transformation processing unit 1230, and a bijective inverse transformation process 1318, 1319. The addition process of the divided extended key and the divided input data after the bijective inverse transformation processes 1303 and 1304 and the bijection transformation process of the data after the addition process are performed by one table reference.

The initial key addition processing unit and the key addition processing unit during the decryption process can be performed in the same manner as the initial key addition processing unit 1220 and the key addition processing unit 1250 during the encryption process. However, the conversion expansion key 1206 (FIG. 12), the conversion expansion key 1308 (FIG. 13), the addition processes 1213 and 1214 (FIG. 12), and the addition processes 1315 and 1316 (FIG. 13) conform to the decryption algorithm.
That is, the decryption processing device corresponding to the cryptographic processing device according to the present embodiment can be configured by the procedure described in the present embodiment and the configuration shown in FIGS. In the decryption processing apparatus, the input is ciphertext and the output is plaintext. Further, the decryption key used for generating the expanded key is the same as the encryption key.

Here, an example of the effect according to the present embodiment will be described.
In addition to the effects shown in the first to third embodiments, it is possible to make the extended key impossible to estimate.
Therefore, even if the attacker knows the encryption algorithm, the value of the expanded key cannot be predicted. Thereby, it is possible to provide resistance to the conventional power difference analysis even for the key schedule processing.

  Next, main features of the cryptographic processing apparatus and the cryptographic processing method described in the first to fourth embodiments will be described.

  Embodiments 1 to 4 are an encryption processing apparatus and encryption processing method for executing encryption by software, and an input and an encryption key when an addition process (key addition process) between an input and an encryption key is realized by referring to a table. Encryption processing apparatus and encryption processing method that each add a divided input and encryption key to each other, realize an addition process by table reference, and add a table output for each divided input and encryption key Explained.

In the first to fourth embodiments, the encryption processing apparatus and the encryption processing method that perform the following processing by referring to the table once for the table in the key addition processing have been described.
A) The input and the encryption key are added according to the original encryption specification.
B) The output of A) is subjected to injection conversion.

  In the first to fourth embodiments, a reference address is calculated from the divided encryption key (decryption key) and the table body, and a table output is obtained from the reference address and the divided input. The processing device and the encryption processing method (decryption processing device and decryption processing method) have been described.

In the first to fourth embodiments, an encryption processing device and an encryption processing method (decryption processing device and decryption processing method) that perform the following processing by referring to a table once in the nonlinear conversion processing executed after the addition processing will be described. did.
C) An inverse transformation process is performed on the injection transformation executed in the key addition process.
D) Non-linear processing is performed on the output of C) according to the original encryption specifications.
E) The output of D) is divided, and bijective transformation is performed on each of the divided outputs.

  In the first to fourth embodiments, in the bijection conversion in the non-linear transformation process, the cryptographic processing apparatus and the cryptographic processing method (decryption processing apparatus and the like) using the bijective transformation that is additive to the exclusive OR operation are used. Decoding method has been described.

  In the first to fourth embodiments, in the key addition process executed after the non-linear transformation, the division is performed in the same manner as in the above E), and the divided input and the encryption key (decryption key) are used as inputs and added by referring to the table. The encryption processing device and the encryption processing method (decryption processing device and decryption processing method) for realizing the processing and adding the table output for each divided input and encryption key (decryption key) have been described.

In Embodiments 1 to 4, after the input in the key addition process is divided in the same manner as in E), the following processing is performed by referring to the table once, and the encryption processing method (decryption) Processing apparatus and decoding processing method) have been described.
F) For each divided input, the inverse transformation of the bijection transformation performed in E) is performed.
G) The output of F) and the encryption key (decryption key) are added according to the original encryption specifications.
H) Injectively transform the output of G).

  In the first to fourth embodiments, an encryption processing device that calculates an address from the divided encryption key (decryption key) and the table body and obtains a table output from the address and the divided input; The encryption processing method (decryption processing device and decryption processing method) has been described.

  In the first to fourth embodiments, the encryption processing device and the encryption processing method (decryption processing device and decryption processing method) that perform the inverse transformation shown in C) at the end of encryption and output the result as ciphertext have been described .

In Embodiments 1 to 4, an encryption processing apparatus and an encryption processing method (decryption processing apparatus and decryption processing method) that perform the following processing with one table reference at the start of encryption (decryption) and then perform key addition processing ) Explained.
I) The input is divided, and the bijective transformation performed in E) is performed on each of the divided inputs.
J) Concatenate the outputs of I) above.

In the first to fourth embodiments, a cryptographic processing device and a cryptographic processing method (decryption processing device and decryption processing method) that perform bijective transformation at the key schedule stage and perform the following processing at the key addition stage will be described. did.
K) An inverse transformation is performed on the bijection transformation performed in the key schedule for the encryption key (decryption key).
L) The input and the output of K) are added according to the original encryption specifications.
M) The output of the above L) is injectively transformed.

In the first to fourth embodiments, a cryptographic processing device and a cryptographic processing method (decryption processing device and decryption processing method) that perform bijective transformation at the key schedule stage and perform the following processing at the key addition stage will be described. did.
N) An inverse transformation is performed on the bijection transformation performed in the key schedule for the encryption key (decryption key).
O) The inverse transformation of the bijection transformation performed in E) is performed on each divided input.
P) The output of N) and the output of O) are added according to the original encryption specifications.
Q) The output of P) is subjected to injection conversion.

Finally, a hardware configuration example of the cryptographic processing apparatus 1 shown in the first to fourth embodiments will be described.
FIG. 16 is a diagram illustrating an example of hardware resources of the cryptographic processing device 1 described in the first to fourth embodiments.
Note that the configuration of FIG. 16 is merely an example of the hardware configuration of the cryptographic processing device 1, and the hardware configuration of the cryptographic processing device 1 is not limited to the configuration described in FIG. Also good.
Also, the decoding processing device can be realized by the hardware configuration of FIG. 16, for example. In the following description, “encryption processing device 1” can be read as “decryption processing device”.

In FIG. 16, the cryptographic processing device 1 includes a CPU 1911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 1911 is connected to, for example, a ROM (Read Only Memory) 1913, a RAM (Random Access Memory) 1914, and a magnetic disk device 1920 via the bus 1912, and controls these hardware devices.
Further, the CPU 1911 may be connected to the communication board 1915, the display device 1901, the keyboard 1902, and the mouse 1903.
Further, the CPU 1911 may be connected to an FDD 1904 (Flexible Disk Drive), a compact disk device 1905 (CDD), a printer device 1906, and a scanner device 1907. Further, instead of the magnetic disk device 1920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 1914 is an example of a volatile memory. The storage media of the ROM 1913, the FDD 1904, the CDD 1905, and the magnetic disk device 1920 are an example of a nonvolatile memory. These are examples of the storage device.
A communication board 1915, a keyboard 1902, a mouse 1903, a scanner device 1907, an FDD 1904, and the like are examples of input devices.
The communication board 1915, the display device 1901, the printer device 1906, and the like are examples of output devices.

  The communication board 1915 is connected to the network. For example, the communication board 1915 may be connected to a LAN (local area network), the Internet, a WAN (wide area network), or the like.

The magnetic disk device 1920 stores an operating system 1921 (OS), a window system 1922, a program group 1923, and a file group 1924.
The programs in the program group 1923 are executed by the CPU 1911 using the operating system 1921 and the window system 1922.
For example, the program group 1923 stores programs that realize the functions of the elements (elements indicated as “˜parts”) included in the cryptographic processing device 1 according to the first to fourth embodiments. The program is read and executed by the CPU 1911.
In the file group 1924, a table referred to by each element (element indicated as “˜part”) included in the cryptographic processing apparatus 1 is stored in the magnetic disk device 1920.

Further, the RAM 1914 temporarily stores at least a part of the operating system 1921 program and application programs to be executed by the CPU 1911.
The RAM 1914 stores various data necessary for processing by the CPU 1911.
For example, when each element included in the cryptographic processing apparatus 1 (element indicated as “˜part”) is a program, a program that realizes the function of each element is loaded into the RAM 1914.
Further, a table referred to by each element (element indicated as “˜”) included in the cryptographic processing apparatus 1 is loaded into the RAM 1914.

The ROM 1913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 1920 stores a boot program.
When the cryptographic processing device 1 is activated, the BIOS program in the ROM 1913 and the boot program in the magnetic disk device 1920 are executed, and the operating system 1921 is activated by the BIOS program and the boot program.

In the file group 1924, in the description of Embodiments 1 to 4, information, data, signal values, variable values, and parameters indicating the results of “˜processing” are stored in “˜file” and “˜database”. It is stored as an item.
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 1911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, the arrow portion of the data flow described in the first to fourth embodiments mainly indicates input / output of data and signals, and the data and signal values are the RAM 1914 memory, the FDD 1904 flexible disk, the CDD 1905 compact disk, Recording is performed on a recording medium such as a magnetic disk of the magnetic disk device 1920, other optical disks, mini disks, and DVDs. Data and signals may be transmitted online via a bus 1912, signal lines, cables, or other transmission media.

  In addition, what is described as “to part” in the description of the first to fourth embodiments may be “to circuit”, “to device”, “to device”, and “to step”, It may be “˜procedure” or “˜processing”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 1913. Alternatively, it may be implemented only by software, only hardware such as elements, devices, substrates, wirings, etc., or a combination of software and hardware, and further a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 1911 and executed by the CPU 1911. That is, the program causes the computer to function as “to part” in the first to fourth embodiments. Alternatively, the computer executes the procedure and method of “to unit” in the first to fourth embodiments.

  As described above, the cryptographic processing device 1 shown in the first to fourth embodiments includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, a display device as an output device, and a communication device. A computer including a board or the like, and implements the functions indicated as “to part” as described above using these processing devices, storage devices, input devices, and output devices.

FIG. 3 is a diagram showing an overall flow of cryptographic processing according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of an initial key addition processing unit according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a nonlinear conversion processing unit according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a linear conversion processing unit according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a key addition processing unit according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a final conversion processing unit according to the first embodiment. FIG. 10 is a diagram illustrating a configuration example of an initial key addition processing unit according to the second embodiment. FIG. 10 is a diagram illustrating a configuration example of a key addition processing unit according to the second embodiment. FIG. 10 is a diagram illustrating an overall flow of cryptographic processing according to the third embodiment. FIG. 10 is a diagram illustrating a configuration example of an initial conversion processing unit according to the third embodiment. FIG. 10 shows a configuration example of a key schedule unit according to the fourth embodiment. FIG. 10 is a diagram illustrating a configuration example of an initial key addition processing unit according to the fourth embodiment. FIG. 10 is a diagram illustrating a configuration example of an initial key addition processing unit according to the fourth embodiment. 2 is a diagram illustrating a configuration example of a cryptographic processing device according to Embodiment 1. FIG. FIG. 9 is a diagram illustrating a configuration example of a cryptographic processing apparatus according to a third embodiment. The figure which shows the hardware structural example of the encryption processing apparatus which concerns on Embodiment 1-4.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Encryption processing apparatus, 11 Key schedule part, 12 Encryption processing part, 1210 Plaintext division | segmentation part, 1220 Initial key addition processing part, 1230 Nonlinear transformation processing part, 1240 Linear transformation processing part, 1250 Key addition processing part, 1260 Final transformation processing part 1270 Ciphertext concatenation unit, 1280 Initial conversion processing unit.

Claims (45)

Enter the extended key generated from the encryption key outside, input the input data,
An encryption processing apparatus comprising: a key addition processing unit that performs addition processing of an input extended key and input data by referring to a table. The key addition processing unit
2. The cryptographic processing apparatus according to claim 1, wherein the process of adding the expanded key and the input data and the injection conversion process of the data after the addition process are performed by referring to the table once. The key addition processing unit
An extended key having the same number of bits and input data are input, and the input extended key is divided at a predetermined division position to form two or more divided extended keys, and the input data that has been input is divided at the same division position as the extended key to 2 With the above divided input data,
The encryption processing apparatus according to claim 1 or 2, wherein the addition processing of the divided extended key and the divided input data and the injection conversion processing of the data after the addition processing are performed by referring to the table once. The key addition processing unit
A plurality of table addresses are provided, and a table indicating calculation results after addition processing and injection conversion processing for each table address is managed,
A value indicating any table address of the table is calculated from the divided extended key and the divided input data, and the calculation result indicated by the table address matching the calculated value is obtained from the table, and the divided extended key and the divided key are divided. 4. The cryptographic processing apparatus according to claim 3, wherein the input data addition processing and the injection conversion processing of the data after the addition processing are performed by referring to the table once. The key addition processing unit
5. The divided extended key is converted using a part of the table, and a value indicating any one of the table addresses of the table is calculated from the converted divided extended key and the divided input data. Cryptographic processing equipment. The key addition processing unit
6. The cryptographic processing apparatus according to claim 1, wherein plain text data is input as input data. The cryptographic processing device further includes:
A non-linear transformation processing unit that performs bijective transformation processing on data,
The key addition processing unit
Input the data after bijection conversion processing is performed by the nonlinear conversion processing unit as input data,
Refer to the table for the bijection inverse transformation process that performs the inverse transformation of the bijection transformation process by the nonlinear transformation processing unit on the input data, and the addition process of the input data after the bijective inverse transformation process and the expanded key The cryptographic processing apparatus according to claim 1, wherein: The key addition processing unit
Perform a bijection inverse transformation process on input data, an addition process between the input data after the bijection inverse transformation process and the expanded key, and a bijection transformation process of the data after the addition process by referring to the table once. The cryptographic processing apparatus according to claim 7. The key addition processing unit
An extended key having the same number of bits and input data are input, and the input extended key is divided at a predetermined division position to form two or more divided extended keys, and the input data that has been input is divided at the same division position as the extended key to 2 With the above divided input data,
Refer to the table once for the bijection inverse transformation processing for the divided input data, the addition processing of the divided input data after the bijection inverse transformation processing and the divided expanded key, and the injection transformation processing of the data after the addition processing. The cryptographic processing apparatus according to claim 7 or 8, wherein The key addition processing unit
A plurality of table addresses are provided, and a table indicating calculation results after bijection inverse transformation processing, addition processing, and bijection transformation processing is managed for each table address,
A value indicating any table address of the table is calculated from the divided extended key and the divided input data, and the calculation result indicated by the table address matching the calculated value is obtained from the table, and the bijection conversion process A bijection inverse transformation process for the divided input data of the later input data, an addition process of the divided input data after the bijective inverse transformation process and the divided expanded key, and a bijection transformation process of the data after the addition process The cryptographic processing apparatus according to claim 9, wherein the cryptographic processing apparatus is performed by referring to the table once. The key addition processing unit
The divided extended key is converted by using a part of the table, and a value indicating any table address of the table is calculated from the converted divided extended key and the divided input data. Cryptographic processing equipment. The key addition processing unit
The extended key and input data is divided into n (n ≧ 2) pieces of divided expanded key and n pieces of divided input data, the input of the injection conversion and x ₁ ~x _n, the output of the injection conversion processing f When (x ₁ ) to f (x _n ) and x ₁ to x _n are connected to x,
A table conversion is performed by referring to a table, in which a map f (x) of x (f (x) corresponds to a value obtained by adding f (x ₁ ) to f (x _n )) is a bijection map. The cryptographic processing apparatus according to claim 2 or 8, characterized in that: The key addition processing unit
Obtain table output data by the number of divisions by table reference, perform addition processing of each table output data, output the data after the addition processing to the nonlinear conversion processing unit,
The non-linear transformation processing unit
Input the data output from the key addition processing unit,
One table of inverse transformation processing of the injection transformation processing of the key addition processing unit for the input data, nonlinear transformation processing for the data after the inverse transformation processing, and bijection transformation processing for the data after the nonlinear transformation processing The cryptographic processing apparatus according to claim 8, wherein the cryptographic processing apparatus is performed by reference. The non-linear transformation processing unit
The inverse transformation process, the nonlinear transformation process, a process of dividing the data after the nonlinear transformation process at the same division position as the division position of the expanded key and the input data in the key addition processing unit, and each divided data 14. The cryptographic processing apparatus according to claim 13, wherein the bijection conversion process and the process of concatenating each piece of data after the bijection inverse conversion process are performed by referring to the table once. The non-linear transformation processing unit
15. The cryptographic processing apparatus according to claim 7, 13 or 14, wherein an additive bijective conversion process is performed on an exclusive OR operation. The cryptographic processing device further includes:
Input the data output from the key addition processing unit,
The final conversion processing unit which performs reverse conversion processing of the injection conversion processing of the key addition processing unit on the input data, and outputs the data after the reverse conversion processing as ciphertext data. The cryptographic processing device according to any one of 8 to 11. The cryptographic processing device further includes:
Enter plain text data,
An initial conversion processing unit that performs processing for dividing the input plaintext data, bijection conversion processing for each divided data, and processing for connecting the data after the bijection conversion processing by one table reference The cryptographic processing apparatus according to claim 1. The initial conversion processing unit includes:
18. The cryptographic processing apparatus according to claim 17, wherein an additive bijective conversion process is performed on the exclusive OR operation.   An encryption processing apparatus comprising: a key schedule unit that performs a bijection conversion process on an extended key obtained from an encryption key, and outputs the expanded key after the bijection conversion process as a conversion extended key. The cryptographic processing device further includes:
Input the conversion expansion key from the key schedule part, input the input data,
A bijection inverse transformation process for performing an inverse transformation of the bijection transformation process by the key schedule unit on the input transformation extension key, and an addition process of the transformation expansion key after the bijective inverse transformation process and the input data; The encryption processing apparatus according to claim 19, further comprising a key addition processing unit that performs the process by referring to a table. The key addition processing unit
A one-time table reference includes a bijection inverse transformation process for the transformation expansion key, an addition process between the transformation expansion key after the bijection inverse transformation process and the input data, and a bijection transformation process of the data after the addition process. The encryption processing apparatus according to claim 20, wherein the encryption processing apparatus performs the encryption processing. The key addition processing unit
Input a conversion expansion key and input data with the same number of bits, divide the input conversion expansion key at a predetermined division position to make two or more division expansion keys, and divide the input data input at the same division position as the conversion expansion key Thus, two or more pieces of divided input data are obtained, and a bijective inverse transformation process for the divided extended key, an addition process of the divided extended key after the bijective inverse transformation process and the divided input data, and a unit of the data after the addition process The cryptographic processing apparatus according to claim 20 or 21, wherein the recursive conversion process is performed by referring to the table once. The cryptographic processing device further includes:
A non-linear transformation processing unit that performs bijective transformation processing;
Input a transformation expansion key from the key schedule unit, and input data after bijection transformation processing is performed by the nonlinear transformation processing unit as input data,
A first bijection inverse transformation process for performing an inverse transformation of the bijection transformation process by the key schedule unit on the input conversion expanded key, and a bijection transformation process by the nonlinear transformation processing unit on the input data A second bijective inverse transformation process for performing an inverse transformation of the first bijective inverse transformation process, and an addition process of the transformation expansion key after the first bijective inverse transformation process and the input data after the second bijective inverse transformation process. The cryptographic processing apparatus according to claim 19, wherein the cryptographic processing apparatus is performed by referring to a table. The key addition processing unit
The first bijective inverse transform process, the second bijective inverse transform process, the transformation expansion key after the first bijective inverse transform process, and the input data after the second bijective inverse transform process 24. The cryptographic processing apparatus according to claim 23, wherein the addition processing of the data and the injection conversion processing of the data after the addition processing are performed by referring to the table once. The key addition processing unit
Input a conversion expansion key and input data with the same number of bits, divide the input conversion expansion key at a predetermined division position to make two or more division expansion keys, and divide the input data input at the same division position as the conversion expansion key Into two or more divided input data,
A first bijective inverse transform process for the divided extended key, a second bijective inverse transform process for the divided input data, and the divided expanded key and the second bijective after the first bijective inverse transform process. The encryption processing apparatus according to claim 23 or 24, wherein the addition processing with the divided input data after the reciprocal transformation processing and the injection transformation processing of the data after the addition processing are performed by referring to the table once. . Enter the extended key generated from the encryption key outside, input the input data,
A program for causing a computer to execute a key addition processing procedure for performing addition processing of an input extended key and input data by referring to a table.   A program characterized by causing a computer to execute a key schedule procedure for performing bijection conversion processing on an expanded key obtained from an encryption key and outputting the expanded key after the bijection conversion processing as a converted expanded key. Input the extended key generated from the decryption key outside, input the input data,
A decryption processing apparatus comprising: a key addition processing unit that performs an addition process between an input extended key and input data by referring to a table. The key addition processing unit
29. The decryption processing apparatus according to claim 28, wherein the process of adding the expanded key and the input data and the injection conversion process of the data after the addition process are performed by referring to the table once. The key addition processing unit
An extended key having the same number of bits and input data are input, and the input extended key is divided at a predetermined division position to form two or more divided extended keys, and the input data that has been input is divided at the same division position as the extended key to 2 With the above divided input data,
30. The decryption processing apparatus according to claim 28 or 29, wherein the addition processing of the divided extended key and the divided input data and the injection conversion processing of the data after the addition processing are performed by referring to the table once. The key addition processing unit
A plurality of table addresses are provided, and a table indicating calculation results after addition processing and injection conversion processing for each table address is managed,
A value indicating any table address of the table is calculated from the divided extended key and the divided input data, and the calculation result indicated by the table address matching the calculated value is obtained from the table, and the divided extended key and the divided key are divided. 31. The decoding processing apparatus according to claim 30, wherein the input data addition processing and the injection conversion processing of the data after the addition processing are performed by one table reference. The decoding processing device further includes:
A non-linear transformation processing unit that performs bijective transformation processing on data,
The key addition processing unit
Input the data after bijection conversion processing is performed by the nonlinear conversion processing unit as input data,
Refer to the table for the bijection inverse transformation process that performs the inverse transformation of the bijection transformation process by the nonlinear transformation processing unit on the input data, and the addition process of the input data after the bijective inverse transformation process and the expanded key The decryption processing apparatus according to claim 28, wherein The key addition processing unit
Perform a bijection inverse transformation process on input data, an addition process between the input data after the bijection inverse transformation process and the expanded key, and a bijection transformation process of the data after the addition process by referring to the table once. 33. The decoding processing apparatus according to claim 32. The key addition processing unit
An extended key having the same number of bits and input data are input, and the input extended key is divided at a predetermined division position to form two or more divided extended keys, and the input data that has been input is divided at the same division position as the extended key to 2 With the above divided input data,
Refer to the table once for the bijection inverse transformation processing for the divided input data, the addition processing of the divided input data after the bijection inverse transformation processing and the divided expanded key, and the injection transformation processing of the data after the addition processing. 34. The decoding processing apparatus according to claim 32 or 33, wherein The key addition processing unit
A plurality of table addresses are provided, and a table indicating calculation results after bijection inverse transformation processing, addition processing, and bijection transformation processing is managed for each table address,
A value indicating any table address of the table is calculated from the divided extended key and the divided input data, and the calculation result indicated by the table address matching the calculated value is obtained from the table, and the bijection conversion process A bijection inverse transformation process for the divided input data of the later input data, an addition process of the divided input data after the bijective inverse transformation process and the divided expanded key, and a bijection transformation process of the data after the addition process The decryption processing apparatus according to claim 34, wherein the decryption processing apparatus is performed by referring to the table once. The decoding processing device further includes:
Enter plain text data,
An initial conversion processing unit that performs processing for dividing the input plaintext data, bijection conversion processing for each divided data, and processing for connecting the data after the bijection conversion processing by one table reference 29. The decoding processing apparatus according to claim 28.   A decryption processing apparatus comprising: a key schedule unit that performs a bijection conversion process on an expanded key obtained from a decryption key and outputs the expanded key after the bijection conversion process as a converted expanded key. The decoding processing device further includes:
Input the conversion expansion key from the key schedule part, input the input data,
A bijection inverse transformation process for performing an inverse transformation of the bijection transformation process by the key schedule unit on the input transformation extension key, and an addition process of the transformation expansion key after the bijective inverse transformation process and the input data; 38. The decryption processing apparatus according to claim 37, further comprising: a key addition processing unit that performs the process by referring to a table. The key addition processing unit
A one-time table reference includes a bijection inverse transformation process for the transformation expansion key, an addition process between the transformation expansion key after the bijection inverse transformation process and the input data, and a bijection transformation process of the data after the addition process. The decoding processing apparatus according to claim 38, wherein the decoding processing apparatus performs the decoding processing. The key addition processing unit
Input a conversion expansion key and input data with the same number of bits, divide the input conversion expansion key at a predetermined division position to make two or more division expansion keys, and divide the input data input at the same division position as the conversion expansion key Thus, two or more pieces of divided input data are obtained, and a bijective inverse transformation process for the divided extended key, an addition process of the divided extended key after the bijective inverse transformation process and the divided input data, and a unit of the data after the addition process The decoding processing apparatus according to claim 38 or 39, wherein the reflection conversion process is performed by referring to the table once. The decoding processing device further includes:
A non-linear transformation processing unit that performs bijective transformation processing;
Input a transformation expansion key from the key schedule unit, and input data after bijection transformation processing is performed by the nonlinear transformation processing unit as input data,
A first bijection inverse transformation process for performing an inverse transformation of the bijection transformation process by the key schedule unit on the input conversion expanded key, and a bijection transformation process by the nonlinear transformation processing unit on the input data A second bijective inverse transformation process for performing an inverse transformation of the first bijective inverse transformation process, and an addition process of the transformation expansion key after the first bijective inverse transformation process and the input data after the second bijective inverse transformation process. 38. The decoding processing device according to claim 37, wherein the decoding processing device is performed by referring to a table. The key addition processing unit
The first bijective inverse transform process, the second bijective inverse transform process, the transformation expansion key after the first bijective inverse transform process, and the input data after the second bijective inverse transform process 42. The decoding processing apparatus according to claim 41, wherein the addition processing of the data and the injection conversion processing of the data after the addition processing are performed by referring to the table once. The key addition processing unit
Input a conversion expansion key and input data with the same number of bits, divide the input conversion expansion key at a predetermined division position to make two or more division expansion keys, and divide the input data input at the same division position as the conversion expansion key Into two or more divided input data,
A first bijective inverse transform process for the divided extended key, a second bijective inverse transform process for the divided input data, and the divided expanded key and the second bijective after the first bijective inverse transform process. 43. The decoding processing apparatus according to claim 41, wherein the addition processing with the divided input data after the reciprocal transformation processing and the injection transformation processing of the data after the addition processing are performed by one table reference. . Input the extended key generated from the decryption key outside, input the input data,
A program for causing a computer to execute a key addition processing procedure for performing addition processing of an input extended key and input data by referring to a table.   A program characterized by causing a computer to execute a key schedule procedure for performing bijection conversion processing on an extended key obtained from a decryption key and outputting the expanded key after bijection conversion processing as a conversion expanded key.

Images