JPH09269727A - Encryption method and encryption device - Google Patents

Abstract

(57) An object of the present invention is to provide an encryption method and an encryption device capable of improving encryption strength and encryption processing speed by effectively utilizing resources of hardware and software. SOLUTION: A plurality of intermediate keys K1 to Kn are generated based on input key data 112, and a plurality of (n) stages of stirring are performed on the input block data 110 using each of the generated plurality of intermediate keys. An encryption method and an encryption device that perform agitation processing by a function f to generate encrypted data 111, wherein the key update unit 107 agitates each time a predetermined amount of encrypted data 111 is generated. Intermediate key K used for the final stage and first stage stirring functions f using the function f
Update n and K1.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and apparatus for encrypting information used in an information communication network requiring security, for example.

[0002]

2. Description of the Related Art A DES (Data Encryption-Stan) is used as a widely used encryption method.
dard, Federal InformationP
processing Standard No. 46)
There is a method. This is classified as a secret key cryptosystem,
It is distinguished from public key cryptosystems such as the RSA system. The present invention relates to a configuration of a secret key cryptosystem such as the DES system.

In the DES system, a key scheduling unit for expanding an input key to generate an intermediate key and plaintext data based on the generated intermediate key are mixed and converted into ciphertext data. Conversely, it consists of a data agitation unit that converts ciphertext into plaintext.

Although the DES system boasts high reliability, the specifications of the key schedule part are very simple and do not include a key update procedure. Therefore, a large amount of plaintext data is input and the encryption result is input. Applying an observing attack makes it possible to estimate key data with high probability. As a typical attack method based on this principle, differential attack (E. Bih
am and A. Shamir "Differen"
tialCryptanalysis of DES-
like Crypto-systems ”, Jour
nal of Cryptology, Vol. 4, N
o. 1, pp3-72, 1991) is particularly famous.

On the other hand, as the configuration of the data agitation unit, the DES method has a configuration in which the encryption strength is increased by applying a relatively simple and cryptographically weak function in multiple stages.
If the number of stages is increased, the safety is improved, but the processing speed is reduced. When the key is fixed, it is said that about 16 rounds of repetitive processing are required to nullify the differential attack.

[0006]

As described above, in the DES method, since the intermediate key generation procedure adopted in the key schedule part is simple, the mutual correlation between the intermediate keys is large, and the key update is supported. Therefore, there is a problem that it is weak against a kind of selective plaintext attack such as a differential attack.

Further, the processing speed is sacrificed because the resistance to attack is enhanced by increasing the number of processing steps of the data agitation unit to 16 steps. Therefore, the present invention has been made in view of the above problems, and it is possible to increase the cryptographic strength by performing key update for an intermediate key that is a weak point against attacks such as differential attacks, and the same cryptographic strength An object of the present invention is to provide an encryption method and an encryption device capable of improving the processing speed while maintaining the above.

[0008]

The encryption method of the present invention comprises:
Generate multiple intermediate keys based on the input key data,
Each time the input plaintext data is encrypted using a plurality of stages of encryption using each of the generated intermediate keys, encrypted data is generated, and encrypted data of a predetermined data amount is generated each time. By updating the intermediate key used for the encryption process at the final stage, it is possible to effectively use the resources of hardware and software to improve the encryption strength and the encryption processing speed.

The encryption method of the present invention further improves the encryption strength by further updating the intermediate key used for the encryption process at the first stage every time a predetermined amount of encrypted data is generated. improves.

Further, in the encryption method of the present invention, at least two of the key data and the intermediate keys generated so far are subjected to an encryption process used when encrypting the plaintext data, and the intermediate data is encrypted. By updating the key, the resources of hardware and software can be effectively used to improve the encryption strength and the encryption processing speed.

Further, according to the encryption method of the present invention, a plurality of intermediate keys are generated based on the input key data, and the first plaintext data is subjected to the first encryption processing to generate the first encrypted data. Then, with respect to the generated first encrypted data,
A plurality of stages of the second encryption processing is continuously performed using each of the plurality of intermediate keys to generate second encrypted data, and a third encryption processing is performed on the generated second encrypted data. Is performed to generate the third encrypted data, and each time the third encrypted data having a predetermined data amount is generated, at least two of the key data and the intermediate keys generated so far are generated. On the other hand, by performing the second encryption processing and updating the intermediate key used for the final second encryption processing, the resources of hardware and software are effectively used, and encryption strength and encryption processing are performed. The speed can be improved.

Further, the encryption method of the present invention, when the third encrypted data of a predetermined data amount is generated,
By performing the second encryption process on at least two of the key data and the intermediate keys generated so far, and further updating the intermediate key used for the first-stage second encryption process, Strength is further improved.

Further, the encryption apparatus of the present invention includes an intermediate key generating means for generating a plurality of intermediate keys based on the input key data and a plurality of intermediate keys generated by the intermediate key generating means. Using the generating means for continuously performing a plurality of stages of encryption processing on the input plaintext data to generate the encrypted data, and for each time the encrypted data of a predetermined data amount is generated by the generating means, the final stage is generated. The updating means for updating the intermediate key used in the encryption processing of 1. can effectively utilize the resources of the hardware and software to improve the encryption strength and the encryption processing speed.

Further, the updating means further updates the intermediate key used for the first-stage encryption processing every time when the encrypted data of a predetermined data amount is generated by the generating means, whereby the encryption strength is increased. Is further improved.

Further, the updating means updates the intermediate key by performing an encryption process for encrypting the plaintext data on at least two of the key data and the intermediate key generated so far. This makes it possible to effectively use hardware and software resources to improve encryption strength and encryption processing speed.

Further, the encryption apparatus of the present invention performs the first encryption processing on the input plaintext data and the intermediate key generation means for generating a plurality of intermediate keys based on the input key data, and first And a plurality of intermediate keys generated by the intermediate key generating means for the first encryption data generated by the first encryption means and the first encryption data generated by the first encryption means. Second encryption means for continuously performing a plurality of stages of second encryption processing using the second encryption data, and
Third encryption means for performing third encryption processing on the second encryption data generated by the second encryption means to generate third encryption data, and a predetermined data amount Every time the third encrypted data of is generated, the second encryption processing is performed on at least two of the key data and the intermediate keys generated up to that time to perform the second encryption means. And an updating means for updating the intermediate key used for the second encryption processing at the final stage of the above, thereby effectively utilizing the resources of hardware and software to improve the encryption strength and the encryption processing speed. Can be achieved.

Further, the updating means sets the key data and at least two of the intermediate keys generated so far to at least two each time the third encrypted data of a predetermined data amount is generated. The second encryption is performed to perform the second
By further updating the intermediate key used in the first-stage second encryption processing of the encryption means of 1, the encryption strength is further improved.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 schematically shows the configuration of the encryption device according to this embodiment. In FIG. 1, the key scheduling unit 102 includes an intermediate key expanding unit 106 and a key updating unit 107.
06 generates an initial intermediate key (K1, K2, ... Kn) based on the key data input from the outside.

Plaintext data input from the outside is input to the data mixing unit 101 (block data 110) in units of blocks of a predetermined length, preprocessed by the preprocessing unit 103, and then processed by the intermediate processing unit 104. A plurality of stirring functions f (i = 1
.About.n) times, further post-processed by the post-processing unit 105, and encrypted output block data (encrypted data) 1
11 is output.

The agitation function f is supplied with the output of the agitation function f of the preceding stage at its first input, and the second input of the plurality (n) of intermediate keys generated by the intermediate key expansion unit 106 at its second input. This is a cryptographic function that is supplied with one and performs shuffling processing on the input block data by an algorithm of two inputs and one output.

As a specific example of the pre-processing / post-processing in the pre-processing unit 103 and the post-processing unit 105, there is the exchange of bit positions. A more generalized bijective image is used. If the pre-processing and the post-processing are selected so that they have an inverse transformation relationship with each other, it is easy to make a decoding device. It is also possible to use a function that directly outputs the input as the pre-processing / post-processing.

When the data agitation unit 101 has performed encryption a predetermined number of times, the key processing unit 107 is adapted to update the intermediate key. At this time, at least the key Kn supplied to the final-stage stirring function f is processed so that its value changes (the update function is designed so that the probability that it will continue even if the value becomes the same is extremely low). Be done).

The differential attack is achieved by controlling the input difference so that the difference value of the input to the final stage stirring function f can be estimated with a certain probability determined by the transfer characteristic of the stirring function f. However, if the key input to the final stage changes relatively frequently in this way, even if the effective difference happens to reach the final stage, the key used at that time will not be used for a long time after that, and the final stage will not be used. It is difficult to estimate the key.

Further, by using the shuffling function f used in the data shuffling section 101 as a key updating function, it is possible to share hardware or software with the data shuffling section 101, and a compact implementation is possible. Become.

Next, regarding the key update frequency, the highest frequency is to update the key each time one data block is converted. Generally, it is updated every time k data blocks are processed (k is a natural number), but this may need to be determined in consideration of safety and processing speed.

As an example of a concrete determination method, when the transfer characteristic probability of the difference is represented by p (0 <p <1), it is considered that an appropriate coefficient a is determined and k = a / p is determined.
When the difference transfer characteristic probability is p, if a difference of the order of 1 / p is observed, the desired difference becomes the input of f at the final stage with a high probability, so a = 1, 0.1, 0.001 ,. It is possible to determine k while giving consideration to the safety factor by giving, for example, It is possible in some cases to use a value of 1 or more as a.

According to the present invention, it is also possible to improve the processing speed without deteriorating the encryption strength. As mentioned above, increasing the frequency of key updates can increase the difficulty of key estimation. However, it is known that the difficulty of key estimation depends on the number of connected stages of the stirring function f, and that the difference characteristic probability increases by increasing the number of stages. Therefore, there is a possibility that the difficulty of estimation increased by increasing the update frequency can be made equal to the original difficulty by reducing the number of stages. In fact, if the new key can be determined completely randomly, the agitation function f has one stage and the processing content is simply the first.
It is known that it is safe to use bitwise exclusive OR of the input and the second input. Actually, the key is not decided at all at random but is decided by the stirring function f.
In any case, the processing speed can be increased by reducing the number of stages.

Next, a more specific embodiment will be described based on the above principle. FIG. 2 schematically shows the configuration of the encryption device of the present invention using the basic configuration of the DES system.

The DES in FIG. 2 is converted so that the bit length of the intermediate key and the bit width of the data agitation unit have a relationship of 1: 2. The function written as SPE in the figure is the S of DES
A box, a P conversion, and an E conversion are connected in series in this order, and FIG. 3 shows a block diagram thereof. 4 as a whole
It is a non-linear function with 8-bit input and 48-bit output.

The configuration of the encryption device shown in FIG.
Except for 7, it is completely equivalent to an ordinary DES encryption device. In FIG. 2, the number of times the key is updated is represented by t,
The intermediate key supplied to the stirring function f of the round is represented as Ki (t). In this embodiment, the (n-1) th intermediate key and the nth key
The key updating unit 207 receives the nth key as the input and the nth key (final stage)
Updating the key of. The same value is used for the first to (n-1) th intermediate keys until the key is changed. It is assumed that the key is updated every time a fixed number, for example, 100 blocks of ciphertext is output.

In the encryption device shown in FIG. 2, the key scheduling unit 202 has a DES key expanding unit 206 and a key updating unit 207.
The DES key decompression unit 206 has 64 bits input from the outside (8 bits of which are regarded as parity bits and are not used in the process of encryption and decryption).
Intermediate keys K1 (t), K2 based on the key data K of
(T), ... Kn (t) are generated.

In the DES key decompression unit 206, the transposed PC-1 (Permut) is first applied to the 54-bit key data K.
A transposing process called ed choice 1) for changing the order of bits is performed, and the registers C and D are divided into two. The bits in registers C and D are 1-bit or 2-bit left circular shifts and right circular shifts during decoding. Then a reduced transposed PC-2 (Permuted choice) for 54 bits in the C and D registers.
By applying 2), the 48-bit intermediate key K1
(T) is generated. Thereafter, in the same manner, by performing the left circulation shift and the reduced transpose PC-2 once in the registers C and D, the intermediate keys K2 (t), ... Kn (t) are sequentially generated.

Plaintext data input from the outside is input to the data mixing unit 201 in block units (64 bits) of a predetermined length (block data M). First, as preprocessing,
The initial transposition processing unit 210 performs an initial transposition IP, that is, a process of changing the order of bits, and thereafter, it is divided into two parts each having 32 bits, and the transposition processing units 212a and 212a,
Enter in 12b. In the transposition processing units 212a and 212b, the enlarged transposition E for overlapping the bits is performed, respectively.
Outputs 8-bit block data.

Next, an intermediate process is performed. First, the first-stage agitation function f calculates the exclusive OR of the 48-bit block data from the transposition processing unit 212a and the intermediate key K1 (t) generated by the DES key expansion unit 206 (222a).

The 48 bits of the result of the exclusive OR are
The SPE processing unit 2 is divided into eight 6-bit blocks.
21. As shown in FIG. 3, the SPE processing unit 2
In 21, the eight substitution tables, that is, the selection function (S-bo
x) Sj (j = 1 to 8) receives eight 6-bit blocks, and the selection function Sj outputs 4-bit blocks. Total of 3 output from S-box
Transpose P that replaces the bit order for 2 bits
(P conversion), and the above-mentioned enlarged transposition E is applied (E conversion) to output a 48-bit block. S-b
The processes by ox, P conversion, and E conversion are collectively referred to as an SPE function here.

Now, returning to the description of FIG. 2, the SPE processing unit 2
The output of 21 is XORed with the output of the transposition processing unit 212b (222b), and the result is the stirring function f of the second stage.
To the DES key expansion unit 2 and the 48-bit block data which is the output of the first-stage agitation function f in the same manner as described above.
The exclusive OR with the intermediate key K2 (t) generated in 06 is obtained (222a). On the other hand, in the second-stage stirring function f, the exclusive OR of the output of the transposition processing unit 212a and the output of the SPE function 221 is obtained (222b).

Similarly, in the case of the agitation function f of a particular stage (i = 3 to n), the output from the agitation function f of the previous stage (i = i-1) and the intermediate key Ki generated by the DES key expansion unit 206.
The exclusive OR with (t) is taken (222a), and the previous stage (i)
= I−2), the output of the exclusive OR (222b) of the output of the exclusive OR (222b) of the stirring function f and the output of the SPE function 221 of the current stage (i) is output.

The 48-bit output of the stirring function f at the final stage (i = n) is then subjected to post-processing. Last stage (i =
The 48-bit output of the stirring function f of n) is reduced to 32 bits by the transposition processing unit 213b that applies the inversion value E ^-1 of the above-mentioned enlarged transposition E, while the stirring function of the (i = n-1) th stage The 48-bit output of f is also reduced to 32 bits by the transposition processing unit 213a that applies the inversion value E ⁻¹ of the above-mentioned enlarged transposition E. The reverse initial transposition processing unit 221 applies the reverse transposition IP ⁻¹ of the initial transposition IP to the outputs of the transposition processing units 213a and 213b,
The encrypted output block data C is output.

The key updating unit 207 is composed of a stirring function f used in the data stirring unit 201. That is, the exclusive OR of the intermediate key Kn (t) of the stirring function f at the final stage (nth stage) and the intermediate key Kn-1 (t) of the stirring function f at the (n-1) th stage is calculated ( 222a), SPE for the result
The function 221 performs agitation processing, and the output of the SPE function 221 and the intermediate key Kn-1 (t) are exclusive-ORed (222).
b) The updated intermediate key Kn (t + 1) at the final stage is output. This key update is performed every time a predetermined amount (for example, 100 blocks) of encrypted data is output from the data agitation unit 201.

FIG. 4 shows another example of the configuration of the key updating unit. A new embodiment is provided by replacing this with the key updating unit 207 of FIG. The key updating unit in FIG. 4 has two registers (D-flip-flop circuit,
Hereinafter referred to simply as FF) 300, 301, stirring function f
(SPE function, two exclusive OR operation units).

At the time of initialization, the FF 300 holds a 48-bit initial value, and the FF 301 holds the initial value Kn (0) of the intermediate key at the final stage (nth stage). At the time of updating the key, in the agitation function f, the value held in the FF 300 and the value held in the FF 301 are exclusive-ORed (222a) and the SPE function 22
It is put in 1, and the output value and the value held in FF300 are exclusive-ORed (222b), and the result is FF3.
The intermediate key Kn (t) is held at 01 and is simultaneously output as the updated intermediate key Kn (t). At this time, the intermediate key Kn (t-1) before update, which is held in the FF 301 by that time, is
It is kept at 0.

When the above processing is written in a recurrence formula, Kn (t + 1) = EPS {Kn (t-1) + Kn
(T)} + Kn (t-1). Here, the output when the input of the EPS function 221 is x is represented by EPS (x).

Although only the encryption processing is described in the above description, the decryption can be easily configured if the sequence of the intermediate key used in the encryption can be generated. This can be generated by using the same encryption function and update function as those used at the time of encryption by the key schedule unit (key schedule unit 102 in FIG. 1, key schedule unit 202 in FIG. 2), and thus the encryption device according to the present invention. Is easy to decrypt.

FIG. 5 shows still another configuration example of the key updating unit. By replacing this with the key updating unit 207 of FIG. 2, yet another embodiment is provided. The same parts as those in FIG. 4 are designated by the same reference numerals, and only different parts will be described. That is, F as an input of the EPS function 221
Value held in F301 and 56 input from outside
The exclusive OR of the values obtained by compressing the bit key data K to 48 bits is used.

In the above description, the case where the key at the final stage is updated has been mainly described, but it is easy to update the intermediate key at the first stage by the same procedure. FIG. 6 shows a configuration example of the encryption device in this case. In FIG. 6, the same parts as those in FIG. 2 are designated by the same reference numerals, and only different parts will be described. That is, in the configuration of the key updating unit 207, the stirring function f for updating the intermediate key used for the stirring function f in the first stage is updated.
Has been added.

In the stirring function f for updating the intermediate key used for the stirring function f in the first stage, the intermediate key K1 of the stirring function f in the first stage is updated.
The exclusive OR of (t) and the intermediate key K2 (t) of the second-stage stirring function f is calculated (222a), and the result is subjected to the stirring process by the SPE function 221, and the output of the SPE function 221 and the intermediate key K2. The exclusive OR of (t) is calculated (222b), and the updated first-stage intermediate key K1 (t + 1) is output.

The configuration of the encryption device shown in FIG. 6 can greatly increase the security against differential attacks. The reason will be described below. The decryption process of the ciphertext encrypted based on the DES method can be realized by reversing the generation order of the intermediate key. This is because the key input at the final stage in the decryption process is input at the first stage in encryption. It is the key. That is, in such a DES encryption device, if the first-stage key in the encryption is fixed, the last-stage key in the decryption is fixed, and the fake ciphertext with an appropriate difference is set in the decryption-mode device. By inputting a large amount,
There is a high possibility that the last-stage key will be estimated.

However, according to the configuration shown in FIG. 6, not only the last-stage key but also the first-stage key is updated in the encryption mode, so that such an attack can be completely prevented. . Such an effect is similar not only to a differential attack but also to a linear attack.

As described above, the encryption method and the encryption device of the above embodiment generate a plurality of intermediate keys K1 (t) to Kn (t) based on the input key data K, and An encryption method and an encryption device that perform encryption processing on input plaintext data by using a plurality of (n) stages of agitation functions f using each of a plurality of generated intermediate keys to generate encrypted data. The intermediate keys Kn (t) and K1 (t) used for the first-stage agitation function f are generated in the key update units 107 and 207 by the agitation function f each time encrypted data of a predetermined data amount is generated. By using the update, the resources of hardware and software can be effectively used to improve the encryption strength and the encryption processing speed.
That is, it is possible to remarkably increase the resistance to an attack as compared with an encryption device that does not perform key update with the same number of steps.

Further, since the same function as the data shuffling function f is used for the key updating process, the increase in software and hardware can be suppressed to a minimum. Since the frequency of key update can be changed, it is possible to control the degree of security as a parameter.

Since the key is updated, it is possible to reduce the number of processing steps (the number of connected steps of the agitation function f) while keeping the security almost the same as compared with the method of fixing the key. As a result, the processing speed is improved. Can be achieved.

If the intermediate key to be updated is limited to the last-stage key, the load of the key updating process can be reduced. In the above embodiment, the updating of the intermediate key is described only for the intermediate keys used for the final-stage and first-stage agitation functions f, but not only in this case, for other intermediate keys, for example, If all intermediate keys are updated, the cipher strength will be further increased.

When the key updating unit is composed of the agitation function f, the two inputs are not limited to those shown in the above embodiment, but the key data K input from the outside and the intermediate key generated up to that point. At least two of them may be used.

[0054]

As described above, according to the present invention,
It is possible to provide an encryption method and an encryption device capable of improving the encryption strength and the encryption processing speed by effectively utilizing the resources of hardware and software.

[Brief description of drawings]

FIG. 1 is a block diagram schematically showing the configuration of an encryption device according to an embodiment of the present invention.

FIG. 2 is a block diagram showing the configuration of an encryption device according to an embodiment of the present invention when the DES method is applied.

FIG. 3 is a diagram for explaining the processing of the SPE function of FIG.

FIG. 4 is a diagram showing another configuration example of a key update unit of the encryption device of FIG.

FIG. 5 is a diagram showing still another configuration example of the key update unit of the encryption device of FIG.

FIG. 6 is a diagram showing another configuration example of the encryption device according to the embodiment of the present invention, which is provided with a key updating unit that also updates the intermediate key of the first-stage stirring function.

[Explanation of symbols]

101, 201 ... Data mixing section, 102, 202 ... Key scheduling section, 103 ... Pre-processing section, 104 ... Intermediate processing section, 105 ... Post-processing section, 106 ... Intermediate key expanding section, 10
7, 207 ... Key update unit, 110 ... Block data (input plaintext data), 111 ... Output block data (encrypted data), 112 ... Key data, 206 ... DES key expansion unit.

Claims (7)

[Claims] 1. A plurality of intermediate keys are generated based on input key data, and a plurality of stages of encryption processing are continuously performed on input plaintext data using each of the generated plurality of intermediate keys. An encryption method, characterized in that encrypted data is generated and an intermediate key used in the final encryption process is updated every time a predetermined amount of encrypted data is generated. 2. The encryption method according to claim 1, further comprising updating the intermediate key used for the first-stage encryption processing every time a predetermined amount of encrypted data is generated. 3. The intermediate key is updated by performing an encryption process used when encrypting the plaintext data on at least two of the key data and the intermediate keys generated so far. The encryption method according to claim 1. 4. A plurality of intermediate keys are generated based on the input key data, a first encryption process is performed on the input plaintext data to generate a first encrypted data, and the generated first encrypted data is generated. Second encrypted processing is continuously performed on each of the encrypted data of step 2 using each of the plurality of intermediate keys.
Of the second encrypted data, the third encrypted data is generated by performing a third encryption process on the generated second encrypted data, and the third encrypted data of a predetermined data amount is generated. Each time it is generated, the second encryption process is performed on at least two of the key data and the intermediate keys generated up to that time to obtain an intermediate key used for the second encryption process at the final stage. An encryption method characterized by updating. 5. Each time a predetermined amount of third encrypted data is generated, the second encryption is performed on at least two of the key data and the intermediate keys generated so far. The encryption method according to claim 4, wherein the intermediate key used for the first-stage second encryption process is further updated by performing the process. 6. A plurality of intermediate key generating means for generating a plurality of intermediate keys based on the input key data, and a plurality of intermediate keys generated by the intermediate key generating means for a plurality of input plaintext data. Generating means for continuously performing the encryption process of the second stage to generate encrypted data, and an intermediate used for the encryption process of the final stage every time the generating device generates the encrypted data of a predetermined data amount. An encryption device comprising: update means for updating a key. 7. An intermediate key generating means for generating a plurality of intermediate keys based on input key data, and a first encryption process for performing first encryption processing on input plaintext data. And a plurality of stages of second keys for each of the first encrypted data generated by the first encryption means and each of the plurality of intermediate keys generated by the intermediate key generation means. Second encryption means for continuously performing encryption processing to generate second encrypted data, and third encryption processing for the second encrypted data generated by the second encryption means. Third encryption means for generating the third encrypted data, and each time the third encrypted data of a predetermined data amount is generated, the key data and the intermediate key generated so far The second encryption processing is performed on at least two of the Encryption device, wherein the second updating means for updating the intermediate-key used for encryption processing in the final stage, by comprising the encryption means.