Mitsubishi Electric Corporation

Yusuke Naito

Yasuyuki Sakai

Daisuke Suzuki

Mitsuru Matsui

A division unit () divides a plaintext M every b bits from a beginning, thereby generating b-bit values M, . . . , Mand a value Mhaving 1 or more bits to b or less bits. An Scalculation unit () assigns a b-bit value Hto a value M, and for each integer i of i=1, . . . , m in an ascending order, takes a value Mas input to an encryption function E, thereby calculating a value S(i), and calculates a value Cfrom the value S(i) and a value M. An Scalculation unit () assigns an r-bit value Hto a value S(0), and for each integer i of i=1, . . . , m in an ascending order, calculates a value S(i) from the value S(i) and from a value S(i−1). A ciphertext generation unit () generates a ciphertext C from a value Cfor each integer i of i=1, . . . , m. An authenticator generation unit () generates a (b+r)-bit authenticator T by using a value S(m) and a value S(m).

Encryption device, decryption device, encryption method, decryption method, and computer readable medium

A message authentication apparatus compresses a message M into a value H of 2n bits, and divides the value H into two values H[1] and H[2] each having n bits. The message authentication apparatus extracts two values U[1] and U[2] each having min{t, n/2} bits from the value H[1], generates a value V[1] of t bits, using as input the message M and the value U[1], and generates a value V[2] of t bits, using as input the message M and the value U[2]. The message authentication apparatus encrypts the value H[2] by a tweakable block cipher E, using the value V[1] as a tweak, to generate a value Z[1], and encrypts the value H[2] by the tweakable block cipher E, using the value V[2] as a tweak, to generate a value Z[2]. The message authentication apparatus generates an authenticator Z from the value Z[1] and the value Z[2].

Message authentication apparatus, message authentication method, and computer readable medium

An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data Sof n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

An encryption device () is an encryption device in authentication encryption. A key generation unit () generates a key K of an encryption function E of a block cipher, in accordance with an initial parameter N. A hash calculation unit () calculates a hash value msk with an internal parameter ctr as an input. An encryption unit () generates a ciphertext c of the message m by using the encryption function E, with a key K generated by the key generation unit (), a hash value msk calculated by the hash calculation unit (), and a message m as inputs.

Encryption device and decryption device

A message authenticator generation apparatus () generates a message authenticator using a block cipher E having a block size n. A hash function unit () calculates a hash value w with a hash function h having an output length longer than n bits, taking as input a message M. A post-processing unit () performs calculations using the block cipher E on the hash value w calculated by the hash function unit (), so as to calculate a message authenticator T not larger than the block size n for the message M.

Message authenticator generation apparatus

A message authenticator generating apparatus (), for each integer i, taking as input a key K and a value m'[i] which is generated from a message M, calculates a value c[i] by a block cipher E. The message authenticator generating apparatus (), taking as input the value c[i] for each integer i, calculates a value w[], a value w[], and a value w[] each maintaining the randomness of the value c[i]. The message authenticator generating apparatus (), taking as input the value w[] and the key K, calculates a value K&#x2032; by a function e which is a substitution function if the key K is fixed, taking as input the value w[] and the value K&#x2032;, calculates a value c by a block cipher E, and taking as input the value w[] and the value c, calculates an authenticator T by a function d which is a substitution function if the value w[] is fixed.

Message authenticator generating apparatus, message authenticator generating method, and computer readable recording medium

The object is to constitute a hash function by removing a feed-forward arithmetic operation. A hash value calculation device, for each integer i of i=1, . . . , L in an ascending order, calculates a function f[i] which, upon input of a value M[i] having k-n bits, an n-bit value y&#x2212;1] (a value y] is a predetermined value IV), and an n-bit value y&#x2212;1] (a value y] is a predetermined value IV), outputs an n-bit value x], an n-bit value x], a k-bit value k], and a k-bit value k]; for the value x] as a plaintext and the value k] as a key, calculates an n-bit value y] with an encryption function of a block cipher; and for the value xas a plaintext and the value k] as a key, calculates an n-bit value y] with the encryption function for the block cipher. The hash value calculation device, upon input of a value y[L] and a value y[L] which are calculated, calculates a hash value with an injective function g.

Hash value calculation device, hash value calculation method, and non-transitory computer-readable storage medium including computer executable instruction

e and n are public information and d is private information. An electronic signature is generated based on a calculated value of e&#xd7;d mod n. A signature generation apparatus includes a random number generation unit, a first calculation unit, a second calculation unit, and a signature generation unit. The random number generation unit generates a random number r. The first calculation unit calculates s1=r&#xd7;n. The second calculation unit calculates s2=s1+e. The signature generation unit calculates s3=s2&#xd7;d mod n and outputs s3 as the calculated value of e&#xd7;d mod n. The signature generation apparatus can thereby generate the above electronic signature securely against differential power attacks.

Signature generation by calculating a remainder modulo public information

A scalar multiplication unit references a t-bit sequence representing a random number k one bit at a time from the most significant bit, and upon each referencing, sets in a work variable R[0] a value obtained by doubling a specific point G on an elliptic curve set in a scalar multiplication variable R, and sets in a work variable R[1] a value obtained by adding the specific point G to the work variable R[0]. The scalar multiplication unitsets the work variable R[0] in the scalar multiplication variable R if the value of the referenced bit is 0, and sets the work variable R[1] in the scalar multiplication variable R if the value of the referenced bit is 1. A scalar multiple point output unitoutputs as a scalar multiple point kG a value obtained by subtracting a constant value 2tG from the scalar multiplication variable R.

Arithmetic apparatus, elliptic scalar multiplication method of arithmetic apparatus, elliptic scalar multiplication program, residue operation method of arithmetic apparatus, and residue operation program

Growing community of inventors

Tokyo, Japan

Yusuke Naito