JP2004347885A - Encryption device processing method, encryption / decryption device processing method, these devices and program - Google Patents

Abstract

An object of the present invention is to verify that a person who knows a plaintext M has created a ciphertext Y in a short time, which is resistant to an active attack and can encrypt a plaintext M longer than the length of an encryption key. Make it possible.
SOLUTION: A random number R is a plain text, and the random number r is encrypted with a public key by a public key cryptosystem of probability cryptography to generate a cipher text C (106). A common key symK is generated (108), a hash function H is applied to M and R to generate data W (111), and a bit combination of M and W is subjected to a common key cryptographic operation using symK to generate a ciphertext. S is generated (114), and the bit combination of C and S is output as ciphertext Y.
[Selection diagram] Fig. 1

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an encryption device and an encryption / decryption device using both a public key encryption method and a common key encryption method, a processing method thereof, and a program.
[0002]
[Prior art]
Generally, encryption methods can be classified into two types: a common key encryption method and a public key encryption method. The public key cryptosystem does not have a problem of key distribution or a problem of key management which is a problem in the common key cryptosystem, and typical public key cryptosystems include RSA encryption, Rabin encryption, ElGamal encryption, Elliptic curve cryptography (elliptical ElGamal cryptography) and the like.
Cryptographic attack methods are roughly classified into passive attack methods and active attack methods. In the passive attack method, an attacker simply searches plaintext from ciphertext and public information. With the active attack method, an attacker can have a legitimate recipient decrypt a ciphertext freely selected by the attacker. Constructing a cryptosystem that is secure against active attack means configuring ciphertext that guarantees stronger security.
[0003]
2. Description of the Related Art Conventionally, as a general method of constructing a ciphertext that is resistant to an active attack based on a deterministic encryption such as the RSA encryption, a method called OAEP (Optimal Asymmetric Encryption Padding) by Bellare and Rogaway is known. (See M. Bellare and P. Rogaway, "Optimal Encryption Encyclopedia with How to Encrypt with RSA", Advances in Cryptology-EUROCRYPT'94, LNCS. Rg. Their method is a method of using two types of random functions. These two types of random functions are, for example, hash functions such as SHA, and the specific configuration method is described in the above-mentioned paper.
[0004]
This OAEP has a problem that the length of a plaintext that can be transmitted in one ciphertext must be shorter than the key length of the applicable public key cryptosystem.
As an improved method of OAEP, OAEP + by Shop is known (see V. Shop, "OAEP Reconciled" Advances in Cryptology-CRYPTO 2001, LNCS, Springer-Verlag, 2001.). OAEP + is a method that uses a random function three times to achieve higher security than OAEP.
However, OAEP + must use a random function three times, and, like OAEP, the length of a plaintext that can be transmitted in one ciphertext must be shorter than the key length of the applicable public key cryptosystem. There was a problem that it did not become.
[0005]
As a method of constructing a ciphertext that is resistant to active attacks using stochastic cryptography, there is known a REACT (Rapid Enhanced-security Asymetric Cryptsystem Transform) proposed in Non-Patent Document 1.
This REACT uses a common key cryptosystem (for example, AES or Camellia) in addition to a random function and a public key cryptosystem (including probability cryptography), and the sender encrypts a random number r by a public key cryptosystem. and c _1, and a random function ciphertext c ₂ obtained by encrypting the plaintext computed function value r 'in the common key cryptography in which a common key r, is sent to the recipient. In the encryption processing, in order to guarantee the validity of the ciphertext, a plaintext, a random number r, a ciphertext c ₁ calculated by a public key cryptosystem, and a ciphertext c ₂ calculated by a common key cryptosystem are converted into a random function. the computed function value _{c 3,} attached to the ciphertext _c 1, _{c 2} as information for the examination.
[0006]
The recipient obtains a r and decrypted using the private key of the recipient c _1, 'seek, r' r and random function calculates r decodes the plaintext from c ₂ a as a common key. After the decryption process, the plaintext, the random number r, and the ciphertexts c ₁ and c ₂ obtained by the decryption are checked to see if a function value obtained by performing a random function operation matches c ₃ . If the validity can be confirmed, the obtained plaintext is regarded as information corresponding to the ciphertext.
REACT enables the application of stochastic cryptography, guarantees high security, and uses a common key cryptosystem to encrypt plaintext and does not use public key cryptography, so the length of plaintext that can be transmitted in one ciphertext , And high communication efficiency can be realized.
[0007]
[Non-patent document 1]
T. Okamoto and D.M. Pointcheval, "REACT: Rapid Enhanced-Security Asymmetric Cryptosystem Transform" The Cryptographer's Track at RSA Conference, LNCS, Springer-200
[0008]
[Problems to be solved by the invention]
REACT includes a ciphertext c ₁ obtained by the public key cryptosystem, if complete common key cipher text c ₂ obtained by the encryption method calculation, the calculation of the information c ₃ for use in the inspection of the validity of the ciphertext There was a problem that the processing could not be started and the processing speed was slow.
An object of the present invention is to provide a cipher that is resistant to active attacks using a public key cryptosystem of general stochastic cryptography, has good communication efficiency using a common key cryptosystem, and can calculate ciphertext at high speed by parallel processing. It is an object of the present invention to provide a decoding device, a decoding device thereof, a processing method of these devices, and a program.
[0009]
[Means for Solving the Problems]
According to the processing method of the encryption device of the present invention, a random number R and r are generated, the random number R is made into a plaintext, and a cryptographic text C is generated by performing encryption with a public key and a public key together with the random number r, The k-bit random number is randomized by a random function G to generate an s-bit secret key symK, and the random number R and plaintext M are randomized by a random function H to generate data W of a fixed number of bits. And the plaintext M are bit-connected, the bit-connected data is encrypted with the secret key symK by a common encryption method to generate a ciphertext S, and the ciphertext C and the ciphertext S are bit-connected and encrypted. Outputs statement Y.
[0010]
According to the processing method of the encryption / decryption device of the present invention corresponding to the processing method of the encryption device, the input cipher text Y is bit-separated into the cipher text S and the cipher text C, and the cipher text C is divided by the secret key pk. A public key cryptosystem is decrypted to generate a random number R, the k-bit random number R is randomized by a random function G to generate an s-bit secret key symK, and a secret key cryptosystem is decrypted using the secret key symK. Is performed on the ciphertext S, the decrypted result is bit-separated into a plaintext M and data W, and the random number R and the plaintext M are randomized by a random function H to generate data W ′ having a fixed number of bits. If W 'and the data W are compared and equal, the plaintext M is output.
[0011]
According to another aspect of the encryption apparatus processing method of the present invention, in the above-described method, the plaintext M is encrypted with the secret key symK into the ciphertext S without performing bit concatenation, and the ciphertext S and the ciphertext C are combined. The data W and the data W are bit-connected to form an output ciphertext Y. Others are the same as the above-mentioned method.
In the processing method of the decryption device corresponding to this processing method, in the decryption device processing method described above, the input ciphertext Y is bit-separated into the ciphertext S, the ciphertext C, and the data W, and the ciphertext S is decrypted with the secret key symK. The result is directly used as plaintext M, and data W ′ obtained by randomization with a random function is compared with bit-separated data W. Others are the same as the above-mentioned method.
[0012]
BEST MODE FOR CARRYING OUT THE INVENTION
The encryption device according to the present invention forms a plaintext M into a ciphertext Y, and the ciphertext Y is decrypted by the encryption / decryption device according to the present invention to obtain a plaintext M. In the configuration of this cryptographic system, a public key cryptosystem and a common key cryptosystem of stochastic cryptography to be used are determined. As the common key cryptosystem, AES, Camellia or a secret key is set to the same length as plain text, and the secret key is used. A method of taking the exclusive OR of the data and the plaintext can be used. The public key of the public key cryptosystem is pk and the secret key is sk. Further, a random function H for converting data of an arbitrary size into data of a specific size and a random function G for converting k-bit data to s bits are used. These random functions H and G are, for example, SHA or the like. A hash function, a specific example of which is given in the above-mentioned OAEP paper. The s bits of the function value of the random function G are equal to the bit length of the secret key symK, for example, about 100 bits or 200 bits when the symmetric key cryptosystem to be used is determined. The fixed bit number n is, for example, approximately equal to the bit length of the secret key symK. The number of bits of the random number r is in a range limited by the public key cryptosystem used.
[0013]
First Embodiment FIG. 1 shows an example of a functional configuration of an encryption device according to a first embodiment of the present invention, and the configuration and a processing method of this device will be described below. The plaintext M to be encrypted is stored in the storage unit 101, and the public key pk of the public key cryptosystem is stored in the storage unit 102.
To generate the ciphertext Y for the plaintext M, first, the random number generator 103 generates a k-bit random number R and an m-bit random number r, and stores them in the storage units 104 and 105, respectively.
These random numbers R and r are input to the encryption unit 106 together with the public key pk, and a public key encryption operation of the probability encryption using the random number R as plain text is performed using the public key pk, and the encrypted text C = E _pk (R, r) is obtained and stored in the storage unit 107.
[0014]
On the other hand, in parallel with the public key encryption operation, the random number R is input to the function operation unit 108, a function operation is performed on the random number R, R is randomized, and an s-bit secret key symK = G (R) is obtained and stored in the storage unit 109.
In parallel with these processes, the plaintext M and the random number R are input to the function operation unit 111, and the plaintext M and the random number R are subjected to a function operation to be randomized, and data W = H (M, R ) Is obtained and stored in the storage unit 112. The plaintext M and the data W are bit-connected by the linking unit 113 to create M‖W.
The secret key symK and the bit connection M と W in the storage unit 109 are input to the encryption unit 114, and a common key encryption encryption operation is performed on the plaintext M using the secret key symK, and the result of the encryption is obtained. The ciphertext S = symE _symK (M‖W) is stored in the storage unit 115.
The ciphertext S in the storage unit 115 and the ciphertext C in the storage unit 107 are bit-connected by the linking unit 116 to generate a ciphertext Y = S‖C, which is output from the encryption device.
[0015]
An input unit 117 for inputting a plaintext M, a public key pk, and the like, a control unit 118 for operating each unit and reading / writing from / to each storage unit, and an output unit 119 for outputting a ciphertext Y are provided. All or a part of the storage units 101, 102, 104, 105, 107, 109, 112, and 115 may be used as a common storage unit. The storage units 104 and 105 are registers in the random number generation unit 103, the storage units 107 and 115 are registers in the encryption units 106 and 114, respectively, and the storage units 109 and 112 are registers in the function operation units 108 and 111, respectively. You may.
[0016]
Next, FIG. 2 shows a functional configuration example of the encryption / decryption device with respect to the encryption device shown in FIG. 1, and the configuration and processing method will be described below.
The ciphertext Y input to the encryption / decryption device is bit-separated into ciphertexts S and C using a separation unit 201 and stored in storage units 202 and 203, respectively. The secret key sk of the public key cryptosystem stored in the encryption unit C and the storage unit 204 is input to the decryption unit 205, and the ciphertext C is subjected to a public key encryption decryption operation using the secret key sk. A random number R = D _sk (C) is obtained and stored in the storage unit 206. The function operation unit 207 performs a function operation on the random number R to randomize the random number R. As a result, an s-bit secret key symK = G (R) is generated and the symK is stored in the storage unit 208.
[0017]
The secret key symK and the ciphertext S read from the storage unit 202 are input to the decryption unit 211, and the ciphertext S is subjected to a public key decryption operation using the secret key symK, and as a result, data M デ ー タ W = symD _{Obtain symK} (S). The data M‖W of the decryption result is bit-separated into plaintext M and data W by the separation unit 212 and stored in the storage units 213 and 214, respectively.
The plaintext M and the random number R between the storage unit 206 are input to the function operation unit 215, and the random number H is calculated by performing a random function H on them, thereby generating an n-bit function value. The comparison unit 216 compares the function value H (M, R) with the data W in the storage unit 214, and verifies whether or not they are equal to each other.
[0018]
If they are not equal, nothing is output, or "verification failed" is output, and if they are equal, the plaintext M in the storage unit 213 is output as a decryption result of the ciphertext Y.
An input unit 217 for ciphertext Y, an output unit 218 for outputting plaintext M, rejection, etc., and a control unit 219 for operating each unit and reading and writing each storage unit are provided. A plurality of or all of the storage units may be used in common, or may be registers in each operation unit or decoding unit.
[0019]
Second Embodiment FIG. 3 shows an example of a functional configuration of an encryption device according to a second embodiment of the present invention, where parts corresponding to those in FIG. 1 are denoted by the same reference numerals. Duplicate description is omitted. In the second embodiment, the connection unit 113 in FIG. 1 is omitted, and the random number generation unit 103 generates random numbers R and r, generates a ciphertext C, and generates a secret key symK as in the first embodiment. And then generates data W. In the second embodiment, the plaintext M is not bit-concatenated with the data W, but the encryption unit 114 performs a common key encryption operation using the secret key symK, and the result of the encryption is ciphertext S = symE _symK ( M) is stored in the storage unit 115. In the linking unit 116, not only the ciphertexts S and C but also the data W are bit-connected and output as ciphertext Y = S と し て W‖C.
[0020]
FIG. 4 shows the functional configuration of the encryption / decryption device according to the second embodiment by assigning the same reference numerals to parts corresponding to those in FIG. 2, and a duplicate description will be omitted. FIG. 4 is different from FIG. 2 in that the separation unit 212 is omitted.
The input ciphertext Y is bit-separated by the separating unit 201 into not only the ciphertext S and the ciphertext C but also the data W, and the data W is stored in the storage unit 214. As in the first embodiment, the ciphertext C is decrypted, the secret key symK is generated, and the ciphertext S is subjected to the common key encryption / decryption operation using the secret key symK. In the second embodiment, the result of decryption by the secret key symK is used as plaintext M without bit separation, and a function operation H is performed on the plaintext M and a random number R. The result H (M, R) The comparison unit 216 compares the data W, which has been bit-separated by the separation unit 201, and outputs nothing or outputs “failure in verification” if they are not equal, and encrypts the plaintext M in the storage unit 213 if they are equal. Output as the result of decrypting sentence Y.
[0021]
1 and 3 can be operated by a computer. In this case, an encryption device processing program for causing a computer to execute the steps of the above-described processing method of the device is installed from a recording medium such as a CD-ROM or a magnetic disk, or into the computer via a communication line. Then, the program may be executed by the computer. Similarly, the encryption / decryption devices shown in FIGS. 2 and 4 may be operated by a computer. In this case as well, an encryption / decryption device processing program for causing a computer to execute each step of the above-described processing method of this device may be used.
[0022]
【The invention's effect】
As described above, according to the present invention, by using the random function, the person who decrypts the ciphertext Y can verify whether the sender knows the value of the plaintext which is the decryption result of the ciphertext Y. . Therefore, when the verification of the decryption process is passed, it is possible to confirm that the sender knows the value of the plaintext M which is the decryption result of the ciphertext Y, so that the encryption method that can guarantee the security against an active attack is also possible. It has become.
In terms of communication efficiency, similar to REACT, the plaintext M to be transmitted is not encrypted by the public key encryption method, and the plaintext M is encrypted by the common key encryption method. There is no restriction on the length of the plaintext M that can be transmitted.
[0023]
Further, in general, the operation amount of the public key encryption (E _pk , D _sk ) is larger than the operation amount of the secret key encryption (sym _E sym _K , sym _D sym _k ) and the functions G and H. In the processing, all other information used for the cipher text can be calculated by performing parallel processing in the process of calculating the public key encryption (E _pk , D _sk ). That is, the amount of cryptographic operation on plaintext in the present invention is equal to the amount of operation of public key cryptography (E _pk , D _sk ). In other words, according to the present invention, the generation of the ciphertext S and the ciphertext C and the data W required for verification are performed in parallel, thereby eliminating the calculation waiting time, performing the encryption processing at high speed, and improving the security. It is possible to do.
[0024]
Moreover when the ciphertext S and C is generated, since the information used to verify the validity of the ciphertext is generated, the verification of the validity of the ciphertext after ciphertext c ₁ and c ₂ are obtained it is possible to generate a ciphertext Y in a shorter time than REACT to generate information c ₃ used.
In the first embodiment, the encryption processing is performed by the encryption unit 114 after the data W is obtained. In the second embodiment, when the entire processing is started, the encryption processing is directly performed on the plaintext M. , The processing time can be shortened accordingly. Assuming that the length of the plaintext M is t bits, the input bit length of the function operation unit 111 is t + k, but the REACT is 2t + 2k. The present invention is also advantageous in this regard.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of a functional configuration of an encryption device according to a first embodiment of the present invention.
FIG. 2 is a diagram showing a functional configuration example of the encryption / decryption device according to the first embodiment of the present invention.
FIG. 3 is a diagram showing an example of a functional configuration of an encryption device according to a second embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of a functional configuration of an encryption / decryption device according to a second embodiment of the present invention.

Claims (10)

A processing method of an encryption device that inputs a plaintext M and a public key of a public key encryption method to an encryption device and outputs a ciphertext,
Generating random numbers R and r;
A process in which the random number R is plaintext, and the random number r is encrypted together with the public key using the public key by a public key cryptosystem, and the encrypted text C is stored in a storage unit;
a process of randomizing the random number R with a random function for converting k-bit data to s-bit data to generate a secret key symK and storing it in a storage unit;
A process of randomizing the random number R and the plaintext M with a random function that converts data of an arbitrary size into data of a specific size to generate data W;
Bit concatenating the data W and the plaintext M;
Encrypting the bit-connected data with the secret key symK by a common encryption method to generate a ciphertext S and storing it in a storage unit;
Outputting the ciphertext Y by bit-concatenating the ciphertext C and the ciphertext S. The processing method of the above-described apparatus, in which a ciphertext Y is input to an encryption / decryption apparatus that holds a secret key pk of a public key cryptosystem and a plaintext M is output,
A step of separating the ciphertext Y into a ciphertext S and a ciphertext C by bit separation and storing them in a storage unit
Decrypting the ciphertext C with the secret key pk using a public key cryptosystem to generate a random number R and storing the random number R in a storage unit;
generating a secret key symK by randomizing the random number R with a random function that converts k-bit data into s-bit data;
Performing decryption of the common key cryptosystem on the ciphertext S with the secret key symK;
A step of separating the decryption result of the common key cryptosystem into plaintext M and data W and storing the result in a storage unit;
A process of randomizing the random number R and the plaintext M with a random function for converting data of an arbitrary size into data of a specific size to generate data W ′;
Comparing the data W 'with the data W and outputting the plaintext M if they are equal. A random number generation unit that generates random numbers R and r;
A first encryption unit that receives the random numbers R and r and a public key, performs an encryption operation of the public key cryptosystem on the random numbers R and r with the public key, and outputs a ciphertext C;
A first function calculator that receives the random number R, calculates a random function for the random number R, converts k-bit data into s-bit data, and outputs a secret key symK;
A second function operation unit that receives the plaintext M and the random number R, calculates a random function on these, and outputs data W having a fixed number of bits;
A first connection unit to which the plaintext M and the data W are input, and that these are bit-connected and output;
A second encryption unit to which an output of the connection unit and the secret key symK are input, and an encryption operation of a common key encryption method is performed on the output of the connection unit with the secret key symK to output a ciphertext S;
A ciphering apparatus comprising: a ciphertext C and a ciphertext S that are input; and a second linking unit that bit-concatenates them and outputs ciphertext Y. A separation unit that performs bit separation of the input ciphertext Y into a ciphertext S and a ciphertext C;
A first decryption unit that receives the ciphertext C and performs a decryption operation of the public key cryptosystem on the secret key pk to generate a random number R;
A first function operation unit that receives the random number R and performs a random function operation for converting k-bit data into s-bit data to generate a secret key symK;
A second decryption unit that receives the ciphertext S and the secret key symK and performs a decryption operation on the ciphertext S with the secret key using a common key cryptosystem;
A separating unit which receives a decoding operation result from the second decoding unit and separates the result into plaintext M and data W;
A second function operation unit that receives the plaintext M and the random number R, performs a random function operation for converting data of an arbitrary size into data of a specific size, and generates data W ′;
An encryption / decryption device comprising: the data W ′ and the data W; and a comparison unit that compares the data W and outputs the plaintext M if they are equal. A processing method of an encryption device that inputs a plaintext M and a public key of a public key encryption method to an encryption device and outputs a ciphertext,
Generating random numbers R and r;
Converting the random number R into plain text, encrypting the random number r with the public key using the public key by a public key cryptosystem, and storing the encrypted text C in a storage unit;
a process of randomizing the random number R with a random function for converting k-bit data to s-bit data to generate a secret key symK and storing it in a storage unit;
A process of randomizing the random number R and the plaintext M with a random function that converts data of an arbitrary size into data of a specific size to generate data W;
Encrypting the plaintext M with the secret key symK by a common encryption method to generate a ciphertext S and storing it in a storage unit;
Encrypting the ciphertext C, the ciphertext S, and the data W, and outputting a ciphertext Y. The processing method of the above-described apparatus, in which a ciphertext Y is input to an encryption / decryption apparatus that holds a secret key pk of a public key cryptosystem and a plaintext M is output,
A process of separating the ciphertext Y into a ciphertext S, a ciphertext C, and data W and separating the ciphertext Y into a storage unit;
Decrypting the ciphertext C with the secret key pk using a public key cryptosystem to generate a random number R and storing the random number R in a storage unit;
generating a secret key symK by randomizing the random number R with a random function that converts k-bit data into s-bit data;
Decrypting the ciphertext S with the secret key symK on the ciphertext S to obtain a plaintext M;
A process of randomizing the random number R and the plaintext M with a random function for converting data of an arbitrary size into data of a specific size to generate data W ′;
Comparing the data W 'with the data W and outputting the plaintext M if they are equal. A random number generation unit that generates random numbers R and r;
A first encryption unit that receives the random numbers R and r and a public key, performs the encryption operation of the public key cryptosystem using the random number R as a plaintext, and the public key together with the random number r, and outputs a ciphertext C;
A first function calculator that receives the random number R, calculates a random function for the random number R, converts k-bit data into s-bit data, and outputs a secret key symK;
A second function operation unit that receives the plaintext M and the random number R, calculates a random function on these, and outputs data W having a fixed number of bits;
A second encryption unit that receives the plaintext M and the secret key symK, performs an encryption operation on the plaintext M with the secret key symK using a common key encryption method, and outputs a ciphertext S;
An encryption apparatus comprising: a coupling unit to which the ciphertext C, the ciphertext S, and the data W are input, bit-concatenating these, and outputting a ciphertext Y. A separation unit that performs bit separation on the input ciphertext Y into data W, ciphertext S, and ciphertext C;
A first decryption unit that receives the ciphertext C and performs a decryption operation of a public key cryptosystem on the secret key pk to generate a random number R;
A first function operation unit that receives the random number R and performs a random function operation for converting k-bit data into s-bit data to generate a secret key symK;
A second decryption unit that receives the secret key symK and the ciphertext S, performs a decryption operation on the ciphertext S with the secret key symK using a common key cryptosystem, and generates a plaintext M;
A second function operation unit that receives the plaintext M and the random number R, and performs a random function operation to convert data of an arbitrary size into data of a specific size to generate data W ′;
An encryption / decryption device comprising: the data W ′ and the data W; and a comparison unit that compares the data W and outputs the plaintext M if they are equal. A program for causing a computer to execute each step of the encryption device processing method according to claim 1. A program for causing a computer to execute each step of the encryption / decryption device processing method according to claim 2.

Images