Patent Grant
6940975
This application is based on Japanese Patent Application No. 10-233921, filed Aug. 20, 1998, the contents of which are incorporated herein by reference.
The present invention relates to an encryption/decryption apparatus and method and, more particularly, to an encryption/decryption apparatus and method which use secret key block encryption and a program storage medium therefor.
The DES (Data Encryption Standard) is secret key block cipher that has currently been used most widely, which is described in detail in Jpn. Pat. Appln. KOKAI Publication No. 51-108701.
The DES has been evaluated in various viewpoints, and cryptanalysis such as a differential cryptanalysis and linear cryptanalysis, which are more effective than a key exhaustive search method, have been proposed.
Note that the differential cryptanalysis is disclosed in E. Biham and A. Shamir, “Differential Cryptanalysis of DES-like Cryptosystems,” Journal of CRYPTOLOGY, Vol. 4, Number 1, 1991. The linear decryption method is disclosed in Mitsuru Matsui, “Linear Cryptanalysis of DES Cipher”, Encryption and Information Security Symposium, SCIS93-3C, 1993.
There is a new cryptanalysis based on power consumption differences. In this method, power consumption differences between given bits of data (power consumption corresponding to bit 0 and power consumption corresponding to bit 1) are measured to estimate bits. In the case of the DES, for example, an input to an S-box and a corresponding output are estimated on the basis of a known ciphertext output and estimation of a key. A power consumption difference that appears when a given one bit is 0 or 1, which is estimated on the basis of the output from the S-box, is measured to check the validity of estimation, i.e., the validity of estimation of the key.
For this reason, there is a possibility that a DES ciphertext is broken by the above method, and hence higher security has been required.
It is an object of the present invention to provide an encryption/decryption apparatus and method which make it difficult to perform decryption by a technique based on power consumption differences without changing the data encryption processing result obtained by a conventional encryption/decryption apparatus and method, and a program storage medium for the apparatus and method.
In order to achieve the above object, according to the first aspect of the present invention, there is provided an encryption apparatus for converting a plaintext block into a ciphertext block depending on supplied key information, comprising means for randomly selecting one pattern of each of pairs ai,{overscore (ai)} (where i is a positive integer not less than one) of one or a plurality of predetermined mask patterns and mask patterns obtained by bit inversion of the predetermined mask patterns every time encryption is performed, means for masking bits dependent on a plaintext within the apparatus with the mask pattern selected by the selection means, and means for removing an influence of the mask a from a ciphertext before the ciphertext is output.
According to the second aspect of the present invention, there is provided an encryption apparatus for converting a plaintext block into a ciphertext block depending on supplied key information, comprising means for randomly selecting one pattern of each of pairs ai,{overscore (ai)} (where i is a positive integer not less than one) of one or a plurality of predetermined mask patterns and mask patterns obtained by bit inversion of the predetermined mask patterns every time encryption is performed, means for masking intermediate bit data within the apparatus with the mask pattern selected by the selection means, and means for removing an influence of the mask a from the intermediate bit data masked by the masking means.
According to the third aspect of the present invention, there is provided an encryption method of converting a plaintext block into a ciphertext block depending on supplied key information, comprising the steps of randomly selecting one pattern of each of pairs ai,{overscore (ai)} (where i is a positive integer not less than one) of one or a plurality of predetermined mask patterns and mask patterns obtained by bit inversion of the predetermined mask patterns every time encryption is performed, masking bits dependent on a plaintext within the method with the selected mask pattern, and removing an influence of the mask a from a ciphertext before the ciphertext is output.
According to the fourth aspect of the present invention, there is provided an encryption method of converting a plaintext block into a ciphertext block depending on supplied key information, comprising the steps of randomly selecting one pattern of each of pairs ai,{overscore (ai)} (where i is a positive integer not less than one) of one or a plurality of predetermined mask patterns and mask patterns obtained by bit inversion of the predetermined mask patterns every time encryption is performed, masking intermediate bit data within the method with the selected mask pattern, and removing an influence of the mask a from the masked intermediate bit data.
According to the fifth aspect of the present invention, there is provided a computer-usable program storage medium storing computer-readable program code means for converting a plaintext block into a ciphertext block depending on supplied key information, comprising computer-readable program code means for causing a computer to randomly select one pattern of each of pairs ai,{overscore (ai)} (where i is a positive integer not less than one) of one or a plurality of predetermined mask patterns and mask patterns obtained by bit inversion of the predetermined mask patterns every time encryption is performed, computer-readable program code means for causing the computer to mask bits dependent on a plaintext within the method with the selected mask pattern, and computer-readable program code means for causing the computer to remove an influence of the mask a from a ciphertext before the ciphertext is output.
According to the present invention, original data is masked, and the mask is removed immediately before it is inputted to each S-box. When this mask is removed, there is a possibility that the data may be broken by the above technique based on power consumption differences. For this reason, according to the present invention, mask removal processing immediately before the data is input to each S-box, input operation of the original data to each S-box immediately after mask removal, and masking operation for the output from each S-box are calculated in advance and stored as a table, and the calculation result is obtained by looking up the table. For this reason, neither calculation of an exclusive OR for mask removal nor calculation of an exclusive OR for masking are performed during encryption and decryption, the data cannot be decrypted by the technique based on power consumption differences.
According to the present invention, consistency of encryption and decryption is ensured, and security against the decryption technique based on power consumption differences can be improved by making it difficult to decrypt data by the technique based on power consumption differences.
Additional objects and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objects and advantages of the invention may be realized and obtained by means of the instrumentalities and combinations particularly pointed out hereinafter.
The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate presently preferred embodiments of the invention, and together with the general description given above and the detailed description of the preferred embodiments given below, serve to explain the principles of the invention.
An embodiment of the present invention will be described below with reference to the views of the accompanying drawing.
Referring to
After these data are processed by the 16 round functions, a ciphertext 7 is output by a final permutation IP−1 6.
The right 32-bit data is extended into 48-bit data by the permutation E 11. The resultant data is output to the exclusive OR 13. The exclusive OR 13 outputs the exclusive OR of the output from the permutation E 11 and an extended key 12. The 48-bit data output from the exclusive OR 13 is equally divided into 6-bit data. Each 6-bit data is input to a corresponding one of the S-boxes 14. In this embodiment, each S-box is formed from a table, and outputs 4-bit data with respect to a 64-entry 6-bit input. According to S1 based on the DES, if the left and right ends of a 6-bit input are respectively regarded as the first and sixth bits, a row in a table of the S-box in
An embodiment of the present invention will be described in detail below with reference to
Referring to
When the switch SW12 causes data to branch to the 0 side, the process indicated by a dashed line 34a is performed. More specifically, an exclusive OR 32a calculates the exclusive OR of the output from the exclusive OR 27 and six bits (E(a)) of the result obtained by performing the expansion E for the mask a which corresponds to an input of the S-box, and outputs the resultant data to the S-box 29. The S-box 29 outputs the result obtained by looking up the table of the S-box to an exclusive OR 33a.
The exclusive OR 33a calculates the exclusive OR of bits of p−1(a) as the result obtained by performing inverse permutation p−1 for the mask a and the output from the S-box 29, and outputs the resultant data to the switch SW11.
When the switch SW12 causes the data to branch to the 1 side, the process indicated by a dashed line 34b is performed. More specifically, an exclusive OR 32b calculates the exclusive OR of the output from the exclusive OR 27 and bits of the result obtained by performing the expansion E for the mask ā which corresponds to an input of the S-box, and outputs the resultant data to the S-box 29. The S-box 29 looks up the table of the corresponding S-box and outputs the resultant data to the exclusive OR 33b.
The exclusive OR 33b calculates the exclusive OR of four bits of p−1(ā) as the result obtained by performing inverse permutation p−1 of a permutation P(30) for the mask ā which corresponds to an output from the S-box and the output from the S-box 29, and outputs the resultant data to the switch SW11.
Note that the processes indicated by the dashed lines 34a and 34b must not be performed during encryption and decryption. This is because, even if data is concealed with the above mask, since input/output operation of the S-box 29 is not concealed, cryptanalysis may be attempted by using power consumption differences in S-box processing.
In this embodiment of the present invention, the results of the processes indicated by the dashed lines 34a and 34b are obtained first by pre-calculation performed before encryption and decryption, and encryption processing and decryption processing are then performed. For example, a table in which the index of each input to each S-box and a corresponding output are rewritten is prepared for each S-box, and is used for encryption and decryption. In this case, a table of an S-box corresponding to the mask a and a table of an S-box corresponding to the mask ā are prepared. For example, the following is the result obtained by calculating the process block 34a in
The outputs from the respective process blocks indicated by the dashed lines 34a and 34b are permutated by a permutation P 30. The resultant data is output to an exclusive OR 31. The exclusive OR 31 calculates the exclusive OR of the left 32-bit data and the output from the permutation P 30. An exclusive OR 24 calculates the exclusive OR of the right 32-bit data and the output from the switch SW13 to obtain new right 32-bit data.
Referring to
The output from the exclusive OR 43a becomes the right 32-bit data of an input of the first round function. In the case shown in
Referring to
The characteristics of the arrangement shown in
The exclusive ORs 44a, 42a, and 43a conceal data by using masks such as the masks a and b. With this operation, in the data scrambler, it is difficult to observe the left 32-bit data and right 32-bit data from the outside world. If, however, data is concealed by using the above masks, inputs to the respective S-boxes 14 in
In order to solve the above problem, in each round function, the exclusive OR 25 in
The exclusive OR 24 in
At the output of the final round, to eliminate the influence of each mask on concealment in
The switches SW11, SW12, SW13, and SW14 are controlled by a random number sequence {Rli}. The switches SW21, SW22, and SW23 are controlled by a random number sequence {R2i}. For example, each switch selects a branch to the 0 side when Rji=0, and selects a branch to the 1 side when Rji=1. The random number sequences {R1i} and {R2i} for controlling the switches are characterized by being changed for each of encryption and decryption processes for the respective blocks. For example, in a given encryption process, all the switches SW11, SW12, SW13, and SW14 on the respective rounds perform processing on the 0 side. In another encryption process, all the switches SW11, SW12, SW13, and SW14 on the respective round perform processing on the 1 side.
If there is a clear relationship of dependence between the random number sequences {R1i} and {R2i}, an attacker has a clue to the estimation of the masks a and b, random number sequences having no clear relationship of dependence are used as the random number sequences {R1i} and {R2i}. Ideally, the use of two random number sequences which are statistically independent is recommended. In practice, however, even if there is a statistical dependence relationship, this cryptanalysis technique is effective as a measure against cryptanalysis based on power consumption differences, as long as the relationship is sufficiently weak. Two m sequence generators may be prepared as means for implementing the present invention, and outputs from the first and second m sequence generators may be respectively set to {R1j} and {R2j}. If the period of an m sequence is sufficiently long and the sequence lengths of the two m sequence generators, corresponding convention polynomials, and part or all of initial values are made to differ from each other, the above condition can be sufficiently satisfied. As another means for implementing random number sequences, one m sequence generator may be prepared to generate two bits for each encryption or decryption process. The first and second bits are respectively used as {R1j} and {R2j}.
Although the m sequence generators are presented as practical examples in this case, any random number sequence generator can be used as long as security in practice can be ensured. Note that these random number sequences must be implemented so as not to be estimated from the outside world. According to still another implementation means, random number sequences may be stored in a memory in advance to be sequentially referred to. Note that these random number sequences must be implemented so as not to be estimated from the outside world.
Referring to
Referring to
That is, if the Hamming weights of the respective masks are not extremely offset, it is not easy to discriminate the masks by measurement from the outside world. Therefore, the effect of a countermeasure against the technique based on power consumption differences can be obtained.
Consider the characteristics of the expansion E 26 based on the DES in
When the above mask condition is applied to the implementation of the DES, for example, it is required that both the number of 1s of the “first bits” (the bits on the left ends) of the respective 4-bit blocks of the mask a and the number of 1s of the “fourth bits” (the bits on the right ends) of the respective 4-bit blocks of the mask a are 4 each. That is, this embodiment is characterized by selecting the masks a and b that satisfy the above condition. As mask value that satisfy the above condition,
(10000011111011011110010100100001)2,
(11011010011001010011010110001010)2, and the like can be used.
Ideally, the use of mask values that satisfy the above condition is recommended. However, a similar effect can be obtained if “the number of 1s of the “first bits” of the respective 4-bit blocks of the mask a” and “the number of 1s of the “fourth bits” of the respective 4-bit blocks of the mask a” are not extremely offset.
In using the mask values that satisfy the above condition, when there is no clear correspondence between the random number sequences {R1j} and {R2j} for controlling the switches, even if the same mask value is used for the masks a and b, effective countermeasures can be taken against decryption using the technique based on power consumption differences.
The DES arrangement shown in
Modifications in which the present invention is applied to the DES will be described below.
A method of preventing cryptanalysis using the technique based on power consumption differences by applying the present invention to such a modified DES will be described below.
The output obtained by performing an initial permutation for an input plaintext is divided into two equal halves. The right 32-bit data is input to an expansion E 61a, and the left 32-bit data is input to an expansion E 61b. An exclusive OR 64 calculates the exclusive OR of the 48-bit data output from the expansion E 61a and the mask E(a)/E(a) and outputs the resultant data to an exclusive OR 65. The exclusive OR 65 calculates the exclusive OR of the output from the exclusive OR 64 and the mask E(b)/E(b) to obtain the right 48 bits of an input to the first round. Note that the sequence of the exclusive ORs 64 and 65 may be interchanged depending on the characteristics of the exclusive ORs.
An exclusive OR 69 calculates the exclusive OR of the 48-bit data output from the expansion E 61b and the mask E(b)/E(b) to obtain the left 48 bits of an input to the first round.
An exclusive OR 66 calculates the exclusive OR of the right 48 bits of the input and the mask E(a)/E(a) to obtain the left 48 bits of an input to the next round. An exclusive OR 67 calculates the exclusive OR of the right 48 bits of the input and the E(b)/E(b) and outputs the resultant data to an exclusive OR 68. The exclusive OR 68 calculates the exclusive OR of the output from the exclusive OR 67 and the extended key K1 and outputs the resultant data to Ŝ 62 (“^” indicates exponentiation). The structure of Ŝ 62 will be described later. The output from Ŝ 62 is permuted by an EP 63 and output to an exclusive OR 70.
The shift register 70 calculates the exclusive OR of the left 48 bits of the input data and the output from the EP 63 to obtain the right 48 bits of an input to the next round. The processing on the first round is repeated up to the 16th round. The output from the final round is subjected to processing reverse to that for the input to the first round. More specifically, the right 48 bits are subjected to the exclusive OR 65, exclusive OR 64, and contraction permutation E−1, whereas the left 48 bits are subjected to the exclusive OR 65 and contraction permutation E−1. The resultant two 32-bit data are output to the final permutation.
Referring to
That is, a block 74 in
The embodiment of the present invention is characterized in that the result of the process in the block 74 is obtained first by calculation performed in advance before encryption and decryption, and are then used for encryption processing and decryption processing. For example, a table in which the index of each input to each S-box and a corresponding output are rewritten is prepared for each S-box and used as Ŝ for encryption processing and decryption processing. In this case, an Ŝ table corresponding to the mask α and an Ŝ table corresponding to the mask {overscore (α)} are prepared in each S-box.
In the implementation of the DES in
At the output of the 16th state, the right 32 bits are input a permutation P 82a, and the left 32 bits are input to a permutation P 82b. The respective 32-bit data are input to a final permutation IP−1 89. As a consequence, a 64-bit ciphertext 90 is output. A method of preventing cryptanalysis using the technique based on power consumption differences by applying the present invention to such a modification of the DES will be described below.
Referring to
The output obtained by performing an initial permutation for an input plaintext is divided into two equal halves. The right side 32-bit data is input to a permutation P−1 91a, and the left 32-bit data is input to a permutation P−1 91b. An exclusive OR 94 calculates the exclusive OR of the 32 bits output from the permutation P−1 91a an P−1(a)/P−1(ā) and outputs the resultant data to an exclusive OR 95. The inverter circuit 95 calculates the exclusive OR of the output from the exclusive OR 94 and the mask P−1(a)/P−1(ā) to obtain the right 32 bits of an input to the first round. Note that the sequence of the exclusive ORs 94 and 95 may be interchanged depending on the characteristics of the exclusive ORs.
An exclusive OR 96 calculates the exclusive OR of the right 32 bits of the input and the mask P−1(ā)/P−1(a) to obtain the left 34 bits of an input to the next round. An exclusive OR 97 calculates the exclusive OR of the right 32 bits of the input and the mask P−1(b)/P−1({overscore (b)}) and outputs the resultant data to an EP 93. The 48-bit output obtained by expansion at the EP 93 is output to an exclusive OR 98 to be exclusive-ORed with the enlarge key K1. The resultant data is output to Ŝ 92. The structure of Ŝ 92 will be described later. The output from Ŝ 92 is output to an exclusive OR 100 to be exclusive-ORed with the left 32 bits of the input data so as to obtain the right 32 bits of an input to the next round. The above processing on the first state is repeated up to the 16th round.
The output from the final round is subjected to processing reverse to that for the input to the first round. More specifically, the right 32 bits are subjected to the exclusive OR 95, exclusive OR 94, permutation P, whereas the left 32 bits are subjected to the exclusive OR 95 and permutation P. The resultant two 32-bit data are output to the final permutation.
Referring to
An exclusive OR 103 calculates the exclusive OR of the output from the S-box 102 and a mask P1E−1(α) or P1E−1({overscore (α)}) to obtain an output from Ŝ 92. That is, a block 104 in
In this case, an Ŝ table corresponding to the mask α and an Ŝ table corresponding to the mask {overscore (α)} are prepared in each S-box.
An embodiment in which the present invention is applied to a key scheduler will be described next with reference
A mask pattern c for masking a bit pattern K of a true key and a bit inversion pattern {overscore (c)} are prepared. Let Kc be the value obtained by converting K with c by using designated dyadic operation, and K{overscore (c)} be the value obtained by converting K with {overscore (c)} by using the same dyadic operation. The values Kc and K{overscore (c)} are stored in the memory in advance. Every time encryption or decryption is executed, one of the values Kc and K{overscore (c)} is randomly selected and processed in the same manner as the true key. The resultant data is applied to a plaintext by the above dyadic operation, and inversion of the dyadic operation is performed to remove the influence of the pattern c or {overscore (c)} from the output obtained by the dyadic operation. A case wherein the present invention is applied to a DES scheme as an encryption scheme using exclusive OR operation as dyadic operation will be described first. First of all, two masked keys Kc and K{overscore (c)} are prepared:
Kc=K(+)c
K{overscore (c)}=K(+){overscore (c)}
where (+) represents an exclusive OR for each bit.
Prior to encryption or decryption, one of the keys Kc and K{overscore (c)} is randomly selected, and a key schedule process of the DES is performed to sequentially generate 16 extended keys. The 16 keys extended from Kc are expressed by Kci (i=1, . . . , 16), and the keys extended from K{overscore (c)} are expressed by K{overscore (ci)} (i=1, . . . , 16). The keys extended from Kc are influenced by the mask c, and the keys extended from K{overscore (c)} are influenced by the mask {overscore (c)}. This influence is determined by the key schedule process of the DES. In this case, however, the keys extended from the true key K, which is not masked, according to a key schedule are expressed by Ki (i=1, . . . , 16), the exclusive OR of Ki and Kci is expressed by ci, and the exclusive OR of Ki and K{overscore (ci)} is expressed by {overscore (ci)}. That is, ci=Ki (+)Kci {overscore (ci)}=Ki (+)K{overscore (ci)}.
In the DES, each extended key Ki is applied to a message by an exclusive OR for each bit immediately after the expansion E. In the present invention, Kci or K{overscore (ci)} is applied in place of Ki. When Kci is applied, its influence is removed by applying ci by exclusive OR operation after the application of Kci. When K{overscore (ci)} is applied, its influence is removed by applying {overscore (ci)} by exclusive OR operation after the application of K{overscore (ci)}. The values ci and {overscore (ci)} are obtained by enlarging c and {overscore (c)} according to the key schedule of the DES in the same manner as extended keys. The value ci or {overscore (ci)} may be generated from the mask c or {overscore (c)} selected every time encryption or decryption is performed. However, the method of calculating ci and ci in advance is the method that can suppress the leakage of information most against observation from the outside world. In this case, two sets of 16 48-bit masks, i.e., a total of 1,536 bits, are prepared. When, for example, the present invention is applied to IC cards, since these masks can be fixed at least for each card, ci and {overscore (ci)} can be written in the ROM. This is important especially for IC cards whose storage capacities are severely constrained. In general, when the same number of bits are to be stored, the area of a ROM is smaller than that of a RAM or EEPROM. When a 1,536-bit mask is stored in a ROM, the use efficiency of an LSI chip area becomes higher than when the mask is stored in a RAM or EEPROM.
Referring to
On the key input round of the key scheduler, Kc and K{overscore (c)}are randomly selected by a switch SW31 with a probability of almost ½ and input to a key scheduler 122. The subsequent processing in the key scheduler is the same as key schedule processing in the general DES. An extended key 123 to be output is Kci when the input key is Kc, and K{overscore (ci)} when the input key is Kci.
A method of applying Kci or K{overscore (ci)} to a message is generally the same as the method of applying Ki to a message. An exclusive OR 132 applies the extended key Kci or K{overscore (ci)} to the 48 bits output from an expansion E 131 in units of bits by exclusive OR operation. Since the resultant data is influenced by the mask c or {overscore (c)}, if this data is input to an S-box without any change, correct encryption cannot be performed. For this reason, the influence of the mask c or {overscore (c)} on the data must be removed before it is input to the S-box. More specifically, if the influence of the mask is represented by ci, ci is applied to the data by an exclusive OR 133 before the data is input to an S-box 134. Since inversion of an exclusive OR is an exclusive OR, the influence of ci can be removed. This applies to a case wherein the influence of the masks is represented by {overscore (ci)}.
In this embodiment, if the mask {overscore (c)} is selected as bit translation of the mask c, the respective bits of the extended key uniformly take the values “1” and “0”. This can prevent leakage of information about the key against various types of observation from outside the encryption apparatus. To minimize leakage of information, ci and {overscore (ci)} preferably have similar Hamming weights. Note, however, that ci is obtained by processing c through a key schedule. It is therefore difficult to completely control the Hamming weights of ci on all the rounds. Under the circumstances, a method of selecting a mask having a Hamming weight corresponding to ½ the bit size as the original mask c may be used.
When plaintext data is input (step U1), at least one i-th mask pair is selected (step U2). With this operation, mask patterns ai (step U3) or inverted mask patterns ā of the mask patterns ai are selected. The data is masked with the selected masks (step U5). It is checked whether the next mask pair is selected (step U6). If the selection of the next masks are required, the processing is repeated from the step of selecting the new i-th mask pair (step U2). If the selection of the required mask pair is complete, an encryption process of the data is performed (step U7).
Since the intermediate output data obtained by the encryption process (step U7) has been masked with the mask patterns, the i-th mask pair is determined first (step U8) to determine whether the mask patterns ai were used (step U9) or the inverted mask patterns ā were used (step U10). The masks applied to the data are removed (step U11). It is then checked whether mask removal is complete (step U12). If masks are left, the processing is repeated from the step of determining the new mask pair (step 8). If mask removal is completed by the above steps, the ciphertext is output (step U13).
When data is input to the data translation (step V1), an i-th mask pair is checked (step V2) to determine whether mask patterns ai were used (step V3) or inverted mask patterns ā of the mask patterns ai were used (step V4). The masks applied to the data are removed (step V5).
It is checked whether mask removal is complete (step V6). If masks are left, the processing is repeated from the step of checking a new mask pair (step V2). If mask removal is completed by the above steps, data translation is performed (step V7).
For the output data upon the above data translation (step V7), at least one i-th mask pair is selected (step V8), and the mask patterns ai (step V9) or mask patterns ā (step V10) are selected. The data is masked with the selected masks (step V11). It is then checked whether the next mask pair is selected (step V12). If selection of a mask pair that demands selection of the next mask and masking are complete, the data is output from the data translation (step V13).
When ciphertext intermediate value as intermediate encryption bit data is input (step W1), an i-th mask pair is checked (step W2) to determine whether mask patterns ai were used (step W3) or inverted mask patterns ā of the mask patterns ai were used (step W4). The masks applied to the data are removed (step W5).
It is then checked whether mask removal is complete (step W6). If masks are left, the processing is repeated from the step of checking a new mask pair (step W2). When mask removal is completed by the above steps, an encryption process is performed by an expansion E round function (step W7).
For the output data from the encryption round function (step 7W), at least one i-th mask pair is selected to select the mask patterns ai (step W9) or the inverted mask patterns ā (step W10). The data is masked with the selected mask pair (step W11). It is further checked whether the next mask pair is selected (step W12). If selection of a mask pair that demands selection of the next mask and masking are complete, the ciphertext intermediate value is output (step W13).
For an intermediate value of the encryption data having undergone the above masking process (step X4), mask patterns for masking the input data of a round function is selected (step X5). The masks are removed from the input data of the round function (step X6). Mask patterns for masking an input to the data translation are selected (step X7). The masks are removed from the input data to the data translation (step X8). The data translation then converts the input data (step X9).
Mask patterns for masking the output from the data translation (step X9) are selected (step X10), and the output data from the data translation is masked with the mask patterns (step X11). Mask patterns for masking the output data of the round function are selected (step X12), and the output data of the round function is masked with the mask patterns (step X13).
It is checked whether the above procedure is complete up to the nth round (step X14). If the processing is not complete, the processing is repeated from step X4. If the processing is complete up to the nth round, mask patterns that mask the ciphertext are selected (step X15), and the masks are removed from the bits dependent on the ciphertext (step X16). The finally obtained ciphertext is output (step X17).
AS the processing in steps X2, X3, X15, and X16, the processing described with reference to
In the above embodiment, the application of the present invention to the DES scheme has been described in detail. However, the present invention is not limited to this and can be applied to general encryption schemes comprised of part or all of the following three types of functions, namely dyadic operation like exclusive OR operation, a permutation equivalent to bit interchange, and cipher system equivalent an S-box.
Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described herein. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10-233921 | Aug 1998 | JP | national |
| Number | Name | Date | Kind |
|---|---|---|---|
| 3962539 | Ehrsam et al. | Jun 1976 | A |
| 5323464 | Elander et al. | Jun 1994 | A |
| 5682395 | Begin et al. | Oct 1997 | A |
| 5870470 | Johnson et al. | Feb 1999 | A |
| 6031911 | Adams et al. | Feb 2000 | A |
| Number | Date | Country |
|---|---|---|
| 10-154976 | Jun 1998 | JP |
| WO 9948239 | Sep 1999 | WO |
