JP2017129779A - Cipher generation device, data transmission system, cipher generation method, and data transmission method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a cipher generation device for increasing safety of cipher.SOLUTION: An encryption unit 2020 generates a cipher text from a plain text by using a cipher key and a random number. A random number information output unit 2040 outputs random number information before the encryption part 2020 acquires both the plain text and the cipher key. A cipher output unit 2060 outputs the cipher text generated by the encryption unit 2020. In a cipher generation device 2000, the encryption unit 2020 generates the cipher text from data obtained by connecting the plain text with the random number, or the cipher output unit 2060 outputs both the cipher text and the random number.SELECTED DRAWING: Figure 1

Description

  The present invention relates to cryptographic technology.

  Cryptography is used to exchange information securely between devices. The transmission side device encrypts information (hereinafter, plaintext) to be transmitted to the transmission destination device using an encryption key to generate a ciphertext. The transmission destination device acquires this ciphertext and decrypts the ciphertext using the decryption key, thereby restoring the plaintext.

  For example, Patent Documents 1 and 2 are documents showing prior art related to cryptographic processing. The encryption device of Patent Literature 1 determines the strength of encryption based on the value of information to be encrypted. Patent Document 2 discloses a rearrangement encryption scheme invented by the present inventors.

JP 2006-94241 A Japanese Patent No. 4737334

  One attack against ciphertext is called an insider attack. An insider attack can be recognized by a device that performs encryption processing or the creator or administrator of a cryptographic program used in that device by including unauthorized processing in the processing performed by that device or cryptographic program. It is an attack that leaks the contents of plaintext and encryption keys so that they will not.

  The present inventor is vulnerable to an insider attack in the rearrangement encryption method disclosed in Patent Document 2 and the Advanced Encryption Standard (AES) encryption method in the encryption usage mode using a random number as the initial value (IV). I found. Patent Document 1 does not describe such an insider attack.

  The present invention has been made in view of the above problems. An object of the present invention is to provide a technique for improving the security of encryption.

  The cipher generation apparatus of the present invention includes 1) an encryption unit that generates ciphertext from plaintext using an encryption key and a random number, and 2) before the encryption unit acquires both the plaintext and the encryption key. A random number information output unit that outputs random number information that identifies the random number; and 3) an encryption output unit that outputs the ciphertext. 4) The encryption unit generates the ciphertext from data obtained by combining the plaintext and the random number, or the cipher output unit outputs both the ciphertext and the random number.

  The data transmission system of the present invention includes the encryption generation apparatus and the reception apparatus of the present invention. The receiving apparatus includes: 1) a receiving unit that receives the information output by the cipher output unit and the random number information; and 2) a safety of the ciphertext using the information output by the cipher output unit and the random number information. And a safety verification unit for verifying safety.

  The cipher generation method of the present invention is executed by a computer. The cipher generation method includes 1) an encryption step of generating a ciphertext from plaintext using an encryption key and a random number; and 2) before acquiring both the plaintext and the encryption key in the encryption step, A random number information output step for outputting random number information for specifying the random number; and 3) an encrypted output step for outputting the ciphertext. And 4) generating the ciphertext from data obtained by combining the plaintext and the random number in the encryption step, or outputting both the ciphertext and the random number in the cipher output step.

  The data transmission method of the present invention is executed by a data transmission system having a cipher generation device and a reception device. The data transmission method includes: 1) an encryption step in which an encryption generation device generates an encrypted text from plaintext using an encryption key and a random number; and 2) an encryption generation device in which the plaintext and the A random number information output step for outputting random number information for specifying the random number before acquiring both of the encryption keys, 3) an encryption output step for outputting the ciphertext, and 4) a receiving device A receiving step for receiving the information output in the cipher output step and the random number information, and 5) the receiving device uses the information output in the cipher output step and the random number information received in the receiving step. And a security verification step for verifying the security of the ciphertext. Further, 6) the ciphertext is generated from data obtained by combining the plaintext and the random number in the encryption step, or the ciphertext and the random number are output together in the cipher output step.

  According to the present invention, a technique for improving the security of encryption is provided.

1 is a block diagram illustrating a cipher generation device according to Embodiment 1. FIG. It is a figure which illustrates the insider attack in the case of using an AES encryption method. It is a flowchart which illustrates the encryption production | generation process containing an insider attack about a rearrangement encryption system. It is a figure which illustrates the structure of the computer which implement | achieves a encryption production | generation apparatus. 3 is a flowchart illustrating an example of a flow of processing executed by the cipher generation device according to the first embodiment. 6 is a block diagram illustrating a cipher generation device according to Embodiment 2. FIG. It is the figure which showed the method 1 of Embodiment 2 notionally. It is the figure which showed the method 2 of Embodiment 2 notionally. It is the figure which showed the method 1 of Embodiment 3 notionally. It is the figure which showed the method 2 of Embodiment 3 notionally. FIG. 10 is a block diagram illustrating a cryptographic system according to a fourth embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In all the drawings, the same reference numerals are given to the same components, and the description will be omitted as appropriate. In each block diagram, the flow of arrows indicates the flow of information. Further, in each block diagram, each block indicates a functional unit configuration, not a hardware unit configuration.

[Embodiment 1]
<Overview>
FIG. 1 is a block diagram illustrating a cipher generation device 2000 according to the first embodiment. The cipher generation device 2000 includes an encryption unit 2020, a random number information output unit 2040, and an encryption output unit 2060. The encryption unit 2020 generates a ciphertext from the plaintext using the encryption key and a random number. The random number information output unit 2040 outputs random number information before the encryption unit 2020 acquires both the plaintext and the encryption key. That is, the random number information output unit 2040 is 1) after the encryption unit 2020 acquires the plaintext and before acquiring the encryption key, 2) after the encryption unit 2020 acquires the encryption key and before acquiring the plaintext, or 3 ) The random number information is output at any timing before the encryption unit 2020 acquires the plaintext and before the encryption key is acquired. Here, the random number information is information for specifying a random number acquired by the encryption unit 2020. The cipher output unit 2060 outputs the ciphertext generated by the encryption unit 2020.

  The cipher generation device 2000 satisfies at least one of the following two preconditions. The first precondition is that the encryption unit 2020 generates a ciphertext from data obtained by combining a plaintext and a random number. The second condition is that the cipher output unit 2060 outputs both the ciphertext and the random number. Hereinafter, the former is called a first precondition and the latter is called a second precondition.

  Which of the above-mentioned preconditions is satisfied depends on the encryption method used by the encryption unit 2020. Each will be described below.

<When the first precondition is satisfied>
When the first precondition is satisfied, the encryption unit 2020 uses a rearrangement encryption method. The rearrangement encryption method is an encryption method disclosed in Patent Document 2. The outline of the rearrangement encryption method will be described below. A detailed description of the rearrangement encryption method is disclosed in Patent Document 2.

  The encryption unit 2020 acquires the first pseudo random number R. The encryption unit 2020 generates a second pseudo random number R2 using R as an initial value. The encryption unit 2020 stream-encrypts the plain text using R2 to generate intermediate data M ′. The encryption unit 2020 performs nonlinear integration on the first pseudorandom number R and the intermediate data M ′ using the rearrangement table K as the SBOX. Finally, the encryption unit 2020 rearranges the integrated data using the rearrangement table K, and outputs the final ciphertext C. Here, in the rearrangement encryption method, the encryption key is used as the rearrangement table K.

  As described above, in the rearrangement encryption method, ciphertext is generated by encrypting data (intermediate data Cx) obtained by combining a random number (first pseudorandom number R) and plaintext. Therefore, when the encryption unit 2020 performs encryption using the rearrangement encryption method, the first precondition is satisfied.

<When the second precondition is satisfied>
The second precondition is satisfied, for example, when the encryption unit 2020 generates a ciphertext using the Advanced Encryption Standard (AES) encryption method using a random number as the Initial Value (IV). In the AES encryption method, an encryption usage mode using IV (hereinafter referred to as IV mode) is widely used. Here, the IV mode includes a CBC mode (Cipher Block Chaining Mode), a CTR mode (Counter Mode), a CFB mode (Cipher Feedback Mode), and an OFB mode (Output Feedback Mode).

  In these cipher usage mode AES cryptosystems, the ciphertext provider is provided with data with IV added to the ciphertext header. Therefore, the encryption unit 2020 outputs the ciphertext and IV together.

  In addition, since the concrete encryption process in each above-mentioned encryption utilization mode is a known technique, the description is abbreviate | omitted.

<Action and effect>
Cryptographic methods that satisfy the first precondition or the second precondition have vulnerability to insider attacks. Insider attacks are: “The encryption key used by the creator of the encryption generation device or the encryption program used by the encryption generation device is not recognized by the user of the encryption generation device by including an unauthorized process in the processing performed by the encryption generation device. And the contents of plaintext are leaked.

  Hereinafter, the insider attack will be described in detail. First, an example of an insider attack in the AES encryption method will be described. This insider attack is “include information on plaintext or encryption key in the random number used in the encryption process”. For example, an attacker can use a program that generates a random number to be used for encryption processing: `` Calculate the value e (K) obtained by encrypting the encryption key K and output the value of e (K) as a random number. '' Implement as Here, e (K) can be decrypted by a decryption function d used in a program for decrypting ciphertext. However, the attacker knows the decryption function d because it is the creator of the encryption program. By the above-mentioned insider attack, the attacker can obtain a plaintext or an encryption key.

  FIG. 2 is a diagram illustrating an insider attack when the AES encryption method is used. FIG. 2A illustrates a cipher generation process including an insider attack for the AES encryption method. In the encryption generation process, as described above, the encryption key K is encrypted and e (K) is calculated. The cipher generation process encrypts plaintext M using the AES encryption method using e (K) as IV to generate ciphertext I (K, M). The cipher generation process outputs data with e (K) used as IV added to the header of ciphertext I (K, M). For example, this data is transmitted to the receiving device via the network.

  An insider attack attacker obtains the above data. FIG. 2B illustrates a flow of processing performed by an attacker who has acquired data in which e (K) is added to the ciphertext I (K, M). The attacker knows that e (K) added to the header of the obtained ciphertext I (K, M) can be decrypted using the decryption function d. Therefore, the attacker obtains the encryption key K by decrypting e (K) with the decryption function d. Furthermore, the attacker uses the acquired encryption key K to decrypt the ciphertext I (K, M) and obtains the plaintext M. In this way, the attacker can obtain the encryption key and plaintext.

  Next, an example of an insider attack in the rearrangement encryption method will be described. This insider attack is “by repeating encryption (changing the random number) until the encryption key information is included in the predetermined position of the ciphertext so that the encryption key information is included in the predetermined position of the ciphertext”. That's it.

  FIG. 3 is a flowchart illustrating cipher generation processing including an insider attack for the rearrangement encryption method. The encryption generation process generates a first pseudorandom number R (S202). The cipher generation process generates a second pseudo random number R2 with R as an initial value (S204). In the cipher generation process, the plaintext M is stream-encrypted using R2 to generate intermediate data M ′ (S206). In the encryption generation process, the intermediate data M ′ is encrypted using the encryption key K, and the ciphertext C is generated (S208). The cipher generation processing calculates (the first two bytes mod length (K)) + 1 of C and sets this value as x (S210). Here, Length (K) is a function that outputs the size of the encryption key K in units of bits. The cipher generation processing compares the x-th bit of K with the 17th bit of C (S212). If these values are the same (S212: YES), the cipher generation process outputs ciphertext C (S214). On the other hand, if these values are different (S212: NO), the cipher generation processing returns to S202.

  With the above operation, the 17th bit of the output ciphertext C is the same as the value of the xth bit of K. That is, the attacker can know the value of the xth bit of K by looking at the 17th bit of the ciphertext C without decrypting the ciphertext C. Here, the value of x depends on the value of C. Therefore, the attacker can know the value of each different bit of K from each ciphertext C by repeatedly obtaining the ciphertext C transmitted from the encryption generation device. Eventually, the attacker can grasp the entire K. Note that “2 bytes” in S210 and “17th bit” in S212 are merely examples, and these values can be arbitrarily changed.

  As described above, AES encryption methods and rearrangement encryption methods using IV are vulnerable to insider attacks.

  An attacker who performs an insider attack acquires information (ciphertext or the like) output from the cipher generation device 2000, and uses that information to perform an insider attack. In general, ciphertext is often exchanged via a network. For example, when the mail transmission source is the cipher generation apparatus 2000, the cipher generation apparatus 2000 generates a ciphertext by encrypting the mail text and attached file, and transmits the ciphertext. For this reason, for example, an attacker can obtain ciphertext or the like by eavesdropping on communication performed by the cryptographic generation apparatus 2000 with another apparatus via the network. Since such an eavesdropping method is a known technique, a description of the realization method is omitted.

  In the above-mentioned insider attack, a random number is generated or changed inevitably after obtaining a plaintext or an encryption key. In the case of the AES encryption method, since the plaintext and the encryption key information are included in the random number, after the plaintext and the encryption key are acquired, the value of the random number is generated or changed. In the case of the rearrangement encryption method, since the cipher generation process is repeated until the plaintext and encryption key information are included in a predetermined position of the ciphertext, the value of the first pseudorandom number R is changed accordingly. For this reason, a random number is generated before the encryption unit 2020 acquires a plaintext or an encryption key, and if the random number is not changed, an insider attack is not performed. Therefore, if the encryption unit 2020 generates a random number before acquiring the plaintext and the encryption key, and further confirms that the random number has not been changed, it can be confirmed that no insider attack has been performed.

  Therefore, before the encryption unit 2020 obtains both the plaintext and the encryption key, the cipher generation device 2000 according to the present embodiment outputs random number information that identifies the random number that the encryption unit 2020 uses for encryption. This makes it possible to detect that the random numbers are different when the encryption unit 2020 uses another random number for encryption, that is, when an insider attack is performed. Therefore, according to the present embodiment, it is possible to improve the security against an insider attack in a cryptographic device or the like using a rearrangement encryption method or an AES encryption method.

<< Proof >>
As an example, if the rearrangement cipher and the hash function are safe, a proof that the rearrangement cipher is safe against the insider attack when the hash value of the random number is output as the random number information is shown. First, the random number information output unit 2040 generates a first pseudorandom number R and generates a hash value h (R). Here, h is a hash function and has collision difficulty.

  When the insider attack described above is performed, since the encryption is repeated until the encryption key information is included in a predetermined position of the ciphertext, the value of the first pseudorandom number R changes. Here, let R ′ be the value of the first pseudorandom number when the ciphertext is output. Here, in order to prevent the user from noticing that the value of the first pseudo random number has changed, the hash value of the random number must be prevented from changing. That is, it is necessary to satisfy h (R) = h (R ′).

  However, since the hash function h has difficulty in collision, a pair of R and R ′ such that h (R) = h (R ′) and R ≠ R ′ cannot be found efficiently. Therefore, h (R) = h (R ′) and R ≠ R ′ contradict that the hash function h has difficulty in collision. Therefore, the above-described insider attack in which the first pseudorandom number R changes in the encryption unit 2020 cannot be performed.

  As a method for leaking the contents of the plaintext and the encryption key in addition to changing the random number, a method of separately adding plaintext and encryption key information to the ciphertext is conceivable. However, in this method, the data length of data output from the encryption unit 2020 changes.

  For example, the plaintext is M, the plaintext with zero padding is M0, the ciphertext is C, the encryption key is K, and the data length of some data X is Length (X). In this case, in the AES encryption method and the rearrangement encryption method, Length (M0) = Length (C) and Length (K)> 0. Therefore, if the information of the encryption key K is added to the ciphertext C, Length (M0) + Length (K)> Length (C), and the data length increases. Therefore, by monitoring the data length output from the encryption unit 2020, it is possible to prevent an attack that separately adds an encryption key or plaintext information to the ciphertext.

  In addition, by compressing data in which plaintext and encryption key information are separately added to the ciphertext as described above, the data length is made the same as the data length of the original ciphertext. It may be possible not to know what has been done. However, this method makes it impossible for the user to decrypt the ciphertext. Then, when the ciphertext cannot be decrypted, the user can grasp that there is a possibility that some kind of attack has been performed on the ciphertext. Therefore, an insider attack cannot be performed even by such a method of compressing data.

<Hardware configuration>
Each functional component of the cryptographic generation apparatus 2000 may be realized by hardware (for example, a hard-wired electronic circuit) that implements each functional component, or a combination of hardware and software (for example: It may be realized by a combination of an electronic circuit and a program for controlling it). Hereinafter, the case where each functional component of the cryptographic generation apparatus 2000 is realized by a combination of hardware and software will be further described.

  The computer 1000 is a variety of computers such as a personal computer (PC), a server machine, a tablet terminal, or a smartphone. The computer 1000 may be a dedicated computer designed to realize the encryption generation device 2000, or may be a general-purpose computer.

  FIG. 4 is a diagram illustrating a configuration of a computer 1000 that implements the encryption generation apparatus 2000. The computer 1000 includes a bus 1020, a processor 1040, a memory 1060, a storage 1080, and an input / output interface 1100. The bus 1020 is a data transmission path for the processor 1040, the memory 1060, and the storage 1080 to transmit / receive data to / from each other. However, the method of connecting the processors 1040 and the like is not limited to bus connection. The processor 1040 is an arithmetic processing device such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The memory 1060 is a memory such as a RAM (Random Access Memory) or a ROM (Read Only Memory). The storage 1080 is a storage device such as a hard disk, an SSD (Solid State Drive), or a memory card. The storage 1080 may be a memory such as a RAM or a ROM.

  The input / output interface 1100 is an interface for connecting the computer 1000 and an input / output device. For example, a keyboard and a display device are connected to the input / output interface 1100.

  The storage 1080 stores program modules that implement the functions of the cryptographic generation apparatus 2000. The processor 1040 implements each function corresponding to the program module by executing each program module.

  The hardware configuration of the computer 1000 is not limited to the configuration shown in FIG. For example, each program module may be stored in the memory 1060. In this case, the computer 1000 may not include the storage 1080.

<Process flow>
FIG. 5 is a flowchart illustrating the flow of processing executed by the cipher generation device 2000 according to the first embodiment. The random number information output unit 2040 outputs random number information (S102). The encryption unit 2020 acquires a plaintext and an encryption key (S104). The encryption unit 2020 encrypts the plain text and generates a cipher text (S106). The cipher output unit 2060 outputs the ciphertext (S108).

<Details of Encryption Unit 2020>
The encryption unit 2020 acquires a plaintext and an encryption key. Here, plain text is arbitrary data. For example, plain text is a character string, image data, audio data, or the like. There are various methods for the encryption unit 2020 to acquire the plaintext. For example, the encryption unit 2020 acquires plain text input by the user. Further, for example, the encryption unit 2020 acquires plaintext stored in a storage device provided inside or outside the encryption generation device 2000.

  There are various methods for the encryption unit 2020 to obtain the encryption key. For example, the encryption unit 2020 acquires an encryption key input by the user. For example, the encryption unit 2020 obtains an encryption key stored in a storage device provided inside or outside the encryption generation device 2000.

  The method for encrypting the plaintext by the encryption unit 2020 is as described above.

<Details of Random Number Information Output Unit 2040>
The random number information output unit 2040 generates a random number and outputs random number information that identifies the random number (S102). For example, the random number information indicates the specified random number itself. In addition, for example, the random number information indicates a hash value calculated from the specified random number. The hash function used for calculating the hash value is an arbitrary hash function (for example, SHA-1) having collision difficulty. Note that the process of generating a hash value from a random number may be performed by the random number information output unit 2040 or may be performed outside the random number information output unit 2040. In the latter case, the random number information output unit 2040 acquires a hash value of the random number and outputs the hash value as random number information.

  Various known methods can be used for the random number information output unit 2040 to generate a random number.

  Here, when the encryption unit 2020 performs encryption by the rearrangement encryption method, the random number specified by the random number information output by the random number information output unit 2040 is the first pseudo-random number R. For this purpose, the random number information output unit 2040 generates a first pseudorandom number R. The encryption unit 2020 performs encryption using the first pseudo-random number R generated by the random number information output unit 2040.

<Details of Encryption Output Unit 2060>
The cipher output unit 2060 outputs the ciphertext (S108). Here, the method by which the cipher output unit 2060 outputs the ciphertext is arbitrary. For example, the cipher output unit 2060 stores the ciphertext in the storage device by outputting the ciphertext to the storage device. For example, the encryption output unit 2060 transmits the ciphertext via the network.

  The cipher output unit 2060 may output only the ciphertext, or may output information other than the ciphertext. However, when the encryption unit 2020 performs encryption using the AES encryption method (when the second precondition is satisfied), the encryption output unit 2060 outputs both the ciphertext and the random number.

[Embodiment 2]
FIG. 6 is a block diagram illustrating a cipher generation device 2000 according to the second embodiment. The encryption unit 2020 in the present embodiment performs encryption using a rearrangement encryption method. That is, in the present embodiment, the first precondition described above is satisfied. The cipher generation device 2000 according to the second embodiment further includes a security verification unit 2080. The security verification unit 2080 verifies the safety of the ciphertext output by the encryption output unit 2060. Specifically, the security verification unit 2080 determines whether an insider attack has been performed on the ciphertext. Hereinafter, two specific methods will be exemplified.

<Method 1>
This method is a method executed by the security verification unit 2080 when the random number information indicates a random number. FIG. 7 is a diagram conceptually illustrating the method 1 of the second embodiment. The security verification unit 2080 decrypts the ciphertext generated by the encryption unit 2020. As a result, the safety verification unit 2080 obtains a plaintext and a random number. Then, the safety verification unit 2080 determines whether the random number matches the random number indicated by the random number information output by the random number information output unit 2040.

  If these random numbers match, the random number has not changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. Therefore, it can be seen that no insider attack has been performed. On the other hand, when the random number obtained by decrypting the ciphertext does not match the random number indicated by the random number information, the random number has changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. . In other words, it can be seen that an insider attack may have been performed.

<Method 2>
This method is a method executed by the security verification unit 2080 when the random number information indicates a hash value of a random number. FIG. 8 is a diagram conceptually illustrating the method 2 of the second embodiment. First, as in Method 1, the security verification unit 2080 decrypts the ciphertext and obtains plaintext and a random number. Next, the security verification unit 2080 calculates a hash value of this random number. The hash function used for calculating the hash value is the same hash function as that used by the random number information output unit 2040 for calculating the hash value. Then, the security verification unit 2080 determines whether or not the calculated hash value matches the hash value indicated by the random number information.

  If these hash values match, the random number has not changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. On the other hand, if the hash value calculated from the random number obtained by decrypting the ciphertext does not match the hash value indicated by the random number information, the random number changes before and after the plaintext and the encryption key are acquired by the encryption unit 2020. Will be doing. Therefore, as in the case of Method 1, since it is possible to determine whether or not the random number has changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020, whether or not an insider attack has been performed. I can figure out.

  Each method described above assumes that the security verification unit 2080 can decrypt the ciphertext. For this purpose, the security verification unit 2080 obtains a decryption key for decrypting the ciphertext generated by the encryption unit 2020. For example, the decryption key is stored in a storage device provided inside or outside the cipher generation device 2000. Note that in an apparatus that performs encryption, not only an encryption key used for encryption but also a decryption key used for decrypting the ciphertext is generally prepared.

[Embodiment 3]
The cipher generation apparatus 2000 according to the third embodiment is represented in FIG. 6 similarly to the cipher generation apparatus 2000 of the second embodiment. The encryption unit 2020 in the present embodiment performs encryption using the AES encryption method using IV. That is, in the present embodiment, the second precondition is satisfied. Further, the cryptographic generation apparatus 2000 according to the third embodiment includes a security verification unit 2080 as in the cryptographic generation apparatus 2000 according to the second embodiment. Hereinafter, two specific examples of the operation of the safety verification unit 2080 of this embodiment will be exemplified.

<Method 1>
This method is a method executed by the security verification unit 2080 when the random number information indicates a random number. FIG. 9 is a diagram conceptually illustrating the method 1 of the third embodiment. In the present embodiment, the cipher output unit 2060 outputs a random number together with the ciphertext. The security verification unit 2080 determines whether the random number output together with the ciphertext by the encryption output unit 2060 matches the random number indicated by the random number information output by the random number information output unit 2040. If these random numbers match, the random number has not changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. On the other hand, if these random numbers do not match, the random number has changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. Therefore, in the same manner as the security verification unit 2080 described in the second embodiment, whether or not an insider attack has been performed can be determined whether or not the random number has changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. It is possible to grasp whether or not.

<Method 2>
This method is a method executed by the security verification unit 2080 when the random number information indicates a hash value of a random number. FIG. 10 is a diagram conceptually illustrating the method 2 of the third embodiment. The security verification unit 2080 calculates a hash value of the random number output together with the ciphertext by the encryption output unit 2060. The hash function used for calculating the hash value is the same hash function as that used by the random number information output unit 2040 for calculating the hash value. Then, the security verification unit 2080 determines whether or not the calculated hash value matches the hash value indicated by the random number information. If these hash values match, the random number has not changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. On the other hand, if these hash values do not match, the random number has changed before and after the encryption unit 2020 acquires the plaintext and the encryption key. Therefore, in the same manner as the security verification unit 2080 described in the second embodiment, whether or not an insider attack has been performed can be determined whether or not the random number has changed before and after the plaintext and the encryption key are acquired by the encryption unit 2020. It is possible to grasp whether or not.

  In the present embodiment, the security verification unit 2080 does not need to decrypt the ciphertext.

[Embodiment 4]
FIG. 11 is a block diagram illustrating a data transmission system 4000 according to the fourth embodiment. In the fourth embodiment, the cipher generation device 2000 is connected to the receiving device 3000 so as to be communicable (for example, via a network). The cipher generation device 2000 transmits the information output by the encryption output unit 2060 and the random number information output by the random number information output unit 2040 to the receiving device 3000. As described above, the information output from the cipher output unit 2060 is only the ciphertext, the ciphertext and the random number, or the hash value of the ciphertext and the random number. The receiving device 3000 receives the information transmitted from the cipher generation device 2000. Receiving device 3000 decrypts the received ciphertext and obtains plaintext. Thereby, the user of the receiving device 3000 can know the contents of the plain text. For example, if the plain text is a text of an email created by a user of the encryption generation device 2000, the receiving device 3000 can read the email.

  Furthermore, the receiving device 3000 verifies the security of the received ciphertext. That is, the same operation as that performed by the safety verification unit 2080 described in the second and third embodiments is performed in the receiving device 3000.

  In order to implement the above functions, the receiving device 3000 includes a receiving unit 3020 and a safety verification unit 3040. The receiving unit 3020 acquires information output by the encryption output unit 2060 and random number information. As described above, the information output by the cipher output unit 2060 is only a ciphertext, a ciphertext and a random number, or a hash value of a ciphertext and a random number.

<When the encryption unit 2020 performs encryption by the rearrangement encryption method>
The security verification unit 3040 uses the ciphertext received by the reception unit 3020 to determine whether or not an insider attack has been performed by the same method as that described in the second embodiment.

  In this case, the security verification unit 3040 needs to decrypt the ciphertext and obtain a random number. In this regard, the receiving device 3000 is a device that decrypts the acquired ciphertext, and thus has a decryption key for decrypting the ciphertext. Therefore, the security verification unit 3040 can decrypt the ciphertext using this decryption key.

<When the encryption unit 2020 performs encryption using the AES encryption method>
The security verification unit 3040 uses the ciphertext and the random number received by the reception unit 3020 to determine whether or not an insider attack has been performed by each method described in the third embodiment.

<Action and effect>
According to the present embodiment, the security of the ciphertext output from the cipher generation device 2000 can be verified by the receiving device 3000. Specifically, it is possible to verify whether or not an insider attack has been performed on the ciphertext output from the cipher generation device 2000. Therefore, the user of the receiving device 3000 can exchange the ciphertext with the cipher generation device 2000 with peace of mind after confirming that no insider attack has been performed.

  As mentioned above, although embodiment and Example of this invention were described with reference to drawings, these are illustrations of this invention, the combination of the said embodiment and Example, and various structures other than the said embodiment and Example Can also be adopted.

Hereinafter, examples of the reference form will be added.
1. An encryption unit that generates ciphertext from plaintext using an encryption key and a random number;
A random number information output unit that outputs random number information that identifies the random number before the encryption unit acquires both the plaintext and the encryption key;
A cipher output unit for outputting the ciphertext,
The cipher generation device, wherein the encryption unit generates the ciphertext from data obtained by combining the plaintext and the random number, or the cipher output unit outputs both the ciphertext and the random number.
2. The encryption unit generates the ciphertext by encrypting the plaintext using a rearrangement encryption method. The cipher generation device described in 1.
3. The random number information indicates the random number or a hash value calculated from the random number using a predetermined hash function. Or 2. The cipher generation device described in 1.
4). 1. a security verification unit that verifies the security of the ciphertext using the information output by the cipher output unit and the random number information output by the random number information output unit; To 3. The cipher generation device according to any one of the above.
5. The encryption unit generates the ciphertext by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates the random number,
The security verification unit restores the random number used for encryption by decrypting the ciphertext, and determines whether the random number and the random number indicated by the random number information match, thereby determining the encryption 3. Verify the safety of the sentence. The cipher generation device described in 1.
6). The encryption unit generates the ciphertext by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates a hash value calculated from the random number using a predetermined hash function,
The security verification unit restores a random number used for encryption by decrypting the ciphertext, calculates a hash value of the restored random number using the predetermined hash function, and the hash value and the 3. Verifying the security of the ciphertext by determining whether or not the hash value indicated by the random number information matches. The cipher generation device described in 1.
7). The cipher output unit outputs both the ciphertext and the random number,
The random number information indicates the random number,
3. The security verification unit verifies the security of the ciphertext by determining whether or not the random number output by the encryption output unit matches the random number indicated by the random number information. The cipher generation device described in 1.
8). The cipher output unit outputs both the ciphertext and the random number,
The random number information indicates a hash value calculated from the random number using a predetermined hash function,
The safety verification unit calculates a hash value from the random number output by the cryptographic output unit using the predetermined hash function, and whether or not the hash value and the hash value indicated by the random number information match 3. Verifying the security of the ciphertext by determining whether The cipher generation device described in 1.
9. 1. To 8. A data transmission system comprising the cipher generation device according to any one of the above and a reception device,
The receiving device is:
A receiving unit that receives the information output by the encryption output unit and the random number information;
A data transmission system comprising: a safety verification unit that verifies the security of the ciphertext using the information output by the encryption output unit and the random number information received by the reception unit.
10. 9. The receiving device described in 1.
11. A cipher generation method executed by a computer,
An encryption step for generating ciphertext from plaintext using an encryption key and a random number;
In the encryption step, before acquiring both the plaintext and the encryption key, a random number information output step for outputting random number information specifying the random number;
A cipher output step for outputting the ciphertext,
A cipher generation method of generating the ciphertext from data obtained by combining the plaintext and the random number in the encryption step, or outputting both the ciphertext and the random number in the cipher output step.
12 10. In the encryption step, the ciphertext is generated by encrypting the plaintext using a rearrangement encryption method. The cipher generation method described in 1.
13. 10. The random number information indicates the random number or a hash value calculated from the random number using a predetermined hash function. Or 12. The cipher generation method described in 1.
14 10. a security verification step of verifying the security of the ciphertext using the information output in the cipher output step and the random number information output in the random number information output unit; Thru 13. The encryption generation method according to any one of the above.
15. In the encryption step, the ciphertext is generated by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates the random number,
In the security verification step, the ciphertext is decrypted to restore the random number used for the encryption, and it is determined whether or not the random number and the random number indicated by the random number information match. Verify the safety of the sentence, 14. The cipher generation method described in 1.
16. In the encryption step, the ciphertext is generated by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates a hash value calculated from the random number using a predetermined hash function,
In the security verification step, the random number used for encryption is restored by decrypting the ciphertext, the hash value of the restored random number is calculated using the predetermined hash function, and the hash value and the 13. Verifying the security of the ciphertext by determining whether or not the hash value indicated by the random number information matches, The cipher generation method described in 1.
17. Outputting both the ciphertext and the random number in the cipher output step;
The random number information indicates the random number,
13. In the security verification step, the security of the ciphertext is verified by determining whether or not the random number output by the encryption output step matches the random number indicated by the random number information; The cipher generation method described in 1.
18. Outputting both the ciphertext and the random number in the cipher output step;
The random number information indicates a hash value calculated from the random number using a predetermined hash function,
In the security verification step, a hash value is calculated from the random number output by the cryptographic output step using the predetermined hash function, and whether or not the hash value and the hash value indicated by the random number information match 13. verifying the security of the ciphertext by determining whether The cipher generation method described in 1.
19. A data transmission method executed by a data transmission system having a cipher generation device and a reception device,
An encryption step in which an encryption generation device generates an encrypted text from plaintext using an encryption key and a random number;
A cipher generation device that outputs random number information for identifying the random number before acquiring both the plaintext and the encryption key in the encryption step;
A cipher generation device that outputs the ciphertext;
A receiving step in which the receiving device receives the information output in the encryption output step and the random number information;
A security verification step for verifying the security of the ciphertext using the information output in the cipher output step and the random number information received by the reception device in the reception step; and
A data transmission method, wherein the ciphertext is generated from data obtained by combining the plaintext and the random number in the encryption step, or the ciphertext and the random number are output together in the cipher output step.
20. 19. A receiving method comprising the steps performed by the receiving device in the data transmission method according to claim 1.
21. 11. To 18. A program for causing a computer to execute each step in the encryption generation method according to any one of the above.
22. 20. The program which makes a computer perform each step in the receiving method of description.

1000 Computer 1020 Bus 1040 Processor 1060 Memory 1080 Storage 1100 I / O interface 2000 Cryptographic generator 2020 Encryption unit 2040 Random number information output unit 2060 Cryptographic output unit 2080 Safety verification unit 3000 Receiving device 3020 Receiving unit 3040 Safety verification unit 4000 Data transmission system

Claims (15)

An encryption unit that generates ciphertext from plaintext using an encryption key and a random number;
A random number information output unit that outputs random number information that identifies the random number before the encryption unit acquires both the plaintext and the encryption key;
A cipher output unit for outputting the ciphertext,
The cipher generation device, wherein the encryption unit generates the ciphertext from data obtained by combining the plaintext and the random number, or the cipher output unit outputs both the ciphertext and the random number.   The cipher generation device according to claim 1, wherein the encryption unit generates the ciphertext by encrypting the plaintext using a rearrangement encryption method.   The cipher generation device according to claim 1, wherein the random number information indicates the random number or a hash value calculated from the random number using a predetermined hash function.   4. The apparatus according to claim 1, further comprising a security verification unit that verifies the security of the ciphertext using the information output by the cipher output unit and the random number information output by the random number information output unit. The cipher generation device according to the item. The encryption unit generates the ciphertext by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates the random number,
The security verification unit restores the random number used for encryption by decrypting the ciphertext, and determines whether the random number and the random number indicated by the random number information match, thereby determining the encryption The code | symbol production | generation apparatus of Claim 4 which verifies the safety | security of a sentence. The encryption unit generates the ciphertext by encrypting data obtained by combining the plaintext and the random number with the encryption key,
The random number information indicates a hash value calculated from the random number using a predetermined hash function,
The security verification unit restores a random number used for encryption by decrypting the ciphertext, calculates a hash value of the restored random number using the predetermined hash function, and the hash value and the The cipher generation device according to claim 4, wherein the ciphertext security is verified by determining whether or not the hash value indicated by the random number information matches. The cipher output unit outputs both the ciphertext and the random number,
The random number information indicates the random number,
The safety verification unit verifies the safety of the ciphertext by determining whether or not a random number output by the encryption output unit matches a random number indicated by the random number information. 4. The cipher generation device according to 4. The cipher output unit outputs both the ciphertext and the random number,
The random number information indicates a hash value calculated from the random number,
The safety verification unit calculates a hash value from the random number output by the cryptographic output unit using the predetermined hash function, and whether or not the hash value and the hash value indicated by the random number information match The cipher generation device according to claim 4, wherein security of the ciphertext is verified by determining whether the ciphertext is safe. A data transmission system comprising the cipher generation device according to any one of claims 1 to 8 and a reception device,
The receiving device is:
A receiving unit that receives the information output by the encryption output unit and the random number information;
A data transmission system comprising: a safety verification unit that verifies the security of the ciphertext using the information output by the encryption output unit and the random number information received by the reception unit.   The receiving device according to claim 9. A cipher generation method executed by a computer,
An encryption step for generating ciphertext from plaintext using an encryption key and a random number;
In the encryption step, before acquiring both the plaintext and the encryption key, a random number information output step for outputting random number information specifying the random number;
A cipher output step for outputting the ciphertext,
A cipher generation method of generating the ciphertext from data obtained by combining the plaintext and the random number in the encryption step, or outputting both the ciphertext and the random number in the cipher output step. A data transmission method executed by a data transmission system having a cipher generation device and a reception device,
An encryption step in which an encryption generation device generates an encrypted text from plaintext using an encryption key and a random number;
A cipher generation device that outputs random number information for identifying the random number before acquiring both the plaintext and the encryption key in the encryption step;
A cipher generation device that outputs the ciphertext;
A receiving step in which the receiving device receives the information output in the encryption output step and the random number information;
A security verification step for verifying the security of the ciphertext using the information output in the cipher output step and the random number information received by the reception device in the reception step; and
A data transmission method, wherein the ciphertext is generated from data obtained by combining the plaintext and the random number in the encryption step, or the ciphertext and the random number are output together in the cipher output step.   The data transmission method according to claim 12, comprising a step performed by the receiving device.   The program which makes a computer perform each step in the encryption production | generation method of Claim 11.   The program which makes a computer perform each step in the receiving method of Claim 13.

Images