Hash value generator
To achieve high safety, large-sized nonlinear permutation is employed; however, the larger permutation processing is, the more the period of time required for the processing is, which hence is not efficient. There is provided a hash value generation method or a hash value generator which has the following aspects and which is highly safe and is capable of executing processing at a high speed. 1. As a message insertion method, there is employed a linear conversion in which the insertion message affects all subblocks. 2. An internal state is divided into a plurality of subblocks, and nonlinear permutation is conducted in each subblock unit. 3. Additionally, the linear conversion of item 1 above may be configured such that each subblock of the internal state affects the subblocks of the output.
1. A hash value generator for compressing a message having an arbitrary length and thereby generating a digest of the message, comprising:
a message padding unit for receiving as an input thereto a message M having an arbitrary length, executing padding processing for the message M, the message M being divided into message blocks each having a fixed length, and sequentially outputting a fixed-length message block M[i] according to a clock i,
a register for storing therein an intermediate value of conversion processing,
an initializer unit for setting an initial value to the register,
a compression unit for conducting a conversion according to the clock i by use of the value stored in the register and the message block M[i] output from the message padding unit and thereby producing as an output therefrom a conversion result having a length of the register,
a register control unit for updating, according to the clock i, the value of the register by use of the output from the data compression unit, and
a final processing unit for producing as an output therefrom a fixed-length bit string by use of the value stored in the register, wherein:
the compression unit comprises:
a linear compression unit for producing as an output therefrom a conversion result having a length of the register by use of the message block M[i] and the value stored in the register; and
a nonlinear permutation unit for outputting a conversion result having a length of the register by use of the output from the linear compression unit,
the linear compression unit executes the following processing:
T<−C *( X[ 1] XOR X[ 2] XOR . . . XOR X[w] ),
Y[j]<−L[j] ( M[i ]) XOR T XOR X[j],
Y<−Y[ 1]∥ Y[ 2]∥ . . . ∥ Y[w ]; and
the value stored in the register is divided into message block length units, the values of which are X[1], X[2], . . . , X[w], where:
A<−B indicates that B substitutes for A;
A∥B indicates a concatenation of A and B,
A XOR B indicates an exclusive OR between A and B for each bit,
A*B is multiplication between A and B in a finite field,
C is a non-zero constant,
L[j]( ) indicates an output from the mutually different linear permutation unit,
M[i] indicates an i-th message block outputted from the message padding unit,
X is a value stored in the register, and
Y is an output from the linear compression unit.
2. A hash value generator according to claim 1 , wherein:
the nonlinear permutation unit further comprises a second nonlinear permutation unit an input to which has a further shorter length; and
the compression unit executes the following processing:
Y[ 1 ]∥Y[ 2 ]∥ . . . ∥Y[w]<−Y,
Z[j]<−Qj ( Y[j ]),(1 =<j=<w ),
Z<−Z[ 1]∥ Z[ 2]∥ . . . ∥ Z[w]
Qj( ) indicates an output from the second non linear permutation unit, and
Z indicates an output from the non linear permutation unit.
3. A hash value generator according to claim 2 ,
wherein the second nonlinear permutation unit comprises
a third nonlinear permutation unit an input of which comprises eight words and which comprises a permutation table in units of four to eight bits,
a linear permutation unit an input of which comprises two-word data,
a constant adding unit, and
a control unit to execute loop processing, wherein
the constant to be added by the constant adding unit differs for each loop.
4. A hash value generator according to claim 3 ,
wherein the linear permutation unit executes processing as below:
a<−ax 1 ,b<−bx 1;
b<−b XOR a;
a<−a<<<i 1;
a<−a XOR b;
b<−b<<<i 2;
b<−b XOR a;
a<−a<<<i 3;
a<−a XOR b;
b<−b<<<i 4;
ay 1<− a,by 1 <−b;
wherein, x XOR y indicates an exclusive OR between x and y for each bit and x<<<i indicates an operation to cyclically shift x by i bits to the left in a one-word register and ax 1 and bx 1 are values stored in the registers, ay 1 and by 1 are outputs from the linear permutation units, i 1 , i 2 , i 3 and i 4 are non-zero constants.
5. A hash value generator according to claim 4 , characterized in that
of the parameters i 1 , i 2 , i 3 , and i 4 determining the linear permutation, i 1 to i 3 are even numbers, i 4 is an odd number, and i 2 is indivisible by four.
6. A hash value generator according to claim 2 ,
wherein the final processing unit comprises
a second register,
a third register,
a linear output unit for linearly combining values stored in the second register with each other to produce an output value and outputting the output value to the third register, and
a nonlinear permutation unit for converting the value stored in the second register, wherein
the hash value generator repeatedly executes processing of the nonlinear permutation unit and the linear output unit until data stored in the third register reaches a predetermined output bit length.
7. A message authentication code generator for producing as an output therefrom a fixed-length bit string using a fixed-length secret key and a message having an arbitrary length, characterized by comprising a hash value generator according to claim 1 .
8. A system comprising:
at least one server, a plurality of terminals, and a network,
wherein
the server comprises an arithmetic unit, a memory, a storage, a communication unit, and an encryption processing unit;
the terminal comprises an arithmetic unit, a memory, a storage, and an encryption processing unit; and
the encryption processing units comprise a hash value generator according to claim 1 .