Encryption device, decryption device, encryption method, decryption method, and computer readable medium

1. An encryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption device comprising:

processing circuitry to:

receive a message M;

divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m],

set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c,

update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order,

generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m,

generate an authenticator T of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated,

transmit the generated authenticator T and ciphertext C to a decryption device.

2. The encryption device according to claim 1 , wherein

the processing circuitry divides public data A into blocks of b′ bits, so as to generate data A[1], . . . , data A[a],

sets fixed data IV of n bits to the variable S,

updates the variable S with data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′=n−b′ bits is added, then updates the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, for each integer i=1, . . . , a in ascending order, and

uses, as the data S 0 , the variable S that has been updated.

3. The encryption device according to claim 1 ,

wherein the data X[i] is the data M[i] to a least significant side of which a bit string of c bits is added, and

wherein the data C[i] is generated by extracting most significant b bits of the variable S.

4. A decryption device for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption device comprising:

processing circuitry to:

receive an authenticator T and a ciphertext C,

divide the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C [m],

set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c,

update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order,

generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m,

generate an authenticator T′ of t bits from the variable S that has been updated most recently, where t is an integer of 1 or greater, the processing circuitry updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated, and

outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.

5. The decryption device according to claim 4 , wherein the processing circuitry

divides public data A into blocks of b′ bits, so as to generate data A[1], . . . , data A[a],

sets fixed data IV of n bits to the variable S,

updates the variable S with data obtained by calculating an exclusive OR using as input the variable S and data X*[i] that is data A[i] to which a bit string of c′=n−b′ bits is added, then updates the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, for each integer i=1, . . . , a in ascending order, and

uses, as the data S 0 , the variable S that has been updated.

6. The decryption device according to claim 4 ,

wherein the data X[i] is the data M[i] to a least significant side of which a bit string of c bits is added, and

wherein the data C[i] is generated by extracting most significant b bits of the variable S.

7. The decryption device according to claim 4 , wherein the processing circuitry determines whether or not the authenticator T′ and an authenticator T corresponding to the message M coincide with each other.

8. An encryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption method comprising:

receiving a message M,

dividing the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m];

setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c;

updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generating data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order;

generating a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m; and

updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T oft bits from the variable S that has been updated, where t is an integer of 1 or greater; and

transmitting the generated authenticator T and ciphertext C to a decryption device.

9. A decryption method for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption method comprising:

receiving an authenticator T and a ciphertext C;

dividing the ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m];

setting a variable to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant const[1], where n, b, and c are integers and n=b+c;

updating the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculating data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order;

generating a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m;

updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated most recently and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating an authenticator T′ oft bits from the variable S that has been updated, where t is an integer of 1 or greater; and

outputting, when the received authenticator T is equal to the generated authenticator T′ the generated message M.

10. A non-transitory computer readable medium storing an encryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the encryption program causing a computer to execute:

a reception process to receive a message M;

a division process to divide the message M into blocks of b bits, so as to generate data M[1], . . . , data M[m];

a variable setting process to set to a variable S data obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c;

a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, then update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generate data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, m in ascending order;

a ciphertext generation process to generate a ciphertext C of the message M by concatenating respective pieces of the data C[i] for each integer i=1, m;

an authenticator generation process to generate an authenticator T of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the message M is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T by extracting t bits from the variable S that has been updated; and

a transmission process to transmit the generated authenticator T and ciphertext C to a decryption device.

11. A non-transitory computer readable medium storing a decryption program for an embedded device to confidentially and securely communicating an electronic message between two parties, the decryption program causing a computer to execute:

a reception process to receive an authenticator T and ciphertext C;

a division process to divide a ciphertext C into blocks of b bits, so as to generate data C[1], . . . , data C[m];

a variable setting process to set to a variable S data of obtained by calculating an exclusive OR using, as input, data S 0 of n bits and data Y that is a concatenation of an initial parameter N and a constant cons-[1], where n, b, and c are integers and n=b+c;

a function calculation process to update the variable S with data obtained by calculating an encryption function E of a block cipher using as input the variable S, calculate data M[i] by calculating an exclusive OR using, as input, b bits extracted from the variable S that has been updated and data C[i], and update the variable S with data obtained by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is the data M[i] to which a bit string of c bits is added, for each integer i=1, m in ascending order;

a message generation process to generate a message M that is the decrypted ciphertext C by concatenating respective pieces of the data M[i] for each integer i=1, m; and

an authenticator generation process to generate an authenticator T′ of t bits from the variable S that has been updated most recently by the function calculation process, where t is an integer of 1 or greater, the authenticator generation process updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[2] when a length of the ciphertext C is a multiple of b bits, updating the variable S with data obtained by calculating an exclusive OR using as input the variable S and a constant const[3] that is different from the constant const[2] when the length of the message M is not a multiple of b bits, then updating the variable S with data obtained by calculating the encryption function E using as input the variable S that has been updated, and generating the authenticator T′ by extracting t bits from the variable S that has been updated;

an output process to output, when the received authenticator T is equal to the generated authenticator T′, the generated message M.