Abstract: A grouping means 11 that extracts basis vectors from a set of basis vectors for a lattice having a predetermined relationship with a matrix used to generate a public key, and that groups the basis vectors such that a predetermined condition is satisfied. A sampling means 12 that samples, for at least one group, the same number of arbitrary values as the number of a plurality of basis vectors included in that group, in parallel for the individual basis vectors, onto a lattice constituted by the plurality of basis vectors, the arbitrary values serving as random numbers following a discrete Gaussian distribution. The predetermined condition is that each of the basis vectors included in a group is orthogonal to the other basis vectors included in the same group and is also orthogonal to Gram-Schmidt basis vectors, which are vectors obtained by orthogonalizing the other basis vectors by Gram-Schmidt orthogonalization.

Abstract: Provided are a random number generation device and the like capable of calculating a high precision random number using a memory capacity selected irrespective of the precision of the random number. A random number calculation device is configured to generate first random numbers based on given number and specify, for the given number of second random numbers in a target numeric extent, bin range depending on the first random numbers based on frequency information representing cumulative frequency regarding a frequency of numeric extent including respective second random numbers among given numeric extents, the numeric extent being determined in accordance with a desirable precision.

Abstract: An information-processing device is provided with: a plaintext input unit for inputting plaintext; an initial vector generation unit for generating an initial vector; a common key block encryption unit for performing common key block encryption on the initial vector and generating an encrypted initial vector; a pseudorandom number generation unit which, accepting the encrypted initial vector as input, generates a pseudorandom number series in the same length as the plaintext; a keyed hash unit which, accepting the first portion of a ciphertext in which the pseudorandom number series and the plaintext are exclusive-OR'ed as input, generates a hash value; and a ciphertext output unit for concatenating the second and first portions of a ciphertext in which the hash value and the encrypted initial vector are exclusive-OR'ed and outputting the concatenated portions as a ciphertext.

Abstract: A first apparatus comprises an error correction coding part that receives a message M to be transmitted to a second apparatus, performs coding using a predetermined error correction code, and outputs a codeword C; a message authentication tag generation part that receives the message M and outputs a predetermined message authentication tag T; and a transmission part that transmits the codeword C and the tag T as transmission information S to the second apparatus. The second apparatus receives a message M* to be verified and a tag T?, which are obtained from the transmission information S, and determines that the message M* to be verified has not been tampered with when a tag T* obtained from the message M* to be verified and the tag T? satisfy a predetermined identity criterion.

Abstract: A hash function is computed for each item of a partial string obtained by dividing a message received according to a group testing matrix representing combinatorial group testing relating to the message, and an authentication tag for the partial string is generated using a value obtained by a combining operation of individual hash values by a combiner, wherein the combiner performs the combining operation of the individual hash values, by using a hash value of an item of an empty string as an identity element of the operation.

Abstract: A decoding apparatus includes a plurality-of-bits decoding part configured to receive an input vector obtained by adding a message encrypted by a trapdoor function and an error vector including an element(s) conforming with a discrete Gaussian distribution, and decode a plurality of bits from a lower bit of the message based on the input vector in correctness with a predetermined probability; and a confirmation calculation part configured to determine in parallel whether the decoded plurality of bits are correct or not, wherein the message is encrypted by taking an inner product with a vector including a power of two as an element(s).

Abstract: Disclosed is a MAC tag list generating apparatus capable of efficiently performing message authentication through which information pertaining to a falsified position as well as existence of falsification can be obtained. This MAC tag list generating apparatus is provided with: a group test matrix generating means for generating a group test matrix W, which is a parameter of a combined group test, on the basis of a plurality of items obtained by dividing an obtained message M; and a MAC tag list generating means that, while sharing results obtained by applying a pseudo random function to the items forming each row of the generated group test matrix W, sums the results, and then applies the summed results to pseudo random permutation to generate a MAC tag list T, which is a MAC tag list pertaining to the message M.

Abstract: To achieve one-pass and one-rate authenticated encryption capable of performing parallel processings and totally performing encryption and decode processings by only one encryption function. An authenticated encryption device comprises an authenticated encryption means for applying a two-round Feistel structure using an encryption function assigned with an auxiliary variable for a round function per two blocks to an input plaintext or encrypted text thereby to generate an encrypted text or decoded plaintext. The authenticated encryption means finds an encrypted text chunk CC[i]=(C[i_1], C[i_2]) corresponding to an i-th plaintext chunk MC[i]=(M[i_1], M[i_2]) when dividing a plaintext into chunks per two blocks as: C[i_1]=F_K((N,Tw_i_1),M[i_1])xor M[i_2], C[i_2]=F_K((N,Tw_i_2),C[i_1])xor M[i_1].

Abstract: Disclosed is a MAC tag list generating apparatus capable of efficiently performing message authentication through which information pertaining to a falsified position as well as existence of falsification can be obtained. This MAC tag list generating apparatus is provided with: a group test matrix generating means for generating a group test matrix W, which is a parameter of a combined group test, on the basis of a plurality of items obtained by dividing an obtained message M; and a MAC tag list generating means that, while sharing results obtained by applying a pseudo random function to the items forming each row of the generated group test matrix W, sums the results, and then applies the summed results to pseudo random permutation to generate a MAC tag list T, which is a MAC tag list pertaining to the message M.

Abstract: Provided are a tag generation device, method and program which are capable of parallel execution, need no precomputation, and are capable of reducing block-cipher calls to the minimum necessary using one block cipher key when a tag to be attached to a message is generated.

Abstract: An information-processing device is provided with: a plaintext input unit for inputting plaintext; an initial vector generation unit for generating an initial vector; a common key block encryption unit for performing common key block encryption on the initial vector and generating an encrypted initial vector; a pseudorandom number generation unit which, accepting the encrypted initial vector as input, generates a pseudorandom number series in the same length as the plaintext; a keyed hash unit which, accepting the first portion of a ciphertext in which the pseudorandom number series and the plaintext are exclusive-OR'ed as input, generates a hash value; and a ciphertext output unit for concatenating the second and first portions of a ciphertext in which the hash value and the encrypted initial vector are exclusive-OR'ed and outputting the concatenated portions as a ciphertext.

Abstract: A universal hash function calculation device includes a message register sequentially outputs a message of which the bit number is a prime number and of which the length is such that the smallest primitive root when the bit number is set as the modulo is 2, outputting said message one bit at a time. A cyclic key register cyclically permutates a key having the same number of bits as the message, and sequentially outputs a cyclic key vector obtained as a result of the cyclical permutation. On the basis of the sequentially-output cyclic key vector and a message bit that is sequentially output one bit at a time, a logical product calculation unit outputs the cyclic key vector when the message bit is 1, and outputs an all-zero vector having the same bit number as the cyclic key vector when the message bit is 0. A cumulative sum calculation unit accumulates calculation results having the same number as the output bit number and calculates the exclusive disjunction.

Abstract: [Subject] To provide a format-preserving encryption device and the like that enables efficient and secure encryption/decryption while maintaining the data format. [Solution] An encryption device 10 includes: an unit block tweakable encryption module 101 that encrypts a specific digit of a plain text by using numerical values of remaining respective digits excluding the specific digit of the plain text and an external tweak that is input concurrently with the plain text; a block permutation module 102 that permutates respective digits including the encrypted specific digit of the plain text per digit based on a predetermined rule; and a counter update module 103 that causes processing by the unit block tweakable encryption unit and the block permutation unit to repeat for a predetermined number of times. A decryption device 20 performs the reverse processing to the encryption device 10.

Abstract: To achieve one-pass and one-rate authenticated encryption capable of performing parallel processings and totally performing encryption and decode processings by only one encryption function. An authenticated encryption device comprises an authenticated encryption means for applying a two-round Feistel structure using an encryption function assigned with an auxiliary variable for a round function per two blocks to an input plaintext or encrypted text thereby to generate an encrypted text or decoded plaintext. The authenticated encryption means finds an encrypted text chunk CC[i]=(C[i_1], C[i_2]) corresponding to an i-th plaintext chunk MC[i]=(M[i_1], M[i_2]) when dividing a plaintext into chunks per two blocks as: C[i_1]=F_K((N,Tw_i_1),M[i_1]) xor M[i_2], C[i_2]=F_K((N,Tw_i_2),C[i_1]) xor M[i_1].

Abstract: Provided are a tag generation device, method and program which are capable of parallel execution, need no precomputation, and are capable of reducing block-cipher calls to the minimum necessary using one block cipher key when a tag to be attached to a message is generated.

Abstract: [Subject] To provide a format-preserving encryption device and the like that enables efficient and secure encryption/decryption while maintaining the data format. [Solution] An encryption device 10 includes: an unit block tweakable encryption module 101 that encrypts a specific digit of a plain text by using numerical values of remaining respective digits excluding the specific digit of the plain text and an external tweak that is input concurrently with the plain text; a block permutation module 102 that permutates respective digits including the encrypted specific digit of the plain text per digit based on a predetermined rule; and a counter update module 103 that causes processing by the unit block tweakable encryption unit and the block permutation unit to repeat for a predetermined number of times. A decryption device 20 performs the reverse processing to the encryption device 10.

Abstract: A universal hash function calculation device includes a message register sequentially outputs a message of which the bit number is a prime number and of which the length is such that the smallest primitive root when the bit number is set as the modulo is 2, outputting said message one bit at a time. A cyclic key register cyclically permutates a key having the same number of bits as the message, and sequentially outputs a cyclic key vector obtained as a result of the cyclical permutation. On the basis of the sequentially-output cyclic key vector and a message bit that is sequentially output one bit at a time, a logical product calculation unit outputs the cyclic key vector when the message bit is 1, and outputs an all-zero vector having the same bit number as the cyclic key vector when the message bit is 0. A cumulative sum calculation unit accumulates calculation results having the same number as the output bit number and calculates the exclusive disjunction.

Abstract: A block encrypting device of the present invention includes: a mixing means (101) that applies universal hash function-based permutation to the (n+m)-bit plaintext to generate a first intermediate variable of n bits and a second intermediate variable of m bits; a first tweakable unit block encrypting means (102) that encrypts the first intermediate variable by use of an encrypting function of an m-bit tweakable n-bit block cipher, using the second intermediate variable as the tweak to generate a third intermediate variable of m bits and a fourth intermediate variable of (n?m) bits; a second tweakable unit block encrypting means (103) that encrypts an n-bit intermediate variable formed by connecting the second intermediate variable and the fourth intermediate variable, by use of the encrypting function, using the third intermediate variable as the tweak to generate a fifth intermediate variable of n bits; and an inverse mixing means (104) that applies universal hash function-based inverse-permutation to result

Abstract: In block cipher based on generalized Feistel network, pseudorandomness and strong-pseudorandomness may be fulfilled efficiently. In encrypting a plaintext of kn-bit blocks, Feistel permutation is applied in terms of 2n bits as a unit, and then block-based permutation based on a binary de Bruijn graph with symmetrical type 2 branch coloring is applied. The Feistel permutation and the block-based permutation are grouped together to form a round. The round is repeatedly performed a preset number of times to output a ciphertext.

Abstract: Provided is an incremental MAC tag generation device that enables incremental tag calculations that can support the editing of all block units, without losing the efficiency of normal tag calculations. A padding unit (11) carries out padding on a final block of a plaintext (M) that has been divided into a plurality of blocks. A cache reference parallel encryption unit (12) inputs blocks of the plaintext (M) other than the final block, a cached plaintext (M?), and an intermediate variable (S?) obtained by encrypting the plaintext (M?), and calculates an intermediate variable (S). A scrambled hash unit (13) carries out scrambling processing and calculates a hash value V. A tag generation unit (14) encrypts the hash value V and calculates a tag.