Abstract: A hash value computation device (10) computes a hash value H of 2n bits using a block cipher E that takes as input a key K of k bits and a plaintext block P of n bits, which is a smaller number of bits than k bits, and outputs a ciphertext of n bits. A function computation unit (22) computes a function CF that processes the block cipher E a plurality of times sequentially on an input value M* of k-n bits, an input value S[1] of n bits, and an input value S[2] of n bits so as to compute an output value S?[1] of n bits and an output value S?[2] of n bits. A hash value computation unit (23) computes the hash value H from the output value S?[1] and the output value S?[2].

Abstract: As an antitumor drug which is excellent in terms of antitumor effect and safety, there is provided an antibody-drug conjugate in which an antitumor compound represented by the following formula is conjugated to an antibody via a linker having a structure represented by the following formula: -L1-L2-LP-NH—(CH2)n1-La-Lb-Lc- wherein the antibody is connected to the terminal of L1, and the antitumor compound is connected to the terminal of Lc with the nitrogen atom of the amino group at position 1 as a connecting position.

Abstract: According to one embodiment, an anomaly detection apparatus includes a processing circuit. The processing circuit is configured to: acquire measured values from sensors installed in a system, a first function, a first threshold, and a second function to output a second threshold; generate the predicted values based on the measured value and the first function; detect that a deviation between the measured values and the predicted values exceeds the first threshold; calculate the feature quantities based on the measured values; and determine whether a number of consecutive times is equal to or larger than the second threshold to detect an anomaly or a sign of the anomaly.

Abstract: A film contains a ?-1,3-glucan derivative obtained by introducing an acyl group into a ?-1,3-glucan and at least one resin selected from the group consisting of a rosin-based resin, a terpene-based resin, and a petroleum-based resin. The acyl group is represented by RCO—, and the R is a hydrocarbon group having 1 or more and 5 or less carbon atoms. Parts by weight of the resin with respect to 100 parts by weight of the ?-1,3-glucan derivative are 90 parts by weight or less. A pressure-sensitive adhesive tape includes the film and a pressure-sensitive adhesive layer.

Abstract: A division unit (22) divides a plaintext M every b bits from a beginning, thereby generating b-bit values M1, . . . , Mm-1 and a value Mm having 1 or more bits to b or less bits. An S1 calculation unit (241) assigns a b-bit value H1 to a value M0, and for each integer i of i=1, . . . , m in an ascending order, takes a value Mi-1 as input to an encryption function E, thereby calculating a value S1(i), and calculates a value Ci from the value S1(i) and a value Mi. An S2 calculation unit (242) assigns an r-bit value H2 to a value S2(0), and for each integer i of i=1, . . . , m in an ascending order, calculates a value S2(i) from the value S1(i) and from a value S2(i?1). A ciphertext generation unit (243) generates a ciphertext C from a value Ci for each integer i of i=1, . . . , m. An authenticator generation unit (25) generates a (b+r)-bit authenticator T by using a value S1(m) and a value S2(m).

Abstract: An encryption device divides a plaintext M to generate a value M[1], . . . , and a value M[m]. The encryption device generates an n-bit value B[i] by encrypting a value B[i?1] by a block cipher with a value T[i?1] as a key, for each integer i of i=1, . . . , m in ascending order, generates a value C[i] from the value B[i] and a value M[i], and generates an n-bit value T[i] from a value P(T[i?1]) obtained by converting the value T[i?1] using a replacement function P, a value F(B[i]) obtained by converting the value B[i] using a replacement function F, and the value C[i]. The encryption device generates a ciphertext C by connecting the values C[i] for i=1, . . . , m. The encryption device generates from a value H[m] and the value B[m], an authenticator Tag for detecting an alteration of the ciphertext C.

Abstract: A message authentication apparatus compresses a message M into a value H of 2n bits, and divides the value H into two values H[1] and H[2] each having n bits. The message authentication apparatus extracts two values U[1] and U[2] each having min{t, n/2} bits from the value H[1], generates a value V[1] of t bits, using as input the message M and the value U[1], and generates a value V[2] of t bits, using as input the message M and the value U[2]. The message authentication apparatus encrypts the value H[2] by a tweakable block cipher E, using the value V[1] as a tweak, to generate a value Z[1], and encrypts the value H[2] by the tweakable block cipher E, using the value V[2] as a tweak, to generate a value Z[2]. The message authentication apparatus generates an authenticator Z from the value Z[1] and the value Z[2].

Abstract: A division unit (22) divides a plaintext M every b bits from a beginning, thereby generating b-bit values M1, . . . , Mm-1 and a value Mm having 1 or more bits to b or less bits. An S1 calculation unit (241) assigns a b-bit value H1 to a value M0, and for each integer i of i=1, . . . , m in an ascending order, takes a value Mi-1 as input to an encryption function E, thereby calculating a value S1(i), and calculates a value Ci from the value S1(i) and a value Mi. An S2 calculation unit (242) assigns an r-bit value H2 to a value S2(0), and for each integer i of i=1, . . . , m in an ascending order, calculates a value S2(i) from the value S1(i) and from a value S2(i?1). A ciphertext generation unit (243) generates a ciphertext C from a value Ci for each integer i of i=1, . . . , m. An authenticator generation unit (25) generates a (b+r)-bit authenticator T by using a value S1(m) and a value S2(m).

Abstract: An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

Abstract: An encryption device (10) is an encryption device in authentication encryption. A key generation unit (21) generates a key K of an encryption function E of a block cipher, in accordance with an initial parameter N. A hash calculation unit (22) calculates a hash value msk with an internal parameter ctr as an input. An encryption unit (23) generates a ciphertext c of the message m by using the encryption function E, with a key K generated by the key generation unit (21), a hash value msk calculated by the hash calculation unit (22), and a message m as inputs.

Abstract: A message authenticator generation apparatus (10) generates a message authenticator using a block cipher E having a block size n. A hash function unit (21) calculates a hash value w with a hash function h having an output length longer than n bits, taking as input a message M. A post-processing unit (22) performs calculations using the block cipher E on the hash value w calculated by the hash function unit (21), so as to calculate a message authenticator T not larger than the block size n for the message M.

Abstract: A message authentication apparatus compresses a message M into a value H of 2n bits, and divides the value H into two values H[1] and H[2] each having n bits. The message authentication apparatus extracts two values U[1] and U[2] each having min{t, n/2} bits from the value H[1], generates a value V[1] of t bits, using as input the message M and the value U[1], and generates a value V[2] of t bits, using as input the message M and the value U[2]. The message authentication apparatus encrypts the value H[2] by a tweakable block cipher E, using the value V[1] as a tweak, to generate a value Z[1], and encrypts the value H[2] by the tweakable block cipher E, using the value V[2] as a tweak, to generate a value Z[2]. The message authentication apparatus generates an authenticator Z from the value Z[1] and the value Z[2].

Abstract: A message authenticator generation apparatus (10) generates a message authenticator using a block cipher E having a block size n. A hash function unit (21) calculates a hash value w with a hash function h having an output length longer than n bits, taking as input a message M. A post-processing unit (22) performs calculations using the block cipher E on the hash value w calculated by the hash function unit (21), so as to calculate a message authenticator T not larger than the block size n for the message M.

Abstract: An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

Abstract: An encryption device (10) is an encryption device in authentication encryption. A key generation unit (21) generates a key K of an encryption function E of a block cipher, in accordance with an initial parameter N. A hash calculation unit (22) calculates a hash value msk with an internal parameter ctr as an input. An encryption unit (23) generates a ciphertext c of the message m by using the encryption function E, with a key K generated by the key generation unit (21), a hash value msk calculated by the hash calculation unit (22), and a message m as inputs.

Abstract: A message authenticator generating apparatus (10), for each integer i, taking as input a key K and a value m?[i] which is generated from a message M, calculates a value c[i] by a block cipher E. The message authenticator generating apparatus (10), taking as input the value c[i] for each integer i, calculates a value w[1], a value w[2], and a value w[3] each maintaining the randomness of the value c[i]. The message authenticator generating apparatus (10), taking as input the value w[2] and the key K, calculates a value K? by a function e which is a substitution function if the key K is fixed, taking as input the value w[1] and the value K?, calculates a value c by a block cipher E, and taking as input the value w[3] and the value c, calculates an authenticator T by a function d which is a substitution function if the value w[3] is fixed.

Abstract: A message authenticator generating apparatus (10), for each integer i, taking as input a key K and a value m?[i] which is generated from a message M, calculates a value c[i] by a block cipher E. The message authenticator generating apparatus (10), taking as input the value c[i] for each integer i, calculates a value w[1], a value w[2], and a value w[3] each maintaining the randomness of the value c[i]. The message authenticator generating apparatus (10), taking as input the value w[2] and the key K, calculates a value K? by a function e which is a substitution function if the key K is fixed, taking as input the value w[1] and the value K?, calculates a value c by a block cipher E, and taking as input the value w[3] and the value c, calculates an authenticator T by a function d which is a substitution function if the value w[3] is fixed.

Abstract: A message authenticator generating apparatus, taking as input a key K and a message M, generates an i-times-e-bit value E, and divides the value E at every e bit to generate values M[1], . . . , M[i]. During this, the message authenticator generating apparatus generates the value E such that a value M[1] and a value M[i] out of the values M[1], . . . , M[i] include at least one of bits of the key K. The message authenticator generating apparatus, where a value S[0] is an arbitrary value, for each integer j of j=1, . . . , i in an ascending order, calculates a value R[j] by a function g[j] taking as input a value S[j?1] and a value M[j], and substitutes the calculated value R[j] by a substitution function P[j] to calculate a value S[j]. The message authenticator generating apparatus generates an authenticator T for the message M with using a value S[i].

Abstract: A pseudo-random number generation device calculates a value st[i] of b[i] bits by using a function F[i] taking a value st[i?1] as input for each integer value i with i=1, . . . , n in ascending order. The pseudo-random number generation device calculates a value x[i] of r[i] bits by using a function g[i] taking as input at least a part of bits of a value st[j] and at least a part of bits of the value st[i] for at least a part of an integer value i with i=1, . . . , n, where a value j is an integer value smaller than the integer value i. The pseudo-random number generation device combines the values x[i] calculated by using the function g[i] to obtain a pseudo random number.

Abstract: The object is to constitute a hash function by removing a feed-forward arithmetic operation. A hash value calculation device, for each integer i of i=1, . . . , L in an ascending order, calculates a function f[i] which, upon input of a value M[i] having k-n bits, an n-bit value y1[i?1] (a value y1[0] is a predetermined value IV1), and an n-bit value y2[i?1] (a value y2[0] is a predetermined value IV2), outputs an n-bit value x1[i], an n-bit value x2[i], a k-bit value k1[i], and a k-bit value k2[i]; for the value x1[i] as a plaintext and the value k1[i] as a key, calculates an n-bit value y1[i] with an encryption function of a block cipher; and for the value x2[i] as a plaintext and the value k2[i] as a key, calculates an n-bit value y2[i] with the encryption function for the block cipher. The hash value calculation device, upon input of a value y1[L] and a value y2[L] which are calculated, calculates a hash value with an injective function g.