Abstract: According to one embodiment, a memory chip, which is connected to a controller that controls reading and writing of data in response to a request from an external device, includes: a memory including a special area that is a predetermined data storage area; a key storage unit that stores therein a second key that corresponds to a first key used by the external device to convert the data; a converting unit that receives, from the controller, data to be written into the special area and generates converted data by converting the data to be written using the second key; and a writing unit that writes the converted data into the special area.

Abstract: According to one embodiment, a representation converting unit converts a set of n elements (h0, h1, . . . , hn?1) (hi: a member of a finite field Fp^m, 0?i?n?1) that is a projective representation of a member g of an n-th degree algebraic torus Tn(Fp^m) (n: positive integer, p: prime number, m: positive integer) into a limited projected representation expressed by a set of n elements (h?0, h?1, . . . , h?n?1) (h?i: a member of the finite field Fp^m, 0?i?n?1) in which at least one element out of the n elements is a zero element 0 or an identity element 1. An arithmetic unit omits part of Fp^m operation that is arithmetic operation in the finite field Fp^m based on a fact that an element in the set of n elements (h?0, h?1, . . . , h?n?1) represented by the limited projective representation is a zero element “0” or an identity element “1” when performing Fp^mn operation that is arithmetic operation of a finite field Fp^mn in combination with the Fp^m operation.

Abstract: According to one embodiment, a random number generating circuit includes first to N-th oscillating circuits (N is a natural number equal to 2 or greater), first to N-th latch circuits that latch outputs of the first to N-th oscillating circuits by a first clock having a first frequency, first to N-th exclusive OR circuits, (N+1)-th to (2×N)-th latch circuits that latch outputs of the first to N-th exclusive OR circuits by the first clock, an (N+1)-th exclusive OR circuit that outputs an exclusive OR of outputs of the (N+1)-th to (2×N)-th latch circuits, and an M-bit shift register that converts serial data output from the (N+1)-th exclusive OR circuit into M-bit parallel data (M is a natural number equal to 2 or greater) by a second clock having a second frequency.

Abstract: A compressing unit compresses an element on an algebraic torus into affine representation according to a compression map. A determining unit determines whether a target element on the algebraic torus to be compressed is an exceptional point representing an element on the algebraic torus that cannot be compressed by the compression map. The compressing unit generates, when it is determined that the target element is the exceptional point, a processing result including exceptional information indicating that the target element is the exceptional point, and generates, when it is determined that the target element is not the exceptional point, a processing result including affine representation obtained by compressing the target element according to the compression map.

Abstract: According to one embodiment, a memory chip, which is connected to a controller that controls reading and writing of data in response to a request from an external device, includes: a memory including a special area that is a predetermined data storage area; a key storage unit that stores therein a second key that corresponds to a first key used by the external device to convert the data; a converting unit that receives, from the controller, data to be written into the special area and generates converted data by converting the data to be written using the second key; and a writing unit that writes the converted data into the special area.

Abstract: In a computing device that calculates a square of an element in a finite field, a vector representation of the element in the finite field is accepted. The vector representation includes a plurality of elements. The computing device performs a multiplication operation on a base field using the accepted elements, and obtains a multiplication value. The multiplication operation is determined by a condition under which the element in the finite field is placed in an algebraic torus. The computing device performs an addition and subtraction operation using the obtained multiplication value and the accepted elements, and obtains a calculation result of the square of the element. The addition and subtraction operation is determined by the condition. The computing device then outputs the calculation result.

Abstract: According to one embodiment, in an encryption device, a segmentation unit segments masked plain data into pieces of first segmented data. A first processing unit generates pieces of second segmented data from the pieces of first segmented data. A nonlinear transform unit generates pieces of third segmented data transformed from the pieces of second segmented data. A data integration unit integrates fourth segmented data to generate masked encrypted data. An unmask processing unit generates encrypted data from the masked encrypted data. The exclusive OR of the pieces of second segmented data matches the exclusive OR of input data, subjected to nonlinear transform processing and calculated from the plain data, and the first mask. The exclusive OR of the pieces of third segmented data matches the exclusive OR of transform data, obtained when the nonlinear transform processing is performed on the input data, and the second mask.

Abstract: According to one embodiment, a memory chip, which is connected to a controller that controls reading and writing of data in response to a request from an external device, includes: a memory including a special area that is a predetermined data storage area; a key storage unit that stores therein a second key that corresponds to a first key used by the external device to convert the data; a converting unit that receives, from the controller, data to be written into the special area and generates converted data by converting the data to be written using the second key; and a writing unit that writes the converted data into the special area.

Abstract: In a computing device that calculates a square of an element in a finite field, a vector representation of the element in the finite field is accepted. The vector representation includes a plurality of elements. The computing device performs a multiplication operation on a base field using the accepted elements, and obtains a multiplication value. The multiplication operation is determined by a condition under which the element in the finite field is placed in an algebraic torus. The computing device performs an addition and subtraction operation using the obtained multiplication value and the accepted elements, and obtains a calculation result of the square of the element. The addition and subtraction operation is determined by the condition. The computing device then outputs the calculation result.

Abstract: According to an aspect of the present invention, there is provided a non-linear data converter including: first to fourth converters that each performs a respective converting process on an input bit string to output respective output bit string; a generator that generates a random number bit string; and a selector that selects any one of the output bit strings from the first to fourth converters based on the random number bit string. Each of the converting processes is equivalent to performing a first mask process, a non-linear conversion predetermined for an encoding or a decoding and a second mask process.

Abstract: According to an embodiment, an encryption device performs encryption processing using an encryption key and calculates encrypted data from plain data. The encryption device includes: a register; an input unit configured to receive plain data; a first partial encryption unit configured to calculate first intermediate data from the plain data; a second partial encryption unit configured to calculate (i+1)-th intermediate data based on i-th intermediate data and the encryption key; a first transform unit configured to: transform j-th intermediate data into j-th transformed data; and store the j-th transformed data in the register; and a second transform unit configured to transform the j-th transformed data into the j-th intermediate data; a third partial encryption unit configured to calculate encrypted data from the N-th intermediate data. The second partial encryption unit is configured to repeat processing to calculate (j+1)-th intermediate data while j is equal to from 1 to N?1.

Abstract: An arithmetic device includes an input unit inputting data that are elements of a group; a converting unit is configured, when the input data are in a second representation, to convert the input data into a first representation and to perform arithmetic operation on the converted first representation using an operand in the first representation in which at least one subcomponent is a zero element to convert the converted first representation into first converted data expressed in the first representation, and when the input data are in the first representation, to perform arithmetic operation on the input data using the operand in the first representation in which at least one subcomponent is a zero element to convert the input data into second converted data expressed in the first representation; and an operating unit that performs arithmetic processing on the first or the second converted data using secret information.

Abstract: According to one embodiment, in a key scheduling device, a non-linear transformation unit non-linearly transforms at least one of partial keys resulting from dividing an expanded key. A first linear transformation unit includes first and second circuits. The second circuit linearly transforms the partial key by directly using a transformation result from the non-linear transformation unit. A first storage stores the partial key linearly transformed by the first linear transformation unit. A second linear transformation unit linearly transforms, inversely to the first linear transformation unit, each of partial keys other than the partial key linearly transformed by the second circuit out of the partial keys stored in the first storage, and outputs inversely transformed partial keys. A second storage stores one of inputs to the second circuit. An outputting unit connects the respective inversely transformed partial keys and the input stored in the second storage to be output as a second key.

Abstract: An encryption processing unit executes an arithmetic operation decided in advance and outputs an arithmetic result as an element on an algebraic torus. A compressing unit outputs, when the arithmetic result is an exceptional point representing an element on the algebraic torus that cannot be compressed by a compression map for compressing an element on the algebraic torus into affine representation, a compression result obtained by compressing the arithmetic result according to the compression map and outputs, when the arithmetic result is the exceptional point, an element belonging to a specific set decided in advance that does not overlap a set to which a compression result obtained by compressing the arithmetic result, which is not the exceptional point, belongs.

Abstract: According to one embodiment, a representation converting unit converts a set of n elements (h0, h1, . . . , hn?1) (hi: a member of a finite field Fp?m, 0?i?n?1) that is a projective representation of a member g of an n-th degree algebraic torus Tn(Fp?m) (n: positive integer, p: prime number, m: positive integer) into a limited projected representation expressed by a set of n elements (h?0, h?1, . . . , h?n?1) (h?i: a member of the finite field Fp?m, 0?i?n?1) in which at least one element out of the n elements is a zero element 0 or an identity element 1. An arithmetic unit omits part of Fp?m operation that is arithmetic operation in the finite field Fp?m based on a fact that an element in the set of n elements (h?0, h?1, . . . , h?n?1) represented by the limited projective representation is a zero element “0” or an identity element “1” when performing Fp?mn operation that is arithmetic operation of a finite field Fp?mn in combination with the Fp?m operation.

Abstract: According to one embodiment, in an encryption device, a segmentation unit segments masked plain data into pieces of first segmented data. A first processing unit generates pieces of second segmented data from the pieces of first segmented data. A nonlinear transform unit generates pieces of third segmented data transformed from the pieces of second segmented data. A data integration unit integrates fourth segmented data to generate masked encrypted data. An unmask processing unit generates encrypted data from the masked encrypted data. The exclusive OR of the pieces of second segmented data matches the exclusive OR of input data, subjected to nonlinear transform processing and calculated from the plain data, and the first mask. The exclusive OR of the pieces of third segmented data matches the exclusive OR of transform data, obtained when the nonlinear transform processing is performed on the input data, and the second mask.

Abstract: According to one embodiment, a cryptographic processing apparatus is provided with first to fifth units. The first unit mask-converts input data from first temporary mask into first fixed mask (an invariable value in a first linear operation). In an encryption, the third unit performs a nonlinear operation on the mask-converted data and outputs a first result masked with second fixed mask data (an invariable value in a second linear operation). The fourth unit performs the second linear operation and outputs a encryption result masked with second fixed mask data. In a decryption, the second unit performs the first linear operation on the mask-converted data and outputs a second result masked with the first fixed mask. The third unit performs the nonlinear operation and outputs a decryption result masked with the second fixed mask. In encryption/decryptions, the fifth unit converts the mask of the encryption/decryption results into second temporary mask.

Abstract: A first Exclusive OR circuit operates an Exclusive OR between input data and a predetermined random number. An operation circuit performs one operation of encryption and decryption of output data from the first Exclusive OR circuit. A data register circuit, which has a plurality of data hold units, holds data from the operation circuit in one data hold unit of the plurality of data hold units in response to a selection signal, and supplies the data from the one data hold unit to the operation circuit. A second Exclusive OR circuit performs an Exclusive OR between output data from the data register circuit and the random number. The operation circuit recursively performs the one operation of the data from the data register circuit and outputs next data to the data register circuit.

Abstract: According to one embodiment, a memory chip, which is connected to a controller that controls reading and writing of data in response to a request from an external device, includes: a memory including a special area that is a predetermined data storage area; a key storage unit that stores therein a second key that corresponds to a first key used by the external device to convert the data; a converting unit that receives, from the controller, data to be written into the special area and generates converted data by converting the data to be written using the second key; and a writing unit that writes the converted data into the special area.

Abstract: A calculation apparatus capable of executing any of a first calculating process operation including a first matrix calculation, and a second calculating process operation including a second matrix calculation, includes: a first calculation unit for executing the second matrix calculation; at least one calculation unit other than the first calculation unit, for executing a matrix calculation in parallel to the first calculation unit so as to execute the first matrix calculation; and a logic circuit for performing a logic calculation with respect to a calculation result of the first calculation unit and a calculation result of the other calculation unit. Then, when a calculation result of the first matrix calculation is requested, the calculation apparatus acquires the calculation result from the logic circuit.