Abstract: A MAC tag list generation apparatus includes: a message input part; a group testing matrix generation part which generates a t×m group testing matrix H that is a parameter(s) of combinatorial group testing with respect to the number s (s being a positive integer) of the MACs to be generated, a decodable linear group testing MAC application part which, with respect to the message M, using the group testing matrix H, a variable-length-input fixed-length-output pseudorandom function F; and a Tweakable block cipher G for which a row index of the group testing matrix H is a Tweak, generates a MAC tag list T=(T[1], . . . , T[t]); and a MAC tag list output part which outputs the MAC tag list.

Abstract: An information processing apparatus includes an input receiving unit, a first permutation processing unit that repeats a first permutation process a times and outputs a first intermediate text, a second permutation processing unit that repeats a second permutation process b times and outputs a second intermediate text, and a termination processing unit that performs a termination process for outputting a ciphertext by using the second intermediate text as an input. The first permutation process is a permutation process in which an addition process, an S-box process, a bit permutation process, and a matrix multiplication process are successively performed. The second permutation process is a permutation process in which the addition process, the S-box process, a nibble permutation process, and the matrix multiplication process are successively performed. The termination process is a permutation process in which the S-box process and the addition process are successively performed.

Abstract: A MAC tag list generation apparatus, on reception of a nonce N unique value to each MAC generation process and a message M, generates a t×m group test matrix H serving as combinatorial group testing parameters for s (a positive integer) which is the number of the MACs to be generated, generates a MAC tag list T=(T[1], . . . , T[t]) by generating a MAC value T[i] corresponding to the i-th test (i=1, . . . , t) using the group test matrix H, the nonce N, and pseudorandom functions F and G with variable length input and fixed length output for the message M, and outputs the MAC tag list.

Abstract: An authenticated encryption device 10 includes: an encryption means 11 which encrypts a plaintext block by inputting, to an encryption function whereby data of a predetermined bit number is output when data of the predetermined bit number is input, a plaintext block of the predetermined bit number constituting the plaintext to be encrypted with a mask value, which is uniquely determined from an adjustment value including an initial vector not overlapping a past value and a secret key, being added; and a computation means 12 which computes, as a checksum, the exclusive OR of corresponding bits of a first bit string, a bit number of which is less than the predetermined bit number, of each of a plurality of plaintext blocks constituting the plaintext.

Abstract: An authenticated encryption apparatus capable of reducing delays in encryption and in decryption is provided. A nonce generation unit generates a nonce different from any of values generated in the past. A plaintext encryption unit generates a ciphertext corresponding to a plaintext by encrypting each of blocks obtained by dividing the plaintext by using the nonce as an auxiliary variable. A checksum generation unit generates a checksum by using the plaintext. A hash unit acquires a hash value. A nonce encryption unit acquires an encrypted nonce by encrypting the nonce. An authentication tag generation unit generates an authentication tag by using the checksum, the hash value, and the encrypted nonce.

Abstract: A memory address allocation unit allocates, to each of nodes in a tree structure configured for protecting a memory, a memory address unique to the node. A tag generation unit defines, for each of the nodes in the tree structure, a connection of the memory address and a constant as a nonce, and generates a tag by inputting the nonce and a plaintext of which tampering with is to be detected, or the nonce and a plurality of constants of child nodes of each of the nodes into a message authentication code, the message authentication code being a code by which a partially-updatable tag can be output. A node generation unit uses a constant as a local counter, and generates each of the nodes in the tree structure by combining at least a tag and the local counter.

Abstract: Provided are a random number generation device and the like capable of calculating a high precision random number using a memory capacity selected irrespective of the precision of the random number. A random number calculation device is configured to generate first random numbers based on given number and specify, for the given number of second random numbers in a target numeric extent, bin range depending on the first random numbers based on frequency information representing cumulative frequency regarding a frequency of numeric extent including respective second random numbers among given numeric extents, the numeric extent being determined in accordance with a desirable precision.

Abstract: An encryption device includes an encryption unit that encrypts blocks, obtained by dividing a plaintext, with use of an auxiliary variable, a partial checksum generation unit that generates a plurality of partial checksums on the basis of the blocks obtained by dividing the plaintext, a meta checksum generation unit that generates a meta checksum on the basis of the partial checksums generated by the partial checksum generation unit, and a tag generation unit that generates a tag to be used for detecting tampering, on the basis of the meta checksum generated by the meta checksum generation unit. The encryption device outputs a ciphertext encrypted by the encryption unit and the tag generated by the tag generation unit.

Abstract: A MAC tag list generation apparatus includes: a message input part; a group testing matrix generation part which generates a t×m group testing matrix H that is a parameter(s) of combinatorial group testing with respect to the number s (s being a positive integer) of the MACs to be generated, a decodable linear group testing MAC application part which, with respect to the message M, using the group testing matrix H, a variable-length-input fixed-length-output pseudorandom function F; and a Tweakable block cipher G for which a row index of the group testing matrix H is a Tweak, generates a MAC tag list T=(T[1], . . . , T[t]); and a MAC tag list output part which outputs the MAC tag list.

Abstract: A first apparatus comprises an error correction coding part that receives a message M to be transmitted to a second apparatus, performs coding using a predetermined error correction code, and outputs a codeword C; a message authentication tag generation part that receives the message M and outputs a predetermined message authentication tag T; and a transmission part that transmits the codeword C and the tag T as transmission information S to the second apparatus. The second apparatus receives a message M* to be verified and a tag T?, which are obtained from the transmission information S, and determines that the message M* to be verified has not been tampered with when a tag T* obtained from the message M* to be verified and the tag T? satisfy a predetermined identity criterion.

Abstract: A generation means 11 generates a uniform random number between 0 and a first probability, which is a probability of a stochastic variable becoming a value within a predetermined interval in a positive range in the first discrete distribution. When a uniform random number less than or equal to a second probability is generated, the second probability being a probability of the stochastic variable becoming a value within a predetermined interval in a second discrete distribution, which is a discrete Gaussian distribution on a one-dimensional lattice the center of which is the origin, the selection means 12 selects, as a random number generation method, an accumulation method in which a functional value defining the second discrete distribution is used. When a uniform random number greater than the second probability is generated, the selection means 12 selects a rejection sampling method as the random number generation method.

Abstract: A decoding apparatus includes a plurality-of-bits decoding part configured to receive an input vector obtained by adding a message encrypted by a trapdoor function and an error vector including an element(s) conforming with a discrete Gaussian distribution, and decode a plurality of bits from a lower bit of the message based on the input vector in correctness with a predetermined probability; and a confirmation calculation part configured to determine in parallel whether the decoded plurality of bits are correct or not, wherein the message is encrypted by taking an inner product with a vector including a power of two as an element(s).

Abstract: A hash function is computed for each item of a partial string obtained by dividing a message received according to a group testing matrix representing combinatorial group testing relating to the message, and an authentication tag for the partial string is generated using a value obtained by a combining operation of individual hash values by a combiner, wherein the combiner performs the combining operation of the individual hash values, by using a hash value of an item of an empty string as an identity element of the operation.

Abstract: A MAC tag list generation apparatus, on reception of a nonce N unique value to each MAC generation process and a message M, generates a t×m group test matrix H serving as combinatorial group testing parameters for s (a positive integer) which is the number of the MACs to be generated, generates a MAC tag list T=(T[1], . . . , T[t]) by generating a MAC value T[i] corresponding to the i-th test (i=1, . . . , t) using the group test matrix H, the nonce N, and pseudorandom functions F and G with variable length input and fixed length output for the message M, and outputs the MAC tag list.

Abstract: A grouping means 11 that extracts basis vectors from a set of basis vectors for a lattice having a predetermined relationship with a matrix used to generate a public key, and that groups the basis vectors such that a predetermined condition is satisfied. A sampling means 12 that samples, for at least one group, the same number of arbitrary values as the number of a plurality of basis vectors included in that group, in parallel for the individual basis vectors, onto a lattice constituted by the plurality of basis vectors, the arbitrary values serving as random numbers following a discrete Gaussian distribution. The predetermined condition is that each of the basis vectors included in a group is orthogonal to the other basis vectors included in the same group and is also orthogonal to Gram-Schmidt basis vectors, which are vectors obtained by orthogonalizing the other basis vectors by Gram-Schmidt orthogonalization.

Abstract: An authenticated encryption device 10 includes: an encryption means 11 which encrypts a plaintext block by inputting, to an encryption function whereby data of a predetermined bit number is output when data of the predetermined bit number is input, a plaintext block of the predetermined bit number constituting the plaintext to be encrypted with a mask value, which is uniquely determined from an adjustment value including an initial vector not overlapping a past value and a secret key, being added; and a computation means 12 which computes, as a checksum, the exclusive OR of corresponding bits of a first bit string, a bit number of which is less than the predetermined bit number, of each of a plurality of plaintext blocks constituting the plaintext.

Abstract: An encryption device includes an encryption unit that encrypts blocks, obtained by dividing a plaintext, with use of an auxiliary variable, a partial checksum generation unit that generates a plurality of partial checksums on the basis of the blocks obtained by dividing the plaintext, a meta checksum generation unit that generates a meta checksum on the basis of the partial checksums generated by the partial checksum generation unit, and a tag generation unit that generates a tag to be used for detecting tampering, on the basis of the meta checksum generated by the meta checksum generation unit. The encryption device outputs a ciphertext encrypted by the encryption unit and the tag generated by the tag generation unit.

Abstract: A random number generation system 20 generates a random number using a public key, a component of which is the member of a residue class ring modulo of a predetermined natural number excluding natural numbers represented by the power of a prime in composite numbers, the random number generation system including: a factorizing means 21 that computes the prime factorization for a predetermined natural number; and a generation means 22 that generates a random number in accordance with a discrete Gaussian distribution over a lattice wherein a vector having non-zero components of a single prime factor obtained by computing prime factorization and ?1 is a basis vector.

Abstract: A generation means 11 generates a uniform random number between 0 and a first probability, which is a probability of a stochastic variable becoming a value within a predetermined interval in a positive range in the first discrete distribution. When a uniform random number less than or equal to a second probability is generated, the second probability being a probability of the stochastic variable becoming a value within a predetermined interval in a second discrete distribution, which is a discrete Gaussian distribution on a one-dimensional lattice the center of which is the origin, the selection means 12 selects, as a random number generation method, an accumulation method in which a functional value defining the second discrete distribution is used. When a uniform random number greater than the second probability is generated, the selection means 12 selects a rejection sampling method as the random number generation method.

Abstract: The random number generation system 10 includes: a first generation means 11 that generates a random number according to a one-dimensional discrete Gaussian distribution on a first lattice that is a lattice comprising an addition vector obtained by adding the second vector to the first vector and a subtraction vector obtained by subtracting the second vector from the first vector; a second generation means 12 that generates a random number according to a one-dimensional discrete Gaussian distribution on a second lattice that is the first lattice in which a vector obtained by dividing the sum of the addition vector and the subtraction vector by 2 is added; and an instruction means 13 that instructs the first generation means 11 or the second generation means 12 to generate a random number.