Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: In the evaluation of the randomness of an S-box, measures of resistance to higher order cryptanalysis, interpolation cryptanalysis, partitioning cryptanalysis and differential-linear cryptanalysis and necessary conditions for those measures to have resistance to each cryptanalysis are set, then for functions as candidates for the S-box, it is evaluated whether one or all of the conditions are satisfied, and those of the candidate functions for which one or all of the conditions are satisfied are selected as required. It is also possible to further evaluate the resistance of such selected functions to at least one of differential cryptanalysis and linear cryptanalysis and select those of the candidate functions which are resistant to at least one of the cryptanalyses as required.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit ((FL?1)) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit ((FL?1)) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL?1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL?1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: Permuted data (u1?, u2?, . . . , um?) of input data (u1, u2, . . . , un) expressed by the relationship [ u 1 ? u 2 ? ? u m ? ] = P ? [ u 1 u 2 ? u n ] , are obtained by expressing the permuted data uj? by uj?=ui?+Di, where j?i and calculate uj? for all of j.

Abstract: In an inverse calculation, x is road out of a storage means, [x/2] is calculated and stored therein as b, a lent significant bit of b is stored as a, [(ax+b)/2] is calculated and stored as updated b, and low-order two bits of x are stored as y. Then, for i=1, 2, . . . , n?1, by is calculated, a is updated with ?by, [(b+ax)/(2^(2i))] is calculated and stored as updated b, and y+a2^(2i) is calculated and stored as updated y, where y is road out as the result of inverse calculation.

Abstract: A plurality of round processing parts (38) are provided each of which contains a nonlinear function part (304), and each nonlinear function part (304) comprises: a first key-dependent linear transformation part (341) which performs a linear transformation based on a subkey; a splitting part (342) which splits the output from the first key-dependent linear transformation part into n pieces of subdata; a first nonlinear transformation part (343) which nonlinearly transforms those pieces of subdata, respectively; a second key-dependent linear transformation part (344) which linearly transforms those nonlinearly transformed outputs based on a subkey and outputs n pieces of transformed subdata; a second nonlinear transformation part (345) which nonlinearly transforms those transformed subdata; and a combining part (346) which combines the nonlinearly transformed outputs.

Abstract: In a method for permuting and dividing 16 pieces of k-bit data held in 4k-bit long registers T0, T1, T2 and T3, k being an integer, the data of each register Ti is ANDed with a desired one of mask data (00ffff00), (ff0000ff), (0000ffff) and (ffff0000), and such ANDs are ORed to obtain desired permuted data.

Abstract: In a method for permuting and dividing 16 pieces of k-bit data held in 4 k-bit long registers T0. T1, T2 and T3, k being an integer, the data of each register Ti is ANDed with a desired one of mask data (00ffff00), (ff0000ff), (0000ffff) and (ffff0000), and such ANDs are ORed to obtain desired permuted data.

Abstract: In a method for permuting and dividing 16 pieces of k-bit data held in 4k-bit long registers T0. T1, T2 and T3, k being an integer, the data of each register Ti is ANDed with a desired one of mask data (00ffff00), (ff0000ff), (0000ffff) and (ffff0000), and such ANDs are ORed to obtain desired permuted data.

Abstract: It is desired to share one circuit by an encryption unit 200 and a decryption unit 500. A normal data transformation unit (FL) 251 and an inverse data transformation unit (FL−1) 273 are located at point symmetry on a non-linear data transformation unit 220, and a normal data transformation unit (FL) 253 and an inverse data transformation unit (FL−1) 271 are located at point symmetry on the non-linear data transformation unit 220. Therefore, the encryption unit 200 and the decryption unit 500 can be configured using the same circuits.

Abstract: A scheme for arithmetic operations in finite field and group operations over elliptic curves capable of realizing a very fast implementation. According to this scheme, by using a normal basis [.alpha. .alpha.+1], the multiplicative inverse calculation and the multiplication in the finite field GF(2.sup.2n) can be realized as combinations of multiplications, additions and a multiplicative inverse calculation in the subfield GF(2.sup.n). Also, by using a standard basis [1.alpha.], the multiplication, the square calculation, and the multiplicative inverse calculation in the finite field GF(2.sup.2n) can be realized as combinations of multiplications, additions and a multiplicative inverse calculation in the subfield GF(2.sup.n). These arithmetic operations can be utilized for calculating rational expressions expressing group operations over elliptic curves that are used in information security techniques such as elliptic curve cryptosystems.