Abstract: An arithmetic device for Montgomery modular multiplication which quickly calculates a parameter ND with a large number of effective lower bits. The device comprises an ND generator, a multiplication-accumulation (MAC) operator, and a sum data store. The ND generator produces effective lower bits of ND at a rate of k bits per clock cycle, with reference to lower k bits of a variable S, as well as to lower k bits of an odd positive integer N. The MAC operator multiplies the produced k-bit ND value by N and adds the resulting product to S. The sum data store stores the variable S, which is updated with the output of the MAC operator, with its bits shifted right by k bits, for use by the ND generator in the subsequent clock cycle.

Abstract: A multiple-word multiplication-accumulation circuit suitable for use with a single-port memory. The circuit is composed of a multiplication-accumulation (MAC) operator and surrounding registers. The MAC operator has multiplicand and multiplier input ports with different bit widths to calculate a sum of products of multiple-word data read out of a memory. The registers serve as buffer storage of multiple-word data to be supplied to individual input ports of the MAC operator. The amount of data supplied to the MAC operator in each clock cycle is adjusted such that total amount of data consumed and produced by the MAC operator in one clock cycle will be equal to or smaller than the maximum amount of data that the memory can transfer in one clock cycle. This feature enables the use of a bandwidth-limited single-port memory, without causing adverse effect on the efficiency of MAC operator usage.

Abstract: An encryption device (FIG. 15) performs elliptic curve encryption using a secret key. The encryption device includes: operation means (ECDBL, ECADD) for performing scalar multiplication of a point on an elliptic curve; storage (T[0]-T[2]) having a plurality of data storing areas; and means (SEL) for determining, in accordance with a bit sequence of a given value (d) and with a random value (RNG), an address of one of the plurality of data storage areas that is to be coupled to the operation means for each scalar multiplication.

Abstract: When a user works data required for allowance for the use thereof, the work processing is carried out by utilizing an exclusive work processing device. Thereafter, only the data of work information indicating what kind of working has been made to the original data (for example, differential static image data indicating a difference between the original static image required for allowance for the use and the static image after having been worked) is stored, whereby the use without permission of the data is prevented.

Abstract: Ciphertext X and a constant C having relationships C>p and C>q with respect to secret keys p and q are input, and correction values C←dp and C←dq (dp=d mod (p−1), dq=d mod (q−1)) are obtained. Then, the ciphertext X is multiplied by the constant C. A remainder operation using the secret key p or q as a remainder value is conducted with respect to the multiplication result. A modular exponentiation operation based on a Chinese remainder theorem is conducted with respect to the remainder operation result, and a correction operation using a correction value C←dp or C←dq is conducted. Thereafter, plaintext Y before being encrypted is calculated.

Abstract: An encryption circuit that reduces a scale of circuit and can achieve a certain level of high-speed processing in the implementation of the AES block cipher.

Abstract: The encryption device includes random number generator means for generating a random number; and a first selector for selecting one of q fixed values in response to the random number, a second selector for selecting one set of q sets of fixed tables in response to the random number. XOR means XORs an input with an XOR of a key with the fixed value. Nonlinear transform means nonlinearly transforms an input in accordance with the selected set of fixed table. Another encryption device includes a plurality of encrypting units coupled in parallel, and a selector for selecting one of the plurality of encrypting units in response to the random number. The masking with the fixed values improves of the processing speed and reduces the required RAM area.

Abstract: In a remainder calculating method and a modular-multiplication method on the basis of a Montgomery method, a number expressed by N (N=c2d±1) is used as a divisor N. In order to calculate a remainder in the case of dividing a dividend Y by a divisor N on the basis of a Montgomery method, a number expressed by a condition of N=c2d−1 is used as the divisor N, and the following steps are repeatedly carried out; the steps includes: a step of adding a product of a least digit value yo of the dividend Y and c to a lower d-bit position of the dividend Y; and a step of setting a portion excluding the least digit of the additive result as a next dividend.

Abstract: A contents utilizing management apparatus includes a utilizing condition storing unit for storing a utilizing condition corresponding to a sum of money of purchased authorization of contents, a determination unit, coupled to a plurality of computers in which contents are utilized, for determining, based on the utilizing condition of the contents referring to a utilizing request supplied from one of the plurality of computers, whether the contents can be utilized, and a utilizing permission unit for supplying permission to utilize the contents to the one of the plurality of computers when the determination unit determines that the contents can be utilized.

Abstract: By providing a unit receiving the input of a set T of bit numbers that are obtained by unequally dividing all the bit numbers of input data to be given to a computing apparatus, a unit outputting a value AT indicating an existence probability of an appropriate linear converting unit corresponding to a plurality of S boxes of which the input and output bit numbers are equivalent to the divided bit numbers, a unit determining that an appropriate linear converting unit is present when the value of AT is positive, and a unit forming a pseudo MDS matrix as the linear converting unit, computation is executed using a unit with an excellent data diffusion performance as the linear converting unit in SPN structure, when the input number is not the same as the output number among a plurality of S boxes of the SPN structure in an F function.

Abstract: Intermediate data ai, bi, ci, and di are prepared by an intermediate data preparing equipment 4 from a cryptographic key through a nonlinear type function operation and the like, an extended key preparing equipment 5 selects a [Xr], b [Yr], c [Zr], and d [Wr] corresponding to the number of stages r from the intermediate data, and rearranges the data as well as conducts that of bit operation to prepare extended keys, whereby an extended key preparing apparatus by which an extended key required in the case where common key cryptosystem is applied can be safely prepared at a high speed, a process for preparing such an extended key, and a recording medium used therefor are provided.

Abstract: One or a plurality of prime numbers pi which are generated and a generated random number are used to calculate a larger prime number candidate, and a judgment is made as to whether or not the prime number candidate is a prime number by using a provable prime number judging method, and when the judgment is made that the candidate is a prime number, the prime number p is outputted. As for at least three polynomials F(p) which are factors of ps−1 (s: arbitrary natural number) by a prime number p, a measure against prime factorization is taken. Moreover, when the prime number p is used for a secret key of RSA cryptosystem, a strong prime number p against the iterated-encryption attack on RSA cryptosystem is generated.

Abstract: A key recovery condition encryption apparatus includes a hashing unit, a first concatenating unit, and a condition information encryption unit. The hashing unit calculates a hash value on the basis of a hash function using a key recovery information text serving as information necessary for performing key recovery. The first concatenating unit concatenates the hash value from the hashing unit to the key recovery condition. The condition information encryption unit encrypts a concatenating result from the first concatenating unit by using a first encryption key. Also is disclosed a key recovery condition decryption apparatus for decrypting the encrypted data from the above encryption apparatus.

Abstract: The present invention has an object to overcome problems of a key recovery system using a conventional KRF system and to achieve efficient operation of the overall key recovery system. A key recovery system of the present invention includes check units 12a, 12b for checking whether a user has a recovery authorization for a common key KS, on the basis of a recovery condition RC specified by a recovery condition index RCI which is added to an encrypted message (encrypted message obtained by encrypting the common key KS with a public key KRCpub) supplied from a terminal (10a to 10d) of the user concerned, and a key recovery control unit 14 which is provided separately from the check units 12a, 12b and decrypts the encrypted message with a private key KRCpri paired with the public key KRCpub to recover the common key. The check unit 12a, 12b supplies the common key KS recovered in the key recovery control unit 14 to the user concerned only when the user has the recovery authorization.

Abstract: A key recovery information distribution device is provided between a recoverer device and a key recovery device, recovers a data key for the recoverer device, and reduces the load of the recoverer device. Data is encrypted using the data key and stored with key recovery information. The recoverer device which decrypts the encrypted data distributes the key recovery information to key recovery devices through the key recovery information distribution device to recover key information. A recoverer is authenticated directly between the key recovery device and the recoverer device, and then the key information is transmitted to the recoverer device, and the recoverer device recovers the data key.

Abstract: A data protecting method wherein a resident control program which is stored as to be resident in a storage medium driving device judges on the basis of instruction from an executing device for executing a specified process, whether a control program for executing the process is incorporated or not therein, searches the control program from a set storage medium when the result of judgment is NO, reads in the searched control program, and incorporates the read-in control program therein. A storage medium driving device which stores this resident control program as to be resident, and a storage medium which is driven by this device.

Abstract: When a secret is encrypted and stored, it is necessary to provide a countermeasure for the situation where a key is lost (key recovery system). In the present invention, a key recovery system for an enveloped data format in which a common key is used to encrypt a plaintext (secret) and a user's public key is used to encrypt the common key and attached to an encrypted text is provided. In the present invention, only the common key is decrypted to recover the secret without reconstruction of split secret keys kept in a plurality of key storage apparatuses.

Abstract: A set of a management-use memory medium in which is written various type of regulatory information (limit I of use of software, limit L of production of the next generation, a number K of generations showing up to what generation backup copies can be produced, software identification information PID, etc.) and a software memory medium in which the software is stored is established and use of the software is allowed under the restrictions of this regulatory information. Further, the software memory medium and the management-use memory medium may be provided in the same memory medium or the two may be constituted as separate memory media. In the case of the latter separate management system, the software is allowed to be used only when the software identification information PID written in the two match. It is therefore possible to suppress the unauthorized use of software without detracting from the spatial convenience of software use.

Abstract: A data processing apparatus serves as I/O units coupled to information processes apparatuses such as computers. The data processing apparatus decodes encrypted data and performs processing according to message data. The data processing apparatus includes a data processing circuit performing decoding processing and message processing according to message data, a data buffer accessible from both the data processing circuit and the information processing apparatus, a data buffer monitor circuit monitoring states of read/write of the data to the data buffer, and an access control circuit controlling an access from the information processing apparatus to the data buffer.

Abstract: There is disclosed a licensee notification system for implementing a software sales system wherein license information for converting to executable form software that is presented to a user in non-executable form is communicated to the user from a management center on condition of payment of a charge, and the software is converted into executable form at the user terminal using this license information. The subject of the licensee notification system is software that decides whether or not the correspondence relationship between user identification information and signature information stored in the license file is legitimate, and, if it is legitimate, displays the user identification information to the user before starting proper operation; or, if it is not legitimate, does not start proper operation. The licensee notification system is constituted by connecting the management center and user terminals by communication circuits.