Abstract: A vehicular drive device includes a rotating electrical machine, transmission mechanism, case, and communication oil passage. The case includes a first housing chamber housing the rotating electrical machine and a second housing chamber housing the transmission mechanism. The communication oil passage communicates with the first and second housing chambers. The lower part of the second housing chamber forms a second oil reservoir where oil is scraped up by gear rotation. The case includes a partition wall between the first and second housing chambers axially. The communication oil passage runs under the partition wall and includes a first and second opening. The first opening opens to the first housing chamber at a first position away from the partition wall toward the first side in the axial direction. The second opening opens to the second housing chamber at a second position away from the partition wall toward the second side axially.

Abstract: A hash value computation device (10) computes a hash value H of 2n bits using a block cipher E that takes as input a key K of k bits and a plaintext block P of n bits, which is a smaller number of bits than k bits, and outputs a ciphertext of n bits. A function computation unit (22) computes a function CF that processes the block cipher E a plurality of times sequentially on an input value M* of k-n bits, an input value S[1] of n bits, and an input value S[2] of n bits so as to compute an output value S?[1] of n bits and an output value S?[2] of n bits. A hash value computation unit (23) computes the hash value H from the output value S?[1] and the output value S?[2].

Abstract: A division unit (22) divides a plaintext M every b bits from a beginning, thereby generating b-bit values M1, . . . , Mm-1 and a value Mm having 1 or more bits to b or less bits. An S1 calculation unit (241) assigns a b-bit value H1 to a value M0, and for each integer i of i=1, . . . , m in an ascending order, takes a value Mi-1 as input to an encryption function E, thereby calculating a value S1(i), and calculates a value Ci from the value S1(i) and a value Mi. An S2 calculation unit (242) assigns an r-bit value H2 to a value S2(0), and for each integer i of i=1, . . . , m in an ascending order, calculates a value S2(i) from the value S1(i) and from a value S2(i?1). A ciphertext generation unit (243) generates a ciphertext C from a value Ci for each integer i of i=1, . . . , m. An authenticator generation unit (25) generates a (b+r)-bit authenticator T by using a value S1(m) and a value S2(m).

Abstract: An encryption device divides a plaintext M to generate a value M[1], . . . , and a value M[m]. The encryption device generates an n-bit value B[i] by encrypting a value B[i?1] by a block cipher with a value T[i?1] as a key, for each integer i of i=1, . . . , m in ascending order, generates a value C[i] from the value B[i] and a value M[i], and generates an n-bit value T[i] from a value P(T[i?1]) obtained by converting the value T[i?1] using a replacement function P, a value F(B[i]) obtained by converting the value B[i] using a replacement function F, and the value C[i]. The encryption device generates a ciphertext C by connecting the values C[i] for i=1, . . . , m. The encryption device generates from a value H[m] and the value B[m], an authenticator Tag for detecting an alteration of the ciphertext C.

Abstract: A message authentication apparatus compresses a message M into a value H of 2n bits, and divides the value H into two values H[1] and H[2] each having n bits. The message authentication apparatus extracts two values U[1] and U[2] each having min{t, n/2} bits from the value H[1], generates a value V[1] of t bits, using as input the message M and the value U[1], and generates a value V[2] of t bits, using as input the message M and the value U[2]. The message authentication apparatus encrypts the value H[2] by a tweakable block cipher E, using the value V[1] as a tweak, to generate a value Z[1], and encrypts the value H[2] by the tweakable block cipher E, using the value V[2] as a tweak, to generate a value Z[2]. The message authentication apparatus generates an authenticator Z from the value Z[1] and the value Z[2].

Abstract: A division unit (22) divides a plaintext M every b bits from a beginning, thereby generating b-bit values M1, . . . , Mm-1 and a value Mm having 1 or more bits to b or less bits. An S1 calculation unit (241) assigns a b-bit value H1 to a value M0, and for each integer i of i=1, . . . , m in an ascending order, takes a value Mi-1 as input to an encryption function E, thereby calculating a value S1(i), and calculates a value Ci from the value S1(i) and a value Mi. An S2 calculation unit (242) assigns an r-bit value H2 to a value S2(0), and for each integer i of i=1, . . . , m in an ascending order, calculates a value S2(i) from the value S1(i) and from a value S2(i?1). A ciphertext generation unit (243) generates a ciphertext C from a value Ci for each integer i of i=1, . . . , m. An authenticator generation unit (25) generates a (b+r)-bit authenticator T by using a value S1(m) and a value S2(m).

Abstract: An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

Abstract: An encryption device (10) is an encryption device in authentication encryption. A key generation unit (21) generates a key K of an encryption function E of a block cipher, in accordance with an initial parameter N. A hash calculation unit (22) calculates a hash value msk with an internal parameter ctr as an input. An encryption unit (23) generates a ciphertext c of the message m by using the encryption function E, with a key K generated by the key generation unit (21), a hash value msk calculated by the hash calculation unit (22), and a message m as inputs.

Abstract: A message authenticator generation apparatus (10) generates a message authenticator using a block cipher E having a block size n. A hash function unit (21) calculates a hash value w with a hash function h having an output length longer than n bits, taking as input a message M. A post-processing unit (22) performs calculations using the block cipher E on the hash value w calculated by the hash function unit (21), so as to calculate a message authenticator T not larger than the block size n for the message M.

Abstract: A message authentication apparatus compresses a message M into a value H of 2n bits, and divides the value H into two values H[1] and H[2] each having n bits. The message authentication apparatus extracts two values U[1] and U[2] each having min{t, n/2} bits from the value H[1], generates a value V[1] of t bits, using as input the message M and the value U[1], and generates a value V[2] of t bits, using as input the message M and the value U[2]. The message authentication apparatus encrypts the value H[2] by a tweakable block cipher E, using the value V[1] as a tweak, to generate a value Z[1], and encrypts the value H[2] by the tweakable block cipher E, using the value V[2] as a tweak, to generate a value Z[2]. The message authentication apparatus generates an authenticator Z from the value Z[1] and the value Z[2].

Abstract: A message authenticator generation apparatus (10) generates a message authenticator using a block cipher E having a block size n. A hash function unit (21) calculates a hash value w with a hash function h having an output length longer than n bits, taking as input a message M. A post-processing unit (22) performs calculations using the block cipher E on the hash value w calculated by the hash function unit (21), so as to calculate a message authenticator T not larger than the block size n for the message M.

Abstract: An encryption device divides a message M into blocks of b bits, so as to generate data M[1], . . . , data M[m]. The encryption device sets data S0 of n=b+c bits to a variable S, updates the variable S by calculating a block cipher E using as input the variable S, then updates the variable S by calculating an exclusive OR using as input the variable S that has been updated and data X[i] that is data M[i] to which a bit string of c bits is added, and generates data C[i] by extracting b bits from the variable S that has been updated, for each integer i=1, . . . , m in ascending order. The encryption device generates a ciphertext C of the message M by concatenating the respective pieces of the data C[i] for each integer i=1, . . . , m. The encryption device extracts t bits from the variable S as an authenticator T, where t is an integer of 1 or greater.

Abstract: An encryption device (10) is an encryption device in authentication encryption. A key generation unit (21) generates a key K of an encryption function E of a block cipher, in accordance with an initial parameter N. A hash calculation unit (22) calculates a hash value msk with an internal parameter ctr as an input. An encryption unit (23) generates a ciphertext c of the message m by using the encryption function E, with a key K generated by the key generation unit (21), a hash value msk calculated by the hash calculation unit (22), and a message m as inputs.

Abstract: A message authenticator generating apparatus (10), for each integer i, taking as input a key K and a value m?[i] which is generated from a message M, calculates a value c[i] by a block cipher E. The message authenticator generating apparatus (10), taking as input the value c[i] for each integer i, calculates a value w[1], a value w[2], and a value w[3] each maintaining the randomness of the value c[i]. The message authenticator generating apparatus (10), taking as input the value w[2] and the key K, calculates a value K? by a function e which is a substitution function if the key K is fixed, taking as input the value w[1] and the value K?, calculates a value c by a block cipher E, and taking as input the value w[3] and the value c, calculates an authenticator T by a function d which is a substitution function if the value w[3] is fixed.

Abstract: A message authenticator generating apparatus (10), for each integer i, taking as input a key K and a value m?[i] which is generated from a message M, calculates a value c[i] by a block cipher E. The message authenticator generating apparatus (10), taking as input the value c[i] for each integer i, calculates a value w[1], a value w[2], and a value w[3] each maintaining the randomness of the value c[i]. The message authenticator generating apparatus (10), taking as input the value w[2] and the key K, calculates a value K? by a function e which is a substitution function if the key K is fixed, taking as input the value w[1] and the value K?, calculates a value c by a block cipher E, and taking as input the value w[3] and the value c, calculates an authenticator T by a function d which is a substitution function if the value w[3] is fixed.

Abstract: A message authenticator generating apparatus, taking as input a key K and a message M, generates an i-times-e-bit value E, and divides the value E at every e bit to generate values M[1], . . . , M[i]. During this, the message authenticator generating apparatus generates the value E such that a value M[1] and a value M[i] out of the values M[1], . . . , M[i] include at least one of bits of the key K. The message authenticator generating apparatus, where a value S[0] is an arbitrary value, for each integer j of j=1, . . . , i in an ascending order, calculates a value R[j] by a function g[j] taking as input a value S[j?1] and a value M[j], and substitutes the calculated value R[j] by a substitution function P[j] to calculate a value S[j]. The message authenticator generating apparatus generates an authenticator T for the message M with using a value S[i].

Abstract: A pseudo-random number generation device calculates a value st[i] of b[i] bits by using a function F[i] taking a value st[i?1] as input for each integer value i with i=1, . . . , n in ascending order. The pseudo-random number generation device calculates a value x[i] of r[i] bits by using a function g[i] taking as input at least a part of bits of a value st[j] and at least a part of bits of the value st[i] for at least a part of an integer value i with i=1, . . . , n, where a value j is an integer value smaller than the integer value i. The pseudo-random number generation device combines the values x[i] calculated by using the function g[i] to obtain a pseudo random number.

Abstract: The object is to constitute a hash function by removing a feed-forward arithmetic operation. A hash value calculation device, for each integer i of i=1, . . . , L in an ascending order, calculates a function f[i] which, upon input of a value M[i] having k-n bits, an n-bit value y1[i?1] (a value y1[0] is a predetermined value IV1), and an n-bit value y2[i?1] (a value y2[0] is a predetermined value IV2), outputs an n-bit value x1[i], an n-bit value x2[i], a k-bit value k1[i], and a k-bit value k2[i]; for the value x1[i] as a plaintext and the value k1[i] as a key, calculates an n-bit value y1[i] with an encryption function of a block cipher; and for the value x2[i] as a plaintext and the value k2[i] as a key, calculates an n-bit value y2[i] with the encryption function for the block cipher. The hash value calculation device, upon input of a value y1[L] and a value y2[L] which are calculated, calculates a hash value with an injective function g.

Abstract: e and n are public information and d is private information. An electronic signature is generated based on a calculated value of e×d mod n. A signature generation apparatus includes a random number generation unit, a first calculation unit, a second calculation unit, and a signature generation unit. The random number generation unit generates a random number r. The first calculation unit calculates s1=r×n. The second calculation unit calculates s2=s1+e. The signature generation unit calculates s3=s2×d mod n and outputs s3 as the calculated value of e×d mod n. The signature generation apparatus can thereby generate the above electronic signature securely against differential power attacks.

Abstract: A scalar multiplication unit references a t-bit sequence representing a random number k one bit at a time from the most significant bit, and upon each referencing, sets in a work variable R[0] a value obtained by doubling a specific point G on an elliptic curve set in a scalar multiplication variable R, and sets in a work variable R[1] a value obtained by adding the specific point G to the work variable R[0]. The scalar multiplication unit 122 sets the work variable R[0] in the scalar multiplication variable R if the value of the referenced bit is 0, and sets the work variable R[1] in the scalar multiplication variable R if the value of the referenced bit is 1. A scalar multiple point output unit 123 outputs as a scalar multiple point kG a value obtained by subtracting a constant value 2tG from the scalar multiplication variable R.