JPH0760292B2 - Data randomizer - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial application] The present invention relates to a security technology in a data communication system, that is, an invention relating to a one-way data randomization device applicable to encryption, message authentication, digital signature, and the like. is there.

[Conventional technology]

Conventionally, unidirectional data randomizers have been used for DES encryption (Data
Encryption Standard, FIPS PUB 46, NBS, JAN, 1977,
And USP No. 552685) A device is typically used.

FIG. 5 is a diagram showing the concept of the former process, particularly, of the encryption process and the decryption process of the conventional DES encryption device.

In FIG. 5, P is 64-bit input plaintext data, 1 is key processing, 2 is cryptographic processing, 51 and 62 are initial bit transposition and final bit transposition, 52, 54, 56, 58 and 60 are left registers, 53,55,5
7, 59 and 61 are right registers, L and R are the left 32 bits and right 32 bits of the data to be processed, respectively, and the lower right subscripts of L and R indicate the processing stage. Further, f of 63-1, 63-2, 63-3 is data diffusion function means, 64-1, 64-2, 64-3 are exclusive ORs corresponding to bits, and K is 64-bit input key data. , 66-1,66-2,6
K _{1 to} K _{16 of} 6-3 are processing keys obtained by processing the key K, and C is a ciphertext.

First, the 64-bit input plaintext data P is transposed at the bit position by IP51. Subsequently, the 64-bit data is divided into left and right 32-bit L ₀ and R ₀ , and left register 52
And stored in the right register 53. And the right half data R ₀
6-1 is applied to the data diffusion function means f of 63-1 by using the processing key K ₁ , and this data and the data of the left half L ₀ are exclusive ORed by the circuit 64-1 and the result is newly obtained in the right half. data from
Set to R ₁ and store in right register 55. Also, the conventional right half data R ₀ is newly changed to the left half data L ₁ and the left register
Store in 54. These processes are repeated 16 times,
The left data L ₁₆ is stored in the left register 58, and the right data R ₁₆ is stored in the right register 59. Lastly, the left half data and the right half data are exchanged, that is, the right data R is stored in the left register 60.
₁₆ stores, stores left data L ₁₆ to the right register 61, R ₁₆
Then, the 64-bit data obtained by arranging L ₁₆ and L ₁₆ is transposed to the bit position by IP ⁻¹ of the final bit transpose 62 to obtain a 64-bit ciphertext C.

The functions of the initial bit transposition 54 and the final bit transposition 62 are
Mathematically speaking, they are inverse functions of each other.

The above is the description of the process of encrypting the plaintext data P and obtaining the ciphertext C using the cryptographic process 2.

In this encryption processing, the input is the ciphertext C, the order of the processing keys is reversed, that is, the processing key K ₁₆ is input from the arrow 66-1, the processing key K ₁₅ is input from 66-2, and so on. Thus, when the processing key K ₁ is input from 66-3, the initial bit transposition 51, the final bit transposition 62, the registers 52 to 61, the function f 63-
1 to 63-3 and exclusive OR 64-1 to 64-3, etc., the method of processing all of them is the same as the encryption processing,
Decryption processing can be performed. That is, the ciphertext C is added to the initial transposition 51.
, The plain text data P is restored from 62 and output.
The encryption process and the decryption process described above will be supplementarily described below.

First, the encryption process will be described.

The input 64-bit long plain text P is processed by the initial bit transposition 51, and IP (P) is output. This is divided equally into 32 bits, and the left data is L ₀ and the right data is R ₀ . That is, it is represented by L ₀ ‖R ₀ = IP (P). Here, ‖ indicates data connection.

L ₀ is stored in the register 52, and R ₀ is stored in the register 53. Next, the right data R ₁ is stored in the register 55 and the left data L ₁ is stored in the register 54 through the f function 63-1 and the exclusive OR 64-1. L ₁ and R ₁ can be expressed by the following equation.

L ₁ = R ₀ R ₁ = L ₀ f (R ₀ , K ₁ ) (1) Hereafter, in the same manner, L _i and R _i are obtained as follows.

R _i = L _i-1 L _i = R _i-1 f (R _i-1 , K _i ) (2) However, i = 1 to 16 here.

Left data L ₁₆ is stored in register 58 and right data R _{16 is} stored in register 59.
Are memorized respectively.

Next, L ₁₆ and R ₁₆ are exchanged, and the left data R ₁₆ is stored in the register 60.
The right data L ₁₆ is stored in the register 61, respectively. R ₁₆
The 64-bit data obtained by combining L ₁₆ and L ₁₆ is input to the final bit transpose 62, and the ciphertext C is obtained. That is, C = IP ⁻¹ (R ₁₆ ‖L ₁₆ ) ... (3) Next, the decoding process will be described. In order to use it for explanation of decryption, the above-mentioned encryption control is as follows by rewriting a part of (2).

L _i = R _i-1 R _i f (L _i , K _i ) = L _i-1 (4) where i = 1 to 16.

The input ciphertext C having a 64-bit length is processed by the initial bit transposition 51, and IP (C) is output. This is bisected by 32 bits. As a result, the following relationship holds.

IP (C) = IP (IP ^-1 (R ₁₆ ‖L ₁₆ )) ＝ R ₁₆ ‖L ₁₆ ……
(5) That is, the left data of IP (C) is R ₁₆ and the right data is
It becomes L ₁₆ .

R ₁₆ is stored in the register 52, and L ₁₆ is stored in the register 53. Since the input of the f function 63-1 is L ₁₆ and the processing key K ₁₆ , the output of the exclusive OR 64-1 is given by the following equation.

R ₁₆ f (L ₁₆ , K ₁₆ ) = L ₁₅ (6) Store L ₁₅ in the register 55. The L ₁₆ stored in the register 53 is L ₁₆ = R ₁₅ from the above relational expression.
Store ₁₅ in register 54. After that, the same process is repeated, and R ₁ is stored in the register 56, L ₁ is stored in the register 57,
Each is remembered. Register 58 contains R ₀ and register 59
L ₀ is stored in each. L ₀ is in register 60,
R ₀ is stored in the register 61, respectively. To the final bit transposition 62, L ₀ ‖R ₀ having a 64-bit length is input. That is, IP ⁻¹ (L ₀ ‖R ₀ ) = IP ⁻¹ (IP (P)) = P (7) As a result, the original plaintext data P is restored as the output of the final bit transposition 62.

As is clear from the above description, for example, the function f (R _i-1 , K
_{In i} ), even if the information is lost due to overflow operation, the ciphertext can be decrypted. The detailed principle will be described below. In the next calculation, it is assumed that the information in the function f is lost. It is assumed that x ′ and y ′ are obtained from x and y.

x ′ = xy ′ = yf (x, K _i ) As a result, x and y can be restored by using the processing key K _i .

x = x 'y = y'f (x', K _i ) Since this principle is used, even if the information is lost in the function f, the ciphertext can be decrypted.

Next, the key processing of the DES encryption device will be described.

FIG. 6 is a block diagram showing the concept of the key processing device in FIG.

In FIG. 6, reference numeral 4 designates the input connection of the 64-bit data of the input key K, and the 56-bits obtained by excluding the specific 8 parity bits are rearranged in a fixed order to output 56-bits. Is. Here, the output 56 bits of the selected connection-1 is called a 56-bit effective key.

5-0, 5-1, 5-2, ..., 5-16 are 28-bit left circular shift registers, 6-0, 6-1, 6-2, ... are 5-0, 5-1, 5 -2, 7-0, 7-1, 7-2, ..., 7
-16 is a 28-bit left circular shift register, 8-0,8-1,8-
2, ..., The left circular shift operation corresponding to each of 7-0,7-1,7-2, ... is input, and each of 9-1,9-2 ,. 48 bits obtained by excluding 8 bits by the specific rule are rearranged in a fixed order, and the selected connection line-2 for outputting 48 bits is shown.

This key processing operates as follows. The input 64-bit key has the parity bit removed by the selection connection of 4-1, and the remaining 56 bits are rearranged according to a certain rule to make a 56-bit effective key.

The 56-bit effective key is divided into two, and the left 28-bit is the register 5-
The right 28 bits to 0 are transferred to and stored in the register 5-1. Next, 16 processing keys K ₁ , K
₂ …, K ₁₆ is generated.

The 28-bit data stored in the register 5-0 is left circularly shifted by a specific number of bits in 6-0 and stored in the register 5-1. The 28-bit data stored in the register 5-1 is left-circularly shifted by a specific number in 6-1 and is transferred to the register 5
-2 is stored. Thereafter, similar processing is repeated, and 28-bit data is stored in the register 5-16.

The 28-bit data stored in the register 7-0 is also subjected to the same processing, transmitted to the registers 7-1, ..., And the register 7-16 and stored therein. The 56-bit total data stored in the register 5-i and the register 7-i is merely a rearrangement of the 56-bit effective keys output from the 4 selected connection lines-1.

The selection connection line-2 of 9-1 receives a total of 56 bits of 28 bits from the registers 5-1 and 7-1 and inputs the key K ₁ obtained by rearranging 48 bits obtained by excluding 8 bits. Output.

For selection connection-2 of 9-2, a total of 56 bits of 28 bits are input from registers 5-2 and 7-2, and a key K ₂ obtained by rearranging 48 bits obtained by excluding 8 bits is obtained. Output. After that, the same process is repeated, and as for the selection connection-2 of 9-16, a total of 56 bits of 28 bits are input from registers 5-16 and 7-16, and 48 bits are obtained by excluding 8 bits. The key K ₁₆ obtained by rearranging is output.

When the key processing device 1 performs encryption, 66-1 to 66-3
In this case, the processing keys K _{1 to} K ₁₆ are output in this order, and when decryption is performed, from 66-1 to 66-3, the order of the processing keys is the reverse of the case of encryption, that is, K ₁₆ ~ K ₁ should be output in this order. This control is realized by changing the operations of the left circulation shifts 6-0 to 8-0 inside the key processing.

Here, the continuous processing keys Ki (48 bits) and Ki + 1 (48 bits) of the created DES cipher have a characteristic that 40 bits are duplicate values and only the remaining plural bits are different. For this reason, the original 64-bit key can be reconstructed from two consecutive processing keys Ki and Ki + 1. Therefore, in order to break the cipher, it is possible to deduce the cipher by decrypting two consecutive processing keys.

[Problems to be solved by the invention]

In the present invention, in order to further improve the reliability of countermeasures against cipher breaking, the configuration and control of a device for increasing the diffusion of input data and generating highly reliable data random numbers (including key generation) are clarified. To do.

[Means for solving problems]

In order to achieve the above object, in the data randomization device of the present invention, the spreading function means (F) and the exclusive OR means () that perform predetermined arithmetic processing on the input data and output the spread data. And a control unit of the diffusion function means and the exclusive OR means as a basic unit, and the basic unit is connected in at least three stages, and the basic unit at the first stage is an all-zero unit. Data block (D ₀ ) and the right half data block (R ₀ ) of the input data (P) are input to the exclusive OR means of the first stage, and the output data block of the exclusive OR means and the left half of P The data block (L ₀ ) is input to the spreading function means of the first stage, the spreading function means generates the left output data block (R ₁ ) of the first stage, and the right half data block (R ₀ ) of the first stage remains unchanged. Right output data Lock (L ₁ and
D ₂₎ and then, the basic unit of the second stage, the input left half data block of the data _{(P) (D 1 (L} 0
The same)) and the left output data block (R ₁ ) of the first stage are input to the exclusive OR means of the second stage, and the output data block of the exclusive OR means and the right output data block of the first stage (R ₁ ). L ₁ ) and are input to the diffusion function means of the second stage,
The spreading function means is the second output data block (R ₂ ) of the second stage.
The right input data block (R ₁ ) of the second stage is directly used as the right output data block (L ₂ ) of the second stage, and each basic unit after the third stage is the right output data block of the previous stage. (D ₂ (L ₁
Same as the above)) and the left output data block of the preceding stage (R _{2 in the case} of the third stage) are inputted to the exclusive OR means of the basic unit,
The output data block of the exclusive OR means and the right output data block of the preceding stage (L _{2 in the case} of the third stage) are input to the spreading function means of the basic unit, and the spreading function means of the basic unit is input. The left output data block (R _{3 in} the third stage) is generated, the right input data block is directly used as the right output data block (L _{3 in} the third stage) of the basic unit, and By arranging the right output data block and the left output data block from the left as output data (C), the input data (P) is randomized.

The data randomization device of the present invention has at least 3 basic units.
The input data P of 64 bits is input, and the right output data block of the previous stage and the left output data block of the previous stage are input to the exclusive OR means of the basic unit, The output data block of the disjunction means and the right output data block of the preceding stage are input to the spreading function means of the basic unit, the spreading function means generates the left output data block of the basic unit, and the right input data block remains as it is. The right output data block of the basic unit, and the input data P
Repeat the process of spreading.

Further, the spreading function means divides the input data into a plurality of data blocks of the same length, and at least once for all the other data blocks with respect to the data of each data block divided by the division means. Fusion means for directly or indirectly operating with the data to generate data of a new data block, and substitution means for performing substitution processing on the data of each data block generated by the fusion means to generate a new data block. , Combining means for combining the finally obtained data of the respective data blocks generated by the substituting means and outputting as the spread data of the input data, wherein the input data is input to the dividing means, Amida structure for outputting the output from the dividing means by the combining means via the plurality of fusion means and the plurality of substitution characters To.

It should be noted that the fusion means may be any one that inputs two data of the block data and another block data, calculates the two data, and generates new data. Then, it is an adder indicated by 21,23,25,27 in FIG. The adder of the embodiment has two data x1 and x2.
However, both x1 and x2 are 1-byte length data, and the relation 0 ≦ x1 ≦ 256, 0 ≦ x2 <256 holds, and y
= X1 + x2mod256. (Where mod256
Represents a mathematical symbol (modulo 256 addition) that divides the addition result of x1 + x2 by 256 or represents the remainder. Further, the substituting means may be any one as long as the substituting process is performed on the block to generate a new block. In the embodiment of the present invention, two bits represented by 22, 24, 26 and 28 in FIG. It is a circuit device.

[Work]

A data random number (including a processing key) configured by a data randomizing device in which the above basic units are connected to the cryptographic processing device in a plurality of stages includes a right output data block in the previous stage and a left output data block in the previous stage. It is obtained by inputting to the exclusive OR means of the basic unit and inputting the output data block of this exclusive OR means and the right output data block of the preceding stage to the diffusion function means of the basic unit. Therefore, the random number of data is generated by the two spreading function means of the continuous basic unit.

Further, when the input data is used as a key, in the present invention,
Three processing keys Ki, Ki + 1, Ki + with consecutive basic units
These processing keys allow the key to be reconstructed for the first time since they generate 2. Therefore, in order to break the cipher, it is possible to deduce the cipher by decrypting three consecutive processing keys.

Furthermore, as described in claim (2) of the present specification,
The diffusion function means includes a dividing means, a merging means, and a character substituting means, the input data is divided into blocks of the same length by the dividing means, and then the merging process and the character substituting process are performed plural times.
In the fusion process, the divided blocks of the input data are combined by an amid-like structure in which all bytes of the output data are directly or indirectly determined, and the finally obtained data of each block are combined by combining means, Output as highly reliable spread data.

〔Example〕

FIG. 1 is a block diagram showing the basic configuration and control of the data randomization device of the present invention. The control of the data random number generation will be described below based on this block diagram. Here, F is a diffusion function means, is an exclusive logic means, and other control means.

In the figure, P is 64-bit input data L, R is the left 32-bit of the 64-bit data being processed and right 32-bit data, and D is the 32-bit data fused to the input data to the F function. The lower right subscripts of the temporary storage buffer, L, R, and D indicate the processing stage. Is an exclusive OR means (circuit) for each bit, F
Is a 32-bit-32-bit spreading function means, and C is a random number.

First, D is initialized to 32-bit data D ₀ of all 0s. Next, the left and right 32 bits of the input data P are set to L ₀ and R ₀ , respectively. Hereinafter, each processing is performed for j = 1 to 5.

D _j = L _j-1 L _j = R _j-1 R _j = F (L _j-1 , R _j-1 D _j-1 ) The L ₅ and R ₅ obtained by the above procedure are arranged in order from the left. Let C be the data obtained. That is, the diffusion function means F11
Exclusive-OR D ₀ and R ₀ before input to. Then, at the next input stage of the diffusion function means F12, control is performed so as to obtain the relation of the above equation.

That is, the next control is performed in the relationship of L ₁ = R ₀ , D ₁ = L ₀ , R ₁ = F (L ₀ , R ₀ D ₀ ).
At the next input stage of the diffusion function means F13, L ₂ = R ₁ , D ₂ = L ₁ , R ₂
= F (L ₁ , R ₁ D ₁ ) In this way, L ₅ , R
Combine ₅ to form random number C and output.

In the above description, the diffusing means F has been described as controlling in five steps from j = 1 to j = 5, but it can be easily inferred that the same can be done in n steps of control. It is obvious that the value of L ₄ or R ₄ cannot be obtained from the value of the random number C, that is, the values of L ₅ and R ₅ . Similarly, it is clear that the values of L ₃ and R ₃ cannot be obtained from the values of L ₄ and R ₄ . Less than,
Repeat in the same way, from the values of L ₅ and R ₅ the original input data P
It is easy to see that there is no good inverse calculation method to find (L ₀ and R ₀ ). That is, it is understood that it is impossible to back-calculate the original input data P by knowing the values of L _j and R _j .
L _j and R _j can be obtained from the value of input data P, but L _j
The original input data P cannot be calculated backward by knowing the values of _j and R _j .

To summarize the above, the spreader according to the present invention can easily obtain the one-way property in randomization, that is, the output data L _j and R _{j randomized} from the input data P. It turns out that it has the property that it cannot be obtained.

FIG. 2 is a detailed explanatory diagram of the diffusion function means F in FIG. 21,23,25,27 ADD is adder, 22,24,26,28 ROL
Represents a 2-bit rotator and represents a bitwise exclusive OR circuit. The dividing means of 29 divides the input data L _j-1 into a plurality of blocks L ⁰ _j-1 , L ¹ _j-1 , L ² _j-1 , L ³ _j-1 . Here, the term “division” means that the input data L _j-1 of 32 bits (4 bytes) is
4 blocks of 1 byte each L ⁰ _j-1 , L ¹ _j-1 , L ² _j-1 , L ³
_{j-1 is to} divide. The coupling means of 30 are the respective data F ⁰ , F on the passages 30-1, 30-2, 30-3, 30-4 of the block.
¹ , F ² and F ³ are combined to form the data F on the output path 30-5. Here, combining the data F ^0, F ^1, F ^2, F ³ means that the data F data F ^0, F ^1, F ^2, F ³ are arranged from left in this order. In Figure 2, 32-bit data F
(L _j-1 , R _j-1 D _j-1 ) is represented, and this is simply represented by F, and the number of bytes from the left is F ^i.
(I = 0 to 3) and the upper right subscript. At this time, F is obtained by the following procedure.

F ¹ = L ¹ L ⁰ F ² = L ² L ³ F ¹ = ROL (F ¹ + (F ² D ⁰ R ⁰ ) +1) F ² = ROL (F ² + (F ¹ D ¹ R ¹ )) F ⁰ = ROL (L ⁰ + (F ¹ D ² R ² )) F ³ = ROL (L ³ + (F ² D ³ R ³ ) +1) In the above procedure, + indicates numerical addition and ROL indicates data. It shows the means for rotating 2 bits to the left. That is, in FIG. 2, ADD21 and ROL22 are F ¹ , ADD23 and ROL are
24 and F ² , ADD25 and ROL26 F ⁰ , ADD27 and ROL28 F ³ ,
Represents each. First, the diffusion function means F has L _i-1
Input D _i-1 and divide it into L data of the 1st, 2nd, 3rd, and 4th bytes from the left, and perform an exclusive OR of D _j-1 and R _j-1. The 0th byte from the left is distributed to the F ¹ block, the 1st byte to the F ² block, the 2nd byte to the F ⁰ block, and the 3rd byte to the F ³ block. As a result, the above formula is calculated in each ADD and ROL.

In addition, it is possible to change the bit rotation number indicated by ROL to 1 bit, to make it variable, or to change the processing stage, by changing the design of the present invention. Further, when the input data has 128 bits, for example, the processing unit is set to 2 bytes and the bit rotation number indicated by ROL is increased, whereby the structure shown in FIG. 1 can be realized as it is. In the above description, the adders 21, 23, 25 and 27 are fusion means for inputting two data, calculating the two data and generating new data.
Reference numerals 2, 24, 26 and 28 are substitution means for performing substitution processing on the block to generate a new block.

As described above, the diffusion function means includes the dividing means, the merging means, and the substituting means, the input data is divided into blocks of the same length by the dividing means, and then the fusion processing and the substituting processing are performed a plurality of times. In the fusion process, the divided blocks of input data are combined with all bytes of the output data in an amida-like structure that is directly or indirectly determined, and the finally obtained data of each block is combined and spread by a combining means. It is possible to output as data and generate highly diffused data.

FIG. 3 is a configuration for creating an authenticator by using the data randomization device of the present invention. In FIG. 3, M _{1 to} M _n are n data blocks divided into 64-bit messages, K
Is the 64-bit input key data, is the bitwise exclusive OR circuit, HBF is the data randomization device of the present invention, N is the final 64-bit data, and m is the certifier to be obtained.

First, the message consists of n blocks M ₁ ~
Divided into M _n . Then, the 64-bit data M ₁ K is converted into HBF
To enter. Then the resulting 64-bit data and M ₂
The exclusive OR circuit of is taken and the result is input to HBF. The above processing is sequentially applied, and finally, the result of applying the data HBF obtained by exclusive ORing with M _n is R.
The 32-bit data of the right half of R is obtained as the authenticator m.

FIG. 4 is a data randomization device using the device shown in FIG. 1 as the key processing unit of the encryption device of FIG. In Fig. 4, K is the input data and consists of a 64-bit key.
₀ ~K ₇ is used as the processing key for each 16-byte is output data. The other symbols represent the same as in FIG. Fourth
The figure shows the case where the number of processing stages of the present embodiment shown in FIG. 1 is four. If the number of processing stages is increased to n, the output data also increases from K _{0 to} K _2n-1 . By using this key as the processing keys K ₁ , K ₂ , ..., K ₁₆ shown in FIG. 5, the data randomization device of the present invention can be used as the key process of the existing encryption device. In addition, 66-1 of the DES encryption device of FIG.
The upper K ₁ , 66-2, the upper K ₂ , and the upper ₁₆ K ₁₆ are respectively 48 bits, and the processing key Ki shown in FIG.
Since it is 16 bits, 48-bit data obtained by combining three processing keys shown in FIG. 4 may be used as the 48-bit processing key shown in FIG. As described above, the data randomization device can be used as the key processing of the encryption device.

The processing key (R) of the output of the spreading function means 43 in FIG. 4 is at least the processing key Ki (R) of the output of the spreading function means 41 in the preceding stage and the processing key Ki + 1 of the output of the spreading function means 42 in the preceding stage. (R) is required. For this reason, three consecutive processing keys K
When i, Ki + 1, Ki + 2 are obtained, the original 64-bit key is obtained for the first time. Therefore, it is more reliable than DES.

〔The invention's effect〕

As described above, according to the present invention, it is possible to generate a highly reliable unidirectional data random number having a stronger one-way property and data diffusion property than the DES encryption device.

In particular, in the case of generating an encryption key to be transferred to the cryptographic processing device, the basic unit is composed of the diffusion function means, the exclusive OR means, and the control means of the above means, and by connecting a plurality of the basic units. , The output of the diffusion function means of the second before the previous stage and the output of the diffusion function means of the previous stage are exclusive ORed by the exclusive OR means, and the result is input to the diffusion function means, and the processing key is input. It is characterized in that the plurality of processing keys generated for each basic unit are transferred to the cryptographic processing apparatus, and the random number is repeatedly generated by controlling the cryptographic processing apparatus. In other words, since the processing key that is the output of the spreading function means of the second previous stage and the data that is input based on the processing key of the previous stage generate a plurality of new processing keys, a conventional key processing device such as a cryptographic DES It is a highly reliable product that cannot be obtained.

Further, as described in claim (2) of the present invention, the diffusion function means has an amida structure. By using this configuration as the spreading function means of the data randomization device, the data spreading effect can be doubled as compared with the conventional DES structure. Therefore, the data randomizer as a whole has the effect of being able to generate a very reliable cipher.

[Brief description of drawings]

FIG. 1 is a block diagram of a data randomizing device showing the basic configuration and control of the present invention, FIG. 2 is a diagram showing a 32-bit spreading function means F in FIG. 1, and FIG. 3 is an application example of the present invention. FIG. 4 is a block diagram of a data randomizer for generating an authenticator for message authentication, FIG. 4 is a data randomizer for an encryption device showing an application example of the present invention, FIG. 5 is a conventional DES encryption device, and FIG. FIG. 7 is a diagram showing a data randomization device using DES, and FIG. 7 is an encryption device realized by connecting the data randomization device of the present invention to the DES encryption device. 1: Key processing device, 2: Cryptographic processing device 11,12,13,14,15,41,42,43,44, F: 32-bit spreading function means P: 64-bit input data, C: 64-bit encryption (Random number), IP, IP ^-1 : DES initial and final bit transposition, L, R: Left and right 32-bit data of each 64-bit data to be processed, D: 32-bit data temporary storage buffer, f: DES 32-bit spreading function means :: Exclusive OR circuit for bits, K: 64-bit input key data, 21,23,25,27, ADD: Addition, 22,24,26,28, ROL: To the left 2-bit rotation of data, M _{1 to} M _n : n data blocks obtained by dividing the message into 64 bits, N: 64-bit data, 31,32, 33, 34, HBF: Data random number of this embodiment Device. 29: dividing means, 30: coupling means, 30-1, 30-2, 30-3, 30-4: block passage, 30-5: output passage.

Claims (2)

[Claims] 1. A diffusion function means (F) for subjecting input data to predetermined arithmetic processing and outputting diffusion data, an exclusive OR means (), and these diffusion function means and exclusive OR means. Is a data randomizing device in which at least three stages are connected to each other as a basic unit, and the basic unit at the first stage is an all-zero data block (D ₀ ) and input data (P ₀ ). ) Right half data block (R ₀ ) is input to the exclusive OR means of the first stage, and the output data block of the exclusive OR means and the left half data block (L ₀ ) of P are spread in the first stage. Input to the function means, the spreading function means generates a left output data block (R ₁ ) of the first stage, and the right half data block (R ₀ ) is as it is, the right output data block (L ₁ and
D ₂₎ and then, the basic unit of the second stage, the input left half data block of the data _{(P) (D 1 (L} 0
The same)) and the left output data block (R ₁ ) of the first stage are input to the exclusive OR means of the second stage, and the output data block of the exclusive OR means and the right output data block of the first stage (R ₁ ). L ₁ ) and are input to the diffusion function means of the second stage,
The spreading function means is the second output data block (R ₂ ) of the second stage.
The right input data block (R ₁ ) of the second stage is directly used as the right output data block (L ₂ ) of the second stage, and each basic unit after the third stage is the right output data block of the previous stage. (D ₂ (L ₁
Same as the above)) and the left output data block of the preceding stage (R _{2 in the case} of the third stage) are inputted to the exclusive OR means of the basic unit,
The output data block of the exclusive OR means and the right output data block of the preceding stage (L _{2 in the case} of the third stage) are input to the spreading function means of the basic unit, and the spreading function means of the basic unit is input. The left output data block (R _{3 in} the third stage) is generated, the right input data block is directly used as the right output data block (L _{3 in} the third stage) of the basic unit, and A data randomization device, comprising: arranging a right output data block and a left output data block from the left as output data (C). 2. The spreading function means according to claim 1, wherein the spreading function means divides the input data into a plurality of data blocks having the same length, and the data of each data block divided by the dividing means. A fusing means for directly or indirectly operating with data of all other data blocks at least once to generate data of a new data block, and substitution processing for the data of each data block generated by the fusing means. And substituting means for generating a new data block and combining means for combining the finally obtained data of each data block generated by the substituting means and outputting as the spread data of the input data. A data randomization device characterized by: