Method of and an apparatus for generating internal crypto-keys

[0002] The present invention relates to a method of and an apparatus for generating internal crypto-keys which are used as initial values to be set in feedback registers of an pseudo-random-sequence generator for generating pseudo-random-numbers to be XORed (added according to eXclusive OR logic) onto a data sequence recorded in a recording medium or to be transmitted in a communication system, for preventing a third party from tapping the data sequence without permission.

[0003] Cryptography called secret-key-cryptography can be classified into two types, cryptography called block ciphers and cryptography called stream ciphers. In the former cryptography, data of a fixed length, 64 bits, for example, called the plain text is transformed into a data block called the cipher text according to a certain transformation algorithm. On the other hand, a sequence of pseudo-random-numbers called the key-stream is XORed onto a data stream called the plain text stream to be converted into a cipher-stream.

[0004] As a method of generating a pseudo-random-sequence which is cryptographically secure, there is known a method making use of a one-way function such as a public-key-cryptograph function. Here, the one-way function means a function f(x) which can be easily calculated from a variable x, but it is hardly possible to estimate the variable x from an output of the function f(x).

[0005] FIG. 5 is a block diagram illustrating a configuration example of a conventional pseudo-random-sequence generator which generates the cryptographically secure pseudo-random-sequence.

[0006] Referring to FIG. 5, an external key-data of n-bits is supplied to a first input terminal 405. A one-way function circuit 101 outputs an n-bit conversion result by processing n-bit output of a selector 201 with a certain one-way function (such as a public key function) according to a certain conversion parameter (such as a public key) supplied to a second input terminal 104. The LSB (Least Significant Bit) of the conversion result is output from an output terminal 508 as a bit of the pseudo-random-sequence.

[0007] With each clock pulse CLK supplied from a clock terminal 210, a register 202 outputs registered n-bit data to the selector 201 and newly registers the n-bit conversion result of the one-way function circuit 101.

[0008] Only when the clock pulse CLK is supplied for the first to the register 202, a selection signal SEL supplied to the selector 210 through a selection terminal 211 is set at logic ‘0’ for controling the selector 201 to output the external key-data supplied from the first input terminal 405 to the one-way function circuit 101, and afterwards the selection signal SEL is turned to logic ‘1’ so that the selector is controlled to select the output of the register 202 to be fed-back to the one-way function circuit 101.

[0009] Thus, the pseudo-random-sequence is output bit-by-bit from the output terminal 508 in synchronization with the clock pulse CLK.

[0010] The pseudo-random-sequence generator of FIG. 5 is known to be cryptographically secure. However, calculation of the one-way function takes comparatively long time.

[0011] Therefore, a pseudo-random-sequence generator consisting of combination of several linear feedback-sift-registers or nonlinear feedback-shift-registers is generally used for generating the key-stream of the stream cipher, when a high speed is required, having such configuration as illustrated in a block diagram of FIG. 6.

[0012] In the pseudo-random-sequence generator of FIG. 6, there are comprised linear feedback-sift-registers or nonlinear feedback-shift-registers (hereinafter generically called the feedback-shift-registers) S₁to S_n. To each of the feedback-shift-registers, working as a sub-generator, an internal key K₁to K_nis set initially. At each clock, each of the feedback-shift-resisters is shifted by one bit outputting its LSB to a combination function F, and its MSB (Most Significant Bit) is generated according to a certain feedback function from its registered bit sequence. The combination function F generates a key-stream bit by bit according to a certain combination function from outputs of the feedback-shift-registers S₁to S_n.

[0013] However, the key-stream generated making use of feedback-shift-registers, such as illustrated in FIG. 6, may sometimes be broken by a deciphering method called correlation attacks. So, various kinds of devices has been studied, whereof some examples are described in “Applied Cryptography, Second Edition: Protocols, Algorithms, and Source Code in C,” by Bruce Schneier, published by John Wiley & Sons, Inc., 1996, and as to the correlation attacks, there is an explanation in “Correlation-Immunity of Nonlinear Combining Functions for Cryptographic Applications” by T. Siegenthaler, IEEE Transactions on Information Theory, Vol. IT-30, No. 5, 1984, for example. However, description of details of the pseudo-random-sequence generator itself or the correlation attacks is omitted, here.

[0014] In any way, to be sufficiently robust against cryptographic analysis such as the correlation attacks, sufficient numbers of sufficiently long-bit feedback-shift-registers should be used for generating the key-stream, which requires numbers of internal keys to be set to the feedback-shift-registors as their initial values.

[0015] On the other hand, bit-length of a secret crypto-key is usually limited practically, such as 64 bits, for example. Therefore, it is important for the pseudo-random-sequence generator consisting of feedback-shift-registers how to securely generate numbers of internal keys to be set thereto, from a secret-key given from external (hereinafter called the external key).

[0016] As above mentioned, one or some internal keys may be estimated by the correlation attacks. Hence, when the internal keys are generated from a single external key without sufficient care, all the internal keys may be easily estimated based on the broken internal keys.

[0017] Cryptographically secure internal keys may be obtained making use of a one-way function in the same way with generating the pseudo-random-sequence itself, by the pseudo-random-sequence generator of FIG. 5, for example. However, a demerit of obtaining the internal keys by way of the one-way function lies in that it takes too long time even for generating the internal keys once at the beginning of a cipher-stream. Because, the pseudo-random-sequence generator cannot but generate the pseudo-random-numbers bit by bit. Therefore, n×m clocks should be needed for generating n sets of internal keys of m bits, for example, and the clock frequency cannot be made high because of comparatively long calculation time of the one-way function.

[0018] Therefore, a primary object of the present invention is to provide method of and an apparatus for generating internal crypto-keys to be set initially in the feedback-shift-registers of a pseudo-random-sequence generator of the stream cipher system, with sufficient security and sufficiently high speed as well.

[0019] In order to achieve the object, a method according to the invention of generating internal crypto-keys from an external key comprises:

[0020] a step of outputting m sets of first conversion results, each i-th of the m sets of first conversion results being obtained by processing an (i−1)-th of the m sets of first conversion results with a first non-linear function and first of the m sets of first conversion results being obtained by processing a first part of the external key with the first nonlinear function, m being a positive integer more than one, i being a positive integer more than one and not more than m, and the first nonlinear function being a function wherein a variable giving a value of the function is difficult to be estimated from the value of the function;

[0021] a step of outputting m sets of second conversion results, each i-th of the m sets of second conversion results being obtained by processing an (i−1)-th of the m sets of first conversion results with a second nonlinear function and first of the m sets of second conversion results being obtained by processing a second part of the external key with the second nonlinear function, the second nonlinear function being a function wherein a variable giving a value of the function is difficult to be estimated from the value of the function; and

[0022] a step of outputting each j-th of m internal crypto-keys by combining a j-th of the m sets of first conversion results and an (m−j+1)-th of the m sets of second conversion results according to a combining function, j being a positive integer not more than m, so that each bit of the j-th of the m internal crypto-keys has XOR logic of corresponding bits of the i-th of the m sets of first conversion results and the (m−j+1)-th of the m sets of second conversion results, for example.

[0023] Each of the first nonlinear function and the second nonlinear function is preferably a one-way function wherein a variable giving a value of the one-way function is substantially impossible to be estimated from the value of the one-way function.

[0024] Therefore, by giving an external key of 2n bits, the apparatus of the invention can generates m sets of internal keys of n bits at once, that is, about n times faster than to generate the same number of internal keys by way of the pseudo-random-sequence generator of FIG. 5, wherein only an LSB is available at one clock.

[0025] Further, even if a third party, who does not know the external key, might have succeeded to obtain a k-th (k being 1 to m) internal key by some means, and to estimate a k-th of the m sets of first conversion results and an (m−k+1)-th of the m sets of second conversion results, other internal keys can be protected from the third party with sufficient security.

[0026] The above method can be realized with an apparatus, for example, comprising:

[0027] a one-way-function circuit for outputting a conversion result by processing an input bit sequence with a one-way function;

[0028] a register for holding the conversion result outputted from the one-way-function circuit and outputting the conversion result previously held in the register in synchronization with a clock signal;

[0029] a selector for selecting either the external key or an output of the register according to a selection signal as the input bit sequence to be processed by the one-way-function circuit;

[0030] a LIFO (Last-In-First-Out) buffer wherein conversion results output from the one-way-function circuit are stacked in synchronization with the clock signal when the LIFO buffer is controlled in a writing mode, and the conversion results stacked in the LIFO buffer are popped up in synchronization with the clock signal when the LIFO buffer is controlled in a reading mode; and

[0031] a combining circuit for outputting internal crypto-keys in synchronization with the clock signal by combining outputs of the LIFO buffer and the one-way-function circuit.

[0032] In the above apparatus, the LIFO buffer is controlled in the writing mode for first m clock pulses after initialization. At the first one clock, the external key is selected by the selector as the input bit sequence to be processed by the one-way-function circuit, and afterwards, the output of the register is selected, so that m sets of conversion results are stacked in the LIFO buffer. Then, the LIFO buffer is controlled in the reading mode for following m clock pulses, in order to generate m internal crypto-keys by combining outputs of the one-way-function circuit and the LIFO buffer, clock by clock.

[0033] The foregoing, further objects, features, and advantages of this invention will become apparent from a consideration of the following description, the appended claims, and the accompanying drawings wherein the same numerals indicate the same or the corresponding parts.

[0034] In the drawings:

[0035] FIG. 1 is a functional block diagram illustrating an apparatus for generating internal crypto-keys according to a first embodiment of the invention;

[0036] FIG. 2 is a functional block diagram illustrating the apparatus for generating the internal crypto-keys according to a second embodiment of the invention;

[0037] FIG. 3 is a flowchart illustrating operational flow of the second embodiment of FIG. 2;

[0038] FIG. 4 is a functional block diagram illustrating a third embodiment of the invention;

[0039] FIG. 5 is a block diagram illustrating a configuration example of a conventional pseudo-random-sequence generator; and

[0040] FIG. 6 is a functional block diagram illustrating a configuration example of a pseudo-random-sequence generator having a plurality of feedback-shift-registers.

[0041] Now, embodiments of the present invention will be described in connection with the drawings.

[0042] FIG. 1 is a functional block diagram illustrating an apparatus for generating internal crypto-keys according to a first embodiment of the invention.

[0043] Referring to FIG. 1, the apparatus comprises a first cascade connection of a first to an m-th one-way-function circuit 101₁to 101_m, a second cascade connection of another first to another m-th one-way-function circuit 102₁to 102_mand a first to an m-th n-bit XOR circuit 103₁to 103_m.

[0044] Half n bits (upper half n bits, for example) of an external key-data of 2n bits are supplied to the first one-way-function circuit 101₁of the first cascade connection through a first external-key input terminal 105, and the other n bits of the external key-data are supplied to the first one-way-function circuit 102₁of the second cascade connection through a second external-key input terminal 107.

[0045] In the first cascade connection, the first one-way-function circuit 101₁outputs a conversion result of n bits by processing the first half n-bit data of the external key with a first one-way function according to a first conversion parameter (public key) supplied through a first public-key input terminal 104, and each i-th (101_i; i being 2 to m) of the second to the m-th one-way-function circuit outputs a conversion result of n bits by processing an output of the (i−1)-th one-way-function circuit ¹⁰¹_i−1with the first one-way function according to the first conversion parameter.

[0046] In the same way, the first one-way-function circuit 102₁of the second cascade connection outputs a conversion result of n bits by processing the other half n-bit data of the external key with a second one-way function according to a second conversion parameter (public key) supplied through a second public-key input terminal 106, and each i-th (102_i; i being 2 to m) of the second to the m-th one-way-function circuit outputs a conversion result of n bits by processing an output of the (i−1)-th one-way-function circuit 102_i−1with the second one-way function according to the second conversion parameter, in the second cascade connection.

[0047] Each i-th (i being 1 to m) of the first to m-th XOR circuit 103₁to 103_mcalculates an XOR bit sequence of n bits to be output as an i-th internal key through corresponding one (108_i) of a first to an m-th output terminal 108₁to 108_m, from outputs of the i-th one-way-function circuit 101_iof the first cascade connection and the (m−i+1)-th one-way-function circuit 102_m−i+1of the second cascade connection, so that each bit of the XOR bit sequence has XOR logic of corresponding two bits of outputs of the i-th one-way-function circuit 101_iand the (m−i+1)-th one-way-function circuit 102_m−i+1.

[0048] The apparatus for generating internal crypto-keys of FIG. 1 according to the first embodiment is thus configured. Therefore, by giving an external key of 2n bits together with a first and a second conversion parameter (public key), the apparatus of FIG. 1 can generates m sets of internal keys of n bits at once, that is, about n times faster than to generate the same number of internal keys by way of the pseudo-random-sequence generator of FIG. 5, wherein only an LSB is available at one clock.

[0049] Further, even if a third party, who does not know the external key, might have succeeded to obtain a k-th (k being 1 to m) internal key output from the k-th output terminal 108_kby some means, and to estimate outputs of the k-th one-way-function circuit 101_kof the first cascade connection and the (m−k+1)-th one-way-function circuit 102_m−k+1, other internal keys can be protected from the third party.

[0050] This is because the third party cannot trace but outputs of the k-th to the m-th one-way-function circuit 101_kto 101_mof the first cascade connection and (m−k+1)-th to m-th one-way-function circuit of the second cascade connection according to characteristic of the one-way function, even if he might have obtained the outputs of the k-th one-way-function circuit 101_kand the (m−k+1)-th one-way-function circuit 102_m−k+1. Therefore, the third party cannot obtain but either of two inputs of the first to the m-th XOR circuit 103₁to 103_mexcept the k-th XOR circuit 103_k, which makes hardly possible to estimate other internal keys for the third party which knows neither the external key nor the internal keys.

[0051] Practically saying, it is very difficult for the third party to estimate the outputs of the k-th one-way-function circuit 101_kand the (m−k+1)-th one-way-function circuit 102_m−k+1, even if he has succeeded to obtain the k-th internal key. Therefore, even if more than one internal keys be broken, it is impossible to estimate other internal keys.

[0052] In the embodiment of FIG. 1, the same one-way-function circuits given with the same conversion parameter are described to be used in either of the first cascade connection or the second cascade connection. However, they may be different with each other and may be given different conversion parameters with each other in either or both of the first and the second cascade connection, or on the contrary, one-way-function circuits which process their input bit sequences with the same one-way-function may be applied to all the one-way-function circuits of the first and the second cascade connection, given with the same or different conversion parameters.

[0053] The one-way-function circuits may be used cyclically.

[0054] FIG. 2 is a functional block diagram illustrating the apparatus for generating the internal crypto-keys according to a second embodiment of the invention, having a first sub-generator comprising a first selector 201, a first one-way-function circuit 101 and a first register 202, a second sub-generator comprising a second selector 205, a second one-way-function circuit 102 and a second register 204, a LIFO (Last-In-First-Out) buffer 203, and an XOR circuit 103.

[0055] Each of the first and the second sub-generator has a similar configuration to the pseudo-random-sequence generator of FIG. 5.

[0056] Half n bits of an external key of 2n bits are input to the first selector 201 through a first external-key input terminal 105 and the other n bits of the external key are input to the second selector 205 through the second external-key input terminal 107. The first one-way-function circuit 101 outputs a conversion result of n bits by processing an n-bit output of the first selector 201 with a first one-way function according to a first conversion parameter (public key) supplied through a first public-key input terminal 104.

[0057] The first register 202 holds the conversion output of the first one-way-function circuit 101 and outputs previously held data of n bits to the first selector 201, in synchronization with a clock pulse CLK supplied through a clock terminal 210.

[0058] The first selector 201 selects the n-bit output of the first register 202 when a selection signal SEL supplied through a selection signal input terminal 211 is at logic ‘1’ and selects the first half n bits of the external key supplied through the first external-key input terminal 105 when the selection signal SEL is at logic ‘0’, as the n-bit output to be processed by the first one-way-function circuit 101.

[0059] In the same way, the second one-way-function circuit 102 outputs a conversion result of n bits by processing an n-bit output of the second selector 205 with a second one-way function according to a second conversion parameter (public key) supplied through a second public-key input terminal 106. The second register 204 holds the conversion output of the second one-way-function circuit 102 and outputs previously held data of n bits to the second selector 205, in synchronization with the clock pulse CLK. The second selector 205 selects the n-bit output of the second register 204 when the selection signal SEL is at logic ‘1’ and selects the other n bits of the external key supplied through the second external-key input terminal 107 when the selection signal SEL is at logic ‘0’, as the n-bit output to be processed by the second one-way-function circuit 102.

[0060] The LIFO buffer 203, comprising a memory and an address counter, initializes the address counter when the clock pulse CLK is supplied during a control signal CLR supplied through a control terminal 212 is at logic ‘0’.

[0061] When the control signal CLR is at logic ‘1’ and a read/write signal R/W supplied through a read/write terminal 213 is at logic ‘0’, the LIFO buffer stores the n-bit output of the second one-way-function circuit 102 in synchronization with the clock pulse CLK at an address indicated by the address counter, incrementing the address counter, and the LIFO buffer outputs n-bit data of an address indicated by the address counter to the XOR circuit 108 in synchronization with the clock pulse CLK decrementing the address counter, when both the read/write signal R/W and the control signal CLR are at logic ‘1’.

[0062] The XOR circuit 103 calculates an XOR bit sequence of n bits to be output as an internal key through an output terminal 108, from outputs of the first one-way-function circuit 101 and the LIFO buffer 203, so that each bit of the XOR bit sequence has XOR logic of corresponding two bits of the n-bit outputs of the first one-way-function circuit 101 and the LIFO buffer 203.

[0063] Now, referring to a flowchart of FIG. 3, operation of the second embodiment of FIG. 2 is described.

[0064] Supplying each half of an external key of 2n bits to respective one of the first and the second external-key input terminal 105 and 107, and the first and the second conversion parameters to the first and the second public-key input terminal 104 and 106, respectively, the control signal CLR of logic ‘0’ is supplied to the LIFO buffer 203 for initializing the LIFO buffer 203 with the first clock pulse CLK (at step 310). Then the LIFO buffer 203 is controlled in a writing mode by turning the control signal CLR to logic ‘1’ and supplying the read/write signal R/W of logic ‘0’ (at step 320).

[0065] Then the second selector 205 is controlled to select the half bits of the external key supplied through the second external-key input terminal 205 by supplying the selection signal SEL of logic ‘0’, and one clock pulse CLK is supplied (at step 330) to the second register 204 and the LIFO buffer 203. Then, turning the selection signal to logic ‘1’ for controlling the second selector 205 to select n-bit outputs of the second register 204, and m−1 clock pulses CLK are supplied to the second register 204 and the LIFO buffer 203 (at step 340).

[0066] Thus, m sets of conversion results of n bits of the second one-way-function circuit 102 are stored in the LIFO buffer 203.

[0067] Then, the read/write signal R/W is turned to logic ‘1’ for controlling the LIFO buffer 203 into a reading mode (at step 350), and the selection signal SEL of logic ‘0’ is supplied for controlling the first selector 201 to select the other half of the external key supplied to the first external-key input terminal 105 at the next clock pulse CLK (at step 360).

[0068] Then, turning the selection signal SEL to logic ‘1’ for controlling the first selector 201 to select n-bit outputs of the first register 202, m−1 clock pulses CLK are supplied to the first register 202 and the LIFO buffer 203 (at step 370).

[0069] Thus controlling the apparatus of FIG. 2, m sets of internal keys of n bits are output from the output terminal 108 in synchronization with the clock pulse CLK set by set at step 360 and step 370, and the internal keys having the same security with the internal keys generated by the first embodiment of FIG. 1 can be obtained with a far simpler configuration than the first embodiment and with only two times calculation time.

[0070] FIG. 4 is a functional block diagram illustrating a third embodiment of the invention. In the third embodiment, a single n-bit external key is supplied to an external-key input terminal 405 together with a conversion parameter supplied to a public-key input terminal 104. The LIFO buffer 203 is controlled in the writing mode for the first m clock pulses CLK after initialization and the conversion results of a single one-way-function circuit 101 is buffered in the LIFO buffer 203, in a similar way with the second embodiment of FIG. 2. For the following m clock pulses CLK, the LIFO buffer 203 is set in the reading mode, and the output of the LIFO buffer 203 is XORed with the conversion result of the one-way-function circuit 101 by the XOR circuit 103 clock by clock to be output as each of the m sets of the internal keys.

[0071] As above described, the apparatus of FIG. 4 is equivalent to the apparatus of FIG. 2 on condition that the same n-bit external keys are supplied to the the first and the second external-key input terminal 105 and 107, and the first and the second one-way-function circuit 101 and 102 output conversion results by processing the output of respective selectors 201 and 205 with the same one-way function according to the same conversion parameters, in the second embodiment of FIG. 2. Therefore, duplicated explanation is omitted.

[0072] However, either or both the external key and the conversion parameter to be supplied to the third embodiment may be changed for the first m clocks and for the following m clocks, of cause.

[0073] According to the third embodiment of FIG. 4, the second one-way-function circuit 102, the second register 204 and the second selector 205 can be further economized compared to the second embodiment of FIG. 2.

[0074] Heretofore, internal keys of n-bit length are described to be generated from an external key of 2n-bits or n bits. However, when bit-length of the given external key is shorter, necessary number of bits having any logic may be supplemented, or, a part of outputs of the output terminal 108 or the 108₁to 108_mmay be used as the internal keys, when bit-length of the required internal keys is shorter. Further, the XOR circuit 103, or 103₁to 103_mmay be replaced with any appropriate combining functions.

[0075] Still further, the one-way-function circuits 101, 102, 101₁to 101_m, or 102₁to 102_mmay be replaced with non-linear function circuits when required security is not so high, on condition that inverse prediction is sufficiently difficult in the non-linear function circuits.