| 摘要 |
The object is to constitute a hash function by removing a feed-forward arithmetic operation. A hash value calculation device, for each integer i of i = 1, ..., L in an ascending order, calculates a function f[i] which, upon input of a value M[i] having k-n bits, an n-bit value y1[i-1] (a value y1[0] is a predetermined value IV1), and an n-bit value y2[i-1] (a value y2[0] is a predetermined value IV2), outputs an n-bit value x1[i], an n-bit value x2[i], a k-bit value k1[i], and a k-bit value k2[i]; for the value x1[i] as a plaintext and the value k1[i] as a key, calculates an n-bit value y1[i] with an encryption function of a block cipher; and for the value x2[i] as a plaintext and the value k2[i] as a key, calculates an n-bit value y2[i] with the encryption function for the block cipher. The hash value calculation device, upon input of a value y1[L] and a value y2[L] which are calculated, calculates a hash value with an injective function g. |
