DATA TRANSFORMATION DEVICE AND RECORDING MEDIUM HAVING RECORDED THEREON A PROGRAM FOR IMPLEMENTING THE SAME

摘要

A plurality of round processing parts (38) are provided each of which contains a nonlinear function part (304), and each nonlinear function part (304) comprises: a first key-dependent linear transformation part (341) which performs a linear transformation based on a subkey; a splitting part (342) which splits the output from the first key-dependent linear transformation part into n pieces of subdata; a first nonlinear transformati on part (343) which nonlinearly transforms those pieces of subdata, respectively; a second key-dependent linear transformation part (344) which linearly transforms those nonlinearly transformed outputs based on a subkey and outputs n pieces of transformed subdata; a second nonlinear transformation part (345) which nonlinearly transforms those transformed subdata; and a combining part (346) which combines the nonlinearly transformed outputs. An n x n matrix, which represents the linear transformation in the second key-dependent linear transformation part (344), is formed by n vectors whose Hamming weights are equal to or larger than T-1 for a security threshold T, thereby increasing the invulnerability again st differential cryptanalysis and linear cryptanalysis.