Evaluation of Cryptographic
Techniques in Japan
CRYPTREC Project

March 30, 2001

Hideki Imai
Institute of Industrial Science, The University of Tokyo
http://imailab-www.iis.u-tokyo.ac.jp/

CRYPTREC
 CRYPTREC（（Cryptography Research andEvaluation Committee））– Secretariat: Information-technology Promotion
Agency (IPA), Japan, Security Center
http://www.ipa.go.jp/security/– Founded in April 2000

 CRYPTREC Project– Part of the Electronic Government Security
Technology Development Project, which issponsored by MITI and entrusted to the IPA

Foundations of the CRYPTREC
 Project of the Information-Technology Promotion
Agency (IPA), JAPAN– Investigation and research on criteria for
cryptography to be purchased by the government– CRYPTREC was established on the basis of thereport of the consulting committee of the project.
 Study Group for Promotion and Advancement ofEncrypted Communications, MPT
 Project of Telecommunications Advancement
Organization of Japan (TAO)Motivation of the CRYPTEC
Project (1) Creation of the infrastructure for theelectronic government by FY 2003
 Assessment of the Security and theImplementation of Available
Cryptographic Techniques to Achieve
Information Security in the ElectronicGovernment
 Enhancing the security and reliability ofthe nationwide information network

Motivation of the CRYPTECProject (2)Recommendation of the OECD Council“Guidelines for Cryptography Policy”– PRINCIPLES 1. TRUST IN CRYPTOGRAPHIC METHODS• Cryptographic methods should be trustworthy in order togenerate confidence in the use of information andcommunications systems.

Trend of Standardization– ISO/IEC JTC1 SC27
• From registration (IS-9979) to real standard– AES Project in USA– NESSIE (New European Schemes for Signature, Integrity,and Encryption)• The Information Societies Technology (IST) Programme ofthe European Commission

Goal of the CRYPTREC Project Open Call for Cryptographic Techniques Available for the electronic government system

 Proposed cryptographic techniques areevaluated from technical point of view byexperts.
Technical Report Including a
List of Analytical Results–Security Profile, and–Implementation Aspects
The report will be submitted to thegovernment and open to the public.

Features of the CRYPTREC
Project
 Four related government offices
participate in the CRYPTREC as
observers:
 Management and Coordination Agency
 Japan Defense Agency
 Ministry of International Trade and Industry
 Ministry of Posts and Telecommunications

 Front-line researchers in the area ofcryptology in Japan assembled.
 The balance of the security and theefficiency of implementation is among thetop priority.

Organization of theCRYPTREC(1) Members
Hideki Imai
(University of Tokyo, Chair)
Naoyuki Iwashita(Bank of Japan)
Eiji Okamoto(Toho University)
Tatsuaki Okamoto(NTT Laboratories)
Toshinobu Kaneko (Science University of Tokyo)
Kouichi Sakurai(Kyushu University)
Ryoichi Sasaki(Hitachi, Ltd.)
Shigeo Tsujii(Chuo University)
Kenji Naemura(Keio University)
Mitsuru Matsui(Mitsubishi Electric Corporation)
Tsutomu Matsumoto (Yokohama National University)

Organization of theCRYPTREC(2) Observersz Management and Coordination Agency
z Japan Defense Agency
z Ministry of International Trade and Industryz Ministry of Posts and Telecommunications
 Secretariatz Information-Technology Promotion Agency(IPA), JAPANSchedule Schedule of the research and evaluation
2000
67892001
101112

1

2

3

4Submission
Screening
evaluation
Detailed
evaluation
Announcement ofresults☆

☆ April 18

Procedure of Evaluating
Cryptographic Techniques Two-step Evaluation
 Screening evaluation
 Detailed evaluation

 Screening Evaluation
 Evaluation based on the submitted forms byentrusted experts

 Detailed Evaluation
 Detailed evaluation by the entrusted experts
including experimental examination Voluntary evaluation by academic groups etc.
 Technical information is open to public Call for evaluation

Categories of Solicited
Cryptographic Techniques Asymmetric Cryptographic Schemes
 For confidentiality, authentication, signature, and key-sharing
 Cryptographic schemes with primitives are invited Cryptographic primitive：an elementary cryptographic
algorithm that provides security based on integer factoring
problems, discrete logarithm, etc.
 Cryptographic scheme: an algorithm that provides one ormore security functions by using cryptographic primitives
and some auxiliary functions such as a hash function.

 Symmetric Ciphers Stream ciphers , 64-bit block ciphers,128-bit block ciphers Hash Functions
 Pseudo-Random Number Generators

Number of Applications for theCRYPTREC Call-Up Asymmetric Cryptographic Schemes : 24
– Confidentiality– Authentication– Signature– Key-sharing

71106

 Symmetric Ciphers :19– Stream ciphers– 64-bit block ciphers– 128-bit block ciphers649

 Hash Functions :0
 Pseudo-Random Number Generators : 5
 Total:48

Screening Evaluation
 Security Evaluation
 The schemes with evident critical defects areexcluded from the detailed evaluation process.

 Evaluation on the Implementation
 The following are excluded from the detailed
evaluation process.
 Proposal of a cryptographic technique not appropriate
for the electronic government Proposal not providing enough information for the third
party to implement it

Shortening the List of the Candidates
for the Detailed Evaluation

Result of the Screening
Evaluation
 Asymmetric Cryptographic Schemes :14– Confidentiality– Authentication– Signature– Key-sharing

5144

 Symmetric Ciphers :12– Stream ciphers– 64-bit block ciphers– 128-bit block ciphers

246

 Hash Functions :0
 Pseudo-Random Number Generators : 1
 Total:27

Cryptographic Techniques forthe Detailed Evaluation (1) Asymmetric Cryptographic Schemes(Confidentiality)– HIME-2(HITACHI)– EPOC(NTT)– PSEC(NTT)– ECAES in SEC1(FUJITSU & Certicom)– ACE Encryption(IBM) Asymmetric Cryptographic Schemes(Authentication)– ESIGN(NTT)Cryptographic Techniques forthe Detailed Evaluation (2) Asymmetric Cryptographic Schemes (Signature)– MY-ELLTY ECMR-h(MATSUSHITA)– ESIGN(NTT)– ECDSA in SEC1(FUJITSU & Certicom)– ACE Sign(IBM) Asymmetric Cryptographic Schemes (Key-sharing)– HIME-1(HITACHI)– ECDHS in SEC1 (FUJITSU & Certicom)– ECMQVS in SEC1 (FUJITSU & Certicom)– HEF-ECDH(JAIST & MATSUSHITA)Cryptographic Techniques forthe Detailed Evaluation (3) Symmetric Ciphers (Stream Ciphers)– MULTI-S01(HITACHI)– TOYOCRYPTO-HS1(TOYOCOM） Symmetric Ciphers (64-bit Block Ciphers)– CIPHERUNICORN-E(NEC)– MISTY1(MITSUBISHI)– FEAL-NX(NTT)– Hierocrypt-L1(TOSHIBA)

Cryptographic Techniques forthe Detailed Evaluation(4) Symmetric Ciphers (128-bit Block Ciphers)– CIPHERUNICORN-A(NEC)– Camellia(NTT & MISTUBISHI)– RC6(RSA Data Security)– SC2000(FUJITSU)– MARS(IBM)– Hierocrypt-3(TOSHIBA) Pseudo-Random Number Generators– TOYOCRYPTO-HR1(TOYOCOM）

Reasons of the Exclusion (1)The proposed technique submitted to a category
cannot be considered as a cryptographic
technique in that category.



The specification of the proposal is insufficient andcannot be interpreted as that of a cryptographictechnique.

The self-evaluation of the security was not enoughto proceed to the detailed evaluation stage of theshort period.



The technology specification is not sufficient toimplement the technique.

Reasons of the Exclusion (2)A critical defect in the security was pointed out.



Short of the processing speed for the use of theelectronic government.

The proposal is evaluated in another category,because essentially the same cryptographic
technique was submitted there.

Documentation defect was found.

Withdrawn.

Detailed Evaluation (Methods)
 Evaluation by Foreign Researchers
 Reviewer: Eminent researchers in the area of cryptanalysis
 Multiple cryptographic techniques are evaluated from theresearcher's unique point of view.

 Evaluation by Domestic Researchers Multiple cryptographic techniques are evaluated by each
evaluation team.
 Heuristic attacks to the candidate cryptographic techniques
are surveyed and examined.
 Performance when being implemented by hardware isevaluated.

 Voluntary Evaluation by Academic GroupsOther Important CryptographicTechniques To Be Listed


CRYPTREC adds the following to the List:– Cryptographic techniques used in many systems,– Cryptographic techniques indispensable for the application
to the electronic government.



Cryptographic Techniques To Be Included– Asymmetric Cryptographic Schemes• RSA-OAEP, RSA-PSS, DSA, DH Key Exchange– Symmetric Ciphers• AES(Rijndael)• Triple-DES– Hash Functions• SHA-1, MD-5, RIPEMD-160– Pseudo-Random Number Generators (RNG)• RNG based on SHA1

Detailed Evaluation (Criteria)
 Security
 Unified evaluation of the strength of thetechniques in a category against the well-known
general attacks
 Evaluation of the strength of each techniqueagainst systematic and heuristic attacks

 Implementation（（Software & Hardware) SW
Processing speed, resource amount, etc. areexamined on the common platform.
 HW
Processing speed, amount of gates, etc. areexamined on the common platform.

Evaluation Criteria (1) Security of the Asymmetric Cryptographic

Schemes– Both schemes and primitives are evaluated.
– Evaluation Criteria of Schemes• Possibility of passive attacks and active attacks• Effect of the attacks to the functions(confidentiality, authentication, signature, andkey-sharing)– Evaluation Criteria of Primitives• Strength against the well-known attacks

Evaluation Criteria (2)■ Security of Stream Ciphers– Period, linear complexity, mutual information, etc.
– Statistical characteristics (frequency, 0-1 balance, etc.)– Heuristic cryptanalysis■ Security of Block Ciphers– Well-known attacks (linear cryptanalysis, differential
cryptanalysis, etc.)– Other attacks (higher order differential cryptanalysis, etc.)– Statistical characteristics (avalanche criterion, etc.)
 Security of Pseudo-Random NumberGenerators– Statistical property to the randomness tests such as thepoker test, the long run test as described in FIPS140-1

Evaluation Criteria (3) Implementation Evaluation– Implementation by software on normal platforms– Implementation by hardware (gate array, FPGA, etc.)– Special requirements for the implementation– Experience of exposure if it is in public use
 Design Criteria– Design criteria of the key setting and the security
parameters will be evaluated.

Cooperation with the Similar
Projects Overseas
 Sharing the Knowledge on Evaluation of

Cryptographic Techniques with the Similar
Projects– Cryptographic Standard by the ISO/ I E C JTC1.
– AES by U.S.A (NIST)– NESSIE by EU.
 Cooperation and Harmonization from

Various Aspects

Summary and the FutureWorks (1) Significance of the CRYPTREC Project It will provide reliable and proper information on
cryptographic techniques required for theelectronic government.
 It will promote the development of cryptographic
technology in Japan.

 Status The screening process was finished.
 The short list of the candidates for the detailedevaluation is available.
 Detailed evaluation has started.

Summary and the FutureWorks (2) Evaluation of the cryptographic

technology must be continued.
– The periods of the call-up and the evaluation are
too short. (New cryptographic techniques and theimproved ones should be evaluated. )– Continuation of evaluation is essentially importantfor cryptographic techniques. (Security time isfaster than Internet time.)– Permanent organization is necessary.
 The first step to the information security

technology agency.