Abstract:
Consider a case of implementing a circuit which performs both encryption and decryption according to a cipher that has the SPN construction. If a data transformation performed by a data transformation unit is an involution, i.e., a transformation which is equal to its own inverse, then the same data transformation unit can be commonly used for encryption and decryption. This enables a circuit which performs both encryption and decryption to be implemented without increases in circuit scale.

Description:
[0001]    This application is based on an application No. 2002-070938 filed in Japan, the contents of which are hereby incorporated by reference.  
         BACKGROUND OF THE INVENTION  
         [0002]    1. Field of the Invention  
           [0003]    The present invention relates to a data encryption device and a data decryption device.  
           [0004]    2. Related Art  
           [0005]    Digital communications have become widespread in recent years. To foster sound industrial development and also to protect privacy, increasing importance is attached to ensuring confidentiality of data in such digital communications. Data cryptography provides a means of ensuring data confidentiality. Data cryptography needs to have a high level of security against cryptanalytic attacks.  
           [0006]    One example of such cryptographic techniques is a block cipher. A block cipher is the following. First, plaintext is partitioned into blocks of a predetermined size. Then a nonlinear transformation is performed on each of these blocks, thereby generating ciphertext. Thus, block ciphers achieve high security by employing nonlinear transformations. Examples of block ciphers include Serpent and Hierocrypt-3. These block ciphers have the SPN (Substitution-Permutation Network) construction. The SPN construction is explained using a specific example below.  
           [0007]    To realize a block cipher having the SPN construction, an encryption device has four data transformation units and one data diffusion unit. When 128-bit plaintext data is input, the encryption device divides the plaintext data into four 32-bit data blocks. These four 32-bit data blocks are input respectively to the four data transformation units. Each data transformation unit performs a nonlinear transformation on its input 32-bit data block, and outputs the result to the data diffusion unit. The data diffusion unit receives the four 32-bit data blocks from the four data transformation units, and shuffles these four 32-bit data blocks. The four 32-bit data blocks are then connected and output as 128-bit ciphertext data. In an actual encryption device, the above operations of the data transformation units and data diffusion unit are repeated a plurality of times to generate ciphertext.  
           [0008]    To decrypt this ciphertext data into the original plaintext data, a decryption device has one inverse data diffusion unit and four inverse data transformation units. When the 128-bit ciphertext data is input, the decryption device divides the ciphertext data into four 32-bit data blocks. These 32-bit data blocks are input in the inverse data diffusion unit. The inverse data diffusion unit performs the inverse operation of the above data diffusion unit on the four 32-bit data blocks. Having done so, the inverse data diffusion unit outputs the resulting four 32-bit data blocks respectively to the four inverse data transformation units. Each inverse data transformation unit performs the inverse operation of the above data transformation units on its input 32-bit data block. The resulting four 32-bit data blocks are connected and output as the 128-bit plaintext data. In an actual decryption device, the above operations of the inverse data diffusion unit and inverse data transformation units are repeated the same number of times as in the encryption device, to generate plaintext.  
           [0009]    Thus, according to a block cipher having the SPN construction, data transformation units and data diffusion unit used for encryption conduct different operations from data transformation units and data diffusion unit used for decryption. In other words, the inverse operation of the encryption is performed in the decryption. Accordingly, when implementing a circuit that performs both encryption and decryption, the circuit scale needs to be twice as large as a circuit that performs only one of encryption and decryption. This causes increases in cost.  
         SUMMARY OF THE INVENTION  
         [0010]    The present invention was conceived in view of the problem described above, and has an object of providing a data encryption device and data decryption device which enable a circuit that performs both encryption and decryption to be implemented without increases in circuit scale.  
           [0011]    The stated object can be achieved by a data encryption device for encrypting N-bit plaintext to generate N-bit ciphertext where N is a positive integer, including: a division unit operable to divide the N-bit plaintext into M data blocks which are each B bits long, where N=M×B; a first transformation unit operable to perform a data transformation on each of the M data blocks, the data transformation being equal to its own inverse; a diffusion unit operable to perform an invertible data diffusion on the M data blocks transformed by the first transformation unit; a second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks diffused by the diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the N-bit ciphertext.  
           [0012]    According to this construction, the data encryption device uses such a data transformation that is equal to its own inverse. Therefore, the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by performing the same data transformation again on the ciphertext. Hence a circuit that performs the data transformation can be commonly used for encryption and decryption.  
           [0013]    Here, the first transformation unit may include: a division subunit operable to divide each of the M data blocks into first data of higher-order B/2 bits and second data of lower-order B/2 bits; a shuffle subunit operable to shuffle the first data and the second data to generate third data of higher-order B/2 bits and fourth data of lower-order B/2 bits; and a connection subunit operable to exchange in order the third data and the fourth data, and connect the exchanged third data and fourth data as a data block transformed by the first transformation unit.  
           [0014]    According to this construction, the data transformation is equal to its own inverse, because the third data and the fourth data are exchanged in order. Hence the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by using the same data transformation.  
           [0015]    Here, the shuffle subunit may include: a substitution subunit operable to concurrently (a) perform a substitution on the second data and output the substituted second data to a combination subunit, and (b) output the second data as the fourth data; and the combination subunit operable to combine the first data and the substituted second data, and output the combination as the third data.  
           [0016]    According to this construction, the data shuffling effect is enhanced.  
           [0017]    Here, the first transformation unit may be operable to perform the data transformation on each of the M data blocks a plurality of times, and the diffusion unit may be operable to perform the data diffusion on the M data blocks transformed by the first transformation unit, a plurality of times.  
           [0018]    According to this construction, the data shuffling effect is further enhanced.  
           [0019]    The stated object can also be achieved by a data encryption device for encrypting N-bit plaintext to generate N-bit ciphertext where N is a positive integer, including: a division unit operable to divide the N-bit plaintext into M data blocks which are each B bits long, where N=M×B; a first transformation unit operable to perform a series of operations a plurality of times on each of the M data blocks, the series of operations including, in the stated order, (a) a data transformation that is equal to its own inverse and (b) an invertible data diffusion; a round control unit operable to count a number of times the first transformation unit has performed the series of operations, and when the number reaches a predetermined number, to output the resulting M data blocks to a second transformation unit; the second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks output from the round control unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the N-bit ciphertext.  
           [0020]    According to this construction, the data encryption device repeats the data transformation and the data diffusion a plurality of times. This increases the data shuffling effect. Also, the data encryption device uses such a data transformation that is equal to its own inverse. Hence the data encryption device can decrypt ciphertext which was generated by the data encryption device itself, by using the same data transformation.  
           [0021]    The stated object can also be achieved by a data decryption device for decrypting N-bit ciphertext to obtain N-bit plaintext where N is a positive integer, the N-bit ciphertext being generated by a data encryption device by (1) dividing the N-bit plaintext into M data blocks which are each B bits long where N=M×B, (2) performing a data transformation that is equal to its own inverse, on each of the M data blocks, (3) performing an invertible data diffusion on the transformed M data blocks, (4) further performing the data transformation on each of the diffused M data blocks, and (5) connecting the further transformed M data blocks as the N-bit ciphertext, the data decryption device including: a division unit operable to divide the N-bit ciphertext into M data blocks which are each B bits long; a first transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks divided by the division unit; an inverse diffusion unit operable to perform an inverse of the data diffusion performed by the data encryption device, on the M data blocks transformed by the first transformation unit; a second transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks inverse-diffused by the inverse diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby obtaining the N-bit plaintext.  
           [0022]    According to this construction, the data decryption device performs the same data transformation as the data encryption device. Therefore, the data decryption device can share a circuit that performs the data transformation with the data encryption device.  
           [0023]    The stated object can also be achieved by a data decryption device for decrypting N-bit ciphertext to obtain N-bit plaintext where N is a positive integer, the N-bit ciphertext being generated by a data encryption device by (1) dividing the N-bit plaintext into M data blocks which are each B bits long where N=M×B, (2) performing a first series of operations a plurality of times on each of the M data blocks, the first series of operations including, in the stated order, (a) a data transformation that is equal to its own inverse and (b) an invertible data diffusion, (3) counting a number of times the first series of operations has been performed, and when the number reaches a predetermined number, outputting the resulting M data blocks, (4) further performing the data transformation on each of the output M data blocks, and (5) connecting the further transformed M data blocks as the N-bit ciphertext, the data decryption device including: a division unit operable to divide the N-bit ciphertext into M data blocks which are each B bits long; a first transformation unit operable to perform a second series of operations a plurality of times on each of the M data blocks divided by the division unit, the second series of operations including, in the stated order, (c) the same data transformation as the data transformation performed by the data encryption device and (d) an inverse of the data diffusion performed by the data encryption device; a round control unit operable to count a number of times the first transformation unit has performed the second series of operations, and when the number reaches the predetermined number, to output the resulting M data blocks to a second transformation unit; the second transformation unit operable to perform the same data transformation as the data transformation performed by the data encryption device, on each of the M data blocks output from the round control unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby obtaining the N-bit plaintext.  
           [0024]    According to this construction, the data decryption device performs the same data transformation as the data encryption device. Hence the data decryption device can share a circuit that performs the data transformation with the data encryption device.  
           [0025]    The stated object can also be achieved by a data encryption/decryption device for encrypting/decrypting first N-bit data to generate second N-bit data where N is a positive integer, including: a division unit operable to divide the first N-bit data into M data blocks which are each B bits long, where N=M×B; a first transformation unit operable to perform a data transformation on each of the M data blocks, the data transformation being equal to its own inverse; a switch unit operable to switch an output destination of the M datablocks transformed by the first transformation unit, depending on whether the first N-bit data is subjected to encryption or decryption; a diffusion unit operable to receive the M data blocks transformed by the first transformation unit when the first N-bit data is subjected to encryption, and perform an invertible data diffusion on the received M data blocks; an inverse diffusion unit operable to receive the M data blocks transformed by the first transformation unit when the first N-bit data is subjected to decryption, and perform an inverse of the data diffusion on the received M data blocks; a second transformation unit operable to perform the same data transformation as the data transformation performed by the first transformation unit, on each of the M data blocks diffused by the diffusion unit or inverse-diffused by the inverse diffusion unit; and a connection unit operable to connect the M data blocks transformed by the second transformation unit, thereby generating the second N-bit data.  
           [0026]    According to this construction, the data encryption/decryption device uses such a data transformation that is equal to its own inverse. Which is to say, the data encryption/decryption device performs the same data transformation for both encryption and decryption. This allows the same data transformation circuit to be used for encryption and decryption. Hence the circuit scale can be reduced when compared with the case where different data transformations are performed for encryption and decryption, with it being possible to reduce costs.  
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0027]    These and other objects, advantages and features of the invention will become apparent from the following description thereof taken in conjunction with the accompanying drawings which illustrate a specific embodiment of the invention.  
         [0028]    In the drawings:  
         [0029]    [0029]FIG. 1 shows a construction of a cryptographic communication system to which an embodiment of the invention relates;  
         [0030]    [0030]FIG. 2 is a block diagram showing a construction of a reception device shown in FIG. 1;  
         [0031]    [0031]FIG. 3 is a block diagram showing a construction of an encryption/decryption unit shown in FIG. 2;  
         [0032]    [0032]FIG. 4 is a block diagram showing a construction of a second data scramble unit shown in FIG. 3;  
         [0033]    [0033]FIG. 5 is a block diagram showing a construction of a first data scramble unit shown in FIG. 3;  
         [0034]    [0034]FIG. 6 shows a construction of a data transformation unit shown in FIG. 5;  
         [0035]    [0035]FIG. 7 shows a construction of a data shuffle unit shown in FIG. 6;  
         [0036]    [0036]FIG. 8 shows a construction of a data substitution unit shown in FIG. 7;  
         [0037]    [0037]FIG. 9 shows a construction of a first data diffusion unit shown in FIG. 5;  
         [0038]    [0038]FIG. 10 shows a construction of a second data diffusion unit shown in FIG. 5;  
         [0039]    [0039]FIG. 11 is a flowchart showing an overall operation of the reception device;  
         [0040]    [0040]FIG. 12 is a flowchart showing a decryption operation of the encryption/decryption unit in step S 104  shown in FIG. 11;  
         [0041]    [0041]FIG. 13 is a flowchart showing an encryption operation of the encryption/decryption unit in step S 106  shown in FIG. 11;  
         [0042]    [0042]FIG. 14 shows a construction of a data shuffle unit which is a modification to the embodiment; and  
         [0043]    [0043]FIG. 15 shows a construction of a data substitution unit shown in FIG. 14. 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0044]    The following is a description of a cryptographic communication system to which an embodiment of the present invention relates, with reference to drawings.  
         [0045]    [0045]FIG. 1 shows a construction of a cryptographic communication system  1 . As illustrated, the cryptographic communication system  1  is roughly made up of a reception device  10 , a recording medium  11 , a content delivery device  12 , and a broadcast satellite  13 .  
         [0046]    The content delivery device  12  is actually realized by a digital broadcast device. The content delivery device  12  broadcasts encrypted digital content which is superimposed on a digital broadcast wave, via the broadcast satellite  13 .  
         [0047]    The reception device  10  receives the digital broadcast wave which is broadcast from the content delivery device  12  via the broadcast satellite  13 . The reception device  10  extracts the encrypted digital content from the digital broadcast wave, and decrypts the encrypted digital content. The reception device  10  then re-encrypts the decrypted digital content using another key, and writes this re-encrypted digital content onto the recording medium  11 .  
         [0048]    1. Construction of the Reception Device  10   
         [0049]    The following describes a construction of the reception device  10 .  
         [0050]    [0050]FIG. 2 is a block diagram showing the construction of the reception device  10 . As shown in the drawing, the reception device  10  includes a reception unit  101 , a data storage unit  102 , a key input unit  103 , a key storage unit  104 , a control unit  105 , an encryption/decryption unit  106 , an input/output unit  107 , and an antenna  108 .  
         [0051]    The reception device  10  is actually realized by a computer system that has a microprocessor, a ROM, a RAM, a key operating unit, a communication unit, an antenna, and the like. A computer program is stored in the RAM. The functions of the reception device  10  are realized by the microprocessor operating in accordance with this computer program.  
         [0052]    (1) Reception Unit  101   
         [0053]    The reception unit  101  receives the digital broadcast wave from the content delivery device  12  through the antenna  108 . The reception unit  101  extracts ciphertext data C 1  which is the encrypted digital content, from the received digital broadcast wave. The reception unit  101  writes ciphertext data C 1  to the data storage unit  102 .  
         [0054]    Ciphertext data C 1  referred to here has been generated by the content delivery device  12 , by encrypting plaintext data P using 1280-bit key data K 1 .  
         [0055]    (2) Data Storage Unit  102   
         [0056]    The data storage unit  102  stores ciphertext data C 1  output from the reception unit  101 . The data storage unit  102  also stores plaintext data P output from the encryption/decryption unit  106 .  
         [0057]    (3) Key Input Unit  103   
         [0058]    The key input unit  103  receives an input of 1280-bit key data K 1  used for decrypting ciphertext data C 1  into plaintext data P, and writes key data K 1  to the key storage unit  104 .  
         [0059]    The key input unit  103  also receives an input of 1280-bit key data K 2  used for re-encrypting plaintext data P, which is obtained by decrypting ciphertext data C 1  using key data K 1 , into ciphertext data C 2 . The key input unit  103  writes key data K 2  to the key storage unit  104 .  
         [0060]    Here, key data K 2  is different from key data K 1 .  
         [0061]    (4) Key Storage Unit  104   
         [0062]    The key storage unit  104  receives key data K 1  and key data K 2  from the key input unit  103 , and stores them.  
         [0063]    (5) Control Unit  105   
         [0064]    The control unit  105  exercises the following control when decrypting ciphertext data C 1 .  
         [0065]    The control unit  105  instructs the encryption/decryption unit  106  to read key data K 1  stored in the key storage unit  104 . The control unit  105  also sets a flag held in a switch unit  220  in the encryption/decryption unit  106 , to “1”. After this, the control unit  105  divides ciphertext data C 1  stored in the data storage unit  102  into partial data in units of 128 bits, starting from the most significant bit. The control unit  105  sequentially outputs these 128-bit partial data to the encryption/decryption unit  106 , in the order in which they were divided.  
         [0066]    Meanwhile, the control unit  105  exercises the following control when encrypting plaintext data P.  
         [0067]    The control unit  105  instructs the encryption/decryption unit  106  to read key data K 2  stored in the key storage unit  104 . The control unit  105  also sets the flag held in the switch unit  220  in the encryption/decryption unit  106 , to “0”. After this, the control unit  105  divides plaintext data P stored in the data storage unit  102  into partial data in units of 128 bits, starting from the most significant bit. The control unit  105  sequentially outputs these 128-bit partial data to the encryption/decryption unit  106 , in the order in which they were divided.  
         [0068]    (6) Encryption/Decryption Unit  106   
         [0069]    The encryption/decryption unit  106  receives key data K 1  and ciphertext data C 1  from the control unit  105 , and decrypts ciphertext data C 1  into plaintext data P using key data K 1 . Here, the encryption/decryption unit  106  performs decryption in units of 128 bits in the order in which the partial data of ciphertext data C 1  is output from the control unit  105 . By repeating such 128-bit decryption, the encryption/decryption unit  106  obtains plaintext data P. The encryption/decryption unit  106  writes plaintext data P obtained in this way, into the data storage unit  102  through the control unit  105 .  
         [0070]    Also, the encryption/decryption unit  106  receives key data K 2  and plaintext data P from the control unit  105 , and encrypts plaintext data P into ciphertext data C 2  using key data K 2 . Here, the encryption/decryption unit  106  performs encryption in units of 128 bits in the order in which the partial data of plaintext data P is output from the control unit  105 , as in the case of the above decryption. By repeating such 128-bit encryption, the encryption/decryption unit  106  obtains ciphertext data C 2 . The encryption/decryption unit  106  outputs ciphertext data C 2  obtained as a result of this re-encryption, to the input/output unit  107 .  
         [0071]    The following describes the encryption/decryption unit  106  in greater detail.  
         [0072]    (Construction of the Encryption/Decryption Unit  106 )  
         [0073]    [0073]FIG. 3 is a block diagram showing a construction of the encryption/decryption unit  106 . As shown in the drawing, the encryption/decryption unit  106  includes a key control unit  201 , a first data scramble unit  202 , a round control unit  203 , and a second data scramble unit  204 .  
         [0074]    The key control unit  201  receives 1280-bit key data K 1  from the key storage unit  104  through the control unit  105 . The key control unit  201  divides 1280-bit key data K 1  into 128-bit partial keys K 1   0 , K 1   1 , . . . , K 1   9 , starting from the most significant bit. When 128-bit partial data of ciphertext data C 1  is first input in the first data scramble unit  202 , the key control unit  201  outputs partial key K 1   0  to the first data scramble unit  202 . Subsequently, the key control unit  201  outputs a partial key in the order of K 1   1 , K 1   2 , . . . , K 1   9 , each time 128-bit partial data is input in the first data scramble unit  202 .  
         [0075]    In the same manner, the key control unit  201  receives 1280-bit key data K 2  from the key storage unit  104  through the control unit  105 . The key control unit  201  divides 1280-bit key data K 2  into 128-bit partial keys K 2   0 , K 2   1 , . . . , K 2   9 , starting from the most significant bit. When 128-bit partial data of plaintext data P is first input in the first data scramble unit  202 , the key control unit  201  outputs partial key K 2   0  to the first data scramble unit  202 . Subsequently, the key control unit  201  outputs a partial key in the order of K 2   1 , K 2   2 , . . . , K 2   9 , each time 128-bit partial data is input in the first data scramble unit  202 .  
         [0076]    The first data scramble unit  202  receives 128-bit partial data from the control unit  105 . The first data scramble unit  202  also receives a 128-bit partial key from the key control unit  201 . The first data scramble unit  202  performs a nonlinear transformation on the 128-bit partial data, and further performs a linear transformation on the nonlinearly-transformed partial data using the partial key. The first data scramble unit  202  outputs the resulting 128-bit partial data to the round control unit  203 . This first data scramble unit  202  is explained in more detail later.  
         [0077]    The round control unit  203  receives the 128-bit partial data from the first data scramble unit  202 . The round control unit  203  keeps count of the number of times it has received 128-bit partial data from the first data scramble unit  202 . When the count reaches ten, the round control unit  203  outputs the 128-bit partial data to the second data scramble unit  204  and resets the count. If the count is below ten, the round control unit  203  outputs the 128-bit partial data back to the first data scramble unit  202 .  
         [0078]    [0078]FIG. 4 shows a construction of the second data scramble unit  204 . As illustrated, the second data scramble unit  204  includes data transformation units  210   e,    210   f,    210   g,  and  210   h.    
         [0079]    In the case of decryption, the second data scramble unit  204  receives 128-bit partial data from the round control unit  203 , and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units  210   e - 210   h,  in the order in which they were divided. Each of the data transformation units  210   e - 210   h  performs the nonlinear transformation on its input 32-bit data block. The four 32-bit data blocks output from the data transformation units  210   e - 210   h  as a result of this nonlinear transformation are connected to form 128-bit partial data, which is then output to the data storage unit  102  via the control unit  105 .  
         [0080]    In the case of encryption, likewise, the second data scramble unit  204  receives 128-bit partial data from the round control unit  203  and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units  210   e - 210   h,  in the order in which they were divided. Each of the data transformation units  210   e - 210   h  performs the nonlinear transformation on its input 32-bit data block. Four 32-bit data blocks output from the data transformation units  210   e - 210   h  as a result of this nonlinear transformation are connected to form 128-bit partial data, which is then output to the input/output unit  107 .  
         [0081]    Although the second data scramble unit  204  is shown as an independent construction element in FIG. 3 for ease of explanation, actually the data transformation units  210   e - 210   h  of the second data scramble unit  204  share a circuit with data transformation units  210   a - 210   d  of the first data scramble unit  202  shown in FIG. 5. Each of these data transformation units is explained in detail later.  
         [0082]    (Construction of the First Data Scramble Unit  202 )  
         [0083]    [0083]FIG. 5 is a block diagram showing a construction of the first data scramble unit  202 . In the drawing, the first data scramble unit  202  includes the data transformation units  210   a - 210   d,  the switch unit  220 , a first data diffusion unit  230 , and a second data diffusion unit  240 .  
         [0084]    The first data scramble unit  202  receives 128-bit partial data from the control unit  105 , and divides it into four 32-bit data blocks starting from the most significant bit. The four 32-bit data blocks are input respectively to the data transformation units  210   a - 210   d,  in the order in which they were divided.  
         [0085]    Each of the data transformation units  210   a - 210   d  receives a 32-bit data block, performs the nonlinear transformation on the 32-bit data block, and outputs the result to the switch unit  220 . Each data transformation unit is explained in more detail later.  
         [0086]    The switch unit  220  receives four 32-bit data blocks from the data transformation units  210   a - 210   d.    
         [0087]    The switch unit  220  holds the flag that shows the output destination of the data blocks received from the data transformation units  210   a - 210   d.  This flag takes “0” or “1”. If the flag is “0”, the data blocks are output to the first data diffusion unit  230 . If the flag is “1”, the data blocks are output to the second data diffusion unit  240 . The switch unit  220  is connected to the control unit  105 , and switches the flag when instructed by the control unit  105 .  
         [0088]    Upon receiving the four 32-bit data blocks, the switch unit  220  refers to the flag held therein. If the flag is “0”, the switch unit  220  outputs the data blocks to the first data diffusion unit  230 . If the flag is “1”, the switch unit  220  outputs the data blocks to the second data diffusion unit  240 .  
         [0089]    The first data diffusion unit  230  is used when encrypting plaintext data P into ciphertext data C 2 . The first data diffusion unit  230  receives four 32-bit data blocks from the data transformation units  210   a - 210   d  via the switch unit  220 . Also, the first data diffusion unit  230  is connected to the key control unit  201 , and receives a partial key from the key control unit  201 . The first data diffusion unit  230  performs a linear transformation on the four 32-bit data blocks using the partial key, and outputs the result to the round control unit  203 .  
         [0090]    The second data diffusion unit  240  is used when decrypting ciphertext data C 1  into plaintext data P. The second data diffusion unit  240  receives four 32-bit data blocks from the data transformation units  210   a - 210   d  via the switch unit  220 . Also, the second data diffusion unit  240  is connected to the key control unit  201 , and receives a partial key from the key control unit  201 . The second data diffusion unit  240  performs a linear transformation on the four 32-bit data blocks using the partial key, and outputs the result to the round control unit  203 .  
         [0091]    The first data diffusion unit  230  and the second data diffusion unit  240  are explained in more detail later.  
         [0092]    (Construction of the Data Transformation Unit  210   a )  
         [0093]    [0093]FIG. 6 shows a construction of the data transformation unit  210   a.    
         [0094]    In the drawing, the data transformation unit  210   a  includes data shuffle units  300   a,    300   b,  and  300   c.  The transformation performed by the data transformation unit  210   a  is an involution. An involution refers to such an operation that recovers the original data when repeated twice. In other words, an involution is an operation that is equal to its own inverse.  
         [0095]    A 32-bit data block input in the data transformation unit  210   a  is divided into the higher-order 16-bit data and the lower-order 16-bit data, and then input in the data shuffle unit  300   a.  The data shuffle unit  300   a  shuffles these two sets of 16-bit data and outputs them to the data shuffle unit  300   b.  The data shuffle unit  300   b  shuffles the two sets of 16-bit data and outputs them to the data shuffle unit  300   c.  The data shuffle unit  300   c  shuffles the two sets of 16-bit data and outputs them. The higher-order 16-bit data and the lower-order 16-bit data output from the data shuffle unit  300   c  are transposed (i.e. exchanged in position) and then connected to form a 32-bit data block. This 32-bit data block is the output data of the data transformation unit  210   a.    
         [0096]    The data transformation units  210   b - 210   h  have the same construction as the data transformation unit  210   a,  so that their explanation has been omitted here.  
         [0097]    (Construction of the Data Shuffle Unit  300   a )  
         [0098]    [0098]FIG. 7 shows a construction of the data shuffle unit  300   a.    
         [0099]    In the drawing, the data shuffle unit  300   a  includes a data substitution unit  301  and a data combination unit  302 . Here, the higher-order 16-bit data and the lower-order 16-bit data input in the data shuffle unit  300   a  are denoted respectively as first input data F 0  and second input data F 1 . Also, the higher-order 16-bit data and the lower-order 16-bit data output from the data shuffle unit  300   a  are denoted respectively as first output data H 0  and second output data H 1 . This being so, first input data F 0  is input in the data combination unit  302 , whilst second input data F 1  is output as first output data H 0  and at the same time is input in the data substitution unit  301 .  
         [0100]    The data substitution unit  301  performs data substitution on second input data F 1  and outputs the outcome as 16-bit data G. 16-bit data G is input in the data combination unit  302 .  
         [0101]    The data combination unit  302  performs a bitwise exclusive-OR operation on 16-bit data G and first input data F 0 , and outputs the result as second output data H 1 .  
         [0102]    The data shuffle units  300   b  and  300   c  have the same construction as the data shuffle unit  300   a,  so that their explanation has been omitted here.  
         [0103]    (Construction of the Data Substitution Unit  301 )  
         [0104]    [0104]FIG. 8 shows a construction of the data substitution unit  301 .  
         [0105]    In the drawing, the data substitution unit  301  includes table substitution units  401   a  and  401   b.  Second input data F 1  input in the data substitution unit  301  is divided into the higher-order 8-bit data and the lower-order 8-bit data. The higher-order 8-bit data and the lower-order 8-bit data are then input in the table substitution units  401   a  and  401   b  respectively.  
         [0106]    Each of the table substitution units  401   a  and  401   b  has a substitution table in which different 8-bit data is stored in each of  256  locations. When 8-bit data is input, each of the table substitution units  401   a  and  401   b  reads 8-bit data stored in a location indicated by the input 8-bit data, and outputs the read 8-bit data. Note here that the table substitution units  401   a  and  401   b  have the same substitution table. A specific example of such a table is 256×8-bit data described in S. Moriai et al. “Constructing an S-box in Consideration of Security against Known Block Cipher Attacks”  Technical Report of the Proceeding of the Institute of Electronics, Information and Communication Engineers,  ISEC98-13.  
         [0107]    The data substitution unit  301  connects the 8-bit data output from the table substitution unit  401   a  and the 8-bit data output from the table substitution unit  401   b,  and outputs the result to the data combination unit  302  as 16-bit data G.  
         [0108]    (Construction of the First Data Diffusion Unit  230 )  
         [0109]    [0109]FIG. 9 shows a construction of the first data diffusion unit  230  shown in FIG. 5. In the drawing, the first data diffusion unit  230  includes ten exclusive-OR units  501  to  510 .  
         [0110]    The first data diffusion unit  230  receives 32-bit data block I 0  from the data transformation unit  210   a  through the switch unit  220 . The first data diffusion unit  230  also receives 32-bit data block I 1  from the data transformation unit  210   b  through the switch unit  220 . The first data diffusion unit  230  also receives 32-bit data block  12  from the data transformation unit  210   c  through the switch unit  220 . The first data diffusion unit  230  also receives 32-bit data block I 3  from the data transformation unit  210   d  through the switch unit  220 . Furthermore, the first data diffusion unit  230  receives a 128-bit partial key from the key control unit  201 , and divides it into four sets of 32-bit key data starting from the most significant bit. Here, the four sets of 32-bit key data are denoted by K 0 , K 1 , K 2 , and K 3  in the order in which they were divided.  
         [0111]    The exclusive-OR unit  501  receives I 0  and K 0 , and performs a bitwise exclusive-OR operation on I 0  and K 0 . The exclusive-OR unit  501  outputs the result to the exclusive-OR units  505  and  509 .  
         [0112]    The exclusive-OR unit  502  receives I 1  and K 1 , and performs a bitwise exclusive-OR operation on I 1  and K 1 . The exclusive-OR unit  502  outputs the result to the exclusive-OR unit  505 .  
         [0113]    The exclusive-OR unit  503  receives I 2  and K 2 , and performs a bitwise exclusive-OR operation on I 2  and K 2 . The exclusive-OR unit  503  outputs the result to the exclusive-OR unit  506 .  
         [0114]    The exclusive-OR unit  504  receives I 3  and K 3 , and performs a bitwise exclusive-OR operation on I 3  and K 3 . The exclusive-OR unit  504  outputs the result to the exclusive-OR units  506  and  510 .  
         [0115]    The exclusive-OR unit  505  receives the calculation result of the exclusive-OR unit  501  and the calculation result of the exclusive-OR unit  502 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  505  outputs the result to the exclusive-OR units  507  and  508 .  
         [0116]    The exclusive-OR unit  506  receives the calculation result of the exclusive-OR unit  503  and the calculation result of the exclusive-OR unit  504 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  506  outputs the result to the exclusive-OR unit  507 .  
         [0117]    The exclusive-OR unit  507  receives the calculation result of the exclusive-OR unit  505  and the calculation result of the exclusive-OR unit  506 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  507  outputs the result to the exclusive-OR units  508  and  510 , and at the same time outputs the result as output data J 2 .  
         [0118]    The exclusive-OR unit  508  receives the calculation result of the exclusive-OR unit  505  and the calculation result of the exclusive-OR unit  507 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  508  outputs the result to the exclusive-OR unit  509 , and at the same time outputs the result as output data J 1 .  
         [0119]    The exclusive-OR unit  509  receives the calculation result of the exclusive-OR unit  501  and the calculation result of the exclusive-OR unit  508 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  509  outputs the result as output data J 0 .  
         [0120]    The exclusive-OR unit  510  receives the calculation result of the exclusive-OR unit  504  and the calculation result of the exclusive-OR unit  507 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  510  outputs the result as output data J 3 .  
         [0121]    In sum, output data J 0 , J 1 , J 2 , and J 3  can be expressed as follows: 
           J   0 = K   0 (+) K   2 (+) K   3 (+) I   0 (+) I   2 (+) I   3   (Equation 1) 
           J   1 = K   2 (+) K   3 (+) I   2 (+) I   3   (Equation 2) 
           J   2 = K   0 (+) K   1 (+) K   2 (+) K   3 (+) I   0 (+) I   1 (+) I   2 (+) I   3   (Equation 3) 
           J   3 = K   0 (+) K   1 (+) K   2 (+) I   0 (+) I   1 (+) I   2   (Equation 4) 
         [0122]    where (+) denotes a bitwise exclusive-OR operation.  
         [0123]    The first data diffusion unit  230  performs the above processing, each time it receives four 32-bit data blocks from the data transformation units  210   a - 210   d  and a 128-bit partial key from the key control unit  201 .  
         [0124]    The first data scramble unit  202  connects J 0 , J 1 , J 2 , and J 3  output from the first data diffusion unit  230  in this order, and outputs the resulting 128-bit partial data.  
         [0125]    (Construction of the Second Data Diffusion Unit  240 )  
         [0126]    [0126]FIG. 10 shows a construction of the second data diffusion unit  240  shown in FIG. 5.  
         [0127]    In the drawing, the second data diffusion unit  240  includes ten exclusive-OR units  601  to  610 .  
         [0128]    The second data diffusion unit  240  receives 32-bit data block L 0  from the data transformation unit  210   a  through the switch unit  220 . The second data diffusion unit  240  also receives 32-bit data block L 1  from the data transformation unit  210   b  through the switch unit  220 . The second data diffusion unit  240  also receives 32-bit data block L 2  from the data transformation unit  210   c  through the switch unit  220 . The second data diffusion unit  240  also receives 32-bit data block L 3  from the data transformation unit  210   d  through the switch unit  220 . Furthermore, the second data diffusion unit  240  receives a 128-bit partial key from the key control unit  201 , and divides it into four sets of 32-bit key data starting from the most significant bit. Here, the four sets of 32-bit key data are denoted by K 0 , K 1 , K 2 , and K 3  in the order in which they were divided.  
         [0129]    The exclusive-OR unit  601  receives L 0  and L 1 , and performs a bitwise exclusive-OR operation on L 0  and L 1 . The exclusive-OR unit  601  outputs the result to the exclusive-OR units  605  and  610 .  
         [0130]    The exclusive-OR unit  602  receives L 2  and L 3 , and performs a bitwise exclusive-OR operation on L 2  and L 3 . The exclusive-OR unit  602  outputs the result to the exclusive-OR units  606  and  607 .  
         [0131]    The exclusive-OR unit  603  receives L 1  and L 2 , and performs a bitwise exclusive-OR operation on L 1  and L 2 . The exclusive-OR unit  603  outputs the result to the exclusive-OR units  604  and  605 .  
         [0132]    The exclusive-OR unit  604  receives L 2  and the calculation result of the exclusive-OR unit  603 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  604  outputs the result to the exclusive-OR unit  606 .  
         [0133]    The exclusive-OR unit  605  receives the calculation result of the exclusive-OR unit  601  and the calculation result of the exclusive-OR unit  603 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  605  outputs the result to the exclusive-OR unit  609 .  
         [0134]    The exclusive-OR unit  606  receives the calculation result of the exclusive-OR unit  602  and the calculation result of the exclusive-OR unit  604 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  606  outputs the result to the exclusive-OR unit  608 .  
         [0135]    The exclusive-OR unit  607  receives K 3  and the calculation result of the exclusive-OR unit  602 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  607  outputs the result as output data M 3 .  
         [0136]    The exclusive-OR unit  608  receives K 2  and the calculation result of the exclusive-OR unit  606 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  608  outputs the result as output data M 2 .  
         [0137]    The exclusive-OR unit  609  receives K 1  and the calculation result of the exclusive-OR unit  605 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  609  outputs the result as output data M 1 .  
         [0138]    The exclusive-OR unit  610  receives K 0  and the calculation result of the exclusive-OR unit  601 , and performs a bitwise exclusive-OR operation on these two values. The exclusive-OR unit  610  outputs the result as output data M 0 .  
         [0139]    In sum, output data M 0 , M 1 , M 2 , and M 3  can be expressed as follows: 
           M   0 = K   0 (+) L   0 (+) L   1   (Equation 5) 
           M   1 = K   1 (+) L   0 (+) L   2   (Equation 6) 
           M   2 = K   2 (+) L   1 (+) L   2 (+) L   3   (Equation 7) 
           M   3 = K   3 (+) L   2 (+) L   3   (Equation 8) 
         [0140]    where (+) denotes a bitwise exclusive-OR operation.  
         [0141]    The second data diffusion unit  240  performs the above processing, each time it receives four 32-bit data blocks from the data transformation units  210   a - 210   d  and a 128-bit partial key from the key control unit  201 .  
         [0142]    The first data scramble unit  202  connects M 0 , M 1 , M 2 , and M 3  output from the second data diffusion unit  240  in this order, and outputs the resulting 128-bit partial data.  
         [0143]    (Relationship between Encryption and Decryption)  
         [0144]    The following explains the relationship between encryption and decryption performed by the encryption/decryption unit  106 .  
         [0145]    The transformation performed by each of the data transformation units  210   a - 210   d  shown in FIG. 5 and the transformation performed by each of the data transformation units  210   e - 210   h  shown in FIG. 4 are the exact same transformation. This transformation is an involution.  
         [0146]    Let  
         [0147]    Y=F(X)  
         [0148]    denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, performing the above data transformation on each of these data blocks, and connecting the resulting data blocks as 128-bit data Y. Since the data transformation is an involution, 
           X=F ( F ( X) )  (Equation 9) 
         [0149]    holds true.  
         [0150]    Next, suppose the output of the first data diffusion unit  230  and the input of the second data diffusion unit  240  are equal to each other, and also the partial key used by the first data diffusion unit  230  and the partial key used by the second data diffusion unit  240  are equal to each other. Which is to say, suppose J 0 =L 0 , J 1 =L 1 , J 2 =L 2 , J 3 =L 3  in Equations 1-8, with K 0 -K 3  in Equations 1-4 being the same as K 0 -K 3  in Equations 5-8. This being so, M 0 -M 3  output from the second data diffusion unit  240  can be written as 
           M   0 = K   0 (+) J   0 (+) J   1   (Equation 10) 
           M   1 = K   1 (+) J   0 (+) J   2   (Equation 11) 
           M   2 = K   2 (+) J   1 (+) J   2 (+) J   3   (Equation 12) 
           M   3 = K   3 (+) J   2 (+) J   3   (Equation 13) 
         [0151]    Substituting Equations 1-4 into Equations 10-13 yields  
         [0152]    M 0 =I 0   
         [0153]    M 1 =I 1   
         [0154]    M 2 =I 2   
         [0155]    M 3 =I 3   
         [0156]    This indicates that, given the same partial key, the second data diffusion unit  240  is the inverse of the first data diffusion unit  230 .  
         [0157]    Let  
         [0158]    Y=G 1 (K,X)  
         [0159]    denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, inputting the data blocks into the first data diffusion unit  230  together with partial key K, and connecting the resulting data blocks as 128-bit data Y. Also, let  
         [0160]    Y=G 2 (K,X)  
         [0161]    denote an operation of dividing 128-bit data X into 32-bit data blocks starting from the most significant bit, inputting the data blocks into the second data diffusion unit  240  together with partial key K, and connecting the resulting data blocks as 128-bit data Y. This being so, 
           X=G   2 ( K,G   1 ( K,X ))  (Equation 14) 
         [0162]    holds true, due to the inverse relationship between the first data diffusion unit  230  and the second data diffusion unit  240 .  
         [0163]    Based on the above, the relationship between encryption and decryption performed by the encryption/decryption unit  106  in the reception device  10  is explained below.  
         [0164]    The encryption/decryption unit  106  computes 128-bit ciphertext C from 128-bit plaintext P, as follows. 
           T   0 = G   1 ( K   0 , F ( P ))  (Equation 15) 
           T   1 = G   1 ( K   1 , F ( T   0 ))  (Equation 16) 
           T   2 = G   1 ( K   2 , F ( T   1 ))  (Equation 17) 
           T   9 = G   1 ( K   9 , F ( T   8 ))  (Equation 18) 
           C=F ( T   9 )  (Equation 19) 
         [0165]    On the other hand, the encryption/decryption unit  106  computes 128-bit decrypted text D from such computed ciphertext C, as follows. Here, the same key data K 0 -K 9  are used in the encryption and the decryption. 
           U   0 = G   2 ( K   9 , F ( C ))  (Equation 20) 
           U   1 = G   2 ( K   8 , F ( U   0 ))  (Equation 21) 
           U   2 = G   2 ( K   7 , F ( U   1 ))  (Equation 22) 
           U   9 = G   2 ( K   0 , F ( U   8 ))  (Equation 23) 
           D=F ( U   9 )  (Equation 24) 
         [0166]    Substituting Equation 19 Equation 20 yields  
         [0167]    U 0 =G 2 (K 9 ,F(F(T 9 )))  
         [0168]    This can be transformed into  
         [0169]    U 0 =G 2 (K 9 ,T 9 )  
         [0170]    according to Equation 9.  
         [0171]    Next, substituting Equation 18 into this equation yields  
         [0172]    U 0 =G 2 (K 9 ,G 1 (K 9 ,F(T 8 )))  
         [0173]    This can be transformed into  
         [0174]    U 0 =F(T 8 )  
         [0175]    according to Equation 14.  
         [0176]    Substituting this equation into Equation 21 yields  
         [0177]    U 1 =G 2 (K 8 ,T 8 )  
         [0178]    Repeating the same equation transformation will eventually result in  
         [0179]    P=D  
         [0180]    This indicates that, given the same key, the decryption performed by the encryption/decryption unit  106  is the inverse of the encryption performed by the encryption/decryption unit  106 .  
         [0181]    (Decryption of Ciphertext Data C 2 )  
         [0182]    Accordingly, the encryption/decryption unit  106  can decrypt ciphertext data C 2 , which it has generated by encrypting plaintext data P using key data K 2 , into plaintext data P by performing the same operation as the above decryption of ciphertext data C 1  while using key data K 2  instead of key data K 1 .  
         [0183]    In more detail, the switch unit  220  in the encryption/decryption unit  106  sets the flag to “1”, in accordance with an instruction from the control unit  105 . Also, the input/output unit  107  reads ciphertext data C 2  from the recording medium  11  and outputs it to the encryption/decryption unit  106 , in accordance with an instruction from the control unit  105 . The control unit  105  reads key data K 2  from the key storage unit  104  and outputs it to the encryption/decryption unit  106 .  
         [0184]    The encryption/decryption unit  106  receives ciphertext data C 2  and key data K 2 . In the same manner as the aforedescribed decryption of ciphertext data C 1  into plaintext data P, the encryption/decryption unit  106  subjects ciphertext data C 2  to the processing of the first data scramble unit  202  using key data K 2 , and then subjects the outcome to the processing of the second data scramble unit  204 . As a result, plaintext data P is obtained. Since the flag in the switch unit  220  is set at “1”, the second data diffusion unit  240  is used in the first data scramble unit  202 .  
         [0185]    (7) Input/Output Unit  107   
         [0186]    The input/output unit  107  is actually realized by a DVD-RAM drive unit. Here, the recording medium  11  is a DVD-RAM. The input/output unit  107  writes digital content onto the recording medium  11 , or reads digital content from the recording medium  11 .  
         [0187]    2. Operation of the Reception Device  10  (Overall Operation)  
         [0188]    An operation of the reception device  10  is explained below, by referring to FIGS.  11  to  13 .  
         [0189]    [0189]FIG. 11 is a flowchart showing an overall operation of the reception device  10 .  
         [0190]    The reception unit  101  receives ciphertext data C 1  from the content delivery device  12 , via the broadcast satellite  13  and the antenna  108  (S 101 ). Here, ciphertext data C 1  has been generated by encrypting plaintext data P that is digital content. The reception unit  101  outputs ciphertext data C 1  to the data storage unit  102 . The data storage unit  102  stores ciphertext data C 1  (S 102 ).  
         [0191]    The key input unit  103  receives an input of key data K 1  that is a decryption key for decrypting ciphertext data C 1  into plaintext data P. The key input unit  103  outputs key data K, to the key storage unit  104 . The key storage unit  104  stores key data K 1  (S 103 ).  
         [0192]    The encryption/decryption unit  106  decrypts ciphertext data C 1  into plaintext data P, using key data K 1  (S 104 ).  
         [0193]    Following this, the key input unit  103  receives an input of key data K 2  that is an encryption key for re-encrypting plaintext data P, which has been decrypted by the encryption/decryption unit  106 , into ciphertext data C 2 . The key input unit  103  outputs key data K 2  to the key storage unit  104 . The key storage unit  104  stores key data K 2  (S 105 ).  
         [0194]    The encryption/decryption unit  106  encrypts plaintext data P into ciphertext data C 2 , using key data K 2  (S 106 ).  
         [0195]    The input/output unit  107  writes ciphertext data C 2  onto the recording medium  11  (S 107 ).  
         [0196]    (Decryption)  
         [0197]    [0197]FIG. 12 is a flowchart showing the decryption performed in step S 104  in FIG. 11. Since the encryption/decryption unit  106  performs decryption in units of 128 bits, the size of ciphertext data C 1  is assumed here to be 128 bits for ease of explanation.  
         [0198]    The control unit  105  reads 128-bit ciphertext data C 1  from the data storage unit  102 , and outputs it to the first data scramble unit  202  in the encryption/decryption unit  106  (S 201 ). The control unit  105  also reads 1280-bit key data K 1  from the key storage unit  104 , and outputs it to the key control unit  201  in the encryption/decryption unit  106 . The key control unit  201  divides key data K 1  starting from the most significant bit, into ten 128-bit partial keys (S 202 ). The key control unit  201  outputs the ten 128-bit partial keys one by one to the first data scramble unit  202 , in the order in which they were divided. The first data scramble unit  202  processes 128-bit ciphertext data C 1  using a partial key (S 203 ). The round control unit  203  in the encryption/decryption unit  106  judges whether the number of times the first data scramble unit  202  has performed the processing reaches ten (S 204 ). If the number is below ten (S 204 :NO), the procedure returns to step S 203  where 128-bit data output from the first data scramble unit  202  is input again in the first data scramble unit  202 . If the number reaches ten (S 204 :YES), 128-bit data output from the first data scramble unit  202  is input in and processed by the second data scramble unit  204  (S 205 ).  
         [0199]    Though the operation of decrypting 128-bit ciphertext data C 1  is explained in this example, in reality the size of ciphertext data C 1  is likely to be more than 128 bits. In such a case, the above operation is repeated in units of 128 bits, until all of ciphertext data C 1  are decrypted.  
         [0200]    (Encryption)  
         [0201]    [0201]FIG. 13 is a flowchart showing the encryption performed in step S 106  in FIG. 11. Since the encryption/decryption unit  106  performs encryption in units of 128 bits, the size of plaintext data P is assumed here to be 128 bits for ease of explanation.  
         [0202]    The control unit  105  reads 128-bit plaintext data P from the data storage unit  102 , and outputs it to the first data scramble unit  202  in the encryption/decryption unit  106  (S 301 ). The control unit  105  also reads 1280-bit key data K 2  from the key storage unit  104 , and outputs it to the key control unit  201  in the encryption/decryption unit  106 . The key control unit  201  divides key data K 2  starting from the most significant bit, into ten 128-bit partial keys (S 302 ). The key control unit  201  outputs the ten 128-bit partial keys one by one to the first data scramble unit  202 , in the order in which they were divided. The first data scramble unit  202  processes 128-bit plaintext data P using a partial key (S 303 ). The round control unit  203  in the encryption/decryption unit  106  judges whether the number of times the first data scramble unit  202  has performed the processing reaches ten (S 304 ). If the number is below ten (S 304 :N 0 ), the procedure returns to step S 303  where 128-bit data output from the first data scramble unit  202  is input again in the first data scramble unit  202 . If the number reaches ten (S 304 :YES), 128-bit data output from the first data scramble unit  202  is input in and processed by the second data scramble unit  204  (S 305 ).  
         [0203]    Though the operation of encrypting 128-bit plaintext data P is explained in this example, in reality the size of plaintext data P is likely to be more than 128 bits. In such a case, the above operation is repeated in units of 128 bits until all of plaintext data P are encrypted.  
         [0204]    3. Construction of the Content Delivery Device  12   
         [0205]    The content delivery device  12  is actually realized by a digital broadcast device. The content delivery device  12  broadcasts encrypted digital content which is superimposed on a digital broadcast wave, via the broadcast satellite  13 . The encrypted digital content referred to here is ciphertext data C 1  received by the reception device  10 .  
         [0206]    The content delivery device  12  has an encryption/decryption unit which is identical to the encryption/decryption unit  106  in the reception device  10 . This being so, the content delivery device  12  encrypts plaintext data P into ciphertext data C 1  using 1280-bit key data K 1 , and transmits ciphertext data C 1  to the reception device  10  through the broadcast satellite  13 .  
         [0207]    4. Modifications  
         [0208]    The present invention has been described by way of the above embodiment, though it should be obvious that the invention is not limited to the above. Example modifications are given below.  
         [0209]    (1) The above embodiment describes the case where digital content is transmitted by satellite digital broadcasting, but the invention is not limited to such. The digital content may equally be transmitted through the Internet, a mobile phone network, a cable television network, a terrestrial digital broadcast network, or a recording medium such as a DVD.  
         [0210]    (2) Examples of digital content described in the above embodiment include digitized movie films, music, still images, moving images, software games, computer programs, and other various data.  
         [0211]    (3) The above embodiment describes the case where each data transformation unit has the construction shown in FIGS. 6, 7, and  8 , but this is not a limit for the invention. Each data transformation unit may have another construction so long as it performs an involution.  
         [0212]    (4) The above embodiment describes the case where the first data diffusion unit  230  and the second data diffusion unit  240  have the constructions shown in FIGS. 9 and 10 respectively, but this is not a limit for the invention. The first data diffusion unit  230  and the second data diffusion unit  240  may have other constructions so long as they have an inverse relationship.  
         [0213]    (5) In the above embodiment, plaintext data P, ciphertext data C 1 , and ciphertext data C 2  may have any data size.  
         [0214]    The encryption/decryption unit  106  performs encryption and decryption in units of 128 bits. Accordingly, in each of the decryption of ciphertext data C 1  into plaintext data P, the encryption of plaintext data P into ciphertext data C 2 , and the decryption of ciphertext data C 2  into plaintext data P, the control unit  105  controls the encryption/decryption unit  106  to repeat processing in units of 128 bits until the whole data is processed.  
         [0215]    (6) The above embodiment describes the case where key data K 1  and key data K 2  are each 1280 bits long, but this may be modified in such a way as to generate 1280-bit data from key data smaller than 1280 bits using a random number generator.  
         [0216]    (7) The above embodiment describes the case where the data transformation units, the first data diffusion unit  230 , and the second data diffusion unit  240  each perform processing in units of 32 bits, but the processing data size should not be limited to such. One specific example of this is explained below, with reference to FIGS. 14 and 15.  
         [0217]    [0217]FIG. 14 shows a data shuffle unit  350 . This data shuffle unit  350  includes a data substitution unit  311  and a data combination unit  312 , like the data shuffle unit  300   a.  However, the data shuffle unit  350  differs from the data shuffle unit  300   a  in that data is processed in units of 64 bits.  
         [0218]    64-bit data input in the data shuffle unit  350  is divided into the higher-order 32-bit data and the lower-order 32-bit data. The higher-order 32-bit data is input in the data combination unit  312 , whilst the lower-order 32-bit data is input in the data substitution unit  311  and at the same time is output as the higher-order 32 bits of the output data of the data shuffle unit  350 . The data substitution unit  311  includes table substitution units  501   a  and  501   b,  as shown in FIG. 15. The higher-order 16 bits of the 32-bit data are input in the table substitution unit  501   a,  whereas the lower-order 16 bits are input in the table substitution unit  501   b.  The table substitution units  501   a  and  501   b  each perform data substitution using a substitution table. Resulting 32-bit data output from the data substitution unit  311  is then input in the data combination unit  312 . The data combination unit  312  performs a bitwise exclusive-OR operation on the higher-order 32-bit data and the 32-bit data output from the data substitution unit  311 , and outputs the result as the lower-order 32 bits of the output data of the data shuffle unit  350 .  
         [0219]    According to this construction, the invention can be applied to a machine equipped with a 64-bit CPU.  
         [0220]    (8) In the above embodiment, the operation of each data transformation unit in the first data scramble unit  202  may be repeated a plurality of times. Also, the operation of the first data diffusion unit  230  or second data diffusion unit  240  in the first data scramble unit  202  may be repeated a plurality of times.  
         [0221]    (9) The invention also applies to the method described above. This method may be realized by a computer program that is executed by a computer. Such a computer program may be distributed as a digital signal.  
         [0222]    The invention may also be realized by a computer-readable storage medium, such as a floppy disk, a hard disk, a CD-ROM (Compact Disc-Read Only Memory), an MO (Magneto-Optical) disc, a DVD (Digital Versatile Disc), a DVD-ROM, a DVD-RAM, or a semiconductor memory, on which the computer program or digital signal mentioned above is recorded. Conversely, the invention may also be realized by the computer program or digital signal that is recorded on such a storage medium.  
         [0223]    The computer program or digital signal that achieves the invention may also be transmitted via a network, such as an electronic communications network, a wired or wireless communications network, or the Internet.  
         [0224]    The invention can also be realized by a computer system that includes a microprocessor and a memory. In this case, the computer program can be stored in the memory, with the microprocessor operating in accordance with this computer program.  
         [0225]    The computer program or digital signal may be provided to an independent computer system by distributing a storage medium on which the computer program or digital signal is recorded, or by transmitting the computer program or digital signal via a network. The independent computer system may then execute the computer program or digital signal to function as the invention.  
         [0226]    (10) The limitations described in the embodiment and the modifications may be freely combined.  
         [0227]    Although the present invention has been fully described by way of examples with reference to the accompanying drawings, it is to be noted that various changes and modifications will be apparent to those skilled in the art.  
         [0228]    Therefore, unless such changes and modifications depart from the scope of the present invention, they should be construed as being included therein.