Patent ID: 7359515

Claim:
A symmetric-key decryption apparatus, which is alteration-detectable, comprising: a circuit for inputting a ciphertext C, which is an encrypted text of a plaintext P by using a secret key K, said plaintext P including a message M and data Z for use in alteration detection, to produce a series of ciphertext blocks C′ i (1<=i<=n) divided in a predetermined length; and a decryption arithmetic circuit for generating a series of plaintext blocks P′ i (1<=i<=n ) corresponding to said series of ciphertext blocks C′ i , wherein said decryption arithmetic circuit, which inputs both a first random number block and a second random number block generated corresponding to at least one of said ciphertext blocks in a manner independent of a result of said decryption arithmetic circuit, comprises: a first circuit for performing a first arithmetic computation on one of said ciphertext blocks; a second circuit for performing a second arithmetic computation on a result of said first arithmetic computation by said first circuit and said first random number block; and a third circuit for performing a third arithmetic computation on a result of said second arithmetic computation by said second circuit and said second random number block, to output a result of said third arithmetic computation as said plaintext block corresponding to said ciphertext block, wherein said first circuit performs said first arithmetic computation on one of said ciphertext blocks and the result of said second arithmetic computation said second circuit has produced on another of said ciphertext blocks, and wherein said decryption arithmetic circuit, based on said secret key, generates a series of plaintext blocks P′ i in such a manner that influence of an alteration made to any of said ciphertext blocks C′ i would be propagated up to data Z′ for use in alteration detection, judging that a message M′ included in said plaintext blocks P′ i is not altered if a series of said data Z′ extracted from said plaintext blocks P i is the same as a series of predetermined said data Z included in said plaintext P, while judging that said message M′ is altered if said data Z′ is otherwise.