Patent ID: 8340282

Claim:
A cryptography processing apparatus adapted to perform a cryptographic process, the apparatus comprising: a processor; and a non-transitory computer-readable memory comprising instructions for carrying out the functions of: a nonlinear transformation process including a plurality of nonlinear transformation layers each having an input and an output of a plurality of bits, and a linear transformation process, wherein the linear transformation process uses matrices satisfying a constraint condition, wherein: the input to the nonlinear transformation process has a length of 2m×n bits, where m and n are integers, the output from the nonlinear transformation layers has a length of m×n bits, the linear transformation process transforms the output of the nonlinear transformation layers using an F-function in each of r rounds, and the F-function performs the linear transformation process according to a matrix M i , where the matrix M i is a m×m square matrix whose elements are on an extension field of degree 2, GF(2 n ), defined by an irreducable polynomial of degree n, and wherein the constraint condition imposed on matrices used in the linear transformation process is given as follows: when parameters are defined such that for a matrix M i implementing a mapping θ: {0, 1} na →{0, 1} nb which performs a linear transformation from n×a bit data into n×b-bit data in the linear transformation process using the F-function in each of r rounds, the number of branches B(θ) is defined by B (θ)=min α≠0 {hw n (α)+ hw n (θ(α))} where min α≠0 {X α } denotes a minimum value of all values of X α satisfying α≠0, and hw n (Y) is a function which splits a given bit string Y into n-bit elements and returns the number of non-zero elements including at least one non-zero bit, a mapping θ satisfying B(θ)=b+1 is defined as an optimal diffusion mapping, where B(θ) is the number of branches defined above, and BD 1 and BD 2 are defined by BD 1 =min{ B ( M i )|1 ≦i≦r} BD 2 =min{ B ( M i |M i+2 )|1 ≦i≦r− 2} where B(M) denotes the number of branches of a matrix M, and A|B denotes a matrix obtained by connecting matrices A and B, and the matrix M i is determined so that BD 1 and BD 2 are both equal to or greater than 3.