共通鍵暗号の精密解析に関する研究

1. 实现鲁棒和安全的伪随机数生成器是低成本射频识别（RFID）标签的一个具有挑战性的问题。在本研究中，我们研究了基于lfsr的PRNG在EPC Gen2标签上的安全性，并利用基于lfsr的PRNG提供更好的结构。我们提供了针对J3Gen的密码分析，J3Gen是基于lfsr的PRNG，由Sugei等人提出，用于EPC Gen2标签，使用区分攻击，并使用NIST随机测试对其输入进行观察。我们还使用NIST SP800-22测试了EPC Gen2 RFID标签中的PRNG。作为应对措施，我们根据安全分析结果提出了两个修正模型。结果表明，我们的结果在计算和统计性能方面优于J3Gen。积分攻击可以看作是统计饱和攻击的确定性版本，它是通过跟踪经过若干轮加密后的积分集的性质来实现的。在第二项研究中，我们首次研究了如何利用积分攻击并利用统计方法将其应用于密码分析。我们的贡献之一是首次将集合的内部碰撞作为评估统计量，并展示了该性质如何在具有双射映射S-Box的一般费斯特尔结构（GFS）中有效地传播。其次，我们提供了一个简单的统计框架来评估数据的复杂性。最后，我们对几种GFS进行了评估，并发现对于某些设计，我们的方法与其他统计攻击相比提供了更好的结果。

1. To implement robust and secure pseudo-random number generators (PRNG) is a challenging issue for low-cost Radio-frequency identification (RFID) tags. In this first research, we study the security of LFSR-based PRNG implemented on EPC Gen2 tags and exploit LFSR-based PRNG to provide a better constructions. We provide a cryptanalysis against the J3Gen which is LFSR-based PRNG and proposed by Sugei et al. for EPC Gen2 tags using distinguish attack and make observations on its input using NIST randomness test. We also test the PRNG in EPC Gen2 RFID Tags by using the NIST SP800-22. As a counter-measure, we propose two modified models based on the security analysis results. We show that our results perform better than J3Gen in terms of computational and statistical property.2. Integral attack can be considered as the deterministic version of the statistical saturation attack,which works by tracing the properties of the integral sets after certain rounds of encryption.In this second research, we provide the first study on how to take advantage of the integral attack and apply it to cryptanalysis by using statistical approach. One of our contributions is to firstly apply the internal collision of a set as the evaluated statistics and show how this property can be efficiently propagated in the General Feistel Structure (GFS) with bijective map S-Box. Secondly, we provide a simple statistical framework to evaluate the data complexity. Finally, we evaluate several GFS and find out for some of the designs, our approach provide a better result compared with other statistical attack.