JPH06282226A - Elliptic curve-based public-key cipher system - Google Patents

Abstract

PURPOSE:To provide an elliptic curve-based public-key enciphering system having much enhanced safety by eliminating a limit to the prime factor of a parameter. CONSTITUTION:An arbitrary prime factor is first selected and an enciphering key corresponding to the factor is registered with a public file device 10. Then, a decoding key list corresponding to the factor and the enciphering key is generated and saved in a decoding device 40, together with the factor. Thereafter, an enciphering device 30 receives the public-key of a receiver (decoding device) from the public file device 10, and performs the multiplication of a plain text on an elliptic curve. Then, the device 30 sends the multiplied value as a cryptotext to the decoding device 40. This device 40 calculates an elliptic curve parameter from the cryptotext and selects such a decoding key as corresponding to the parameter, using the decoding key list. Then, the plain text is obtained from the multiplied value of the cryptotext on the elliptical curve, using a remainder theorem.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an elliptic curve-based public key cryptosystem, and more particularly to an elliptic curve-based cryptosystem and cipher on a finite monoid in the cryptosystem for transmitting a digitized document. The present invention relates to an elliptic curve-based public key cryptosystem in a key generation device, an encryption device, and a decryption device used in the system.

[0002]

2. Description of the Related Art Public key cryptography (KMOV method) based on an elliptic curve was proposed in 1990. This KMOV system is based on the security of the difficulty of factorizing the parameter n (= pq). The KMOV method is
There is a restriction that the prime numbers p and q of the parameters must be p≡q≡2 (mod 3) or p≡q≡3 (mod 4).

[0003]

However, the conventional public-key cryptosystem uses the KMOV system as the cryptosystem, but since the prime factor of n of the modulus is limited, the encryption is performed within this limit. When the method is applied, there is a problem with the security of the key.

The present invention has been made in view of the above points, and an object thereof is to provide an elliptic curve-based public encryption system in which the security is further improved by eliminating the limitation of the prime number of the parameter.

[0005]

FIG. 1 is a block diagram showing the principle of the present invention. According to the present invention, a public file device 10 that selects arbitrary prime numbers p and q of 5 or more by a receiver and registers public keys e and n corresponding to the prime numbers p and q, and an elliptic curve for prime numbers p and q E _p (0, b): y ² ≡x ³ + b _p (mod
p), E _q (0, b): y ² ≡x ³ + b _q (mod q) An order showing the correspondence between the identifiers and the order showing the relationship between the orders b _p and b _q of the parameter b and the order b. Order table generating means 21 for generating
And a decryption key from the order table generated by the order table generating means 21 and prime numbers p and q, and a decryption key table generation for generating a decryption key table showing the correspondence between the decryption key and the identifier of the order table. Means 24
A key generation device 20 including a plaintext M and a public key e, n of the recipient are input, and the plaintext M is elliptic curve E _n (0,
b _M ): y ² ≡x ³ + b _M (mod n) includes an elliptic curve multiplication means 31 that multiplies based on the public key e, and outputs the ciphertext from the encryption device 30 and the key generation device 20. Storage means 41 for storing the received prime numbers p and q and the decryption key table
And the ciphertext C from the encryption device 30 and the prime numbers p and q, the elliptic curve E _p (0, b _p ): y ² ≡x ³ + b _p (mod
p), E _q (0, b _q ): y ² ≡x ³ + b _q (modq)
Coefficient calculating means 42 for calculating the parameters b _p and b _q of
And a decryption key search unit that retrieves the decryption keys d _p and d _q corresponding to the parameters of the elliptic curve from the decryption key table stored in the storage unit 41, and the ciphertext C input from the encryption device 30 to the ellipse. Elliptic curve multiplication means 45 for multiplying on the curves E _p (0, b _p ) and E _q (0, b _q ) based on the decryption keys d _p and d _q , and the value M obtained by the elliptic curve multiplication means 45.
It has a decoding device including _{p 1} and M _q, and Chinese remainder theorem calculation means 46 that calculates and outputs plaintext M from prime numbers p and q based on the Chinese remainder theorem.

[0006]

According to the present invention, an arbitrary prime number p, q of 5 or more is selected,
The public file device 1 stores the encryption keys e and n corresponding to p and q.
0, generate the decryption key table corresponding to p, q, and e,
The decryption key table is stored in the decryption device together with the prime numbers p and q.
The sender (encryption device) obtains the public key e, n of the receiver (decryption device) from the public file device 10, and the plaintext M = (m
_x, m _y) an elliptic curve _{E n (0, b M)} : y 2 ≡x 3 +
The point C multiplied by e on b _M (mod n) is transmitted to the receiver (decryption device) as a ciphertext C. From the ciphertext C, the receiver (decryption device) uses the elliptic curve E _p (0, b _p ): y ² ≡x ³ + b _p
(Mod p), E _q (0, b _q ): y ² ≡x ³ + b _q (mo
d parameter b _p of q), to calculate the b _q, parameter b _p using the decryption key table, b _q is calculated, and parameter b _p using the decryption key table stored in advance on the decoding apparatus side, b _q
The decryption keys d _p and d _q corresponding to are selected, and the plaintext M is obtained from the points M _p and M _{q obtained} by multiplying the ciphertext C by d _p and d _q with an elliptic curve using the Chinese Remainder Theorem. As a result, the public key cryptosystem is based on an elliptic curve on a finite monoid instead of the conventional KMOV system, and there is no limit to the prime numbers used.
The factorization becomes more difficult than the KMOV method, and the safety becomes higher.

[0007]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 shows the system configuration of an embodiment of the present invention. The system shown in the figure discloses a public file device 10 in which public keys e and n are registered, a public key e and n, a key generation device 20 which generates decryption keys d _p and d _q, and an input plaintext M. The plaintext M is encrypted by the public keys e and n from the file device 10, the ciphertext C is created, and the ciphertext C input from the encryption device 30 and the ciphertext C input from the encryption device 30 are decrypted using the elliptic curve. Decoding device 40 that outputs plaintext M
Composed of.

Before describing the embodiments, the preconditions for the public key cryptosystem of the present invention will be described. The public key cryptosystem in the present invention is based on an elliptic curve on a finite monoid, and there is no limit to the prime numbers used.

First, the symbols relating to the elliptic curve will be described. A set obtained by adding a point at infinity Ο to a set of points satisfying y ² ≡x ³ + ax + b (mod p) for a prime number p and parameters a and b is called an elliptic curve E _n (a, b). In the embodiment of the present invention, an elliptic curve E _n (0, b) whose parameter a is zero (a = 0) is used.

Each device of one embodiment of the present invention will be described below. 1. Public File Device The public file device 10 depends on the recipient (decryption device) 5
The above arbitrary prime numbers p and q are selected, and the encryption keys (public keys) e and n corresponding to these prime numbers are registered.

2. Key Generation Device FIG. 3 shows the configuration of a key generation device according to an embodiment of the present invention. The decryption key generation device 24 shown in the figure includes a prime number generator 241, an order table generation devices 242 and 243, and a decryption key table generation device 24.
It is composed of 4. The prime number generator 241 generates prime numbers p and q, and inputs the prime number p to the order table generating device 242 and the prime number q to the order table generating device 243.

(1) Order table generation device Here, each of the order table generation devices 242 and 243 creates a order table from the prime number generator 241 using prime numbers p and q. The order table generating device 242 associates the order with the identifier indicating the relationship between the order of the elliptic curve E _p (0, b): y ² ≡x ³ + b (mod p) and the parameter b with respect to the prime number p. To generate a table of orders. If the prime number p is p≡2 (mod 3), the order table generated by the order table generator 242 is

[0014]

[Table 1]

[0015] The order table generator 242 outputs this order table to the decryption key table generator 245.

The order table generator 243 uses an identifier indicating the relationship between the order of the elliptic curve E _q (0, b): y ² ≡x ³ + b (mod q) and the parameter b with respect to the prime number q. A table of orders showing the correspondence of the orders is generated. If the prime number q is q≡2 (mod 3), the order table generated by the order table generator 243 is

[0017]

[Table 2]

Then, the order table generator 243 outputs this order table to the decryption key generator 245.

Here, the order table generators 242 and 243 obtain an integer π = α-βω on the quadratic field Z [ω] satisfying p = ππ ′ and π≡2 (mod 3). At this time, the order table generators 242 and 243 generate the following order tables.

[0020]

[Table 3]

The order table generators 242 and 243 output this order table to the decryption key generator 245, and the operation ends.

(2) Decryption Key Table Generation Device Next, the decryption key table generation device 245 calculates the public keys e and n from the two prime numbers p and q and the order table of each prime number, and generates the decryption key table. Then, the public keys e and n and the decryption key table are output.

FIG. 4 is a diagram for explaining the decryption key table generation device of the key generation device of one embodiment of the present invention. The decryption key table generator 245 uses the decryption key generators 1 to 3 that are used by inputting the prime numbers p and q.

First, when the prime numbers p and q are p≡q≡2 (mod 3), the prime numbers p and q and their order tables are input to the decryption key generating apparatus 1 to enable the decryption key generating apparatus 1 to operate. The output is used as it is as the output of the decryption key generation device 245, and the process is ended.

Specifically, the decryption key generating apparatus 1 is provided with prime numbers p and q and a rank table of the prime numbers p and q as inputs. Here, the decryption key generation device 1 randomly sets the public key e such that gcd (e, p + 1) = gcd (e, q + 1) = 1. Then, the decryption keys d _p0 and d _q0 satisfying the following equation are calculated. e ・ d _p0 ≡1 (mod p), e ・ d _q0 ≡1 (mod
q). As a result, the decryption key table output by the decryption key generation device 1 is

[0026]

[Table 4]

[0027] However, in these tables, the item in the left column represents the identifier, and the item in the right column represents the decryption key corresponding to the identifier. As a result, the decryption key generation device 1 outputs the encryption keys e and n and the decryption key table.

Next, if the prime numbers p and q are p≡1 (mod 3) and q≡2 (mod 3), the prime numbers p and q and their order tables are input to the decryption key table generator 2. Then, the output of the decryption key table generation device 2 is directly used as the output of the decryption key table generation device 245, and the process is ended.

Specifically, the decryption key generating device 2 is provided with prime numbers p and q and a rank table of the prime numbers p and q as inputs. Here, the decryption key generation device 1 is: gcd (e, N _p0 ) = gcd (e, N _p0 ) = gcd (e, N _p1 ) = gcd (e, N _p2 ) = gcd (e, N _p3 ) = A public key e for which (e, q + 1) = 1 is randomly set. Then, the decryption keys d _pi (i = 0 to 3) and d _q0 satisfying the following expressions are calculated.

E · d _pi ≡1 (mod p) (i = 0 to 3), e · d _q0 ≡1 (mod q). As a result, the decryption key table output by the decryption key generation device 2 is

[0031]

[Table 5]

It is assumed that However, in these tables, the item in the left column represents the identifier, and the item in the right column represents the decryption key corresponding to the identifier. As a result, the decryption key generation device 2 outputs the encryption keys e and n and the decryption key table.

Further, if the prime numbers p and q are p≡q≡1 (mod 3), the prime numbers p and q and their order tables are input to the decryption key table generating device 3, and the decryption key table generating device 245 outputs the prime numbers p and q. Outputs and ends the process.

More specifically, the decryption key generation device 3 is provided with prime numbers p and q and order tables of the prime numbers p and q as inputs. Here, the decryption key generation device 1 randomly sets the public key e such that gcd (e, N _pi ) = gcd (e, N _pi ) = 1 (i = 0 to 3). Then, the decryption keys d _pi and d _qi that satisfy the following equation are calculated.

E · d _pi ≡1 (mod p) e · d _qi ≡1 (mod q) (i = 0 to 3). As a result, the decryption key table output by the decryption key generating device 3 is

[0036]

[Table 6]

It is assumed that However, in these tables, the item in the left column represents the identifier, and the item in the right column represents the decryption key corresponding to the identifier.

As a result, the decryption key generation device 3 outputs the encryption keys e and n and the decryption key table to the public file device 10 or the decryption device 40.

(3) Encryption Device FIG. 5 shows the configuration of an encryption device according to an embodiment of the present invention. The encryption device 30 has an elliptic curve multiplier 31 that multiplies the plaintext M input on the elliptic curve E _n (0, b _M ) by the public key e.

The encryption device 30 includes, as an input, a public key e, n and the plaintext _{M = (m x, m y} ) is given. _{However, 0 <m x, m y} <n and gcd (m x, n) = g
_{cd (m y, n) =} 1 to.

The encryption device 30 uses the elliptic curve E._n(0, b
_M): Y²≡ x³+ B_MOn (mod n)  e ・ m over E_n(0, b_M) Is calculated, and the calculation result is ciphertext C. And dark
The message C is output to the decoding device 40, and the process ends.

(4) Decoding Device FIG. 6 shows the configuration of a decoding device according to an embodiment of the present invention. In the figure, the decoding device 40 includes a prime number p storage unit 410, a prime number q storage unit 411, first and second coefficient calculators 420 and 42.
First, first and second identifier calculators 430 and 431, decryption key searchers 440 and 441, first and second elliptic curve multipliers 4
50, 451, and p decryption key table storage unit 470, q decryption key storage unit 471, and Chinese remainder theorem calculator 460.

The prime p storage unit 410 of the decoding device 40 stores the prime p, and the prime q storage unit 411 stores the prime q.

The first coefficient calculator 420 is used by the encryption device 3
Calculate the parameter b _p of the elliptic curve E _p (0, b _p ): y ² ≡x ³ + b _p (mod p) from the ciphertext C input from 0 and the prime number p stored in the prime number p storage unit 410 To do.

The second coefficient calculator 421 is used by the encryption device 3
The parameter b _q of the elliptic curve E _q (0, b _q ): y ² ≡x ³ + b _q (mod q) is calculated from the ciphertext C input from 0 and the prime number q stored in the prime number q storage unit 411. To do.

The first identifier calculator 430 calculates the identifier τ _p from the elliptic curve parameter b _p and the prime number p.

The second identifier calculator 431 calculates an identifier τ _q from the elliptic curve parameter b _q and the prime number q.

The p decryption key table storage unit 470 stores the decryption key table of the prime number p, and the decryption key table storage unit 471 of q stores the decryption key table of the prime number q.

When the decryption key table from the decryption key table storage unit 470 of _p and the identifier τ _p from the first identifier calculator 430 are input, the decryption key searcher 440 retrieves the decryption key table by the identifier τ _p . Then, the decryption key d _p is acquired.

[0050] When the decryption key retriever 441 identifier q is input, searches the decryption key table by the identifier tau _q, acquires the decryption key d _q.

The first elliptic curve multiplication unit 450 calculates the ciphertext C input from the encryption device 30 into an elliptic curve E _p (0, b).
and d _p times over _p), and outputs the multiplied result M _p.

The second elliptic curve multiplication unit 451 converts the ciphertext C input from the encryption device 30 into an elliptic curve E _q (0, b
_q ) times d _q above and outputs the multiplied result M _q .

The Chinese remainder theorem calculator 460 uses the prime number p from the prime number p storage unit 410 and the prime number q from the prime number q storage unit 411.
When M _p and M _q are input from the first elliptic curve multiplier 450 and the second elliptic curve multiplier 451, the plaintext M is output according to the Chinese Remainder Theorem.

Specifically, the decoding device 40 receives as an input,
Ciphertext C = (c _x, C_y) Given
Then, in the first and second coefficient calculators 420 and 421,
Parameter b_p= C_y ²-C_x ³mod p, b_q= C_y ²-C_x ³Compute mod q.

First and second identifier calculators 430, 43
1 is each parameter b _p , b _q and each prime number storage unit 41.
Depending on the prime numbers obtained from 0 and 411, p≡q≡2
If (mod 3), the identifier for the prime number p is "*",
The identifier for the prime number q is “*”. Also, p ≡ 1
If (mod 3), q≡2 (mod 3), the identifier τ _p for the prime _p is

[0056]

[Equation 1] And the identifier τ _q for the prime number q,

[0057]

[Equation 2]

[0058] and then, to each of the calculation result identifier tau _p for prime p, the identifier tau _q for prime q. The decryption key searchers 440 and 441 are connected to the decryption key table recording unit 47 for p and q.
Identifier tau _p decryption key table from 0,471 searches by tau _q, to obtain the decryption key d _p, d _q. Next, the first elliptic curve multipliers 450 and 451 use the elliptic curves E _p (0, b _p ): y ² ≡x ³ + b _p (mod p) E _q (0, b _q ): y ² ≡x. ^{On 3} + b _q (mod q), d _p · C over E _p (0, b _p ) and d _q · C over E _q (0, b _q ) are calculated, and the respective calculation results are M _p and M. _{Let q} . Accordingly, the Chinese remainder theorem calculator 460 calculates the plaintext M from M _p and M _q using the Chinese remainder theorem, and outputs it as the plaintext M.

The number of digits of the prime numbers p and q used in the description of the above embodiment is determined in consideration of the difficulty of factoring the product n (= pq).

[0060]

As described above, according to the present invention, since the prime factors p and q of the modulus n are not limited, it is more difficult to factor them, and when the prime numbers p and q have the same size, KM
It is safer than the OV method. This makes it possible to provide a secure public key cryptosystem.

[Brief description of drawings]

FIG. 1 is a principle configuration diagram of the present invention.

FIG. 2 is a system configuration diagram of an embodiment of the present invention.

FIG. 3 is a configuration diagram of a key generation device according to an embodiment of the present invention.

FIG. 4 is a diagram for explaining a decryption key table generation device according to an embodiment of the present invention.

FIG. 5 is a configuration diagram of an encryption device according to an embodiment of the present invention.

FIG. 6 is a configuration diagram of a decoding device according to an embodiment of the present invention.

[Explanation of symbols]

 1, 2 and 3 Decryption key generation device 10 Public file device 20 Key generation device 21 Number table generation means 24 Decryption key generation means 30 Encryption device 31, 45 Elliptic curve multiplication means 40 Decryption device 41 Storage means 42 Coefficient calculation means 43 Identifier calculation means 44 Decryption key search means 46 Chinese remainder theorem calculation means 241 Prime number generator 242, 243 Order table generation device 245 Decryption key table generation device 410 Prime number p storage unit 411 Prime number q storage unit 420 First coefficient calculator 421 Second coefficient calculator 430 First identifier calculator 431 Second identifier calculator 440,441 Decryption key searcher 450 First elliptic curve multiplier 451 Second elliptic curve multiplier 460 Chinese remainder theorem calculator

[Procedure amendment]

[Submission date] May 7, 1993

[Procedure Amendment 1]

[Document name to be amended] Statement

[Name of item to be amended] Claims

[Correction method] Change

[Correction content]

[Claims]

Claims (1)

[Claims] 1. A public file device for selecting an arbitrary prime number of 5 or more by a receiver and registering a public key corresponding to the prime number, and an elliptic curve y ² ≡x ³ + ax (mod n) for the prime number. An identifier showing the relationship between the order and the parameter and a order table generating means for generating a order table showing the correspondence of the order, and decoding from the prime table and the order table generated by the order table generating means. A key generation device having a decryption table generation device including a decryption key table generation means for calculating a key and generating a decryption key table showing the correspondence between the decryption key and the identifier of the order table, a plaintext and a public key Is input and the plaintext is converted into an elliptic curve y ² ≡x ³
An encryption device that includes an elliptic curve multiplication unit that multiplies on + ax (mod n) based on the public key, a storage unit that stores the prime number and the decryption key table in advance, and the encryption unit. Coefficient calculation means for calculating the parameters of the elliptic curve y ² ≡x ³ + ax (mod n) from the ciphertext and the prime number acquired from the encryption device, and the ellipse from the decryption key table stored in the storage means. Decryption key search means for searching a decryption key corresponding to the parameter of the curve y ² ≡x ³ + ax (mod n), and the ciphertext input from the encryption device to the elliptic curve y ² ≡x
³ + ax (mod n) Elliptic curve multiplication means for multiplying based on the decryption key, plaintext is calculated from the value obtained by the elliptic curve multiplication means and the prime number based on the Chinese Remainder Theorem, and output A public key cryptosystem based on an elliptic curve, comprising: a decryption device including a remainder theorem calculation means.