JP2000089668A - Encryption method, decryption method, encryption and decryption method and cipher communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To permit high-speed decryption processing of sum-of-product type ciphers by setting a radix vector at a specific value with an encryption method for obtaining ciphertext by using a plaintext vector and the radix vector. SOLUTION: One entity (a) enciphers plaintext (x) to the ciphertext C=m0 B0+m1B1+...mK-1BK-1 by using the plaintext vector m=(m0, m1,..., mK-1) formed by dividing the plaintext (x) by K by an encryption device 1 the radix vector B=(B0, B1,..., BK-1). Bi (0<=i<=K-1) is set at Bi=b0b1...bi by using an integer bi. The formed ciphertext C is sent via a communication path 3 from the entity (a) to another entity (b). The entity (b) deciphers this ciphertext C to the original plaintext x by a decryption device 2.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to an encryption method for converting a plaintext into a ciphertext and a decryption method for converting a ciphertext into an original plaintext, and more particularly to a product-sum encryption.

[0002]

2. Description of the Related Art In a modern society called an advanced information society, important documents and image information in business are transmitted, communicated, and processed in the form of electronic information based on a computer network. Such electronic information has a property that it can be easily copied and it is difficult to distinguish a copy from an original, and thus the importance of information security is emphasized. In particular, "sharing of computer resources",
The realization of a computer network that satisfies each element of "multi-access" and "wide area" is indispensable for the establishment of an advanced information society, but this includes elements inconsistent with the problem of information security between parties. As an effective method for resolving such inconsistency, cryptographic technology that has been used mainly in military and diplomatic aspects in the past history of humankind has attracted attention.

[0003] Encryption means exchanging information so that the meaning of the information cannot be understood by anyone other than the parties. In encryption, it is encryption to convert an original sentence (plaintext) that anyone can understand into a sentence (ciphertext) whose meaning is unknown to a third party, and decryption is to return the ciphertext to plaintext. The entire process of encryption and decryption is collectively called an encryption system. In the encryption process and the decryption process, secret information called an encryption key and a decryption key are used, respectively. Since a secret decryption key is required at the time of decryption, only a person who knows the decryption key can decrypt the ciphertext, and the encryption can maintain the confidentiality of the information.

[0004] Encryption methods can be broadly classified into two types: a common key encryption system and a public key encryption system. In the common key cryptosystem, the encryption key and the decryption key are equal, and the sender and the receiver have the same key to perform encrypted communication. The sender encrypts the plaintext based on the secret common key and sends it to the recipient,
The recipient uses the common key to decrypt the ciphertext into plaintext.

In the public key cryptosystem, on the other hand, the encryption key and the decryption key are different, the sender encrypts the plaintext with the public key of the public receiver, and the receiver uses his / her own private key. Performs encrypted communication by decrypting the ciphertext.
The public key is a key for encryption, the secret key is a key for decrypting a ciphertext converted by the public key, and the ciphertext converted by the public key can be decrypted only by the private key.

[0006]

With respect to the multiply-accumulate cryptosystem, which is one of the public key cryptosystems, new systems and attack methods have been proposed one after another, but in particular, a large amount of information can be processed in a short time. Thus, development of an encryption / decryption technique capable of high-speed decryption is desired.

The present invention has been made in view of the above circumstances, and provides a novel encryption method and a new decryption method in multiply-accumulate encryption, which can perform high-speed decryption processing by using a multi-ary system. The purpose is to do.

[0008]

An encryption method according to claim 1.
The method is a plaintext vector m = (m₀,
m ₁, ..., m_K-1) And the radix vector B = (B₀, B₁,
…, B_K-1) And ciphertext C = m₀B₀+ M₁B₁
+ ... + m_K-1B_K-1In the encryption method to get
Note B_i(0 ≦ i ≦ K−1) is converted to an integer b_iUsing B_i= B
₀b₁... b_iIs set.

A second aspect of the present invention is the encryption method according to the first aspect, wherein the K is a power of two.

According to a third aspect of the present invention, there is provided a decryption method for decrypting the ciphertext C encrypted according to the first aspect, wherein a plaintext vector m = (m ₀ , m ₁ ,..., M _K-1 ). Step _{0 C 0 = C / b 0} m 0 ≡C 0 (mod b 1) Step i (i = 1~K-2) C i = (C i-1 -m i-1) / b i m i ≡ C _i (mod b _{i + 1} ) step K−1 m _K−1 = (C _K−2 −m _K−2 ) / b _K−1

According to a fourth aspect of the present invention, in the encryption method, the plaintext is divided into K minutes.
The plaintext vector m = (m₀, M ₁, ..., m_K-1)When
Radix vector B = (B₀, B₁, ..., B_K-1) And
And ciphertext C = m₀B₀+ M₁B₁+ ... + m_K-1B
_K-1In the encryption method for obtaining_i(0 ≦ i ≦ K
-1) is an integer b_i, Random number v_iUsing B_i= V_ib₀b
₁... b_iIs set.

According to a fifth aspect of the present invention, in the encryption method according to the first aspect, a random number vector v = (v ₀ , v ₁ ,..., V _{K -1} ).
Ciphertext using _{C = m 0 v 0 B 0} + m 1 v 1 B 1 + ··
-It is characterized in that + m _K-1 v _K-1 B _K-1 is obtained.

According to a sixth aspect of the present invention, in the first or fourth aspect, a plurality of sets of the K b _i are prepared, and a ciphertext is obtained for each set. I do.

According to a seventh aspect of the present invention, there is provided an encryption / decryption method comprising:
Plaintext vector m = (m ₀, M₁, ..., m
_K-1) And the radix vector B = (B₀, B₁, ..., B_K-1)
And converts the plaintext into ciphertext, and uses the ciphertext as the original
In the encryption / decryption method for converting into plaintext of_i
(0 ≦ i ≦ K−1) is converted to an integer b_iUsing B_i= B₀b₁
... b_iSatisfies w <P (P: prime number)
Addition w is selected, and the public key vector c =
(C₀, C₁, ..., c_K-1C) and c_i≡wB_i (Mod P) (a) The inner product of the plaintext vector m and the public key vector c gives
Creating a ciphertext C shown in (b); C = m₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (B) With respect to the ciphertext C, the intermediate decryption text M is expressed by the following equation (c).
And M ス テ ッ プ w^-1C (mod P) (c) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Step and Step 0 M₀= M / b₀ m₀≡M₀ (Mod b₁) Step i (i = 1 to K-2) M_i= (M_i-1-M_i-1) / B_i m_i≡M_i (Mod b_{i + 1}) Step K-1 m_K-1= (M_K-2-M_K-2) / B_K-1 It is characterized by having.

[0015] The encryption method / decryption method according to claim 8 comprises:
A plaintext vector m obtained by dividing the plaintext into K (K is a power of 2)
= (M₀, M₁, ..., m_K-1) And the radix vector B = (B
₀, B₁, ..., B_K-1) To convert the plaintext into ciphertext.
Convert and convert the ciphertext to the original plaintext
The method, wherein B_i(0 ≦ i ≦ K−1) is converted to an integer b_i
Using B_i= B₀b₁... b_iSetting to
Select w that satisfies w <P (P: prime number), and
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod P) ... (d) The inner product of the plaintext vector m and the public key vector c gives
(E) creating a ciphertext C, C = m₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (E) For the ciphertext C, the intermediate decryption text M is expressed as in equation (f).
And M ス テ ッ プ w^-1C (mod P) (f) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Steps and [Divide Algorithm] First Step ML ≡ M (mod B_{K / 2}) Second step MR = (ML-ML) / B_{K / 2} [High-speed algorithm] ML and MR are again divided into two parts.
Apply the algorithm. That of the intermediate decrypted text divided into four
The two-partition algorithm is again applied to each. like this
It is characterized by having repeating.

According to a ninth aspect of the present invention, there is provided an encryption / decryption method comprising:
Plaintext vector m = (m ₀, M₁, ..., m
_K-1) And the radix vector B = (B₀, B₁, ..., B_K-1)
The ciphertext is converted to ciphertext using
In the encryption / decryption method for converting into plaintext of_i
(0 ≦ i ≦ K−1) is set by equation (g)
And B_i= V_ib₀b₁... b_i ... (g) where v_i: Random number b_i: Integer gcd (v_i, B_{i + 1}) = 1 Select w that satisfies w <P (P: prime number), and
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod P) (h) The inner product of the plaintext vector m and the public key vector c gives
(C) creating a ciphertext C shown in (i);₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (I) With respect to the cipher text C, the intermediate decrypted text M
And M ス テ ッ プ w^-1C (mod P) (j) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Step and Step 0 M₀= C / b₀ m₀≡M₀v₀ ^-1 (Mod b₁) Step i (i = 1 to K-2) M_i= (M_i-1-M_i-1v_i-1) / B_i m_i≡M_iv_i ^-1 (Mod b_{i + 1}) Step K-1 M_K-1= (M_K-2-M_K-2v_K-2) / B_K-1 m_K-1= M_K-1/ V_K-1 It is characterized by having.

[0017] The encryption / decryption method according to claim 10 is
A plaintext vector m = (m₀, M₁,…,
m_K-1) And the radix vector B = (B₀, B₁,…,
B_K-1) To convert the plaintext into ciphertext, and
In an encryption / decryption method that converts a sentence into the original plaintext,
A step of setting prime numbers P and Q, and a radix vector B
_Pi(0 ≦ i ≦ K−1) is converted to an integer b_PiUsing B_Pi= B_P0b
_P1... b _PiAnd the radix vector B_Qi(0
≦ i ≦ K−1) is an integer b_QiUsing B_Qi= B_Q0b_Q1... b
_QiAnd the Chinese remainder theorem,
The remainder by P and Q is B_Pi, B_QiThe most
Small integer B_iAnd w <N (N = PQ)
The w that satisfies is selected, and the public key vector c =
(C₀, C₁, ..., c_K-1C) and c_i≡wB_i (Mod N) ... (k) The inner product of the plaintext vector m and the public key vector c gives
(C) creating a ciphertext C shown in (l);₀c₀+ M₁c₁+ ... + m_K-1c_K-1 ... (l) For ciphertext C, in law P and law Q, respectively
Decrypted text M_P, M_QIs calculated as in Equations (m) and (n).
And M_P≡w^-1C (mod P) ... (m) M_Q≡w^-1C (mod Q) ... (n) This intermediate decrypted text M_P, M_QBy the following algorithm
Decrypt the plaintext vector m = (m₀, M₁, ..., m_K-1)
And step 0 M_P0= M_P/ B_P0 M_Q0= M_Q/ B_Q0 m₀ ^(p)≡M_P0 (Mod b_P1) M₀ ^(Q)≡M_Q0 (Mod b_Q1) According to the Chinese remainder theorem₀Ask for. Step i (i = 1 to K-2) M_Pi= (M_Pi-1-M_i-1) / B_Pi M_Qi= (M_Qi-1-M_i-1) / B_Qi m_i ^(p)≡M_Pi (Mod b_{Pi + 1}) M_i ^(Q)≡M_Qi (Mod b_{Qi + 1}) According to the Chinese remainder theorem_iAsk for. Step K-1 m_K-1= (M_PK-2-M_K-2) / B_PK-1 Or m_K-1= (M_QK-2-M_K-2) / B_QK-1 It is characterized by having.

An encryption / decryption method according to claim 11 is characterized in that, in claim 10, the ciphertext C is transmitted modulo N.

[0021] According to a twelfth aspect of the present invention, there is provided an encryption communication system for performing information communication using a ciphertext between a plurality of entities, according to any one of the first, second, fourth, fifth, and sixth aspects. An encryption device that creates a ciphertext from a plaintext using, a communication path that transmits the created ciphertext from one entity to the other entity, and a decoder that decrypts the sent ciphertext into the original plaintext. It is characterized by having.

The concept of the encryption / decryption method of the present invention will be described below. In the present invention, a multi-ary system is used.

The message m = (m₀, M₁,…,
m_K-1) In the base B = (B₀, B₁, ..., B _K-1)
Therefore, as shown in the following equation (1),
Can be. Here, m_iB_i<B_{i + 1}Is established
It shall be. M = m₀B₀+ M₁B₁+ ... + m_K-1B_K-1 … (1)

In the equation (1), when B _i = 2 ⁱ , the message is represented by a normal binary number. When B _i = 10 ⁱ , the message is represented by a normal decimal number. It is represented by

Here, a case is considered where the above B _i is set as in the following equation (2). B _i = b ₀ b ₁ ... B _i (2) In the equation (2), b ₀ = 1 and b _i = 2 (1 ≦ i ≦ K−
If set to 1), it matches the case of binary numbers, b ₀ = 1, b
Setting _i = 10 (1 ≦ i ≦ K−1) matches the case of a decimal number.

In the present invention, a ciphertext is created using such a multi-ary notation, that is, using equations (1) and (2).

When the radix is given by equation (2), the message m = (m ₀ , m ₁ ,..., M _{K -1} ) can be decoded from the integer M by the following algorithm. . This decoding algorithm is called a sequential decoding algorithm I.

[Sequential Decoding Algorithm I] Step 0 M ₀ = M / b ₀ m ₀ ≡M ₀ (mod b ₁ ) Step i (i = 1 to K−2) M _i = (M _i−1 −m _{i -1) / b i m i ≡M} i (mod b i + 1) step _{K-1 m K-1 =} (M K-2 -m K-2) / b K-1 Incidentally, in the algorithm Does not uniquely decode m _j unless m _j <b _{j + 1} .

The above-described encryption method based on the multi-ary system and the decryption method therefor are the features of the present invention. The specific method will be described later.

[0028]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be specifically described below. FIG. 1 is a schematic diagram showing a state where the encryption / decryption method according to the present invention is used for information communication between entities a and b. In the example of FIG. 1, one entity a encrypts a plaintext x into a ciphertext C by the encryptor 1 and transmits the ciphertext C to the other entity b via the communication path 3. , The decryptor 2 decrypts the ciphertext C into the original plaintext x. It should be noted that the decoder 2 has a built-in counter 2a that is used during a decoding process described later.

(First Embodiment) A secret key and a public key are prepared as follows.・ Private key: {b _i }, P, w ・ Public key: {c _i } A base is given as in the above equation (2), and an integer w satisfying w <P (P is a large prime number) is randomly selected, Equation (3) is derived. c _i ≡wB _i (mod P) (3) The public key vector c is given by Expression (4). c = (c ₀ , c ₁ ,..., c _K−1 ) (4)

Further, μ satisfying μ <min (b ₁ ,..., B _K−1 ) is disclosed to each entity. The entity a divides the plaintext x into K-dimensional message vectors having a size equal to or less than μ based on the disclosed μ. By limiting the number of bits of the message in this way, b ₀ , b ₁ ,
, B _K-1 may be set arbitrarily. And
The inner product of the message vector m and the public key vector c is obtained as in equation (5), and the plaintext x is encrypted to obtain a ciphertext C. The created ciphertext C is transmitted from the entity a to the entity b via the communication path 3. C = m ₀ c ₀ + m ₁ c ₁ +... + M _K-1 c _K-1 (5)

Note that this encryption can be performed in a time required for one multiplication by K-fold parallel processing and a log ₂ K addition processing.

On the entity b side, decoding processing is performed as follows. For the ciphertext C, the intermediate decryption text M
Is obtained as in equation (6). M≡w ⁻¹ C (mod P) (6) Since this intermediate decryption text M is specifically given as Expression (7), it can be decrypted by the above-described sequential decoding algorithm I. _{M = m 0 b 0 + m} 1 b 0 b 1 + ··· + m K-1 b 0 b 1 ... b K-1 ... (7)

FIG. 2 is a flowchart showing a processing procedure of the sequential decoding algorithm I performed in the decoder 2. First, the counter 2a is reset, and its count value T is set to 0 (S1). Then, after the calculation of step 0 is performed to obtain m ₀ (S2), the count value T is set to 1 (S3). Next, determine the m _i by executing the step i (S4), increments the count value T by 1 (S5). It is determined whether or not the count value T has reached K-1 (S6), and if not, (S6: NO), S
Steps S4 and S5 are repeated. By repeating this process from T = 1 to T = K-2, it is obtained from m ₁ to m _K-2. When the count value T reaches K-1,
(S6: YES), step K-1 is executed to obtain mK _-1 (S7).

By the way, in the first embodiment,
In the case where b _i has a simple form such as b _i = p ^d, the following equations (8) and (9) are obtained, and thus equation (10) is established and P is exposed. _{wb 0 b 1 ... b J /} wb 0 b 1 ... b J-1 ≡B J / B J-1 (mod P) ... (8) wb 0 b 1 ... b J + 1 / wb 0 b 1 ... b J _{≡B J + 1 / B J (} mod P) ... (9) (B J) 2 -B J-1 B J = Ng ... (10) on the other hand, if you choose b _i randomly around the p ^d, Assuming a single b _i value brute force also exposes P. b _i must be selected to be at least about 64 bits.

In the first embodiment, the 0,1 nap
Cryptography can be positioned as a generalized method.
You. That is, m_iIf ∈GF (2), the super-increased sequence ｛b
₀, B ₀b₁, ..., b₀b₁... b_K-10 by｝
It matches one knapsack cipher.

In general, in the conventional multiply-accumulate cryptosystem using a super-increased sequence, there is no relation between the radixes, and it is necessary to sequentially decode the upper digits of the plaintext, and the multiple-length integer is used as the divisor. Division was required. However, according to the method of the present invention using this b _i- ary number, it can be seen that decoding can be performed at high speed because the remainder operation and division modulo a small integer starting from the lower digit can be repeated.

A decoding method capable of further increasing the decoding speed will be described below. ML is the first half of the intermediate decrypted text M
, The latter half of the intermediate decrypted text M divided by B _{K / 2}
And Specifically, ML and MR are represented by the formula (1)
1) and Equation (12). Note that K is a power of two. _{ML = m 0 B 0 + ···} + m K / 2-1 B K / 2-1 ... (11) MR = (m K / 2 B K / 2 + ··· + m K-1 B K-1) / B _{K / 2} … (12)

The two-partitioning algorithm and a high-speed algorithm obtained by repeatedly applying the two-partitioning algorithm are described below.

[Divide Algorithm] First Step ML≡M (mod B _{K / 2} ) Second Step MR = (M−ML) / B _{K / 2}

[High-speed algorithm] A two-partition algorithm is applied to ML and MR again. The divide-by-two algorithm is applied to each of the divide-by-four messages. This is repeated.

In this way, when K is a power of 2, particularly high-speed decoding processing can be realized, and when this high-speed algorithm is applied, K / log ₂ K times as compared with the above-described sequential decoding algorithm. Can only be decoded at high speed.

For example, let b _{i be} a prime number of about 64 bits,
When K = 64 is selected, the size of the ciphertext C is 4166 bits, but the decryption time by the high-speed algorithm is 64 = 2.
^Since it is ^6, it is almost the same as the decoding time by the sequential decoding algorithm when K = 6. That is, the decoding process can be performed about 10 times faster. In this case, the public key size is as large as about 1 kilobit, but considering the situation where high-density recording of 1 gigabit / cm ² is possible, this public key size is practically acceptable. .

(Second Embodiment) A second embodiment in which random numbers are added to the first embodiment will be described. In the first embodiment, {B _i } is a very increasing sequence. Therefore, LLL (Lenatra-
The first embodiment may be susceptible to attack by the Lenatra-Lovasz method. Therefore, in the second embodiment, security is enhanced by adding a random number to the radix, that is, by using the radix vector multiplied by the random number in the first embodiment as a radix vector.

A secret key and a public key are prepared as follows. - secret _{key: {b i}, {v} i}, P, w · public key: give {c _i} base B _i as in Equation (13). B _i = v _i b ₀ b ₁ ... B _i (13) Here, v _i is set so that each B _i shown in Expression (13) has substantially the same size. Therefore, {B _i } is not a super-incremental sequence and is not easily attacked by the LLL method. Where gc
_{d (v i, b i +} 1) shall meet the = 1.

Using the integer w, the public key vector c is obtained as in the following equations (14) and (15), as in the first embodiment. c _i ≡wB _i (mod P) (14) c = (c ₀ , c ₁ ,..., c _K-1 ) (15)

Message vector m and public key vector c
The ciphertext C is obtained in the same manner as in the first embodiment (Equation (5)) by the inner product of.

The decoding process is performed as follows.
An intermediate decryption text M is obtained from the cipher text C as in equation (16). M≡w ⁻¹ C (mod P) (16) Since this intermediate decrypted text M is specifically given as Expression (17), it can be decrypted by the sequential decoding algorithm II shown below. _{M = m 0 v 0 b 0} + m 1 v 1 b 0 b 1 + ··· + m K-1 v K-1 b 0 b 1 ... b K-1 ... (17)

[Sequential Decoding Algorithm II] Step 0 M ₀ = M / b ₀ m ₀ ≡M ₀ v ₀ ⁻¹ (mod b ₁ ) Step i (i = 1 to K−2) M _i = (M _{i− 1 -m i-1 v i-} 1) / b i m i ≡M i v i -1 (mod b i + 1) step _{K-1 M K-1 =} (M K-2 -m K-2 v _K-2 ) / bK _{- 1mK-1} = _MK-1 / vK _-1

The flowchart for executing the sequential decoding algorithm II in the decoder 2 is the same as the flowchart for the sequential decoding algorithm I (FIG. 2).

Here, a specific example in the second embodiment will be described.・ Secret key b = (1,11,13) v = (1009,131,7) B = (1009,1441,1001) P = 27481 w = 739 w ^-1 ≡702 (mod P) (b ₁ <b _{Since 2} <b ₃ , v ₁ > v ₂ > v ₃ is set so that B ₁ , B ₂ , and B ₃ do not become a super-increased sequence. ・ Public key c {wB} (3664 , 20621, 25233) (mod P)-Let the encrypted message be m = (6, 7, 8). C = c · m = 6 × 3664 + 7 × 20621 + 8 × 25233 = 368195 Decoding The intermediate decrypted text M is obtained and decrypted using the sequential decoding algorithm II. M≡w ^-1 C ≡702 × 368195 ≡24149 (mod 27481) Step 0 M ₀ = 24149/1 = 24149 m ₀ ≡24149 × 1009 ^-1 ≡6 (mod 11) Step 1 M ₁ = (24149 −6 × _{1009) / 11 = 1645 m 1} ≡1645 × 131 -1 ≡7 (mod 13) step _{2 M 2 = (1645-7 × 131} ) / 13 = 56 m 2 = 56/7 = in the 8 above, The message m = (6, 7, 8) is obtained.

(Third Embodiment) In the second embodiment,
The random number is incorporated into the radix vector itself.
Using the same radix vector as in the embodiment, random numbers v ₀ , v ₁ ,..., V _{K -1} can be added at the stage of generating the ciphertext C. The ciphertext C in this case has the same form as in the second embodiment.

(Fourth Embodiment) A fourth embodiment in which radix vectors are multiplexed in the first embodiment will be described. The fourth embodiment is an encryption / decryption method that sets a radix vector {B _i } according to the first embodiment in each of two moduli and uses the Chinese remainder theorem. Also in the fourth embodiment, the radix vector {B _i } does not become a super-incremental sequence, and is resistant to attacks by the LLL method. Also, the number of digits in the plaintext can be increased.

A secret key and a public key are prepared as follows. - secret _{key: {b Pi}, {b} Qi}, P, Q, N, w · Public Key: Select {c _i} 2 two large prime numbers P, Q, to those of the product with N. A set of K b _i in the first embodiment were prepared two ways, {b _Pi}, and {b _Qi}. The radix generated from them is {B _Pi }, {B _Qi }. Using the Chinese remainder theorem, the remainders of P and Q are B _Pi and B
_{Derive the} smallest integer B _i such that _Qi .

Similarly to the first embodiment, the public key vector c is obtained by using the secret integer w using N as a modulus, as in the following equations (18) and (19). c _i ≡wB _i (mod N) (18) c = (c ₀ , c ₁ ,..., c _K−1 ) (19)

Message vector m and public key vector c
The ciphertext C is obtained in the same manner as in the first embodiment (Equation (5)) by the inner product of.

The decoding process is performed as follows.
For the ciphertext C, the intermediate decrypted texts _MP and _MQ are obtained as shown in Expressions (20) and (21) by the methods P and Q, respectively. ^{_{M P ≡w -1 C (mod P}} ) ... (20) M Q ≡w -1 C (mod Q) ... (21)

For each intermediate decrypted text M _P , M _Q , the expression (2
2), Equation (23) holds. M _P = m ₀ B _P0 + m ₁ B _P1 + ... + m _K-1 B _PK-1 ... (22) M _Q = m ₀ B _Q0 + m ₁ B _Q1 + ... + m _K-1 B _QK-1 …(twenty three)

By applying the following sequential decoding algorithm III to M _P and M _Q , the remaining pairs ( _mi ^(p) , _mi ^(Q) ) can be derived. Where m
_i is assumed to be one of Expressions (24) and (25). ^{_{m i ≡m i (p) (}} mod b Pi + 1) ... (24) m i ≡m i (Q) (mod b Qi + 1) ... (25) Applying the remainder theorem Chinese for these , Message m _i < ₁ cm (b _{Pi +1} , b _{Qi + 1} ).

[Sequential Decoding Algorithm III] Step 0 M _P0 = M _P / b _P0 M _Q0 = M _Q / b _Q0 m ₀ ^(p) ≡M _P0 (mod b _P1 ) m ₀ ^(Q) ≡M _Q0 (mod b _Q1 ) Find m ₀ by the Chinese remainder theorem. Step i (i = 1 to K-2) M _Pi = (M _Pi-1 -m _i-1 ) / b _Pi M _Qi = (M _Qi-1 -m _i-1 ) / b _Qi m _i ^(p) Request m _i by _{≡M Pi (mod b Pi + 1} ) m i (Q) ≡M Qi (mod b Qi + 1) Chinese remainder theorem. Step K-1 m _K-1 = (M _PK-2 -m _K-2 ) / b _PK-1 or m _K-1 = (M _QK-2 -m _K-2 ) / b _QK-1

Here, a specific example in the fourth embodiment will be described.・ Private key b _P = (1,11,19) b _Q = (1,13,17) _BP = (1,11,209) B _Q = (1,13,221) B = (1,326859526, 1961157299) P = 45053 Q = 54833 N = 2470391149 w = 320718294 w ^-1 7981798315174 (mod N) (B _P and B _Q show super-increase, but B is not a super-increase sequence) ・ Public key c {WB} (320718294, 1521781250, 644798264) (mod N)-Let the encrypted message be m = (45, 67, 89). C = c · m = 173778712476 (the number of divided bit message can be improved up to 11 × 13 or less) and decoding intermediate decrypted text M _P, seek M _Q, sequential decoding algorithm II
Decrypt using I. ^{_{M P ≡w -1 C≡19383 (mod 45053}} ) M Q ≡w -1 C≡20585 (mod 54833) Step _{0 M P0 = 19383/1 =} 19383 M Q0 = 20585/1 = 20585 m P0 ≡19383 ≡1 (Mod 11) m _Q0 ≡20585 ≡6 (mod 13) m ₀ ≡45 (mod 143) Step 1 M _P1 = (19383 -45) / 11 = 1758 M _Q1 = (20585 -45) / 13 = 1580 m _P1 ≡1758≡10 (mod 19) m _Q1 ≡1580 ≡16 (mod 17) m ₁ ≡67 (mod 323) Step 2 m _P2 = (1758-67) / 19 = 89 m _Q2 = (1580-67) / 17 = 89 m ₂ = 89 As described above, the message m = (45, 67, 89) is obtained.

In a multiplexing system such as the fourth embodiment in which the number of composites N is used as a modulus, if it is difficult to decompose N into prime factors, it is considered safe to disclose N. Therefore, in such a case, the encryption efficiency is improved by transmitting the ciphertext C obtained modulo N.

(Fifth Embodiment) The fifth embodiment is an encryption system in which random numbers are added to the fourth embodiment, in other words, an encryption system in which radix vectors are multiplexed in the second embodiment. Since the contents of the fifth embodiment can be easily understood by referring to the above-described first to fourth embodiments, detailed description will be omitted.

[0063]

As is evident from the foregoing description, in the present invention, so as to set the base B _i to _{B i = b 0 b 1 ...} b i, since a message to be expressed using multi-numeration system, High-speed decoding can be performed. As a result, the present invention can greatly contribute to paving the way for the practical use of the product-sum encryption.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing a communication state of information between two entities.

FIG. 2 is a flowchart showing a decoding processing procedure in the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Encryptor 2 Decryptor 3 Communication path a, b entity

Claims (12)

[Claims] 1. A plaintext vector m = (m
₀ , m ₁ ,..., _{M K− 1} ) and the radix vector B = (B ₀ , B
_{1, ..., B K-1} ) = m 0 ciphertext C by using a B ₀ + m ₁
B ₁ +... + M _{K -1 In} an encryption method for obtaining B _{K -1} , the above B _i (0 ≦ i ≦ K−1) is calculated using an integer b _i.
i = b ₀ b ₁ ... encryption method and setting the b _i. 2. The encryption method according to claim 1, wherein said K is a power of two. 3. A decryption method for decrypting the ciphertext C encrypted according to claim 1, wherein a plaintext vector m = (m ₀ , m ₁ ,
.., M _K-1 ). Step _{0 C 0 = C / b 0} m 0 ≡C 0 (mod b 1) Step i (i = 1~K-2) C i = (C i-1 -m i-1) / b i m i ≡ C _i (mod b _{i + 1} ) step K−1 m _K−1 = (C _K−2 −m _K−2 ) / b _K−1 4. A plaintext vector m = (m
₀ , m ₁ ,..., _{M K− 1} ) and the radix vector B = (B ₀ , B
_{1, ..., B K-1} ) = m 0 ciphertext C by using a B ₀ + m _{1
B 1 + ··· + m K-} 1 in the encryption process for obtaining a B _K-1, wherein _{B i (0 ≦ i ≦ K} -1) integers b _i, a random number v _i
Encryption method and setting the _{B i = v i b 0 b} 1 ... b i with. 5. A random number vector v = (v ₀ , v ₁ ,..., V
Ciphertext _K-1) with a _{C = m 0 v 0 B 0} + m 1 v 1 B 1
The encryption method according to claim 1, wherein + ... + m _K-1 v _K-1 B _K-1 is obtained. 6. A plurality of sets of the K b _i are prepared,
5. The encryption method according to claim 1, wherein a ciphertext is obtained for each set. 7. A plaintext vector m = (m
₀, M₁, ..., m_{K- 1}) And the radix vector B = (B₀, B
₁, ..., B_K-1) To convert the plaintext to ciphertext
Encryption / decryption method for converting the ciphertext into the original plaintext
In the above B_i(0 ≦ i ≦ K−1) is converted to an integer b_iUsing B_i=
b₀b₁... b_iAnd selecting w that satisfies w <P (P: prime number).
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod P) (a) The inner product of the plaintext vector m and the public key vector c gives
Creating a ciphertext C shown in (b); C = m₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (B) With respect to the ciphertext C, the intermediate decryption text M is expressed by the following equation (c).
And M ス テ ッ プ w^-1C (mod P) (c) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Step and Step 0 M₀= M / b₀ m₀≡M₀ (Mod b₁) Step i (i = 1 to K-2) M_i= (M_i-1-M_i-1) / B_i m_i≡M_i (Mod b_{i + 1}) Step K-1 m_K-1= (M_K-2-M_K-2) / B_K-1 An encryption / decryption method comprising: 8. The plaintext is divided into K (K is a power of 2)
Plaintext vector m = (m₀, M₁, ..., m_K-1) And radix base
Vector B = (B₀, B₁, ..., B_K-1) And
Convert the plaintext to ciphertext, and convert the ciphertext to the original plaintext.
In the encryption / decryption method,_i(0 ≦ i ≦ K−1) is converted to an integer b_iUsing B_i=
b₀b₁... b_iAnd selecting w that satisfies w <P (P: prime number), and
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod P) ... (d) The inner product of the plaintext vector m and the public key vector c gives
(E) creating a ciphertext C, C = m₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (E) For the ciphertext C, the intermediate decryption text M is expressed as in equation (f).
And M ス テ ッ プ w^-1C (mod P) (f) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Steps and [Divide Algorithm] First Step ML ≡ M (mod B_{K / 2}) Second step MR = (ML-ML) / B_{K / 2} [High-speed algorithm] ML and MR are again divided into two parts.
Apply the algorithm. That of the intermediate decrypted text divided into four
The two-partition algorithm is again applied to each. like this
Encryption / decryption characterized by having a repetition of
Method. 9. A plaintext vector m = (m
₀, M₁, ..., m_{K- 1}) And the radix vector B = (B₀, B
₁, ..., B_K-1) To convert the plaintext to ciphertext
Encryption / decryption method for converting the ciphertext into the original plaintext
In the above B_i(0 ≦ i ≦ K−1) in equation (g)
Setting step; B_i= V_ib₀b₁... b_i ... (g) where v_i: Random number b_i: Integer gcd (v_i, B_{i + 1}) = 1 Select w that satisfies w <P (P: prime number), and
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod P) (h) The inner product of the plaintext vector m and the public key vector c gives
(C) creating a ciphertext C shown in (i);₀c₀+ M₁c₁+ ... + m_K-1c_K-1 .. (I) With respect to the cipher text C, the intermediate decrypted text M
And M ス テ ッ プ w^-1C (mod P) (j) This intermediate decrypted text M is decrypted by the following algorithm.
Plaintext vector m = (m ₀, M₁, ..., m_K-1Ask for)
Step and Step 0 M₀= C / b₀ m₀≡M₀v₀ ^-1 (Mod b₁) Step i (i = 1 to K-2) M_i= (M_i-1-M_i-1v_i-1) / B_i m_i≡M_iv_i ^-1 (Mod b_{i + 1}) Step K-1 M_K-1= (M_K-2-M_K-2v_K-2) / B_K-1 m_K-1= M_K-1/ V_K-1 An encryption / decryption method comprising: 10. A plaintext vector m = K obtained by dividing a plaintext into K
(M₀, M₁, ..., m _K-1) And the radix vector B =
(B₀, B₁, ..., B_K-1) And encrypts the plaintext
To convert the ciphertext into the original plaintext.
In the decoding method, a step of setting prime numbers P and Q;_Pi(0 ≦ i ≦ K−1) is converted to an integer b_PiUsing
B_Pi= B_P0b_P1... b _PiAnd the radix vector B_Qi(0 ≦ i ≦ K−1) is converted to an integer b_QiUsing
B_Qi= B_Q0b_Q1... b _QiAnd the remainder by P and Q using the Chinese remainder theorem
Re B_Pi, B_QiThe smallest integer B such that_iStep leading to
And w satisfying w <N (N = PQ), and
Public key vector c = (c₀, C₁, ..., c_K-1)
And c_i≡wB_i (Mod N) ... (k) The inner product of the plaintext vector m and the public key vector c gives
(C) creating a ciphertext C shown in (l);₀c₀+ M₁c₁+ ... + m_K-1c_K-1 ... (l) For ciphertext C, in law P and law Q, respectively
Decrypted text M_P, M_QIs calculated as in Equations (m) and (n).
And M_P≡w^-1C (mod P) ... (m) M_Q≡w^-1C (mod Q) ... (n) This intermediate decrypted text M_P, M_QBy the following algorithm
Decrypt the plaintext vector m = (m₀, M₁, ..., m_K-1)
And step 0 M_P0= M_P/ B_P0 M_Q0= M_Q/ B_Q0 m₀ ^(p)≡M_P0 (Mod b_P1) M₀ ^(Q)≡M_Q0 (Mod b_Q1) According to the Chinese remainder theorem₀Ask for. Step i (i = 1 to K-2) M_Pi= (M_Pi-1-M_i-1) / B_Pi M_Qi= (M_Qi-1-M_i-1) / B_Qi m_i ^(p)≡M_Pi (Mod b_{Pi + 1}) M_i ^(Q)≡M_Qi (Mod b_{Qi + 1}) According to the Chinese remainder theorem_iAsk for. Step K-1 m_K-1= (M_PK-2-M_K-2) / B_PK-1 Or m_K-1= (M_QK-2-M_K-2) / B_QK-1 An encryption / decryption method comprising: 11. The encryption / decryption method according to claim 10, wherein said ciphertext C is sent modulo N. 12. A cryptographic communication system for performing information communication by ciphertext between a plurality of entities, wherein
An encryptor that creates a ciphertext from a plaintext using the encryption method described in any of 2, 4, 5, or 6, a communication path that transmits the created ciphertext from one entity to the other entity, A decryptor for decrypting the transmitted ciphertext into the original plaintext.