JP2000200038A - Method and device for generating prime number, and rsa encipherment system and record medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To generate a prime number with a high speed used for a prime number key of an RSA cryptograph resistant to repeated ciphering attacks. SOLUTION: In this prime number generating method, a prime number p0' is generated and a random number Sp0 is generated and it is judged whether or not p0=Sp0p0'+1 is a prime number, and if p0 is a prime number, a random number Rp is generated and it is judged whether or not the random number Rp satisfies the below-mentioned conditions (x), (y), and when the random number Rp satisfies (x), (y), it is judged whether or not p=Rp p0+1 is a prime number, and further judged whether or not the random number Rp satisfies the condition (z), and if the condition (z) is satisfied, the (p) is outputted as a prime number becoming a prime number key of the RSA cryptograph. The conditions (x), (y), (z) are; Rp=WrpRp'... (x), Rp'=SrpRp" +1... (y), gcd (eup-1, p-1)<=Srp... (z). Where, Rp', Rp": prime number, Srp, Srp: the product of the prime numbers, e: ciphering key of RSA cryptograph, and up=1 cm (Srp, Sp0).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and an apparatus for generating a prime number serving as a prime key in, for example, an RSA encryption method, an RSA encryption method using the generated prime number, and a recording recording a program for generating the prime number. Regarding the medium.

[0002]

2. Description of the Related Art A ciphertext in an RSA cryptosystem of a public key cryptosystem utilizing the difficulty of factorization of a factor is expressed as follows:
Is an encryption key and n is a public key, m ^e (mod n)
It is represented by For this cipher text ^me , ^me , ( ^me )
^e , ((m ^e ) ^e ) An attack in which plaintext m is obtained as shown in the following equation by repeating encryption many times as in ^e ,. I have.

[0003]

(Equation 1)

[0004] The number of ciphertexts decrypted by such an encryption attack largely depends on the properties of two prime keys p and q used as RSA encryption keys. Therefore, by devising a method for generating the prime keys p and q of the RSA encryption, R
The strength against repeated encryption attacks on the SA cipher text can be increased.

As a countermeasure against repeated encryption attacks,
The present inventors have proposed the following prime number generation method (hereinafter, referred to as a conventional example) (Japanese Patent Application No. 9-205074). In this conventional example, prime numbers p and q satisfying the following conditions (1) to (4) are used as prime keys of the RSA encryption so that the number of ciphertexts vulnerable to repeated encryption attacks can be limited to a small number.

[0006] _{(1) p = 2R p p} 0 +1 q = 2R q q 0 +1 (R p, R q, p 0, q 0: _{prime) (2) R p = 2} xp 3 yp R p '+1 ( R _p ', R _q ': prime number, R _q = 2 ^xq 3 ^yq R _q '+1 xp, xq, yp, yq ≧ 1) (3) p ₀ = 2p ₀ ' +1 q ₀ = 2q ₀ '+1 (p ₀ ', q _0': ^{prime) (4) gcd (e z} , (p-1) (q-1) / 4) = 1 (z = 2 xpq 3 ypq, xpq = max (xp, xq), ypq = Max (yp, yq), max (a, b) = a (when a> b), b (when a ≦ b)

[0007]

When p and q satisfying the above conditions (1) to (4) are used as a prime key of the RSA encryption, only four ciphertexts are vulnerable to repeated encryption attacks. , Can generate a very secure key. However, since the prime numbers satisfying the conditions (1) to (4) are very small, there is a problem that the time required for key generation becomes enormous, and improvement is desired.

The present invention has been made in view of such circumstances, and even when the number of ciphertexts that are vulnerable to repeated encryption attacks is reduced to four, the prime number key of the RSA encryption is faster than the above-described conventional example. And method for generating a prime number, and an RSA using the generated prime number as a prime key
An object of the present invention is to provide a recording medium on which an encryption method and a program for generating a prime number thereof are recorded.

Another object of the present invention is to provide an RSA even when the number of ciphertexts vulnerable to repeated encryption attacks is set to more than four.
It is an object of the present invention to provide a method and an apparatus for generating a prime number capable of generating a cryptographic prime key, an RSA encryption method using the generated prime number as a prime key, and a recording medium recording a program for generating the prime number.

[0010]

Prime number generation method according to claim 1 Means for Solving the Problems] it is a method for generating a prime number which is a prime RSA key cryptography, and generating a prime number p ₀ ', the random number S _p0
, Determining whether p ₀ = S _p0 p ₀ '+1 is a prime number, generating a random number R _p when p ₀ is a prime number, _p is equal to or less than (a), determining whether or not the condition (b), the random number R _p is (a), in the case where satisfies the _{(b), p = R p} p 0 +1 Determining whether or not is a prime number; determining whether or not the following condition (c) is satisfied;
Generating p as a prime number serving as the prime number key. _{R p = S Rp r p ...} (a) r p = S rp R p '+1 ... (b) gcd (e up -1, p-1) ≦ S Rp ... (c) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 )

According to a second aspect of the present invention, in the method for generating a prime number serving as a prime key of the RSA encryption, the prime number p
₀ ′, generating a random number S _p0 , determining whether p ₀ = S _p0 p ₀ ′ +1 is a prime number, and determining whether p ₀ is a prime number. R _p
And generating the random number R _p by the following (d),
Determining whether the conditions of (e) and (f) are satisfied; and, if the random number R _p satisfies the conditions of (d), (e) and (f), p = R _p p ₀ +1 Determining whether or not is a prime number; determining whether or not the following condition (g) is satisfied; and, if the condition of (g) is satisfied, replacing p with the prime number serving as the prime key And generating it as _{R p = S Rp r p ...} (d) r p = S rp R p '+1 ... (e) S Rp 2 ≦ w ... (f) gcd (e up -1, p-1) ≦ S Rp ... (g ) Where r _p , R _p ′: prime S _Rp , S _rp : product of primes e: RSA encryption key up = lcm (S _rp , S _p0 ) w: maximum of ciphertext vulnerable to repeated encryption attacks Quantity

According to a third aspect of the present invention, in the apparatus for generating a prime number serving as a prime key of the RSA encryption,
Means for generating ₀ ', means for generating a random number S _p0 ,
₀ = a S _p0 p ₀ 'means determines whether or +1 is prime, when the p ₀ is a prime number, and means for generating a random number R _p, the random number R _p is less than or equal to (h) , (I) to determine whether the condition is satisfied, and the random number R _p is (h),
Means for determining whether or not p = R _p p ₀ +1 is a prime number when the condition (i) is satisfied; means for determining whether or not the following condition (j) is satisfied; ), Means for generating p as a prime number serving as the prime key when the condition is satisfied. _{R p = S Rp r p ...} (h) r p = S rp R p '+1 ... (i) gcd (e up -1, p-1) ≦ S Rp ... (j) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 )

[0013] The RSA encryption method according to claim 4 is characterized in that the prime number p generated according to claim 1 or 2 is used as a prime key for encryption.

According to a fifth aspect of the present invention, there is provided a recording medium in which a prime number p ₀ ′ is generated in a computer-readable recording medium storing a program for generating a prime number serving as a prime number key of the RSA encryption. Program code means for causing the computer, and program code means for causing the computer to generate a random number _Sp0 ;
program code means for causing the computer to determine whether p ₀ = S _p0 p ₀ '+1 is a prime number; and generating the random number R _p when the p ₀ is a prime number. program code means for causing the, random number R _p is less than or equal to (k), and program code means for causing the computer to determine whether or not the condition (l), the random number R _p is (k) , (L), the program code means for causing the computer to determine whether p = R _p p ₀ +1 is a prime number, and whether the following condition (m) is satisfied: A program code means for causing the computer to determine whether or not a program is to generate, when the condition (m) is satisfied, p as a prime number serving as the prime number key. And having a code means. _{R p = S Rp r p ...} (k) r p = S rp R p '+1 ... (l) gcd (e up -1, p-1) ≦ S Rp ... (m) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 )

In the present invention, the above-mentioned problems are solved by the following means. (Means 1) When the number of ciphertexts that are vulnerable to repetitive encryption attacks is four as in the conventional example, a prime number is generated using a wider range of determination conditions than in the conventional example, and used as a prime key of the RSA encryption Generate possible prime numbers in a shorter time. (Means 2) Even when the number of ciphertexts vulnerable to the repetitive encryption attack is larger than four in the conventional example, by making it possible to generate a prime number that can be used as a prime key of the RSA encryption, a wider range of determination conditions than in the conventional example Is generated in a short time as a prime key of the RSA encryption satisfying the following condition.

FIG. 1 is a flowchart showing the overall flow of generating a prime number according to the present invention, in which an input value w (w ≧ 4) is set.
Is given, a prime p that can be a prime key of the RSA cryptosystem such that (the number of ciphertexts vulnerable to repeated encryption attacks) ≦ w is generated in the following procedure.

S1: Generate a large prime p ₀ ′, and proceed to S2. S2: Generate a small random number S _p0 and proceed to S3. S3: It is determined whether or not p ₀ = S _p0 p ₀ '+1 is a prime number by using a prime number determination method. As a result of the determination, if p ₀ is a prime number, the process proceeds to S4. If p ₀ is not a prime number, S4
Return to 2. S4: Generate a random number R _p and proceed to S5. S5: Condition determination regarding R _p is performed. The details of this condition determination will be described later. U if the result is yes
p and S _Rp are generated, and the process proceeds to S6. If the determination result is no, the process returns to S4. S6: It is determined whether or not p = R _p p ₀ +1 is a prime number by using a prime number determination method. As a result of the determination, if p is a prime number, the process proceeds to S7, and if p is not a prime number, the process returns to S4. S7: For the encryption key e of the RSA encryption, gcd (e ^up −
(1, p-1) ≦ S _Rp is determined. If the result of the determination is yes, a prime number p is output and the process ends, and if the result is no, the process returns to S4.

FIG. 2 and FIG. 3 are flowcharts showing the contents of the condition determination processing for R _p in S5 of FIG. 1. After inputting R _p , S _p0 , and w, the following procedure is performed for R _p . Outputs yes or no as the judgment result.

S11: _{Assuming that} S _Rp = 1, r _p = R _p and i = 1, the routine proceeds to S12. S12: prime number sequence (t ₁ = 2, t ₂ = 3, t ₃ = 5, t ₄ = 7,...) In which t _i (1 ≦ i ≦ h) are arranged in ascending order
), It is determined whether or not r _p = 0 (mod t _i ). If the result of the determination is yes, proceed to S13, no
If it is, the process proceeds to S15. S13: _{Assuming that} S _Rp = S _Rp × t _i and r _p = r _p / t _i ,
Proceed to 14. S14: It is determined whether or not S _Rp ² ≦ w. If the result of the determination is yes, the process returns to S12, and if the result is no, the process ends with the determination result = no. S15: i: = i + 1, and the process proceeds to S16. S16: It is determined whether or not i ≦ h. As a result of the judgment, ye
If it is s, the process returns to S12. If it is no, the process proceeds to S17. S17: Using the primality test, it is determined whether r _p is large prime. If the result of the determination is yes, S18
The process proceeds to step no, and when the result is no (not a prime number or a small prime number), the processing ends with the determination result = no. _{S18: S rp = 1, R} p '= r p -1, as i = 1, S
Proceed to 19. S19: It is determined whether or not R _p '= 0 (mod t _i ). If the result of the determination is yes, the operation proceeds to S20, and if the result is no, the operation proceeds to S21. S20: _Set S _rp = S _rp × t _i , R _p ′ = R _p ′ / t _i , and return to S19. S21: Set i = i + 1 and proceed to S22. S22: It is determined whether or not i ≦ h. As a result of the judgment, ye
If it is s, the process returns to S19. If it is no, the process proceeds to S23. S23: It is determined whether or not R _p 'is a large prime number by using a prime number determination method. If the result of the determination is yes, S
Proceeding to step 24, if no (not a prime number or a small prime number), the process ends with the determination result = no. S24: Up = lcm (S _rp , S _p0 ) is calculated, up and S _Rp are output, and the processing is terminated with the determination result = yes.

When the prime numbers generated as described above are used as the prime keys of the RSA encryption, the following conditions (5) to (10) are satisfied for the prime keys p and q.

[0021] _{(5) p = R p p} 0 +1 q = R q q 0 +1 (p 0, q 0: large prime _{numbers) (6) R p = S} Rp r p (r p, r q: large prime numbers, _{R q = S Rq r q S} Rp, S Rq: product of small _{primes) (7) r p = S} rp R p '+1 (R p', R q ': large _{primes, r q = S rq R q} ' +1 S _rp , S _rq : product of small prime numbers (8) p ₀ = S _p0 p ₀ ′ +1 (p ₀ , q ₀ ′: large prime number, q ₀ = S _q0 q ₀ ′ +1 S _p0 , S _q0 : Product of small prime numbers) (9) gcd (e ^up −1, p−1) ≦ S _Rp (up = lcm (S _rp , S _p0 )) gcd (e ^uq −1, q−1) ≦ S _Rq ( _{uq = lcm (S rq, S} q0)) (10) S Rp 2 ≦ w S Rq 2 ≦ w

Therefore, the following reasons (A) to (G)
From the number of ciphertexts vulnerable to repeated encryption attacks is S _Rp S
Limited to _Rq . Here, from the above (10), S _Rp ² ≦
w, S _Rq ² ≦ w, so that S _Rp S _Rq ≦ w. As a result, (the number of ciphertexts vulnerable to repeated encryption attacks) ≦ w
Becomes

(A) The number of ciphertexts decrypted by u repeated encryption attacks matches the number of m that satisfies the following equation.

[0024]

(Equation 2)

(B) In general, the number of m that satisfies m ^k ≡1 (mod n) is gcd (k, φ (p)) × gcd (k, φ
(Q)). Where φ is an Euler function,
As a property of the Euler function, when x is a prime number, φ
(X) = x−1.

(C) From (A) and (B), if the following condition (11) is satisfied for an arbitrary small u,
(Number of ciphertexts vulnerable to repeated encryption attacks) ≤ S _Rp S _Rq
Becomes gcd ( ^eu− 1, φ (p)) ≦ _SRp , gcd ( ^eu− 1, φ (q)) ≦ _SRq (11)

(D) Condition (11) is gcd (e ^u− 1, φ
(P) φ (q)) ≦ S _Rp S _Rq Also, φ
(P) φ (q) = (p-1) (q-1) = S Rp S Rq r p
Since r _q p ₀ q ₀ , and S _Rp S _Rq is a product of small prime numbers, and r _p r _q p ₀ q ₀ is a large prime number, condition (11) further satisfies the following condition (12) Is equivalent to _{^{gcd (e u -1, r p}} r q p 0 q 0) = 1 ... (12)

(E) The condition (12) is equivalent to the following condition (13). ^eu ≠ 1 (mod r _p ), ^eu ≠ 1 (mod r _q ), ^eu ≠ 1 (mod p ₀ ), ^eu ≠ 1 (mod q ₀ ) ... (13) Whether it is satisfied for a small u is determined by u | lcm (φ (r _p ), φ (r _q ), φ (p ₀ ), φ
It is sufficient to check whether or not (q ₀ )) is satisfied.
φ (r _p ) = S _rp R _p ′, φ (r _q ) = S _rq R _q ′, φ
Since (p ₀ ) = S _p0 p ₀ ′, φ (q ₀ ) = S _q0 q ₀ ′, the condition of small u is as follows (14). u | lcm (S _rp , S _rq , S _p0 , S _q0 ) (14)

(F) Note that the conditions (11) and (13) are equivalent. From (E), it can be seen that the maximum number of u satisfying the condition (14) is upq = lcm (S _rp , S _rq , S
_When the following condition (15) is satisfied with respect to _p0 , _Sq0 ), the condition (11) is not satisfied for an arbitrary small u, and as a result, (ciphertext vulnerable to repeated encryption attacks) ) ≦ S _Rp S _Rq is satisfied. gcd (e ^upq −1, φ (p)) ≦ S _Rp , gcd (e ^upq −1, φ (q)) ≦ S _Rq (15)

(G) Since the condition (15) is equivalent to the condition (9), if the above conditions (5) to (9) are satisfied, (the number of ciphertexts vulnerable to the repetitive encryption attack) ≦ S _Rp
S _Rq .

[0031]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be specifically described below with reference to the drawings showing the embodiments. In the following embodiment, a case where a prime key of the RSA encryption is generated will be described.

FIG. 4 is a diagram showing an example of the entire configuration when the prime number generating device of the present invention is realized using a computer. The program exemplified here includes S1 to S7 and S11 to S24 shown in FIGS. 1, 2, and 3, and is recorded on a recording medium described below.

In FIG. 4, a recording medium 11 that is connected to the computer 10 on-line is, for example, a WWW (World Wide Web) server computer that is installed separately from a place where the computer 10 is installed. The program 11a is recorded as follows. The computer 10 generates a prime key of the RSA encryption by controlling the computer 20 by the program 11a read from the recording medium 11.

The recording medium 12 provided inside the computer 10 uses a built-in hard disk drive or ROM, for example, and the recording medium 12 stores the program 12a as described above. The program 10a read from the recording medium 12 controls the computer 10 so that the computer 10 generates a prime key of the RSA encryption.

The recording medium 13 used by being loaded into the disk drive 10a provided in the computer 10 is a transportable medium such as a magneto-optical disk, a CD-ROM or a flexible disk. The program 13a is recorded as follows. The program 13a read from the recording medium 13 controls the computer 10 so that the computer 10 generates a prime key of the RSA encryption.

FIG. 5 is a block diagram showing an example of the internal configuration of the computer 10. Inside the computer 10, a CPU
1, the recording medium 12 connected to the bus 2
A disk drive 10a, an I / O port 3 connected to an external keyboard and mouse, a RAM 4 for storing an intermediate value or the like in a prime generation process, a prime generation unit 5 for generating a prime, There is provided a prime number determining unit 6 for determining whether or not a random number is generated, and a random number generating unit 7 for generating a random number of a desired size.

Next, a specific example of a process of generating a prime number serving as a prime key of the RSA encryption will be described. In the following example, as the prime number determination method, the Pocklington method, which is one of the deterministic prime number determination methods, and the Mill, which is one of the stochastic prime number determination methods
The er-Rabin method is used. These prime number determination methods will be briefly described below.

The Pocklington method is described in U. Maurer, ^ Fast gener
ation of secure RSA-moduli withalmost maximum dive
rsity ", Advances in Cryptology-EUROCRYPT'89 (LNCS43
4), pp. 634-647, 1990, and has the following algorithm: Determining inputs a prime candidate _{p = 2h p p '+ 1} .
However, p 'is a prime number, p' is a> h _p. Select a random number a. a ^p-1 ≡1 (mod p) is determined. If true, the process proceeds; otherwise, p is determined to be the number of composites and the process ends. The following condition (16) is determined. If true, p is determined to be a prime number, and the process ends. Otherwise, p is determined to be the number of composites, and the process ends.

[0039]

(Equation 3)

The Miller-Rabin method is described in “Introduction to Cryptography Theory”.
(Eiji Okamoto, Kyoritsu Shuppan) ”on page 16 in“ Prime Number Judgment (Rabin Method) ”and has the following algorithm. However, let s be a prime candidate and let A be a product of small primes. (I) If gcd (s, A) ≠ 1, s is determined to be the number of composites, and the process ends. (II) s = 1 + 2 k w (w: odd) and a k, calculates the w. (III) The following (i) to (v) are repeated from i = 1 to L. (I) randomly generate x satisfying 1 <x <s (ii) y = x ^w (mod s) (iii) j = 0 (iv) j <k, y ≠ 1 and y ≠ s−1 As long as y = y ² (mod s), j = j + 1 (v) If j = k or (j> 0 and y = 1), determine s as a composite number and end. (IV) Determine s as a prime number. To end.

In the following example, S _p0 = 2, w = 2 ³²
, A prime key of the 512-bit RSA encryption is generated.

FIG. 6 is a flowchart showing the overall processing procedure in the embodiment for generating a 512-bit prime number serving as a prime number key.

[0043] First of all, after fixing to w = 2 ³² (step S
31), generating a 259-bit prime p ₀ '(step S
32). Using the Pocklington method, it is determined whether p ₀ = 2p ₀ '+1 is a prime number (step S33). If it is not a prime number (S33: NO), another prime number p ₀ 'is generated (S32). If it is a prime number (S33: YES), a large 252-bit random number _Rp is generated (step S34).

[0044] performing a condition judgment regarding the random number R _p (step S35). 7, FIG. 8 is a flowchart showing the contents of a condition determination processing for this R _p. First, after inputting this random number R _p (step S41), S _Rp = 1, r
_p = R _p and i = 1 are set (step S42). t
_i (1 ≦ i ≦ 300) is set as a sequence of 300 prime numbers arranged in ascending order, and it is determined whether or not r _p = 0 (mod t _i ) (step S43).

If r _p = 0 (mod t _i ), then (S
43: YES), it sets _{S Rp = S Rp × t i} , and _{r p = r p / t i} ( step S44), determines whether the S _Rp ² ≦ ^{2 32} (step S45). If a ^{_{S Rp 2 ≦ 2 32 (S45}} : YES), r p = 0 determines whether the (modt _i) (S43). If S _Rp ² > 2 ³² (S45:
NO), the determination result = no is output (step S46), and the process ends.

If r _p = 0 (mod t _i ), then (S
43: NO), after setting i = i + 1 (step S47), i ≦
It is determined whether it is 300 (step S48). i ≦ 30
If it is 0 (S48: YES), r _p = 0 (mod t _i )
Is determined (S43). If i> is 300 (S48: NO), r p using the Miller-Rabin method determines whether a large prime number (step S49). If it is not a large prime number (S49: NO), the determination result = no is output (S46), and the process ends.

[0047] If r _p is a large prime number (S49: Y
_{ES), S rp = 1,} R p '= r p -1, i = 1 and set (step S50), R _p' is determined whether a = 0 (mod t _i) (step S51) . R _p ′ = 0 (mod
t _i ) (S51: YES), S _rp = S _rp ×
t _i , R _p ′ = R _p ′ / t _i (Step S5)
2) It is determined whether or not R _p '= 0 (mod t _i ) (S51).

If R _p ′ = 0 (mod t _i ) is not satisfied (S51: NO), after setting i = i + 1 (step S53),
It is determined whether or not i ≦ 300 (step S54). i
If ≦ 300 (S54: YES), R _p ′ = 0 (mod
t _i ) is determined (S51). If i> 300 (S54: NO), it is determined using the Miller-Rabin method whether or not R _p 'is a large prime number (step S55). If it is not a large prime number (S55: NO), the determination result = no is output (S46), and the process ends.

On the other hand, if R _p ′ is a large prime number (S55: YES), the judgment result = yes, _Srp and S _Rp are output (step S56), and the process is terminated.

[0050] If the condition judgment result regarding the random number R _p is no in S35 (S35: NO), it generates another random number R _p (S34). If the result of the condition determination regarding the random number R _p in S35 is yes (S35: YES), the Pocklingto
It is determined whether or not p = R _p p ₀ +1 is a prime number using the n method (step S36). If it is not a prime number (S36:
NO), another random number _Rp is generated (S34). If p is a prime number (S36: YES), it is determined whether the encryption key e of the RSA encryption satisfies the following condition (17) (step S37).

[0051]

(Equation 4)

If the condition (17) is not satisfied (S37:
NO), another random number _Rp is generated (S34). If the condition (17) is satisfied (S37: YES), the prime number p is output (step S38), and the process ends.

Next, comparison between generation of prime numbers according to the present invention and generation of prime numbers according to the conventional example will be described. (1)-
The conditions in the conventional example shown in (4) and (5) to (1)
Compared with the condition in the present invention shown in (0), the condition of the present invention is wider when the number of ciphertexts vulnerable to the repetitive encryption attack is four, and in the present invention, Even when there are four or more ciphertexts that are vulnerable to attack, it is possible to generate a prime key of the RSA encryption.

Thus, in the present invention, it is possible to generate a RSA encryption prime key that is resistant to repeated encryption attacks at a higher speed than in the conventional example.

In the case where the number of ciphertexts vulnerable to the repetitive encryption attack is four, the RS and the RS according to the present invention and the conventional example are used.
The generation time of the prime key of the A cipher was measured. Table 1 shows the measurement results. Numerical values in Table 1 indicate generation times per one prime number key (prime number p). It can be seen that the generation time can be greatly reduced in the present invention as compared with the conventional example.

[0056]

[Table 1]

[0057]

As described above, in the present invention, even when the number of ciphertexts that are vulnerable to repeated encryption attacks is suppressed to four, the prime number key of the RSA encryption can be generated faster than in the conventional example described above. In addition, even when the number of ciphertexts that are vulnerable to repeated encryption attacks is set to more than four, it is possible to generate a prime key of the RSA encryption.

[Brief description of the drawings]

FIG. 1 is a flowchart showing a procedure for generating a prime number according to the present invention.

FIG. 2 is a flowchart showing a procedure of a condition determination process (S5) for R _{p in} FIG. 1;

FIG. 3 is a flowchart illustrating a procedure of a condition determination process (S5) for R _{p in} FIG. 1;

FIG. 4 is a diagram illustrating an example of an overall configuration when a prime number generation device of the present invention is implemented using a computer.

FIG. 5 is a block diagram illustrating an example of an internal configuration of a computer.

FIG. 6 is a flowchart showing a specific prime number generation processing procedure according to the present invention.

FIG. 7 is a flowchart showing a procedure of a condition determination process (S35) for R _{p in} FIG. 6;

FIG. 8 is a flowchart showing a procedure of a condition determination process (S35) relating to R _{p in} FIG. 6;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 CPU 5 Prime number generation part 6 Prime number judgment part 7 Random number generation part 10 Computer 11,12,13 Recording medium

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Kazuhiro Yokoyama 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa Prefecture Inside Fujitsu Limited (72) Inventor Naoya Torii 4-1-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa No. 1 Fujitsu Limited F term (reference) 5B056 AA04 BB11 BB42 HH00 5J104 AA23 JA28 NA02 NA08 NA27 9A001 EE03

Claims (5)

[Claims] 1. A method for generating a prime number serving as a prime key of an RSA encryption, comprising the steps of generating a prime p ₀ ′, generating a random number S _p0 , and p ₀ = S _p0 p ₀ ′ +1 and whether the determining whether, when the p ₀ is a prime number, and generating a random number R _p, the random number R _p is less than or equal to (a), whether or not the condition (b) And determining whether p = R _p p ₀ +1 is a prime number when the random number R _p satisfies the conditions (a) and (b), And a step of generating p as a prime number serving as the prime key when the condition (c) is satisfied. _{R p = S Rp r p ...} (a) r p = S rp R p '+1 ... (b) gcd (e up -1, p-1) ≦ S Rp ... (c) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 ) 2. A method for generating a prime number serving as a prime key of an RSA encryption, comprising the steps of: generating a prime p ₀ ′, generating a random number S _p0 , and p ₀ = S _p0 p ₀ ′ +1. A step of determining whether or not the random number is present, a step of generating a random number R _p when the p ₀ is a prime number, and a step of generating the random number R _{p according} to the following conditions (d), (e), and (f). and whether the determining meets, the random number R _p is (d),
When the conditions of (e) and (f) are satisfied, p = R _p p ₀ +
Determining whether 1 is a prime number; determining whether the following condition (g) is satisfied;
(G) generating p as a prime number serving as the prime key when the condition (g) is satisfied. _{R p = S Rp r p ...} (d) r p = S rp R p '+1 ... (e) S Rp 2 ≦ w ... (f) gcd (e up -1, p-1) ≦ S Rp ... (g ) Where r _p , R _p ′: prime S _Rp , S _rp : product of primes e: RSA encryption key up = lcm (S _rp , S _p0 ) w: maximum of ciphertext vulnerable to repeated encryption attacks Quantity 3. An apparatus for generating a prime number serving as a prime key of an RSA encryption, comprising: means for generating a prime p ₀ ′;
means for generating _p0 , means for determining whether or not p ₀ = S _p0 p ₀ '+1 is a prime number; means for generating a random number R _p when p ₀ is a prime number; R _p is less than or equal to (h), means for determining whether or not the condition (i), the random number R _p is (h), if the condition is satisfied in _{(i), p = R p} p 0 Means for determining whether or not +1 is a prime number; means for determining whether or not the following condition (j) is satisfied; and when the condition of (j) is satisfied, p is used as the prime key. Means for generating a prime number. _{R p = S Rp r p ...} (h) r p = S rp R p '+1 ... (i) gcd (e up -1, p-1) ≦ S Rp ... (j) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 ) 4. The method according to claim 1, wherein the prime number p generated according to claim 1 or 2 is used as a prime number key for encryption.
SA encryption method. 5. Program code means for causing a computer to generate a prime p ₀ ′ on a computer-readable recording medium on which a program for generating a prime serving as a prime key of an RSA encryption is recorded. Program code means for causing the computer to generate a random number S _p0, and program code means for causing the computer to determine whether p ₀ = S _p0 p ₀ '+1 is a prime number, determining if p ₀ is a prime number, and program code means for generating a random number R _p on the computer, the random number R _p is less than or equal to (k), whether or not the condition (l) Program code means for causing the computer to do the following: if the random number R _p satisfies the conditions (k) and (l),
= Program code for the program code means for causing the computer that R _p p ₀ +1 is determined whether the prime, to determine whether or not the condition of the following (m) to the computer And a program code means for causing the computer to generate p as a prime number serving as the prime key when the condition (m) is satisfied. _{R p = S Rp r p ...} (k) r p = S rp R p '+1 ... (l) gcd (e up -1, p-1) ≦ S Rp ... (m) where, r _p, R _p' : Prime numbers S _Rp , S _rp : product of prime numbers e: RSA encryption key up = lcm (S _rp , S _p0 )