JP2002268546A - Verifiable cipher method, device therefor, program therefor and recording medium therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely verify propriety by zero knowledge without the danger of leaking secret information s. SOLUTION: A transmitter ciphers the secret information s by the public key (Okamoto - Uchiyama cipher method) of a third party, obtains c=gi <s> hi <r> mod ni , performs a unidirectional function to s by using the public key of the transmitter, obtains w=g<s> mod n, selects random numbers u consisting of [0, 2<k> ] and v consisting of [0, 2<3k> ], obtains a=gi <u> hi <v> mod ni and b=g<u> mod n, obtains the hash value e=H (a, b) of the combination of (a) and b, obtains x=u-es and y=v-er and sends c, w, x, y and e to a verifier. The verifier verifies that x consisting of [0, 2<k> ) and e=H(gi <x> hi <y> c<e> , g<x> w<e> ) and confirms that the decipher value s of c and the inverse function value s of w are equal without knowing s.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authenticatable encryption method, an apparatus, a program, and a recording medium used in protocols such as a simultaneous signature exchange method, a key escrow encryption method, and electronic cash in a telecommunication system.

[0002]

2. Description of the Related Art For example, when simultaneous signature exchanges are performed between users A and B using electric communication, it is difficult to perform simultaneous simultaneous exchanges. Is received first, but it is troublesome that the user B does not send the signature SB to the user. Then, the user A encrypts the signature SA using, for example, a public key of an arbitration institution using an authenticatable encryption method and sends it to the user B.
Receives the cryptographic signature and cannot decrypt the cryptographic signature, but can verify that the cryptographic signature is a valid encryption of the signature SA, and if it passes the verification, , User B sends his signature SB to user A
After receiving the signature SB, the user A sends his / her signature SA to the user B. In this way, after transmitting the signature SB, if the signature SA from the user A is not received, the user B submits the previously received encrypted signature to the arbitration organization and decrypts the signature SA. You can get it.

The verifiable encryption method is used for such a purpose, for example. Conventionally, typical examples of the verifiable encryption methods include documents [1] and [2]. Here, a brief description will be given in particular of the Bao method of Document [2], which is a method similar to the present invention. In Bao's method,
The sender, to the secret information ^{_{s, c = g i s mod}} n i, to create a w = g ^s mod p. That is, a function value w obtained by applying the one-way function f to the data c and s obtained by encrypting s is obtained. Here, (g _i , n _i ) is a parameter obtained by simplifying the Okamoto-Uchiyama cipher (see Reference [3]), p is a prime number,
g∈ (Z / pZ) ^X. (Z / pZ) ^X represents an irreducible coset group modulo p.

[0004] ^{_{D sk (c) = f -1}} (w) ( In fact, D _sk
(C) that を ± {log _g w} (mod p))
Create certification information for certifying without revealing.
D _sk is an encryption function for s and a corresponding decryption function, f ⁻¹
Represents the inverse function of the one-way function f. That is, the sender randomly sets u∈ [0, 2 ^k ) ([0, 2 ^k ) to 0 < u <2 ^k
Is selected) and the following a and b are calculated. _{^{a = g i u mod n i}} , b = g u mod n Next, using the hash function H computes the e = H (a, b) , determining x by the following equation.

X = u-es∈Z where ∈Z represents multiplication and subtraction of simple numerical values.
You. The sender verifies c and w with the certification information (x, e).
Send to witness. The verifier receives c, w, x, and e
And e ′ = H (g_i ^xw^e, g^xw^e) Is calculated and whether or not the calculation result e ′ is equal to the received e
Verify that If c, w, x, e are correct,
Since x = u-es, g_i ^xw^e= G_i ^u-es(G ^s)^e
= A, g^xw^e= G^u-es(G^s)^e= B and e =
e ′, and the value s obtained by decoding c and the inverse function value s of w become
It can be verified that they are equal.

[0006]

The Bao's method is as follows:
c = g _i ^s mod n _i and Okamoto - because you are using a material obtained by simplifying the Uchiyama encryption, together with the input w = g ^s mod n, may have leaked a lot information about the secret information s is there.

[0007]

The present invention is based on the original Okamoto-
Use Uchiyama encryption. However, the parameters used are slightly changed, and the effects of the present invention can be obtained based on the changes. This change will be described below. First, in the conventional Okamoto-Uchiyama cipher, the public parameters are (n, g, h,
k) and the secret parameters are (p, q, L (g _p )). Here, n = p ² q, p and q are prime numbers, and g is (Z / n
In Z) ^X of the original, when you consider the g and (Z / p ² Z) ^X of the original (ie, ^{g ^ = g mod p 2)} g ^ of order ♯ <g ^> is a multiple of p (ie p1 ♯ <g ^>).
Further, h is defined by h = g ⁿ mod n. The encryption is based on the following equation.

[0008] ^{_{E PK OU (m; r)}} = g m h r mod n where plaintext m∈ {0,1} ^k, the random number r∈ {0,1} ^3k decoding D by the following equation _SK ^OU (C) = L (C ^p-1 mod p ² ) / L (g _p ) (mod
p) where g _p = g ^p−1 mod p ² , L (x) = (x−1) / p
It is. In one invention, the public parameter and the secret parameter are basically the same as those of the Okamoto-Uchiyama cipher, but with the following restrictions. n = p ² q, p and q are prime numbers,
That is, p '= (p-1) / 2, q' = (q-1) /
Let 2 also be a prime number. Further, g∈ (Z / nZ) such that ♯ <g ^> = p · p ′ (g ^ = g mod p ² ) ♯ <g ^^> = q ′ (g ^^ = g mod q) Take ^X. Further, h = g ^nt mod n (t∈ ｛0, 1｝ ^3k ), and t is kept secret. As a result, the amount of calculation for verification is increased as compared with the Bao method, but there is an advantage that security proof is attached. In the proposed method, it can be proved that the information about the secret s does not leak beyond the information leaking from the input w (= g ^s mod n). However, such a thing cannot be proved by the Bao method.

[0009]

FIG. 1 shows a system to which the present invention is applied.
1 shows a configuration example of a system. Sender device 11 is verifier device 12
And a communication line 13. Sender device 1
1 is like an IC card, whereas a verifier
Even if the device 12 is like a terminal to which an IC card is attached
Good. The sender device 11 and the verifier device 12 are (n, g)
And (n_i, G_i, H_i, K) and have a common
It has a hash function H function. (N, g) is the sender
Is the public key of the device 11, where n is an arbitrary integer and g∈ (Z / n
Z)^XIt is. (N_i, G_i, H_i, K) are the restrictions described above.
Is the public key of Okamoto-Uchiyama cipher that gave
May be the one of the
Public third party devices other than the belief device 11 and the verifier device 12
Key, for example, the simultaneous signature described in the section of the prior art.
By name it is the public key of the mediator. n_i= P_i ^Twoq_iAnd p
_i, Q _iIs a prime number. The hash function H is (Z / nZ)^X
And (Z / n_iZ)^XWith values belonging to
And outputs a value consisting of k 'bits 0 and 1. here
k, k '(output value size of H), log n (n size of n)
) Is k− (log n + k ′) ∈O (k) (k
Satisfies the relationship For example, as a recommended value
k = 1280 (bit), log n = 1024 (bi
t), k '= 128 (bit).

FIG. 2 shows an example of the functional configuration of the sender apparatus 11, and FIG. 3 shows an example of the processing procedure. Common information n in the storage unit 101 of the sender apparatus _{11, g, n i, g} i, h i,
k is stored. The secret information s is input from the outside through the input unit 102, or is generated or held inside the sender device 11. When the secret information s is input for verifiable encryption (S1), the secret information s and the public keys g _i , h _i , and n _i are input to the encryption unit 103. The random number generator 103a generates a random number r, performs the following encryption operation on s, and generates encrypted data c (S2).

[0011] _{^{c = g i s h i r}} mod n i (1) The s and the public key g of the sender apparatus 11, n is input to the one-way function unit 104, one-way function value w by the following equation Is calculated (S3). w = g ^s mod n (2) It is determined that the value obtained by decrypting the public key encrypted data c is equal to the inverse function value of the one-way function value w without disclosing the secret information s and without any conversation. Proof information C that can be verified by the verifier device 12 in a format is added to c and w and transmitted to the verifier device 12. Hereinafter, a method of generating the certification information C will be described.

The sender device 11 first randomly selects u∈
[0,2 ^k ), v∈ [0,2 ^3k ), that is, a random number generation unit 105 generates a random number u of 0 < u <2 ^{k, and} a random number generation unit 106 generates 0 < v <2 ^3k A random number v is generated (S4). These random numbers u, v and the public keys g _i , h _i , n _i are input to the modular exponentiation multiplication unit 107, and the following calculation is performed (S5). _{^{a = g i u h i v}} mod n i (3) The u and public key g, n is input to the remainder power calculator 108 following calculation is made (S6).

B = ^gu mod n (4) These calculation results a and b are input to the hash function unit 109, and e = H (a, b) (5) is calculated (S7). This hash function value e, random number u, secret information s Is input to the multiplication / subtraction unit 111, and x = u-es∈Z (6) is calculated (S8). Here, ∈Z indicates simple multiplication and subtraction of numerical values u, e, and s. Further, e, the random number v, and the random number r are input to the multiplication / subtraction unit 112, and y = v−er∈Z (7) is calculated (S9). Thus, the secret information s Is generated as proof information C = (x, y, e). The output unit 113 outputs the encrypted data c, the one-way function value w, and the certification information C to the verifier device 12 (S10). Steps S2 and S3 may be performed first, and similarly, steps S5 and S6 and steps S8 and S9 may be performed first.

In the sender device 11, each unit is a control unit 11
4. Next, a verification process in the verifier device 12 will be described. FIG. 4 shows an example of the functional configuration of the verifier device 12, and FIG. 5 shows an example of the processing procedure. The storage unit 201 of the verifier device 12 stores a common information key (n, g) (g _i , h _i , k) of the sender device 11.
The encrypted data c, the one-way function value w, and the proof information C =
When (x, y, e) is received, the storage unit 20
1 (S1).

[0015] received x and the public key k is input to the determination unit 203, x is checked whether the range 0 <x <a 2 ^k (S2). If x satisfies this condition, the received x,
y, c, e and public key g _i, h _i is input to a power multiplication unit ^{_{204, a '= g i x}} h i y c e (8) is calculated (S3). Expression (6) is applied to x, and Expression (7) is applied to y.
Substituting equation (1), respectively to the c, becomes ^{_{a '= g i (u-}} es) h i (v-er) (g i s h i r) e = g i u h i v (9) . X, e, w received by the power multiplication unit 205
Public key g is ^{input, b '= g x w e} (10) is calculated (S4). Substituting equation (6) for x and equation (2) for w gives b '= g ^{(u-es) ges} = ^gu (11). These calculation results a ′ and b ′ are used in the hash function unit 2
06 and e '= H (a', b ') (12) is calculated (S5). This calculation result e 'and the received e
Is input to the comparison unit 207, and it is checked whether or not both are equal (S6). If they are equal, a pass is output (S
7). If the value obtained by decoding c from Expressions (8) and (9) is s, a '= a. If the inverse function value of w is s from Expressions (10) and (11), b' = B, and from equations (5) and (12), if e ′ = e, the decoded s and w of c
Is equal to the inverse function value s.

Therefore, when an output from the determination unit 203 that satisfies the condition x and an output from the comparison unit 207 indicating that e and e 'are equal are input to the output unit 208, it indicates a pass, that is, the reception has been completed. A signal indicating that the decoded value of c is equal to the received inverse function value of w is output. When an output indicating that the condition is not satisfied from the determination unit 203 and an output indicating that the condition is not equal are input from the comparing unit 207 to the output unit 211, the received decoded value of c and the inverse function value of w are equal. No, that is, a signal indicating that the data is not correctly verifiable encrypted data is output (S8). Note that any of steps S2 and S6 may be performed first, and steps S3 and S4 may be performed first. In the verifier device 12, each unit is the control unit 2
09.

Each of the sender device 11 and the verifier device 12 can also function by executing a program by a computer. In this case, for example, as shown in FIG. 6, when showing the sender device 11, the storage unit 121, the random number generation unit 122, the hash function unit 123, the remainder power multiplication unit 1
24, remainder exponentiation calculation unit 125, multiplication / subtraction unit 126, program memory 127, CPU (microprocessor)
128, an output unit 129 is connected to the bus 131, and a program for causing a computer to execute, for example, the method shown in FIG. 2 from a CD-ROM, a floppy (registered trademark) disk, a magnetic disk, or the like is installed in the program memory 127. Or downloaded via a communication line, and stores the program in the memory 127 into the CPU 12
8 is executed, and in step S2, the remainder power multiplication unit 124
To calculate equation (1) as a subroutine, and step S
In step 3, the remainder power calculator 125 calculates equation (2).
In step S4, the random number generation unit 122 makes the random number u , V are generated, and in step S5, the modular exponentiation multiplying unit 124 calculates equation (3). In step S6, the modular exponentiation calculating unit 1
In step S7, the hash function operation unit 123 calculates expression (5). In step S8, the multiplication / subtraction unit 126 calculates expression (6).
Causes the multiplication / subtraction unit 126 to calculate Equation (7), and
At 10, the output unit 129 is sent to the verifier device 12.

[0018]

According to the present invention, it can be proved that D _sk (c) ≡ ± {log _g w} (mod p _i ) for the inputs c and w, while the secret information s the information is input w (= g ^s mod n) leaking information more from the can proved that does not leak. D _sk is a decryption function for the public key encryption function for s. In fact, we can show the following theorem.

The present invention satisfies the following properties. -Completeness: When a correct prover executes a protocol correctly, the probability that a verifier succeeds in verification is 1-2.
^{-(k-log nk} ' ⁾ . Substituting the recommended values for k, n, and k 'yields a success probability of 1-2 ^-28 , which is approximately equal to one. Therefore, if k ′ + log n <k, completeness is always satisfied with an overwhelming probability, the secret s is not leaked, and the verifier can perform complete verification. Zero knowledge: The knowledge leaked when the correct prover correctly executes the protocol is statistically at most 2- ^{(k-log nk} ' ⁾ . Here, the leaked knowledge is the knowledge defined in the statistical zero-knowledge proof. According to the above numerical values, the leaked knowledge is at most ^2-28 , and the knowledge is not substantially leaked.

Soundness: If there is a prover that can satisfy the verification protocol of the verifier device with the probability ε,
The probability that the prover really has the knowledge is 1-｛(k ')
a ^{-logk '+ (k') logk} '/ 2 k' + ε SRSA} It can be checked in time ^{O (k C / (ε-} 2 k ') 2).
Where C is a constant. ε _SRSA is proved by StrongRSA
The probability of solving a problem. That is, the secret s is guaranteed to be true.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration example of a system to which the present invention is applied.

FIG. 2 is a diagram showing a functional configuration example of a sender device according to the present invention.

FIG. 3 is a flowchart showing an example of a processing procedure of the apparatus shown in FIG. 2;

FIG. 4 is a diagram showing a functional configuration example of a verifier device according to the present invention.

FIG. 5 is a flowchart showing an example of a processing procedure of the apparatus shown in FIG. 4;

FIG. 6 is a diagram showing an example of a functional configuration in the case of being configured by a sender device 11 and a computer. References [1] G.Ateniese.Efficient verifiable encryption (and
fair exchange) of digital signature.In Proceeding
s of the Fifth Annual Conference on Computerand Co
mmunications Security, pages 138-146, Singapore, Nov
ember 1999.ACM. [2] F.Bao.An efficient verifiable encryption schem
e for encryption of discrete logarithm.In JJQui
squater and B. Schneier, editors, Smart Card Research
and Aplications, Third International Conference, CA
RDIS'98, volume 1820 of Lecture Notes in Computer S
cience, pages 213-220, Louvain-la-Neuve, Belgium, 200
0. Springer-Verlag. [3] T.Okamoto and S.Uchiyama. A new public-key cry
ptosystem as secure asfactoring.In K. Nyberg, edito
r, Advances in Cryptology-EUROCRYPT'98, Lecture Not
es in Computer Science, pages 308-318.Springer-Verl
ag, 1998.

────────────────────────────────────────────────── ───

[Procedure amendment]

[Submission date] March 27, 2001 (2001.3.2)
7)

[Procedure amendment 1]

[Document name to be amended] Statement

[Correction target item name] Claim 1

[Correction method] Change

[Correction contents]

Claims (6)

[Claims] 1. The sender device and the verifier device are respectively (n, g) (n is an arbitrary integer, g∈ (Z / nZ) ^X ),
The public key (n _i , g _i , h _i , k) of the Okamoto-Uchiyama cipher is held as common information, and a hash function H function is provided. The sender device generates a random number r and generates secret information s∈ [0 ,
2 ^k ), using the common information, an encryption function c = g
_i ^s, create the encrypted data c by computing the h _i ^r mod n _i, and creates a function value w by calculating the one-way function w = g ^s mod n with respect to the secret information s using a common information , The sender device further has a random number u belonging to [0,2 ^k ], [0,
A random number v that belong to 2 ^3k] respectively generated random number u, v seek the common information using _{^{a = g i u, h i}} v mod n i computes and calculation results a, common information to the random number u Is used to calculate a function value b by calculating a one-way function b = g ^u mod n, and a hash function e = H (a, b) is calculated for a pair of the above calculation result a and the function value b. e, x = u-es is calculated using the secret information s, the random number u, and the hash value e, y = v-er is calculated using the random number r, v, and the hash value e. , W and the proof information x, y, e to the verifier device, and the verifier device receives the encrypted data c, the function value w, and the proof information (x, y, e), and x becomes [ Ensure that belong to 0, 2 ^k], using the common information and the received data _{^{H (g i x h i y}} c e, g x
w ^e ) is calculated, and it is checked whether or not the calculated result is equal to the received e. If they are equal, it is determined that the secret information s of the encrypted data c is equal to the variable value s of the one-way function value w. A verifiable cryptographic method characterized by guaranteeing. 2. Common information n, g, n _i ,
a storage unit in which g _i , h _i , and k are stored; n is an arbitrary integer; g∈ (Z / nZ) ^X , n _i , g _i , h _i , and k are public keys of the Okamoto-Uchiyama cipher; _{When i} = p _i ² q _i , p _i and q _i are prime numbers, the secret information s and the above g _i , h _i , and n _i are input, a random number r _i is generated, and c = g _i ^sh _i an encryption unit to calculate the ^r mod n _i and outputs the encrypted data c, the s and the g, n are input, w = g ^s mod n and calculates and outputs a function value w a one-way function A first random number generating unit that receives the ^k and generates a random number u satisfying 0 < u <2 ^k ; and generates a random number v that ^{receives the} k and inputs 0 < v <2 ^3k a second random number generator, the random number u and v, the g _i, h _i, n _i is _{^{input, a = g i u h i}} v mod n i the calculation result remainder exponentiation multiplier for outputting a calculated Part, the random number u and the g, n Is a remainder power calculator for outputting a b = g ^u mod n to calculate and calculation results b, the calculation result a, b are inputted, the hash value calculated hash function value e = H (a, b) e, a first multiplication / subtraction unit that receives the random number u, the hash value e, and the secret information s, calculates x = u−es, and outputs a calculation result x, v, the hash value e, and the random number r are input, a second multiplication / subtraction unit that calculates y = v−er and outputs a calculation result y, the encryption data c, the function value w, and the calculation result x ,
and y an output unit for outputting the hash value e to the verifier device. 3. The common information n, g, n _i ,
a storage unit in which g _i , h _i , and k are stored; n is an arbitrary integer; g∈ (Z / nZ) ^X , n _i , g _i , h _i , and k are public keys of the Okamoto-Uchiyama cipher; _i = p _i ² q _i , p _i and q _i are prime numbers, a receiving unit for receiving encrypted data c, a function value w, and proof information x, y, e; a determination unit for determining whether or not x belongs to the range of 0 < x <2 ^k ; the above x, y, e, c and the above g _i , h _i are inputted; a ′ = g _i ^x h _i ^y calculate the c ^e calculation result a 'and exponentiation multiplication unit for outputting, the x, e, w and the g is input, b' = g ^x w ^e calculated to calculate the result b 'and outputs the exponentiation A calculation unit; a hash function unit that receives the calculation results a ′ and b ′, calculates a hash function value e ′ = H (a ′, b ′), and outputs a hash value e ′; Value e 'is equal A comparison unit for comparing whether or not it is true, an output indicating true from the determination unit, and an output indicating true from the comparison unit are input, the decryption result of the encrypted data c and the function value w An output unit that outputs a signal indicating that the inverse function value is equal to the inverse function value. 4. Common information n, g, n _i , with the verifier device
g _i, h _i, k is a storage unit that is stored, (n is an arbitrary ^{integer, g∈ (Z / nZ) X} , n i, g i, h i, k is Okamoto - Publishing Uchiyama encryption key, p in _{^{n i = p i 2 q i}} i, q i
Is a prime number), and a computer for verifying and encrypting the secret information s at the sender device is provided by using the secret information s and the above g _i , h _i , n _i, and a random number r _i
It _{^{generates, c = g i s h i}} r mod n i calculated to means for obtaining the encrypted data c, the s and the g, via the use of an n w = g ^s mod n The calculated function value w Means for obtaining, means for generating a random number u satisfying 0 < u <2 ^k for ^k , means for generating a random number v satisfying 0 < v <2 ^3k for k, the random numbers u and v , by using the _{g i, h i, n i} , a = g i u h i v mod n calculations to means for obtaining the calculation result a, the random number u and the g, with n, b = g means for calculating ^u mod n to obtain a calculation result b; means for obtaining a hash function value e = H (a, b) for a combination of the calculation results a and b to output a hash value e; Means for calculating x = u-es using the hash value e and the secret information s and outputting a calculation result x, the random number v, the hash value , By using the random number r, y = v-er the calculated and means for obtaining a calculation result y, the encrypted data c, the function value w, the calculation result x,
y, a means for outputting the hash value e to the verifier device. 5. Common information n, g, n _i , with the sender device
g _i, h _i, k is a storage unit that is stored, (n is an arbitrary ^{integer, g∈ (Z / nZ) X} , n i, g i, h i, k is Okamoto - Publishing Uchiyama encryption key, p in _{^{n i = p i 2 q i}} i, q i
Is a prime number), the verifier uses a computer to verify the verifiable cipher received by the verifier device, means for receiving encrypted data c, function value w, proof information x, y, e. Determining means for determining whether or not x belongs to the range of 0 < x <2 ^k by using the above x, y, e, c and the above g _i , h _i , a ′ = g _i ^x h _i ^y c ^e calculated and the calculation result a of the 'means for outputting, the x, e, using the w and the ^{g, b' = g x w} e calculated to means for outputting a calculation result b ', Means for calculating a hash function value e '= H (a', b ') using the above calculation results a', b 'and outputting a hash value e'; whether or not e is equal to hash value e ' Comparing means for comparing the true and false outputs from the determining means and the true and false outputs from the comparing means. Verifiable encryption verification program for the decoding result and, means for outputting a signal indicating that is equal to the inverse function value of the function value w, to function as a. 6. A computer-readable recording medium on which the program according to claim 4 is recorded.