JP2006201468A - Method, system, and program for secret calculation - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method for secret calculation of an exclusive OR enabling reduction of process time even without the knowledge of a value inputted to a function. <P>SOLUTION: A rational point group on an elliptic curve is expressed by G, an element of G is expressed by P, the order of P is expressed by p, Q is set as Q=xP with respect to a secret key x serving as an element of a set ä1, ..., p}, and (G, p, P, Q) is assumed as a public key. A cryptographic function E of a is defined as E(a, r)=(A, B)=(rp, (r+a)Q). Ciphertexts (A, B), (X, Y) of a, b are inputted to a controller, and (A, B) is transmitted to a ciphertext converter first. The ciphertext converter calculates the ciphertext (A', B') of (A, B), transmits it to each decoder. Each decoder calculates x<SB>i</SB>A' and transmits it to the controller. The controller calculates xA', calculates ciphertext (C, D) with respect to the decoding result of (A', B'), and transmits it to the ciphertext converter. The ciphertext converter calculates (C', D') and transmits it to the controller. The controller recognizes (C', D') as the ciphertext of a+b (an exclusive OR). <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to the technical field of information security, and more particularly, to a technique that makes it possible to calculate a function and obtain an output result without knowing an input value to the function by applying a cryptographic technique.

  Conventionally, as means for enabling calculation of a function and acquisition of an output result without knowing an input value to the function, for example, a technique proposed in Non-Patent Document 1 (hereinafter abbreviated as ST04). There is. If STO4 is used, a certain (multiple) numerical value is converted by using a certain cryptographic algorithm to conceal the numerical value, and the converted numerical value is used as input to allow a plurality of devices to cooperate in the calculation. Thus, the output result of the function can be obtained without leaking the input (original) numerical value. Further, it is possible to verify the validity of the output result, that is, whether each device has performed the correct processing. Hereinafter, a method capable of calculating the function and obtaining an output result without knowing an input value to the function will be referred to as a secret calculation method for convenience.

  In STO4, ciphertexts E (a) and E (a) of a and b (assuming that a and b are either 0 or 1) with respect to the encryption algorithm E specified in Non-Patent Document 1. If b) is given, a plurality of devices cooperate in the calculation, so that a + b ciphertext E (a + b) and ciphertext E (a * b) can be obtained without knowing a and b. For convenience, “*” here means exclusive OR. “+” Is a logical sum. Further, for example, by using the distributed decryption technique proposed in Non-Patent Document 2, only a ciphertext (for example, E (a + b) or E (a * b)) in which a certain number of devices or more cooperated in the decryption calculation is decrypted. it can.

B. Schoenmakers and P.M. Tuyls, “Practical Two-Party Calculation based on the Conditional Gates,” ASIA CRYPT 2004, Dec. 2004. T.R. Pedersen, “A threshold cryptosystem without a trusted party,” Advances in Crytology-EUROCRYPT '91, LNCS 547, pp. 522-526, Springer-Verlag, 1991.

  If the numerical value of the input consisting of 0 or 1 is encrypted and the result of the addition of the numerical values and the exclusive OR (the ciphertext) can be obtained, the logical sum (OR) and logical product of the numerical values The result of (AND) can be obtained. That is, in theory, many functions can be calculated with the input numerical value encrypted. However, in ST04, in order to calculate E (a * b) from E (a) and E (b), it is necessary to convert E (a) to E (a ′) once based on a certain conversion rule. . Here, a '= 2a-1.

  The first problem to be solved by the present invention is to make it possible to calculate E (a * b) without performing the above conversion, thereby reducing the amount of calculation.

  The second problem to be solved by the present invention is to reduce the overall processing time by making parallel computing more efficient than before. In ST04, there is a place where each device performs processing in order, and it is considered that a certain device may enter a waiting state. The present invention aims to reduce the overall processing time by newly providing a method for reducing the waiting state.

  In addition, as a story accompanying the solution to the first problem, ST04 uses a technique for proving that each device has correctly processed, but the safety is based on a computational assumption. As a result of the discovery of new attack algorithms, the zero knowledge and soundness of confidential information possessed by each device will be lost (property that cannot be proved if processing is incorrect) there is a possibility. Therefore, it can be said that it is very significant from the viewpoint of safety to find another technique that proves that each device has correctly processed.

  Therefore, the third problem to be solved by the present invention is different from the technique proposed in ST04 in order to prove that each device has correctly processed the solution to the first problem. It is to propose the technology.

  Let G be a group of rational points of an elliptic curve defined on a finite field, and let P be an element of G. Let p be the order of P. Then, for the secret key x∈ {1,..., P}, Q = xP, and (G, p, P, Q) is the public key.

At this time, the encryption function E for encrypting the plaintext aε {0,1} is defined as follows.
E (a, r) = (A, B) = (rP, (r + a) Q)
Here, r is a random number between 1 and p.

  The decryption process only needs to calculate xA.

が成り立つことから、秘密鍵ｘを用いることで容易にＥ（ａ,ｒ）を復号できる。するとａ,ｂ∈｛０,１｝の暗号文Ｅ（ａ,ｒ）,Ｅ（ｂ,ｓ）からａ＋ｂの暗号文を求めることは容易である。すなわち、Ｅ（ａ,ｒ）＋Ｅ（ｂ,ｓ）＝（（ｒ＋ｓ）Ｐ,（ｒ＋ａ＋ｓ＋ｂ）Ｑ）が成り立つことから、この操作によりａ＋ｂの暗号文Ｅ（ａ＋ｂ,ｒ＋ｓ）＝Ｅ（ａ,ｒ）＋Ｅ（ｂ,ｓ）が得られる。

Therefore, E (a, r) can be easily decrypted by using the secret key x. Then, it is easy to obtain the a + b ciphertext from the ciphertexts E (a, r) and E (b, s) of a, bε {0,1}. That is, since E (a, r) + E (b, s) = ((r + s) P, (r + a + s + b) Q) holds, the cipher text E (a + b, r + s) = E (a, r) of a + b is obtained by this operation. ) + E (b, s) is obtained.

Next, an outline of a method for obtaining a * b ciphertext from E (a, r) and E (b, s) will be described. This is the main part of the present invention. Here, the ciphertext E (a, r) (= (A, B), E (b, s) (= (X, Y)) of b, bε {0,1} is given to the control device in advance. Suppose that
First, the ciphertext conversion apparatus performs the following processing with (G, p, P, Q), E (a, r) (= (A, B)) as inputs from the control apparatus.
1. A random bit e and a random number t of 1 to p are generated.
2. According to the following, (A ′, B ′) is obtained and transmitted to a plurality of decoding devices.

  Next, a plurality of decoding devices perform distributed decoding as (A ′, B ′) inputs and transmit them to the control device, whereby the control device obtains a decoding result c of (A ′, B ′) (at this time c = A * e (exclusive OR) holds).

The control device performs the following processing on the decryption result cε {0, 1}.
1. Generate a random number w between 1.1 and p.
2. Obtain (C, D) according to the following, and send the ciphertext to the ciphertext converter.

このとき（Ｃ，Ｄ）の復号結果はａ＊ｂ＊ｅとなる。

At this time, the decoding result of (C, D) is a * b * e.

The ciphertext conversion apparatus performs the following processing with (G, p, P, Q), (C, D) as inputs.
1. Generate a random number u between 1.1 and p.
2. According to the following, (C ′, D ′) is obtained and transmitted to the control device.

  Since the decryption result c ′ of (C ′, D ′) satisfies c ′ = a * b, the control device obtains the ciphertext of a * b, that is, (C ′, D ′) by the above operation. Can do.

  According to the secret calculation method of the present invention, it is necessary to convert E (a) to E (a ′) (a ′ = 2a−1) in order to calculate E (a * b) as in the prior art. Therefore, the calculation time can be reduced. In the prior art, the present invention calculates (A ′, B ′) from (A, B) (this is referred to as [Process 1]) and (C, D) to (C ′, D ′). ) Corresponding to the processing for calculating (this is referred to as [processing 2]) (there are processing portions of [processing 3] and [processing 4], respectively) having the same amount of calculation. In the prior art, it is necessary to calculate at the same time. However, in the present invention, since the process is not the same period, for example, when apparatus A finishes [Process 1], the calculation result is immediately transmitted to apparatus B, and apparatus B immediately receives the calculation result as an input. It can be performed. In addition, after finishing [Processing 1], apparatus A can immediately process another input. On the other hand, in the prior art, since the calculation result is transmitted to the apparatus B after finishing [Process 3] and [Process 4], the waiting time of the apparatus B may be longer than that of the present invention. As a result, the present invention can be expected to improve the efficiency of parallel processing, and can be expected to reduce the overall processing time.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
As shown in FIG. 1, the system configuration in the first embodiment includes ten ciphertext generation apparatuses 1,..., N (N is an appropriate natural number), a control apparatus 20, which are connected by the same network 100. The ciphertext conversion device 30 and the decryption devices 1 and 2 of 40 are included. The reason for setting a plurality of decryption devices here is that if there is a single decryption device, the decryption device has the authority to decrypt the input numeric ciphertext, which is clearly taken up by the present invention. However, if a plurality of decoding devices are set as in this embodiment, it is difficult to know the numerical value of the input unless the decoding devices are collated using distributed decoding technology. is there. In the present embodiment, the number of decoding devices is simply two, but in general, any number of two or more may be used.

First, the encryption method used in the present invention will be described with reference to the processing sequence diagram of FIG.
The control device 20 determines one each of the finite field and the elliptic curve by giving parameters for generating the finite field and the elliptic curve (S101), and further rationalizes the elliptic curve defined on the finite field. A group G consisting of points is determined (S102). Further, one element of G is selected and set as P (S103). Next, the order p of P is calculated (S104). Then, the set of (G, p, P) is transmitted to the decoding device 40 (i) (i = 1, 2).

The decryption device 40 (i) receives (G, p, P) as an input, generates a random number x _{i not} less than 1 and not more than p, calculates Q _i = x _i P, and transmits Q _i to the control device 20. (S105 to S108). Here, the decryption device 40 (1) generates a random number x ₁ (S105), calculates Q ₁ = x ₁ P (S106), transmits the Q ₁ to the control device 20, and the decryption device 40 (2) generates a random number x ₂ (S 107), calculates Q ₂ = x ₂ P (S 108), and transmits Q ₂ to the control device 20.

The control device 20 calculates Q = Q ₁ + Q ₂ (S109) and discloses (G, p, P, Q) (S110).

With the above preparation, the encryption process used in the present invention will be described first.
The encryption function E for encrypting the plaintext a∈ {0,1} is expressed by E (a, r) = (A, B) = (rP, (r + a) Q)
It is defined as Here, r is a random number between 1 and p.

Next, the decoding process will be described.
Now, assuming x = x ₁ + x ₂ , E (a, r) can be decoded by calculating xA. That is,

が成り立つことから、ｘＡ＝Ｂであれば復号結果を“０”とし、ｘＡ＝Ｂ−Ｑであれば“１”とする。なお当該計算に関わる装置が全て正しい処理を行えばｘＡ＝ＢまたはｘＡ＝Ｂ−Ｑの何れかが成り立つことは明らかである。したがって秘密鍵ｘを用いることで容易にＥ（ａ,ｒ）を復号できる。ただし実際の復号手順としては、復号装置ｉ（ｉ＝１,２）がｘ_iＡを計算、公開し、その後、制御装置２０がｘＡ＝ｘ₁Ａ＋ｘ₂Ａを求め、復号結果を得ることになる。

Therefore, if xA = B, the decoding result is “0”, and if xA = B−Q, it is “1”. It is obvious that either xA = B or xA = BQ holds if all the devices involved in the calculation perform the correct process. Therefore, E (a, r) can be easily decrypted by using the secret key x. However, as an actual decoding procedure, the decoding device i (i = 1, 2) calculates and discloses x _i A, and then the control device 20 obtains xA = x ₁ A + x ₂ A and obtains the decoding result. Become.

  Next, as a specific secret calculation method, the procedure of the secret calculation method for the basic logic gates (NOT, AND, OR, NAND, NOR) will be described. Here, the ciphertexts E (a, r) and E (b, s) of a, bε {0,1} that are input to the basic logic gate are converted into the ciphertext generating apparatus 10 using the above-described encryption processing method. (1),..., (N), and it is assumed that the ciphertext is given to the control device 20 in advance. It should be noted that here, ciphertext generation device 10 does not mention which E (a, r) and E (b, s) are generated, but actually, the two ciphertexts need to be generated by the same device. It is generally considered that it varies depending on the application.

  The logic functions representing the basic logic gates (NOT, AND, OR, NAND, NOR) can be expressed as follows using exclusive OR (*), addition / subtraction, and constant multiplication.

  First, the NOT process will be described. This process is simple, and the controller 20 receives E (a, r) (= (A, B)) as input, and 1-a ciphertext (A ′, B ′) = (− A, −B + Q). And the ciphertext may be obtained. here,

であるから、（Ａ′,Ｂ′）＝Ｅ（１−ａ，−ｒ）が成り立ち、（Ａ′,Ｂ′）は１−ａの暗号文、すなわちＦ_NOT（ａ）の暗号文となることが分かる。したがって制御装置は、ａの暗号文Ｅ（ａ,ｒ）から、ａを知ることなくＦ_NOT（ａ）の暗号文を計算することができ、更には当該暗号文を取得することができる。

Therefore, (A ′, B ′) = E (1-a, −r) holds, and (A ′, B ′) becomes a ciphertext of 1-a, that is, a ciphertext of F _NOT (a). I understand that. Therefore, the control device can calculate the ciphertext of F _NOT (a) without knowing a from the ciphertext E (a, r) of a, and can further acquire the ciphertext.

  Next, constant multiplication will be described. This process is also simple. The control device 20 receives the constants k and E (a, r) (= (A, B)) and inputs the ciphertext (A ′, B ′) = (kA, kB) of ka. It is only necessary to calculate and obtain the ciphertext. here,

であるから、（Ａ′，Ｂ′）＝Ｅ（ｋａ，ｋｒ）が成り立ち、（Ａ′，Ｂ′）はｋａの暗号文となることが分かる。したがって制御装置２０は、定数ｋ、およびａの暗号文Ｅ（ａ，ｒ）から、ａを知ることなくｋａの暗号文を計算することができ、更には当該暗号文を取得することができる。

Therefore, it is understood that (A ′, B ′) = E (ka, kr) holds, and (A ′, B ′) becomes the ciphertext of ka. Therefore, the control device 20 can calculate the ciphertext of ka without knowing a from the constant k and the ciphertext E (a, r) of a, and can further acquire the ciphertext.

Next, exclusive OR processing will be described with reference to the processing sequence diagram of FIG. This is a main part of the present embodiment.
Assume that each device holds (G, p, P, Q). The ciphertext E (a, r) (= A, B), E (b, s) (= X, Y)) of a, bε {0,1} , (J) to the control device 20 in advance.
First, the control device 20 transmits E (a, r) (= (A, B)) to the ciphertext conversion device 30. Each device holds (G, p, P, Q) in advance.

The ciphertext conversion apparatus 30 receives (E (a, r) (= (A, B)) as input and performs the following processing.
1. A random bit e and a random number t of 1 to p are generated (S111).
2. The ciphertext (A ′, B ′) is calculated according to the following (S112).

  The ciphertext conversion device 30 transmits the ciphertext (A ′, B ′) to the decryption device 40 (1) and the decryption device 40 (2).

The decoding device 40 (1) receives (A ′, B ′) as input, calculates x ₁ A ′, and transmits it to the control device 20 (S113). Similarly, the decoding device 40 (2) receives (A ′, B ′) as input, calculates x ₂ A ′, and transmits it to the control device 20 (S114).

The controller 20 calculates xA ′ = x ₁ A ′ + x ₂ A ′ (S115). If xA ′ = B ′, the decoding result c of (A ′, B ′) is set to “0”, and otherwise (xA ′ = B′−Q) is set to “1” (S116 to S118). . Thereafter, the following processing is performed on the decoding result cε {0, 1}.
A random number w between 1.1 and p is generated (S119).
2. The ciphertext (C, D) is calculated according to the following (S120).

  Then, the control device 20 transmits (C, D) to the ciphertext conversion device 30.

  The process of obtaining the decoding result c from (A ′, B ′) is a process called distributed decoding. According to the above [Non-Patent Document 2], k (> 2) decoding devices. Decoding is possible only when the decoding process cooperates with the decoding process, and more generally, decoding can be performed only when any of the n decoding apparatuses cooperate with the decoding process (here, N and k are values that can be set to any number). However, since the processing procedure is clear from [Non-Patent Document 2], the description thereof is omitted.

  Here, it is confirmed that c = a * e (exclusive OR) holds for the decryption result c. If e = 0, (A ′, B ′) = ((r + t) P, (r + a + t) Q), and therefore (A ′, B ′) = E (a, r + t) holds. That is, c = a = a * 0 holds. On the other hand, if e = 1, (A ′, B ′) = ((− r + t) P, (− r−a + t + 1) Q) = ((t−r) P, ((t−r) + (1− a)) Since Q), (A ′, B ′) = E (1−a, tr) holds. That is, c = 1−a = a * 1 holds. Therefore, it can be seen that c = a * e holds.

  From the same explanation, it is understood that (C, D) is a ciphertext of b * c. That is, if c = 0, b * c = b and (C, D) = (X, Y) + (wP, wQ) = E (b, s + w) holds. On the other hand, if c = 1, b * c = 1−b and (C, D) = (− X, −Y) + (wP, (w + 1) Q) = E (−b, − s + w) holds. Therefore, (C, D) is a ciphertext of b * c.

Next, the ciphertext conversion apparatus 30 performs the following processing with (C, D) as an input.
A random number u between 1.1 and p is generated (S121).
2. The ciphertext (C ′, D ′) is calculated according to the following (S122).

暗号文変換装置３０は、当該暗号文（Ｃ′,Ｄ′）を制御装置２０に送信する。

The ciphertext conversion device 30 transmits the ciphertext (C ′, D ′) to the control device 20.

  Here, since the decoding result c ′ of (C ′, D ′) satisfies c ′ = b * c * e = a * b, the control device 20 does not know a and b by the above processing. , A * b ciphertext, that is, (C ′, D ′). The control device 20 outputs (C ′, D ′) as required (S123).

  Here, it is confirmed that c ′ = a * b holds for the decoding result c ′. If e = 0, since (C ′, D ′) = (C + uP, D + uQ), the decoding result of (C ′, D ′) and the decoding result of (C, D) are clearly equal. That is, c ′ = b * c = b * (a * e) b = a * b holds. On the other hand, if e = 1, (C ′, D ′) = (− C + uP, −D + (u + 1) Q), so if c = 0, (C ′, D ′) = ((− s −w + u) P, (−s−b−w + u + 1) Q) to obtain c ′ = 1−b = b * 1. On the other hand, since c = 0 and e = 1, a = 1 and c ′ = b = ab holds. If c = 1, (C ′, D ′) = ((− s−w + u) P, (s + b−w + u) Q) is obtained, and c ′ = b is obtained. On the other hand, since c = e = 1, a = 0 and c ′ = a * b holds. Therefore, it can be seen that (C ′, D ′) is a ciphertext of a * b.

  As described above, the control device 20 uses the ciphertext E (a, r) and b's ciphertext E (b, s) in cooperation with the ciphertext conversion device 30 and the decryption devices 40 (1) and (2). , A * b ciphertext can be calculated without knowing a and b, and the ciphertext can be acquired.

  Finally, AND, OR, NAND, and NOR processing will be described together. These processes are simple after using the exclusive OR process, and the control device 20 uses E (a, r) (= (A, B)), E (b, s) (= (X, Y)). ), (C ', D') as inputs (where (C ', D') is the ab ciphertext)

を計算し、当該暗号文を取得すれば良い。ここで今までの説明からＥ_AND,Ｅ_OR,Ｅ_NAND,Ｅ_NORはそれぞれＦ_AND（ａ,ｂ）,Ｆ_OR（ａ,ｂ）,Ｆ_NAND（ａ,ｂ）,Ｆ_NOR（ａ,ｂ）の暗号文となることは明らかである。したがって制御装置２０は、暗号文変換装置３０および復号装置４０（１）,（２）の協力により、ａの暗号文Ｅ（ａ,ｒ）およびｂの暗号文Ｅ（ｂ,ｓ）から、ａ,ｂを知ることなく、Ｆ_AND（ａ,ｂ）,Ｆ_OR（ａ,ｂ）,Ｆ_NAND（ａ,ｂ）,Ｆ_NOR（ａ,ｂ）の暗号文を計算することができ、更には当該暗号文を取得することができる。

And the ciphertext may be obtained. From the above description, E _AND , E _OR , E _NAND , E _NOR are respectively F _AND (a, b), F _OR (a, b), F _NAND (a, b), F _NOR (a, b ). Therefore, the control device 20 uses the ciphertext E (a, r) and b's ciphertext E (b, s) from a with the cooperation of the ciphertext conversion device 30 and the decryption devices 40 (1) and (2). , b can be used to calculate the ciphertext of F _AND (a, b), F _OR (a, b), F _NAND (a, b), F _NOR (a, b), The ciphertext can be acquired.

  The procedure of the secret calculation method for the basic logic gate has been described above. If it is difficult for each device to obtain a and b from E (a, r) and E (b, s), any device is available. As long as there is no collusion, a and b can be protected even when the secret calculation method for the basic logic gate is executed.

[Second Embodiment]
In the first embodiment, the result can be easily tampered by the ciphertext conversion device or the decryption device performing unauthorized processing. Also, if the control device and the ciphertext conversion device collide illegally, the device knows a and b (for example, if the control device that knows c = a * e and the ciphertext conversion device that knows e collide, It can be seen that a can be easily obtained). The second embodiment proposes an example of a method for solving the above problems.

  As shown in FIG. 4, the system configuration in the second embodiment is composed of ten ciphertext generation apparatuses (1),..., (N) and control apparatuses 20 and 30 connected by the same network 100. It consists of sentence conversion devices (1), (2), 40 decryption devices (1), (2), and a verification device 50. As described above, in the second embodiment, a plurality of ciphertext conversion devices 30 are set in order to increase resistance to illegal collusion, and when the ciphertext conversion device 30 and the decryption device 40 perform fraudulent processing, A verification device 50 is required so that it can be detected. As the number of ciphertext conversion devices increases, the resistance to illegal collusion can be increased. However, here, it is assumed to be 2 for the sake of simplicity of explanation.

  In the secret calculation method for the basic logic gate in the first embodiment, except for the process of calculating the exclusive OR, that is, from the ciphertexts E (a, r) and E (b, s) of a and b to a * b Other than the process of obtaining the ciphertext (C ′, D ′), the result is uniquely obtained without requiring secret information such as a secret key or a random number. In other words, it is possible for any device to reproduce the same process other than the process of calculating the exclusive OR, thereby eliminating the need for a special verification process. Therefore, here, a secret calculation method capable of verifying the process validity of the ciphertext conversion apparatus and the decryption apparatus in the process of calculating the exclusive OR shown in the first embodiment will be described.

  FIGS. 5A to 5D show processing sequence diagrams according to the second embodiment. Again, assume that each device holds (G, p, P, Q). Also, the ciphertext E (a, r) (= (A, B)) and E (b, s) (= (X, Y)) of a, bε {0,1} It is assumed that (i) and (j) are given in advance to the control device 20.

  First, the control device 20 transmits E (a, r) (= (A, B)) to the ciphertext conversion device 30 (1).

The ciphertext conversion apparatus 30 (1) receives E (a, r) (= (A, B)) as input and performs the following processing.
1. A random bit e ₁ and a random number t ₁ of ₁ to p are generated (S201).
2. The ciphertext (A ′, B ′) is obtained according to the following [Equation 13], and the ciphertext is transmitted to the ciphertext conversion device 30 (2) and the verification device 50 (S202).

３．（Ａ′,Ｂ′）が［数１３］の関係を満たしていることを検証装置５０にゼロ知識証明する（Ｓ２０３〜Ｓ２０５）。

3. Zero knowledge is proved to the verification device 50 that (A ′, B ′) satisfies the relationship of [Equation 13] (S203 to S205).

  Zero knowledge proofs are described in the literature “R. Cramer, I. Damgard and B. Schoenmakers,“ Proofs of partial knowledge and Simplified design of withs hiding protocols, ”“ Acvances in Cryptology-CRYPTO '94 ”LNCS 839, pp. 174-187, Springer-Verlag, 1994. (Hereinafter referred to as Non-Patent Document 3) and the document “DL Chaum and TP Pedersen“ Wallet databases with observers, ”Advances in Cryptology-CRYPTO '92, LNCS 740, pp. 80-105, Springer. -Verlag, 1993 "(hereinafter referred to as non-patent document 4).

In order to show that (A ′, B ′) satisfies the relationship of [Equation 13], in practice, (A ′, B ′) = (A + t ₁ P, B + t ₁ Q) or (A ′, B ′) ) = (− A + t ₁ P, −B + (t ₁ +1) Q) may be shown. Here, the method, that is, zero knowledge proof combining the methods of [Non-Patent Document 3] and [Non-Patent Document 4] will be specifically described using [Protocol 1] given below. Note Protocol 1], the discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, or to obtain a bottom discrete logarithm and Q of P ₁ which is a base of P Q _This is a protocol that proves that the discrete logarithm of ₁ is equal using zero knowledge proof technique.

[Protocol 1]
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ))
Prover's secret information: (e, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) Generate random numbers r, r ′, c _1-e of _{1 to} p.
(B) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r'P-c _1-e P _1-e , R _{Q, 1-e} = r'Q-c _{1 -e Q 1-e, c e} = H (R P, 0 ‖R Q, 0 ‖R P, 1 ‖R Q, 1) -c 1-e, z e = r + c e t, z 1-e = Calculate r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier determines whether c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ) Verify and accept the proof only if it is valid.

Then, the ciphertext conversion apparatus 30 (1) can prove by using [Protocol 1] that the result of inputting (A, B) to [Equation 13] is (A ′, B ′). . That is, in [Protocol 1], ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ )) ← ((G, p, P, Q), (A′− A, B′−B), (A ′ + A, B ′ + BQ)), (e, t) ← (e ₁ , t ₁ ) may be substituted.

Here, the prover and verifier in [Protocol 1] are the ciphertext conversion device 30 (1) and the verification device 50, respectively. The ciphertext conversion device 30 (1) obtains (z ₀ , z ₁ , c ₀ , c ₁ ) by processing S 203 and S 204 and transmits it to the verification device 50. Does the verification device 50 satisfy c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ )? The verification item is accepted only when it is satisfied (S205).

Here, the verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been accepted.
The verification device 50 notifies the ciphertext conversion device 30 (2) that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the ciphertext conversion apparatus 30 (2) receives (A ', B') as input and performs the following processing.
1. A random bit e ₂ and a random number t ₂ of 1 to p are generated (S206).
2. The ciphertext (A ″, B ″) is obtained according to the following [Equation 14], and the ciphertext is transmitted to the decryption devices 40 (1), (2) and the verification device 50, and further to the ciphertext conversion device 30 (1). (S207).

３．（Ａ″,Ｂ″）が［数１４］の関係を満たしていることを検証装置５０にゼロ知識証明する（Ｓ２０８〜Ｓ２１０）。

3. Zero knowledge is proved to the verification device 50 that (A ″, B ″) satisfies the relationship of [Equation 14] (S208 to S210).

Here, the zero knowledge proof is obtained in (Protocol 1) by ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ )) ← ((G, p , P, Q), (A ″ −A ′, B ″ −B ′), (A ′ + A ″, B ′ + B ″ −Q)), (e, t) ← (e ₂ , t ₂ ) Just do it.

  Here, the verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) has been accepted.

The verification device 50 notifies the decryption devices 40 (1) and (2) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response, the decoding device 40 (1) receives (A ″, B ″) as input, calculates x ₁ A ″, and transmits it to the control device 20 (S211). Similarly, the decoding device 40 ( 2) receives (A ″, B ″) as input, calculates x ₂ A ″, and transmits it to the control device 20 (S212).

Thereafter, zero-knowledge non-dialogue proof technique that the transmission information x ₁ A ″, x ₂ A ″ is a correct calculation result with the decryption devices 40 (1) and (2) as the prover and the verification device 50 as the verifier. (S213 to S222).

Specifically, the proof method is non-interactive that the discrete logarithm of x _i P with P as the base and the discrete logarithm of x _i A ″ with A ″ as the base are equal (that is, both are x _i ). This method can be realized by the basic technique of the previous zero knowledge proof. An example protocol (referred to as protocol 2) is shown below.

[Protocol 2]
Input: (p, (U ₀ , V ₀ ) = (P, x _i P), (U ₁ , V ₁ ) = (A ″, x _i A ″))
Prover's secret information: x _i
1. The prover calculates s and z according to the following and sends them to the verifier.
(A) A random number r of 1 to B is generated.
(B) Calculate R ₀ = rU ₀ and R ₁ = rU ₁ .
(C) Calculate s = H (U ₀ ‖V ₀ ‖U ₁ ‖V ₁ ‖R ₀ ‖R ₁ ). Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
(D) to calculate the z = r-sx _i.
2. The verifier calculates R ₀ ′ = zU ₀ + sV _0, R ₁ ′ = zU ₁ + sV ₁ , and then s = H (U ₀ ‖V ₀ ‖U ₁ ‖V ₁ ‖R ₀ ′ ‖R ₁ ′) holds. We will verify that it is accepted and accept the proof only if it is valid.

  Here, the decoding device 40 (1) obtains (s, z) by processing S 213 to S 216, transmits this to the verification device 50, and the verification device 50 verifies (S 217). Similarly, the decryption device 40 (2) obtains (s, z) by processing S218 to S221, transmits this to the verification device 50, and the verification device 50 verifies (S222).

The verification device 50 proceeds on the assumption that the verification items of the decryption devices 40 (1) and (2) have been received. The verification device 50 informs the control device 20 that the transmission information x ₁ A ″, x ₂ A ″ is correct.

When both x ₁ A ″ and x ₂ A ″ are correct calculation results, the control device 20 calculates xA ″ = x ₁ A ″ + x ₂ A ″ (S223), and if xA ″ = B ″ ( The decoding result c of A ″, B ″) is “0”, and if it is not (xA ″ = B ″ −Q), it is set to “1” (S224 to S226). Thereafter, the decoding result cε {0, 1}, ciphertext (C, D) is obtained according to [Equation 15] (S227), and (C, D) is transmitted to ciphertext conversion apparatus 30 (2) and verification apparatus 50.

Here, c = a * e ₁ * e ₂ (exclusive OR) holds for the decryption result c. This is clear from the first embodiment, and the description thereof is omitted here. Although the processing becomes redundant, a random number w of 1 or more and p or less is generated as in the first embodiment,

となるように（Ｃ，Ｄ）を計算してもよい。

(C, D) may be calculated so that

Ciphertext converter 30 (2) (C, D), (A ', B'), (A ", B"), as input t _2, e _2, first performs the following processing.
A random number u ₂ of 1.1 or more and p or less is generated (S228).
2. The ciphertext (C ′, D ′) is obtained according to the following [Equation 17] (S229), and the ciphertext is transmitted to the ciphertext conversion device 30 (1) and the verification device 50.

３．（Ｃ′,Ｄ′）が［数１７］を満たしていることを検証装置５０にゼロ知識証明する（Ｓ２３０〜Ｓ２３２）。

3. Zero knowledge is proved to the verification device 50 that (C ′, D ′) satisfies [Equation 17] (S230 to S232).

Here, a specific method of the zero knowledge proof will be described. In order to show that (C ′, D ′) satisfies the relationship of [Equation 17], (C ′, D ′) = (C + u ₂ P, D + u ₂ Q) or (C ′, D ′) ) = (− C + u ₂ P, −D + (u ₂ +1) Q) is not sufficient to show that
“(A ″, B ″) = (A ′ + t ₂ P, B ′ + t ₂ Q) and (C ′, D ′) = (C + u ₂ P, D + u ₂ Q)”
Or “(A ″, B ″) = (− A ′ + t ₂ P, −B ′ + (t ₂ +1) Q) and (C ′, D ′) = (− C + u ₂ P, −D + (u ₂ +1) ) Q) "
It must be shown that This is [Proof 1]
“(A ″, B ″) = (A ′ + t ₂ P, B ′ + t ₂ Q) or (A ″, B ″) = (− A ′ + t ₂ P, −B ′ + (t ₂ +1) Q)
And [Proof 2]
“(A ″, B ″) = (A ′ + t ₂ P, B ′ + t ₂ Q) or (C ′, D ′) = (− C ′ + u ₂ P, −D + (u ₂ +1) Q)”
And [Proof 3]
“(A ″, B ″) = (− A ′ + t ₂ P, −B ′ + (t ₂ +1) Q) or (C ′, D ′) = (C + u ₂ P, D + u ₂ Q)”
And [Proof 4]
“(C ′, D ′) = (C + u ₂ P, D + u ₂ Q) or (C ′, D ′) = (− C ′ + u ₂ P, −D ′ + (u ₂ +1) Q)”
Is equivalent to

Here, since [Proof 1] has already been proved, the remaining [Proof 2], [Proof 3], and [Proof 4] may be proved. This can be realized by executing [Protocol 1] three times. Specifically, in order to prove [Proof 2], [Proof 3], and [Proof 4], ((G, p, P , Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ )) ← ((G, p, P, Q), (A ″ −A ′, B ″ −B ′), (C + C ′, D + D′−Q)), (e, t) ← (e ₂ , t ₂ or u ₂ ),
((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ )) ← ((G, p, P, Q), (C′-C, D′-D) , (A ′ + A ″, B ′ + B ″ −Q)), (e, t) ← (e ₂ , t ₂ or u ₂ ),
((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ )) ← ((G, p, P, Q), (C′-C, D′-D) , (C + C ′, D + D′−Q)), (e, t) ← (e ₂ , t ₂ ),
Should be substituted.

  The ciphertext conversion device 30 (2) and the verification device 50 execute the processes S230 to S232 three times (i = 1, 2, 3) to prove [Proof 2], [Proof 3], and [Proof 4]. To do.

Here, the verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) has been accepted. Then, c ′ = a * e ₁ * b holds for the decoding result c ′ of (C ′, D ′). This is clear from the first embodiment, and the description thereof is omitted here.

The verification device 50 informs the ciphertext conversion device 30 (1) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response to this, the ciphertext conversion apparatus 30 (1) receives (C ′, D ′), (A ′, B ′), (A ″, B ″), t ₁ , e ₁ as input, and first performs the following processing. I do.
A random number u ₁ of 1.1 to p is generated (S233).
2. The ciphertext (C ″, D ″) is obtained according to the following [Equation 18], and the ciphertext is transmitted to the control device 110 and the verification device 50 (S234).

３．（Ｃ″,Ｄ″）が［数１８］の関係を満たしていることを検証装置５０にゼロ知識証明する（Ｓ２３５〜Ｓ２３７）。

3. Zero knowledge is proved to the verification device 50 that (C ″, D ″) satisfies the relationship of [Equation 18] (S235 to S237).

  Here, the method of indicating that (C ″, D ″) satisfies the relation of [Equation 18] is omitted from the description of the ciphertext conversion apparatus 30 (2) described above.

  Here, the verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been accepted. Then, c ″ = a * b holds for the decryption result c ″ of (C ″, D ″). This is clear from the first embodiment, and the description thereof is omitted here.

  The verification device 50 informs the control device 20 that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the control device 20 recognizes (C ″, D ″) received earlier than the ciphertext conversion device 30 (1) as ciphertext of a * b, and outputs it as necessary (S238).

As described above, the control device 20 uses the ciphertext conversion devices 30 (1) and (2), the decryption devices 40 (1) and (2), and the verification device 50 in cooperation with the ciphertext E (a, r) of a. The ciphertext of a * b can be calculated from the ciphertext E (b, s) of b and b without knowing a and b, and further, the ciphertext can be acquired. Here, the confidentiality of a and b depends on the confidentiality of the random bits e ₁ and e ₂ generated by the ciphertext conversion devices 30 (1) and (2). That is, if it is difficult to know e ₁ and e ₂ from the protocol shown in this embodiment, a and b are known at least unless there is an illegal collusion of the ciphertext conversion devices 30 (1) and (2). It becomes difficult.

  If the verification device 50 is added to the system configuration of the first embodiment shown in FIG. 1, the ciphertext conversion device 30 and the decryption devices 40 (1), (2) as in the second embodiment. ) Can be detected.

  In the present embodiment, an example in which two ciphertext conversion apparatuses are used has been described. However, in this protocol, it is easy to expand the ciphertext conversion apparatus to three or more (however, the method is clear and omitted here). To do). And the tolerance with respect to the collusion of a ciphertext conversion apparatus increases by the said extension. In other words, the confidentiality of a and b can be effectively enhanced.

  In the above description, the ciphertext conversion device 30 (2) calculates (C ′, D ′) and the ciphertext conversion device 30 (1) calculates (C ″, D ″). The ciphertext conversion device 30 (1) calculates ', D') and the ciphertext conversion device 30 (2) calculates (C ″, D ″), and the results are the same.

[Third Embodiment]
This solves the problem in the first embodiment by a method (protocol) different from that in the second embodiment.

  The system configuration in the third embodiment is the same as that in the second embodiment. That is, as shown in FIG. 4, the ciphertext generation devices 10 (1),..., (N), the control device 20, the ciphertext conversion devices 30 (1), (2), and the decryption connected by the same network 100. It consists of devices 40 (1) and (2) and a verification device 50.

  Here, as in the second embodiment, a method capable of verifying the processing validity of the ciphertext conversion apparatus and the decryption apparatus in the process of calculating the exclusive OR will be described.

First, the control device transmits E (a, r) (= (A, B)) to the encryption conversion device 30 (1). The ciphertext conversion apparatus 30 (1) receives (G, p, P, Q), E (a, r) (= (A, B)) as input, and performs the following processing as in the second embodiment. Do.
1. A random bit e ₁ and a random number t ₁ of ₁ to p are generated.
2. The ciphertext (A ′, B ′) is obtained according to the following [Equation 19], and the ciphertext is transmitted to the ciphertext conversion device 30 (2) and the verification device 50.

３．（Ａ′,Ｂ′）が［数１９］の関係を満たしていることを検証装置にゼロ知識証明する。
当該ゼロ知識証明の方法は、第２の実施の形態と同様であるため、説明を省略する。

3. Zero knowledge is proved to the verification device that (A ′, B ′) satisfies the relationship of [Equation 19].
Since the zero knowledge proof method is the same as that of the second embodiment, the description thereof is omitted.

The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been received.
The verification device 50 notifies the ciphertext conversion device 30 (2) that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the ciphertext conversion apparatus 30 (2) receives (A ', B') as input, and performs the following processing as in the second embodiment.
1. A random bit e ₂ and a random number t ₂ of 1 to p are generated.
2. The ciphertext (A ″, B ″) is obtained according to the following [Equation 20], and the ciphertext is transmitted to the decryption devices 40 (1) and (2) and the verification device 50, and further to the ciphertext conversion device 30 (1). .

３．（Ａ″,Ｂ″）が［数２０］の関係を満たしていることを検証装置５０にゼロ知識証明する。

3. Zero knowledge is proved to the verification device 50 that (A ″, B ″) satisfies the relationship of [Equation 20].

  Since the zero knowledge proof method is the same as that of the second embodiment, the description thereof is omitted.

The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) has been received.
The verification device 50 notifies the decryption devices 40 (1) and (2) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response to this, the decoding device 40 (1) receives (A ″, B ″) as input, calculates x ₁ A ′, and transmits it to the control device 20. Similarly, the decoding device 40 (2) receives (A ″, B ″) as input, calculates x ₂ A ″, and transmits it to the control device 20. Also, it is confirmed that the transmission information is a correct calculation result. Using zero-knowledge non-dialogue proof technique, it is proved to the verification device 50. Since this proof method is the same as that of the second embodiment, description thereof is omitted.

The verification device 50 proceeds on the assumption that the verification items of the decryption devices 40 (1) and (2) have been received.
The controller 50 calculates xA ″ = x ₁ A ″ + x ₂ A ″. If xA ″ = xB ″, the decoding result c of (A ″, B ″) is “0”, otherwise (xA ″ = B If it is "-Q), it is set to 1. After that, for the decryption result cε {0,1}, the ciphertext (C, D) is obtained according to the following [Equation 21], and (C, D) is obtained. It transmits to the ciphertext conversion apparatus 30 (2).

ここで、当該復号結果ｃについて、ｃ＝ａ＊ｅ₁＊ｅ₂（排他的論理和）が成り立つ。このことは第１の実施の形態から明らかであり、ここではその説明を省略する。

Here, c = a * e ₁ * e ₂ (exclusive OR) holds for the decryption result c. This is clear from the first embodiment, and the description thereof is omitted here.

Ciphertext converter 30 (2) (C, D) (A ' , B'), (A ", B"), as input t _2, e _2, first, of the second embodiment similar, the following Process.
A random number u ₂ of 1.1 to p is generated.
2. The ciphertext (C ′, D ′) is obtained according to the following [Equation 22], and the ciphertext is transmitted to the ciphertext conversion device 30 (1) and the verification device 50.

３．（Ｃ′,Ｄ′）が［数２２］を満たしていることを検証装置５０にゼロ知識証明する。

3. Zero knowledge is proved to the verification device 50 that (C ′, D ′) satisfies [Equation 22].

As described in the second embodiment, in order to show that (C ′, D ′) satisfies the relationship of [Equation 22], (C ′, D ′) = (C + u ₂ P , D + u ₂ Q) or (C ′, D ′) = (− C + u ₂ P, −D + (u ₂ +1) Q) is not sufficient,
“(A ″, B ″) = (A ′ + t ₂ P, B ′ + t ₂ Q) and (C ′, D ′) = (C + u ₂ P, D + u ₂ Q)”
Or “(A ″, B ″) = (− A ′ + t ₂ P, −B ′ + (t ₂ +1) Q) and (C ′, D ′) = (− C + u ₂ P, −D + (u ₂ +1) ) Q) "
It must be shown that

In order to show this, in this embodiment, a method different from the method shown in the second embodiment is used. This will be specifically described using [Protocol 3] given below. [Protocol 3]
1. Discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, and the discrete logarithm for Q ₁ in which the bottom of the discrete logarithm and Q of P ₁ which is a base of P are equal,
Or
2. Discrete logarithm of P ₀ which is a base of P 'the discrete logarithm and Q of Q ₀ which is the bottom' are equal, and, discrete 'Q ₁ that the bottom of the discrete logarithm and Q of' P ₁ that the bottom of the P Logarithm is equal,
This is a protocol that proves this by using zero-knowledge proof technology.

[Protocol 3]
Input: ((G, p, P, Q), (P _0, Q ₀ ), (P _1, Q ₁ ), (P ₀ ′ _, Q ₀ ′), (P ₁ ′ _, Q ₁ ′))
Prover's secret information: (e, t, t ')
1. The prover obtains (z ₀ , z ₁ , z ₀ ′, z ₁ ′, c ₀ , c ₁ ) according to the following and sends it to the verifier.
(A) Generate random numbers r, r ′, r ″, r ″ ′, c _1-e of _{1 to} p.
_{(B) R p, e =} rP, R Q, e = rQ, R p, 1-e = r'P-c 1-e P 1-e, R Q, 1-e = r'Q-c 1 _-e Q1 _-e , _{R'P , e} = r "P, _{R'Q, e} = r" Q, _{R'P, 1-e} = r "'P-c1 _-e P1 _-e , R ′ _{Q, 1-e} = r ″ ′ Qc _1-e Q ′ _1-e ,
c _e = H (R _{P, 0} ‖R _{Q, 0} ‖R _{P, 1} ‖R _{Q, 1} ‖R ' _{P, 0} ‖R' _{Q, 0} ‖R ' _{P, 1} ‖R' _{Q, 1} )- _{c 1-e, z e =} r + c e t, z 1-e = r ', z' e = r "+ c e t ', z' 1-e = r"'
Calculate Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier is c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ‖z ₀ ′ P _{-c 0 P 0 '‖z 0'} Q-c 0 Q 0 '‖z 1' P-c 1 P 1 '‖z 1' Q-c 1 Q '1) is whether to verify that holds, when the holds only Accept the certification matter.

Then, the ciphertext conversion apparatus 30 (2) can prove by using [Protocol 3] that the result of inputting (C, D) into [Equation 22] is (C ′, D ′). . That is, in [Protocol 3], ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ), (P ₀ ′, Q ₀ ′), (P ₁ ′, Q ₁ '), (e, t, t')) <-((G, p, P, Q), (A "-A ', B"-B'), (A '+ A ", B' + B") -Q), (C'-C, D'-D), (C + C ', D + D'-Q)), (e 2, t 2, u 2)), (e, t) ← (e 2, u ₂ ) and substitute.

The verification device 50 (verifier) proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) (provider) has been accepted. Then, c ′ = a * e ₁ * b holds for the decoding result c ′ of (C ′, D ′). This is clear from the first embodiment, and the description thereof is omitted here.

The verification device 50 informs the ciphertext conversion device 30 (1) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response to this, the ciphertext converting apparatus 1 receives (C ′, D ′) (A ′, B ′), (A ″, B ″), t ₁ , First, as in the second embodiment, the following processing is performed with e ₁ as an input.
A random number u ₁ of 1.1 to p is generated.
2. The ciphertext (C ″, D ″) is obtained according to the following [Equation 23], and the ciphertext is transmitted to the control device 20 and the verification device 50.

３．（Ｃ″,Ｄ″）が［数２３］の関係を満たしていることを検証装置にゼロ知識証明する。
ここで（Ｃ″,Ｄ″）が［数２３］の関係を満たしていることを示す方法は、前述の暗号文変換装置３０（２）での説明から明らかであるため省略する。

3. Zero knowledge is proved to the verification device that (C ″, D ″) satisfies the relationship of [Equation 23].
Here, the method for indicating that (C ″, D ″) satisfies the relationship of [Equation 23] is omitted from the description of the ciphertext conversion apparatus 30 (2) described above.

  The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been received. Then, c ″ = a * b holds for the decryption result c ″ of (C ″, D ″). This is clear from the first embodiment, and the description thereof is omitted here.

  The verification device 50 informs the control device 20 that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the control device 20 recognizes (C ″, D ″) received earlier than the ciphertext conversion device 30 (1) as the ciphertext of a * b.

As described above, the control device 20 uses the ciphertext conversion devices 30 (1), (2), the decryption devices 40 (1), (2), and the verification device 50 in cooperation with the ciphertext E (ar) of a. From the ciphertext E (b, s) of b and b, the ciphertext of a * b can be calculated without knowing a and b, and further, the ciphertext can be obtained. Here, the confidentiality of a and b depends on the confidentiality of the random bits e _{1 and} e ₂ generated by the ciphertext conversion devices 30 (1) and (2). That is, if it is difficult to know e ₁ and e ₂ from the protocol shown in this embodiment, a and b are known at least unless there is an illegal collusion of the ciphertext conversion devices 30 (1) and (2). It becomes difficult. In the present embodiment, an example in which two ciphertext conversion apparatuses are used has been described. However, in this protocol, it is easy to expand the ciphertext conversion apparatus to three or more (however, the method is clear and omitted here). To do). And the tolerance with respect to the collusion of a ciphertext conversion apparatus increases by the said extension. In other words, the confidentiality of a and b can be effectively enhanced.

  If the verification device 50 is added to the system configuration of the first embodiment shown in FIG. 1, the ciphertext conversion device 30 and the decryption devices 40 (1), (2) as in the third embodiment. ) Can be detected.

[Fourth Embodiment]
This solves the problem in the first embodiment by a method (protocol) further different from the second embodiment and the third embodiment.

  The system configuration in the fourth embodiment is the same as that in the second embodiment. That is, as shown in FIG. 4, the ciphertext generation devices 10 (1),..., (N), the control device 20, the ciphertext conversion devices 30 (1), (2), and the decryption connected by the same network 100. It consists of devices 40 (1) and (2) and a verification device 50.

  Here, as in the second embodiment and the third embodiment, a method capable of verifying the process validity of the ciphertext conversion apparatus and the decryption apparatus in the process of calculating the exclusive OR will be described.

First, the control device 20 transmits E (a, r) 1 = (A, B) to the ciphertext conversion device 30 (1). The ciphertext conversion apparatus 30 (1) receives E (a, r) (= (A, B)) as input, and performs the following processing as in the second embodiment.
1. A random bit e ₁ and a random number t ₁ of ₁ to p are generated.
2. The ciphertext (A ′, B ′) is obtained according to the following [Equation 24], and the ciphertext is transmitted to the ciphertext conversion device 30 (2) and the verification device 50.

３．（Ａ′,Ｂ′）が［数２４］の関係を満たしていることを検証装置５０にゼロ知識証明する。
当該ゼロ知識証明の方法は、第２の実施の形態と同様であるため、説明を省略する。

3. Zero knowledge is proved to the verification device 50 that (A ′, B ′) satisfies the relationship of [Equation 24].
Since the zero knowledge proof method is the same as that of the second embodiment, the description thereof is omitted.

The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been received.
The verification device 50 notifies the ciphertext conversion device 30 (2) that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the ciphertext conversion apparatus 30 (2) receives (A ', B') as input, and performs the following processing as in the second embodiment.
1. A random bit e ₂ and a random number t ₂ of 1 to p are generated.
2. The ciphertext (A ″, B ″) is obtained according to the following [Equation 25], and the ciphertext is transmitted to the decryption devices 40 (1), (2) and the verification device 50, and further to the ciphertext conversion device 30 (1). .

３．（Ａ″,Ｂ″）が［数２５］の関係を満たしていることを検証装置５０にゼロ知識証する。
当該ゼロ知識証明の方法は、第２の実施の形態と同様であるため、説明を省略する。

3. The verification device 50 proves zero knowledge that (A ″, B ″) satisfies the relationship of [Equation 25].
Since the zero knowledge proof method is the same as that of the second embodiment, the description thereof is omitted.

The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) has been received.
The verification device 50 notifies the decryption devices 40 (1) and (2) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response to this, the decoding device 40 (1) receives (A ″, B ″) as input, calculates x ₁ A ′, and transmits it to the control device 20. Similarly, the decoding device 40 (2) receives (A ″, B ″) as input, calculates x ₂ A ″, and transmits it to the control device 20. Also, it is confirmed that the transmission information is a correct calculation result. Using zero-knowledge non-dialogue proof technique, it is proved to the verification device 50. Since this proof method is the same as that of the second embodiment, description thereof is omitted.

The verification device 50 proceeds on the assumption that the verification items of the decryption devices 40 (1) and (2) have been received.
The controller 50 calculates xA ″ = x ₁ A ″ + x ₂ A ″. If xA ″ = xB ″, the decoding result c of (A ″, B ″) is “0”, otherwise (xA ″ = B If “−Q), it is set to“ 1. ”Then, for the decryption result cε {0, 1}, ciphertext (C, D) is obtained according to the following [Equation 26], and (C, D) is obtained. It transmits to the ciphertext conversion apparatus 30 (2).

ここで、当該復号結果ｃについて、ｃ＝ａ＊ｅ₁＊ｅ₂（排他的論理和）が成り立つ。このことは第１の実施の形態から明らかであり、ここではその説明を省略する。

Here, c = a * e ₁ * e ₂ (exclusive OR) holds for the decryption result c. This is clear from the first embodiment, and the description thereof is omitted here.

The ciphertext conversion apparatus 30 (2) has E (b, s) (= (X, Y)), (C, D), (A ′, B ′), (A ″, B ″), t ₂ , e _{With 2} as an input, the following processing is first performed as in the second embodiment.
A random number u ₂ of 1.1 to p is generated.
2. The ciphertext (C ′, D ′) is obtained according to the following [Equation 27], and the ciphertext is transmitted to the ciphertext conversion device 30 (1) and the verification device 50.

３．（Ｃ′,Ｄ′）が［数２７］を満たしていることを検証装置５０にゼロ知識証明する。

3. Zero knowledge is proved to the verification device 50 that (C ′, D ′) satisfies [Equation 27].

As described in the second embodiment, in order to show that (C ′, D ′) satisfies the relationship of [Equation 27], (C ′, D ′) = (C + u ₂ P , D + u ₂ Q) or (C ′, D ′) = (− C + u ₂ P, −D + (u ₂ +1) Q) is not sufficient,
“(A ″, B ″) = (A ′ + t ₂ P, B ′ + t ₂ Q) and (C ′, D ′) = (C + u ₂ P, D + u ₂ Q)”
Or “(A ″, B ″) = (− A ′ + t ₂ P, −B ′ + (t ₂ +1) Q) and
(C ′, D ′) = (− C + u ₂ P + X, −D + (u ₂ +1) Q) ”
It must be shown that

In order to show this, in this embodiment, a method different from the method shown in the second embodiment or the third embodiment is used. This will be specifically described using [Protocol 4] given below. Note that [Protocol 4]
Discrete logarithm of Q ₀ are equal to the base-discrete logarithm and Q of P ₀ which is a base of 1.P,
Or
Discrete logarithm of Q ₁ is equal to that base-discrete logarithm and Q of P ₁ which is a base of 2.P,
Is already proved to be zero knowledge (denoting s as the discrete logarithm)
Only when 1 is true, the discrete logarithm of P ₀ ′ with P as the base is equal to the discrete logarithm of Q ₀ ′ with Q as the base,
Conversely, only when 2 is true, the discrete logarithm of P ₁ ′ with P as the base is equal to the discrete logarithm of Q ₁ ′ with Q as the base (both the discrete logarithm is t).
It is a protocol that can prove that using zero-knowledge proof technology.
[Protocol 4]
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ), (P ₀ ′, Q ₀ ′), (P ₁ ′, Q ₁ ′))
Prover's secret information: (e, s, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) ε = H (P ₀ ‖Q ₀ ‖P ₁ ‖Q ₁ ‖P ₀ '‖Q ₀ ′ ‖P ₁ ′ ‖Q ₁ ′ ‖) is calculated.
(B) Generate random numbers r, r ′, c _1-e between ₁ and p.
(C) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r′P-c _1-e (εP _1-e + P ′ _1-e ), R _{Q, 1- e} = r′Q−c _1−e (εQ _1−e + Q ′ _1−e ), c _e = H (R _{P, 0} ‖R _{Q, 0} ‖R _{P, 1} ‖R _{Q, 1} ) −c _{1-e, z e = r} + c e (εs + t), calculates the z _1-e = r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier calculates ε ′ = H (P ₀ ‖Q ₀ ‖P ₁ ‖Q ₁ ‖P ₀ ′ ‖Q ₀ ′ ‖P ₁ ′ ‖Q ₁ ′), and c ₀ + c ₁ = H (z ₀ P -C ₀ (ε'P ₀ + P ₀ ') ‖z ₀ Q-c ₀ (ε'Q ₀ + Q ₀ ') ‖z ₁ P-c ₁ (ε'P ₁ + P ₁ ') ‖z ₁ Q-c ₁ (ε′Q ₁ + Q ₁ ′)) is verified whether it is satisfied, and the proof matter is accepted only when it is satisfied.

Then, the ciphertext conversion apparatus 30 (2) can prove by using [Protocol 4] that the result of inputting (C, D) into [Equation 27] is (C ′, D ′). . That is, in [Protocol 4], ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ), (P ₀ ′, Q ₀ ′), (P ₁ ′, Q ₁ ′), (e, s, t)) ← ((G, p, P, Q), (A ″ −A ′, B ″ −B ′), (A ′ + A ″, B ′ + B ″ −) Q), (C'-C, D'-D), (C + C ', D + D'-Q)), (e 2, t 2, u 2)), (e, t) ← (e 2, u 2 ).

The verification device 50 (verifier) proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (2) (provider) has been accepted. Then, c ′ = a * e ₁ * b holds for the decoding result c ′ of (C ′, D ′). This is clear from the first embodiment, and the description thereof is omitted here.

The verification device 50 informs the ciphertext conversion device 30 (1) that the proof matter of the ciphertext conversion device 30 (2) has been accepted. In response, the ciphertext conversion apparatus 30 (1) receives (C ', D') (A ', B') (A ", B"), t received earlier than the ciphertext conversion apparatus 30 (2). ₁ and e ₁ are input, and the following processing is first performed as in the second embodiment.
A random number u ₁ of 1.1 to p is generated.
2. The ciphertext (C ″, D ″) is obtained according to the following [Equation 28], and the ciphertext is transmitted to the control device 20 and the verification device 50.

３．（Ｃ″,Ｄ″）が［数２８］の関係を満たしていることを検証装置５０にゼロ知識証明する。
ここで（Ｃ″,Ｄ″）が［数２８］の関係を満たしていることを示す方法は、前述の暗号文変換装置３０（２）での説明から明らかであるため省略する。

3. Zero knowledge is proved to the verification device 50 that (C ″, D ″) satisfies the relationship of [Equation 28].
Here, since the method for indicating that (C ″, D ″) satisfies the relationship of [Equation 28] is clear from the description of the ciphertext conversion apparatus 30 (2), it will be omitted.

  The verification device 50 proceeds on the assumption that the proof matter of the ciphertext conversion device 30 (1) has been received. Then, c ″ = a * b holds for the decryption result c ″ of (C ″, D ″). This is clear from the first embodiment, and the description thereof is omitted here.

  The verification device 50 informs the control device 20 that the proof matter of the ciphertext conversion device 30 (1) has been accepted. In response to this, the control device 20 recognizes (C ″, D ″) received earlier than the ciphertext conversion device 30 (1) as the ciphertext of a * b.

As described above, the control device 20 uses the ciphertext conversion devices 30 (1), (2), the decryption devices 40 (1), (2), and the verification device 50 in cooperation with the ciphertext E (ar) of a. The ciphertext of a * b can be calculated from the ciphertext E (b, s) of b and b without knowing a and b, and further, the ciphertext can be acquired. Here, the confidentiality of a and b depends on the confidentiality of the random bits e _{1 and} e ₂ generated by the ciphertext conversion devices 30 (1) and (2). That is, if it is difficult to know e ₁ and e ₂ from the protocol shown in this embodiment, a and b are known at least unless there is an illegal collusion of the ciphertext conversion devices 30 (1) and (2). It becomes difficult. In the present embodiment, an example in which two ciphertext conversion apparatuses are used has been described. However, in this protocol, it is easy to expand the ciphertext conversion apparatus to three or more (however, the method is clear and omitted here). To do). And the tolerance with respect to the collusion of a ciphertext conversion apparatus increases by the said extension. In other words, the confidentiality of a and b can be effectively enhanced.

  If the verification device 50 is added to the system configuration of the first embodiment shown in FIG. 1, the ciphertext conversion device 30 and the decryption devices 40 (1), (2) are added as in the fourth embodiment. ) Can be detected.

In the first, second, third, or fourth embodiment, the ciphertext (A _i , B _i ) of a _i , b _i ∈ {0, 1} (i = 1, 2,..., N) is used. ), (X _i , Y _i ) are sequentially input at different times, and a predetermined process is sequentially executed by each device, whereby a plurality of sets of a _i * b _i ciphertexts are calculated in a pipeline format. It is possible.

  The processing functions of some or all of the units in the system shown in FIGS. 1 and 4 can be configured by a computer program, and the program can be executed using the computer to realize the present invention. Needless to say, the processing procedures shown in FIG. 2, FIG. 3, FIG. 5 and the like can be configured by a computer program and the program can be executed by the computer. In addition, a computer-readable recording medium such as an FD, MO, ROM, memory card, CD, or the like is stored in the computer. In addition, the program can be recorded and stored on a DVD, a removable disk, etc., and the program can be distributed through a network such as the Internet.

The figure which shows the system configuration example of the 1st Embodiment of this invention. The figure which shows the example of a process sequence which produces | generates a public key (G, p, P, Q) in 1st Embodiment. The figure which shows the example of a process sequence which calculates | requires the ciphertext of a * b from the ciphertext of a and b in 1st Embodiment. The figure which shows the system configuration example of the 2nd Embodiment of this invention, 3rd Embodiment, and 4th Embodiment. The figure which shows the example of a process sequence which calculates | requires the ciphertext of a * b from the ciphertext of a and b in 2nd Embodiment. The figure which shows the example of a process sequence which calculates | requires the ciphertext of a * b from the ciphertext of a and b similarly in 2nd Embodiment. The figure which shows the example of a process sequence which calculates | requires the ciphertext of a * b from the ciphertext of a and b similarly in 2nd Embodiment. The figure which shows the example of a process sequence which calculates | requires the ciphertext of a * b from the ciphertext of a and b in 2nd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Ciphertext production | generation apparatus 20 Control apparatus 30 Ciphertext conversion apparatus 40 Decryption apparatus 50 Verification apparatus 100 Network

Claims (9)

Let G be a group of rational points of an elliptic curve defined on a finite field, P be an element of G, P be the order of P, and Q for the secret key x∈ {1, ..., p}. = XP, (G, p, P, Q) as public key,
The encryption function E that encrypts the plaintext aε {0,1} is E (a, r) = (A, B) = (rp, (r + a) Q)
(R is a random number between 1 and p),
Without knowing a and b from ciphertext E (a, r) (= (A, B)) and E (b, s) (= (X, Y)) of a, b∈ {0,1} , A * b (* means exclusive OR, hereinafter the same), a secret calculation method for calculating a ciphertext,
One or a plurality of ciphertext generation devices, a control device, a ciphertext conversion device, and a plurality of decryption devices connected by a network,
The control device converts the ciphertext E (a, r) (= (A, B)) and E (b, s) (= (X, Y)) with a, bε {0,1} into a ciphertext generation device. First, E (a, r) (= (A, B)) is transmitted to the ciphertext converter,
The ciphertext conversion apparatus receives (G, p, P, Q), E (a, r) (= (A, B)) as input, generates a random bit e and a random number t between 1 and p, Sentence (A ', B')

And the ciphertext (A ′, B ′) is transmitted to each decryption device i (i = 1, 2,...),
Each decryption device i (i = 1, 2,...) Receives (A ′, B ′) as input, calculates x _i A ′ (x _i is a random number), transmits it to the control device,
The control device calculates xA ′ = x ₁ A ′ + x ₂ A ′ +... If xA ′ = B ′, the decoding result c of (A ′, B ′) is “0”, otherwise (xA ′ = B′−Q), “1” is set, and the ciphertext (C, D) is obtained for the decryption result c∈ {0, 1}.

(W is a random number not smaller than 1 and not larger than p), and the ciphertext (C, D) is transmitted to the ciphertext converting apparatus,
The ciphertext conversion apparatus receives (G, p, P, Q), (C, D) as input, generates a random number u between 1 and p, and generates a ciphertext (C ′, D ′).

And the ciphertext (C ′, D ′) is transmitted to the control device,
The control device outputs (C ′, D ′) as ciphertext of a * b. Let G be a group of rational points of an elliptic curve defined on a finite field, P be an element of G, P be the order of P, and Q for the secret key x∈ {1, ..., p}. = XP, (G, p, P, Q) as public key,
The encryption function E that encrypts the plaintext a∈ {0,1} is E (a, r) = (A, B) = (rp, (r + a) Q
(R is a random number between 1 and p),
Without knowing a and b from ciphertext E (a, r) (= (A, B)) and E (b, s) (= (X, Y)) of a, b∈ {0,1} , A secret calculation method for calculating the ciphertext of a * b,
Networked with one or a plurality of ciphertext generation devices, a control device, a plurality of ciphertext conversion devices, a plurality of decryption devices and a verification device,
The control device converts the ciphertext E (a, r) (= (A, B)) and E (b, s) (= (X, Y)) with a, bε {0,1} into a ciphertext generation device. First, E (a, r) (= (A, B)) is transmitted to the first ciphertext conversion apparatus,
The first ciphertext conversion apparatus receives (G, p, P, Q), E (a, r) (= (A, B)) as input, and receives a random bit e ₁ and a random number t _{1 of 1 to} p. Generate ciphertext (A ', B')

And the ciphertext (A ′, B ′) is transmitted to the second ciphertext conversion device and the verification device,
The verification device verifies the processing validity of the first ciphertext conversion device, notifies the second ciphertext conversion device of the result,
When the second ciphertext conversion apparatus receives a notification of processing validity of the first ciphertext conversion apparatus from the verification apparatus, the second ciphertext conversion apparatus generates a random bit e ₂ and a random number t ₂ of 1 or more and p or less, and the ciphertext (A ″) , B ″)

And the ciphertext (A ″, B ″) is transmitted to each decryption device i (i = 1, 2,...) And the verification device,
The verification device verifies the processing validity of the second ciphertext conversion device, notifies the decryption device of the result,
Each decryption device i (i = 1, 2,...) Receives (A ″, B ″) as input and receives x _i A ″ ( x _i is a random number) and sends it to the controller,
The verification device verifies the processing validity of each decryption device, notifies the control device of the result,
When the control device receives notification of processing validity of all the decryption devices from the verification device, it calculates xA ″ = x ₁ A ″ + x ₂ A ″ +..., If xA ″ = B ″ (A ″, B) ”) Decryption result c is“ 0 ”, otherwise (xA ″ = B ″ −Q) is“ 1 ”, and ciphertext (C, D) is obtained for the decryption result c∈ {0, 1}. ,

And the ciphertext (C, D) is transmitted to the first (or second ciphertext conversion device),
The first (or second) ciphertext conversion apparatus receives (G, p, P, Q), (C, D) as input, generates a random number u ₂ of 1 or more and p or less, and generates a ciphertext (C ′ , D ')

(The subscript is 1 for the first ciphertext conversion apparatus), and the ciphertext (C ′, D ′) is transferred to the second (or first) ciphertext conversion apparatus and verification apparatus. Send
The verification device verifies the processing validity of the first (or second) ciphertext conversion device, notifies the second (or first) ciphertext conversion device of the result,
When the second (or first) ciphertext conversion apparatus receives a notification of processing validity of the first (or second) ciphertext conversion apparatus from the verification apparatus, (G, p, P, Q), (C ′, D ′) as an input, generates a random number u ₁ of ₁ to p and generates a ciphertext (C ″, D ″).

(The subscript is 2 for the second ciphertext conversion apparatus), and the ciphertext (C ″, D ″) is transmitted to the control device and the verification device,
The verification device verifies the correctness of the processing of the second (or first) ciphertext conversion device and notifies the control device of the result,
The control device recognizes (C ″, D ″) as a ciphertext of a * b when receiving a notification of processing validity of the second (or first) ciphertext conversion device from the verification device. Secret calculation method. The secret calculation method according to claim 2,
The verification apparatus uses (A ′, B ′), (A ″, B ″), (A), (B ′), (A ′, B ″), (1) using the first or second ciphertext conversion apparatus as the prover and the verification apparatus as the verifier. C ′, D ′) (C ″, D ″) proves zero knowledge that the relationship of [Equation 4], [Equation 5], [Equation 7], and [Equation 8] is satisfied.
[Protocol 1]
Discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, or that the discrete logarithm for Q ₁ in which the bottom of the discrete logarithm and Q of P ₁ which is a base of P is equal to , A protocol that proves using zero-knowledge proof technology,
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ))
Prover's secret information: (e, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) Generate random numbers r, r ′, c _1-e of _{1 to} p.
(B) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r'P-c _1-e P _1-e , R _{Q, 1-e} = r'Q-c _{1 -e Q 1-e, c e} = H (R P, 0 ‖R Q, 0 ‖R P, 1 ‖R Q, 1) -c 1-e, z e = r + c e t, z 1-e = Calculate r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier determines whether c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ) Verify and accept the proof only if it is valid.
A secret calculation method characterized by that. The secret calculation method according to claim 2,
The verification device uses the following protocol 2 with the decryption device as the prover and the verification device as the verifier, and proves zero knowledge that x _i A ″ is a correct calculation result.
[Protocol 2]
A protocol that proves non-interactively that the discrete logarithm of x _i P with P as the base and the discrete logarithm of x _i A ″ with A ″ as the base are equal (ie, both are x _i );
Input: (p, (U ₀ , V ₀ ) = (P, x _i P), (U ₁ , V ₁ ) = (A ″, x _i A ″))
Prover's secret information: x _i
1. The prover calculates s and z according to the following and sends them to the verifier.
(A) A random number r of 1 to p is generated.
(B) Calculate R ₀ = rU ₀ and R ₁ = rU ₁ .
(C) Calculate s = H (U ₀ ‖V ₀ ‖U ₁ ‖V ₁ ‖R ₀ ‖R ₁ ). Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
(D) to calculate the z = r + sx _i.
2. The verifier calculates R ₀ ′ = zU ₀ + sV ₀ , R ₁ ′ = zU ₁ + sV ₁ , and then s = H (U ₀ ‖V ₀ ‖U ₁ ‖V ₁ ‖R ₀ ′ ‖R ₁ ′) holds. We will verify that it is accepted and accept the proof only if it is valid.
A secret calculation method characterized by that. The secret calculation method according to claim 2,
The verification apparatus uses the following protocol 1 with the first or second ciphertext conversion apparatus as the prover and the verification apparatus as the verifier, and (A, B), (A ′, B ′) is expressed as [Equation 4]. ], Prove zero knowledge that the relationship of [Equation 5] is satisfied,
[Protocol 1]
Discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, or that the discrete logarithm for Q ₁ in which the bottom of the discrete logarithm and Q of P ₁ which is a base of P is equal to , A protocol that proves using zero-knowledge proof technology,
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ))
Prover's secret information: (e, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) Generate random numbers r, r ′, c _1-e of _{1 to} p.
(B) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r'P-c _1-e P _1-e , R _{Q, 1-e} = r'Q-c _{1 -e Q 1-e, c e} = H (R P, 0 ‖R Q, 0 ‖R P, 1 ‖R Q, 1) -c 1-e, z e = r + c e t, z 1-e = Calculate r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier determines whether c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ) Verify and accept the proof only if it is valid.
Further, the verification device uses (C ′, D ′) (C ″, D ″) by using the following protocol 3 with the first or second ciphertext conversion device as the prover and the verification device as the verifier. Zero knowledge proof that the relationship of [Equation 7] and [Equation 8] is satisfied,
[Protocol 3]
1. Discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, and the discrete logarithm for Q ₁ in which the bottom of the discrete logarithm and Q of P ₁ which is a base of P are equal,
Or
2. Discrete logarithm of P ₀ which is a base of P 'the discrete logarithm and Q of Q ₀ which is the bottom' are equal, and, discrete 'Q ₁ that the bottom of the discrete logarithm and Q of' P ₁ that the bottom of the P Logarithm is equal,
A protocol to prove this using zero-knowledge proof technology,
Input: ((G, p, P, Q), (P _0, Q ₀ ), (P _1, Q ₁ ), (P ₀ ′ _, Q ₀ ′), (P ₁ ′ _, Q ₁ ′))
Prover's secret information: (e, t, t ')
1. The prover obtains (z ₀ , z ₁ , z ₀ ′, z ₁ ′, c ₀ , c ₁ ) according to the following and sends it to the verifier.
(A) Generate random numbers r, r ′, r ″, r ″ ′, c _1-e of _{1 to} p.
_{(B) R p, e =} rP, R Q, e = rQ, R p, 1-e = r'P-c 1-e P 1-e, R Q, 1-e = r'Q-c 1 _-e Q1 _-e , _{R'P , e} = r "P, _{R'Q, e} = r" Q, _{R'P, 1-e} = r "'P-c1 _-e P1 _-e , R ′ _{Q, 1-e} = r ″ ′ Qc _1-e Q _1-e ,
c _e = H (R _{P, 0} ‖R _{Q, 0} ‖R _{P, 1} ‖R _{Q, 1} ‖R ' _{P, 0} ‖R' _{Q, 0} ‖R ' _{P, 1} ‖R' _{Q, 1} )- c _1-e ,
z _e = r + c _e t, z _1−e = r ′, z ′ _e = r ″ + c _e t ′, z ′ _1−e = r ″ ′
Calculate Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier is c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ‖z ₀ ′ P −c ₀ P ₀ ′ ′ z ₀ ′ Q−c ₀ Q ₀ ′ ′ z ₁ ′ Pc ₁ P ₁ ′ ′ z ₁ ′ Q−c ₁ Q ₁ ′) Accept the certification matter.
A secret calculation method characterized by that. The secret calculation method according to claim 2,
The verification apparatus uses the following protocol 1 with the first or second ciphertext conversion apparatus as the prover and the verification apparatus as the verifier, and (A, B) and (A ′, B ′) are expressed as [Equation 4]. ], [Equation 5]
[Protocol 1]
Discrete logarithm of Q ₀ that the bottom discrete logarithm and Q of P ₀ which is a base of P are equal, or that the discrete logarithm for Q ₁ in which the bottom of the discrete logarithm and Q of P ₁ which is a base of P is equal to , A protocol that proves using zero-knowledge proof technology,
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ))
Prover's secret information: (e, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) Generate random numbers r, r ′, c _1-e of _{1 to} p.
(B) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r'P-c _1-e P _1-e , R _{Q, 1-e} = r'Q-c _{1 -e Q 1-e, c e} = H (R P, 0 ‖R Q, 0 ‖R P, 1 ‖R Q, 1) -c 1-e, z e = r + c e t, z 1-e = Calculate r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier determines whether c ₀ + c ₁ = H (z ₀ P−c ₀ P ₀ ‖z ₀ Q−c ₀ Q ₀ ‖z ₁ P−c ₁ P ₁ ‖z ₁ Q−c ₁ Q ₁ ) Verify and accept the proof only if it is valid.
Further, the verification device uses the following protocol 4 with the first or second ciphertext conversion device as the prover and the verification device as the verifier, and uses (C ′, D ′), (C ″, D ″). Proves that it satisfies the relationship of [Equation 7] and [Equation 8].
[Protocol 4]
Discrete logarithm of Q ₀ are equal to the base-discrete logarithm and Q of P ₀ which is a base of 1.P,
Or
Discrete logarithm of Q ₁ is equal to that base-discrete logarithm and Q of P ₁ which is a base of 2.P,
Is already proved to be zero knowledge (denoting s as the discrete logarithm)
Prove that the discrete logarithm of P ₀ ′ with base P is equal to the discrete logarithm of Q ₀ ′ with Q base only if 1 is true,
Only when 2 is true conversely, (and together the discrete logarithm t) discrete logarithm are equal 'Q ₁ that the bottom of the discrete logarithm and Q of' P ₁ that a bottom of the P, can Proof using a zero-knowledge proof technique,
Input: ((G, p, P, Q), (P ₀ , Q ₀ ), (P ₁ , Q ₁ ), (P ₀ ′, Q ₀ ′), (P ₁ ′, Q ₁ ′))
Prover's secret information: (e, s, t)
1. The prover obtains (z ₀ , z ₁ , c ₀ , c ₁ ) according to the following and transmits it to the verifier.
(A) ε = H (P ₀ ‖Q ₀ ‖P ₁ ‖Q ₁ ‖P ₀ ′ Q ₀ ′ ‖P ₁ ′ ‖Q ₁ ′) is calculated.
(B) Generate random numbers r, r ′, c _1-e between ₁ and p.
(C) R _{P, e} = rP, R _{Q, e} = rQ, R _{P, 1-e} = r′P-c _1-e (εP _1-e + P ′ _1-e ), R _{Q, 1- e} = r′Q−c _1−e (εQ _1−e + Q ′ _1−e ), c _e = H (R _{P, 0} ‖R _{Q, 0} ‖R _{P, 1} ‖R _{Q, 1} ) −c _{1-e, z e = r} + c e (εs + t), calculates the z _1-e = r '. Here, H is a general-purpose one-way hash function, and “‖” means concatenation of data.
2. The verifier calculates ε ′ = H (P ₀ ‖Q ₀ ‖P ₁ ‖Q ₁ ‖P ₀ ′ ‖Q ₀ ′ ‖P ₁ ′ ‖Q ₁ ′), and c ₀ + c ₁ = H (z ₀ P -C ₀ (ε'P ₀ '+ P ₀ ') ‖z ₀ Q-c ₀ (ε'Q ₀ '+ Q ₀ ') ‖z ₁ P-c ₁ (ε'P ₁ + P ₁ ') ‖ It is verified whether or not z ₁ Q−c ₁ (ε′Q ₁ + Q ₁ ′) is satisfied, and the proof matter is accepted only when it is satisfied.
A secret calculation method characterized by that. 7. The secret calculation method according to claim 1, wherein a plurality of sets (A _i , B _i ), (X _i , Y _i ) (i = 1, 2,..., N) are sequentially input. A secret calculation method characterized by sequentially calculating a plurality of sets of a _i * b _i ciphertexts in a pipeline format.   8. The apparatus according to claim 1, comprising one or a plurality of ciphertext generation devices, a control device, a plurality of ciphertext conversion devices, a plurality of decryption devices, and a verification device connected via a network. A secret calculation system characterized by implementing a secret calculation method.   A program for causing a computer to execute the secret calculation method according to claim 1.

Images