JP2008124988A - Public key encryption method, encrypting device, decoding device, public key encryption system, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an encryption method which can verify validity of a ciphertext only by public information with comparatively less computational complexity. <P>SOLUTION: The public key encryption method can verify validity of a ciphertext only by public information, using a secret key of a one-time signature as a random number of a public key encryption, and attain an efficient encryption scheme. In an encryption step, a public key PK of a decoding device is obtained and a random number R is selected. The random number R is used for a secret key of the one-time signature and a public key encryption. A signature verification key U is calculated, w is obtained by encrypting a plain text m, a signature Σ is created using the random number R, and a ciphertext (U, w, Σ) is obtained. In a decoding step, the ciphertext (U, w, Σ) is received, and it is verified that Σ is a valid signature for (U, w) using the signature verification key U. When the verification is successful, a plain text m is obtained from (U, w) using a secret key SK. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a public key encryption method, an encryption device, a decryption device, a public key encryption system, a program, and a recording medium.

  Conventionally, many public key cryptosystems with high security (secure against active attacks) have been proposed. Most of these cryptosystems verify the validity of ciphertext (whether the ciphertext was created from plaintext by a legitimate procedure) using the recipient's private key (Non-Patent Document 1, Non-Patent Document 2). . For example, when such an encryption method is used in a system in which the recipient's private key is distributed and held and decryption is performed by distributed processing, the ciphertext is decrypted in order to verify the validity of the ciphertext. There must be. In other words, the validity of the ciphertext cannot be determined unless an enormous calculation for decryption is performed. If it is determined that the ciphertext is not valid, the enormous calculation is wasted. Therefore, in a system that holds the recipient's private key in a distributed manner, it is important that the validity of the ciphertext can be verified using only public information.

As a method for verifying the validity of a ciphertext using only public information, there is a method of performing a pairing process (Non-Patent Document 3). However, in the decryption that performs the pairing process, a large amount of calculation is required as compared with the decryption of the encryption method using a general elliptic curve.
M. Bellare and P. Rogaway, “Optimal asymmetric encryption”, In Advances in Cryptology-Eurocrypt'94, LNCS, Springer-Verlag, pp.92-111, 1994. R. Cramer and V. Shoup, “A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack”, In Advances in Cryptology-Crypto'98, LNCS, Springer-Verlag, pp.13-25, 1998. X. Boyen, Q. Mei, and B. Waters, “Direct Chosen Ciphertext Security from Identity-Based Techniques”, the proceedings of 12th ACM Conference on Computer and Communications Security-CCS 2005, 2005.

  An object of the present invention is to provide an efficient encryption system (encryption system that does not use pairing) that can verify the validity of a ciphertext using only public information.

  In the public key cryptography method of the present invention, the validity of the ciphertext can be verified only with public information by using a private key of a one-time signature as a random number for public key cryptography, and an efficient encryption Realize the scheme.

  The basic concept is explained below. First, let f and h be one-way functions and m be plaintext. The public key encryption method of the present invention includes a public step, an encryption step, and a decryption step. In the publishing step, the decryption device generates a secret key SK and a public key PK in advance and publishes the public key PK. In the encryption step, the encryption device acquires the public key PK of the decryption device and selects a random number R. The random number R is a private key for a one-time signature and a random number used for public key cryptography. Calculate signature verification key U = f (R), calculate w = h (PK, R, m), create signature Σ using random number R, and decrypt ciphertext (U, w, Σ) Send to device. In the decryption step, the decryption device receives the ciphertext (U, w, Σ), verifies that Σ is a correct signature for (U, w) using the signature verification key U, and the verification is successful. Then, the plaintext m is obtained from (U, w) using the secret key SK.

As a first specific example, first, G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are G generators, x∈ {0, 1,..., P−1}, H Is a mapping from predetermined {0, 1,..., P−1} ³ to {0, 1,. In the encryption apparatus, r1, r2, t1, and t2 randomly selected from {0, 1,..., P−1} are used as the random number R. U = g ₁ ^r1 g ₂ ^r2 and v = g ₁ ^t1 g ₂ ^t2 are used as the signature verification key U, and y ₁ ^r1 y ₂ ^r2 is used as the key (PK, R) for plaintext encryption. Then, σ1 = r1 + H (u, v, w) t1 modp and σ2 = r2 + H (u, v, w) t2 modp are used as signatures Σ. In the decryption device, the validity of the ciphertext is verified by verifying whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds. If established, the decrypted plaintext u ^x as the key.

As a second specific example, first, G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1} , H is a mapping from a predetermined {0, 1,..., P−1} ³ to {0, 1,. In the encryption apparatus, r1, r2, t1, and t2 randomly selected from {0, 1,..., P−1} are used as the random number R. Signature verification key U as ^{_{u = g 1 r1 g 2 r2}} , v = g 1 t1 g 2 with ^t2, _y ¹ as a key (PK, R) to encrypt plaintext ^{_{r1 y 2 r2 z 1 t1 z}} 2 t2 Is used. Then, σ1 = r1 + H (u, v, w) t1 modp and σ2 = r2 + H (u, v, w) t2 modp are used as signatures Σ. In the decryption device, the validity of the ciphertext is verified by verifying whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds. If it is established, u ^x v ^s is decrypted into plaintext using the key.

As a third specific example, first, G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1} , H is a predetermined {0, 1,..., P−1} ³ to {0, 1,..., P−1}, G is predetermined {0, 1,. Let ^{2 be} a mapping from {0, 1, ..., p-1}. In the encryption apparatus, r1, r2, t1, and t2 randomly selected from {0, 1,..., P−1} are used as the random number R. Signature verification key U as ^{_{u = g 1 r1 g 2 r2}} , v = g 1 t1 g 2 with ^t2, key to encrypt the plain text (PK, R) as ^{_{y 1 r1 + G (u,}} v) t1 y 2 r2 + G ^{(U, v) t2} is used. Then, σ1 = r1 + H (u, v, w) t1 modp and σ2 = r2 + H (u, v, w) t2 modp are used as signatures Σ. In the decryption device, the validity of the ciphertext is verified by verifying whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds. If it is established, u ^x v ^{G (u, v) x} is decrypted into plaintext using the key.

  According to the public key encryption method of the present invention, the private key of a one-time signature is also used as a random number for public key encryption. Therefore, if an appropriate function is selected, the validity of the ciphertext can be determined only by public information. Can be verified. In addition, since pairing is not necessary, an efficient encryption method can be realized.

Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
FIG. 1 shows a functional configuration example of the encryption apparatus according to the first embodiment of the present invention, and FIG. 2 shows a flow of encryption processing. FIG. 3 shows a functional configuration example of the decoding apparatus according to the first embodiment of the present invention, and FIG. 4 shows a flow of decoding processing. The encryption device 100 includes a public key acquisition unit 110, a signature verification key calculation unit 120, a plaintext encryption unit 130, a signature calculation unit 140, a ciphertext transmission unit 150, and a recording unit 190. The decryption apparatus 200 includes a ciphertext receiving unit 210, a signature verification unit 220, a plaintext decryption unit 230, a secret key / public key generation unit 270, a public key disclosure unit 280, and a recording unit 290. Also, let f and h be one-way functions and m be plaintext.

  In the decryption apparatus 200, the secret key / public key generation unit 270 generates the secret key SK and the public key PK in advance and records them in the recording unit 290. Then, the public key public unit 280 discloses the public key PK. The plain text m is recorded in advance in the recording unit 190 of the encryption apparatus 100.

  In the encryption device 100, the public key acquisition unit 110 acquires the public key PK of the decryption device 200 (S110). The public key PK is recorded in the recording unit 190 as necessary. The signature verification key calculation unit 120 randomly selects a signature generation key R (random number) and calculates a signature verification key U = f (R) (S120). The signature generation key R is a private key for a one-time signature and a random number used for public key encryption. The plaintext encryption unit 130 obtains w = h (PK, R, m) using the public key PK and the signature generation key R (using the signature generation key R as a random number for public key encryption) (S130). The signature calculation unit 140 generates a signature Σ for U and w (including information) using the signature generation key R (S140). The ciphertext transmission unit 150 transmits (U, w, Σ) as ciphertext to the decryption apparatus 200 (S150).

  In the decryption device 200, the ciphertext receiving unit 210 receives the ciphertext (U, w, Σ) from the encryption device 100 (S210). The signature verification unit 220 verifies that the signature Σ is a correct signature for (U, w) using the signature verification key U (S220). If the verification is successful, the plaintext decryption unit 230 obtains the plaintext m from (U, w) using the secret key SK (S230). If the verification fails, the decoding process ends.

Note that if a part of U is recorded by the encryption device 100 and the decryption device 200, the remaining part of U can be generated by individual encryption processing, so that the speed of the encryption processing is expected. it can.
Since the private key for a one-time signature is also used as a random number for public key cryptography, the validity of the ciphertext can be verified using only public information. In addition, since pairing is not necessary, an efficient encryption method can be realized.

[Second Embodiment]
First, some symbols used in the second embodiment will be described. In the second embodiment, a finite group G is used so that the discrete logarithm problem is difficult. Let p be the order of the finite group G. Specific examples of the finite group G include elliptic curve cryptography (Tatsuaki Okamoto, Hiroshi Yamamoto, “Contemporary Cryptography”, Industrial Books, pp.119-123.). Let g ₁ and g ₂ be the G generator and the secret key xε {0, 1,..., p−1}. Also, let H be a mapping from a predetermined {0, 1,..., P−1} ³ to {0, 1,. For H, for example, a one-way function such as a hash function may be used. m is plaintext, SymEnc (K, m) is a common key encryption function for encrypting plaintext m using the key K, SymDec (K, c) is a common key for decrypting the ciphertext c using the key K Let it be a decryption function.

  FIG. 5 shows a functional configuration example of the encryption apparatus according to the second embodiment, and FIG. 6 shows a flow of encryption processing. FIG. 7 shows a functional configuration example of the decoding apparatus according to the second embodiment, and FIG. 8 shows a flow of decoding processing. The encryption device 300 includes a public key acquisition unit 310, a power operation unit 320, a plaintext encryption unit 330, a signature calculation unit 340, a ciphertext transmission unit 350, and a recording unit 390. The signature calculation unit 340 includes an H calculation unit 341 and a remainder addition unit 342. The decryption device 400 includes a ciphertext receiving unit 410, a signature verification unit 420, a plaintext decryption unit 430, a secret key / public key generation unit 470, a public key disclosure unit 480, and a recording unit 490. The plaintext decryption unit 430 includes a power calculation unit 431 and a decryption unit 432.

In the decryption apparatus 400, the secret key / public key generation unit 470 generates the secret key x in advance and records it in the recording unit 490. Also, the secret key / public key generation unit 470 selects g ₁ and g ₂ and calculates y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , and (g ₁ , g ₂ , y ₁ , y ₂ ) As a public key. The public key public unit 480 discloses public keys (g ₁ , g ₂ , y ₁ , y ₂ ). The plain text m is recorded in advance in the recording unit 390 of the encryption device 300.

In the encryption device 300, the public key acquisition unit 310 acquires the public keys (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device 400 (S310). Public keys (g ₁ , g ₂ , y ₁ , y ₂ ) are recorded in the recording unit 390. Power operation unit 320, {0,1, ..., p- 1} randomly selects the signature generation key r1, r2, t1, t2 ^{_{from, u = g 1 r1 g 2}} r2, v = g 1 t1 g 2 t2 Is calculated (S320). The power calculation unit 320 also calculates y ₁ ^r1 y ₂ ^r2 . (U, v) is the signature verification key, and y ₁ ^r1 y ₂ ^r2 is the key of the common key encryption function SymEnc. The signature generation key (r1, r2, t1, t2) is a one-time signature private key and a random number used for public key encryption. The plaintext encryption unit 330 obtains w by calculating w = SymEnc (y ₁ ^r1 y ₂ ^r2 , m) (S330). The signature calculation unit 340 calculates H (u, v, w) by the H calculation means 341 (S341). The remainder adding unit 342 calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp, and generates a signature (σ1, σ2) (S342). In this process, the signature generation key (r1, r2, t1, t2) is used as a secret key for a one-time signature. The ciphertext transmission unit 350 transmits (u, v, w, σ1, σ2) as the ciphertext to the decryption device 400 (S350).

In the decryption device 400, the ciphertext receiving unit 410 receives the ciphertext (u, v, w, σ1, σ2) from the encryption device 300 (S410). The signature verification unit 420 indicates that the signature (σ1, σ2) is the correct signature for (u, v, w) (the validity of the ciphertext), uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ Whether ^σ2 is satisfied is verified (S420). If satisfied, the exponentiation means plaintext decryption unit 430 calculates a ^{u x} (S431). Then, the decryption unit 432 calculates m = SymDec (u ^x , w) and obtains plaintext m (S432). If step S420 is not established, the decoding process ends.

It will be described that encryption and decryption are correctly performed in the above-described processing. If u, v, σ1, and σ2 are correctly created, the formula of step S420 (the formula for verifying the validity of the ciphertext) is established as follows.
uv ^{H (u, v, w)} = g ₁ ^r1 g ₂ ^r2 (g ₁ ^t1 g ₂ ^t2 ) ^{H (u, v, w)
_{= G 1 r1 + H (u}} , v, w) t1 g 2 r2 + H (u, v, w) t2
= G ₁ ^σ1 g ₂ ^σ2
If this equation holds, the key y ₁ ^r1 y ₂ ^r2 of the common key encryption function SymEnc (y ₁ ^r1 y ₂ ^r2 , m) used in step S330 can be modified as follows.
_{^{y 1 r1 y 2 r2 = g}} 1 xr1 g 2 xr2
= (G ₁ ^r1 g ₂ ^r2 ) ^x
= U ^x
That is, the key u ^x of the common key decryption function SymDec (u ^x , c) used in step S432 is the same as the key of the common key encryption function SymEnc (y ₁ ^r1 y ₂ ^r2 , m). Therefore, encryption and decryption are correctly performed by the above-described processing.

Note that if either the encryption device 300 or the decryption device 400 records one of u and v and the other of u and v is generated by individual encryption processing, speeding up of the encryption processing is expected. it can.
Since the private key for a one-time signature is also used as a random number for public key cryptography, the validity of the ciphertext can be verified using only public information. In addition, since pairing is not necessary, an efficient encryption method can be realized.

[Modification 1]
In Modification 1 of the second embodiment, sε {0, 1,..., P−1} is further used as the secret key of the decryption device. The meanings of the other symbols are the same as in the second embodiment.

  FIG. 9 shows a functional configuration example of the encryption apparatus according to the first modification, and FIG. 10 shows a flow of encryption processing. FIG. 11 shows a functional configuration example of the decoding apparatus according to the first modification, and FIG. 12 shows a flow of decoding processing. The encryption device 500 includes a public key acquisition unit 510, a power operation unit 520, a plaintext encryption unit 530, a signature calculation unit 540, a ciphertext transmission unit 550, and a recording unit 590. The signature calculation unit 540 includes an H calculation unit 541 and a remainder addition unit 542. The decryption apparatus 600 includes a ciphertext receiving unit 610, a signature verification unit 620, a plaintext decryption unit 630, a secret key / public key generation unit 670, a public key disclosure unit 680, and a recording unit 690. The plaintext decryption unit 630 includes a power calculation unit 631 and a decryption unit 632.

Decryption apparatus 600 generates secret keys x and s by secret key / public key generation unit 670 in advance and records them in recording unit 690. The secret key / public key generation unit 670 selects g ₁ and g ₂ and calculates y ₁ = g ₁ ^X , y ₂ = g ₂ ^X , z ₁ = g ₁ ^s , z ₂ = g ₂ ^s . Then, (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) is recorded in the recording unit 690 as a public key. The public key public unit 680 publishes public keys (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ). The plain text m is recorded in advance in the recording unit 590 of the encryption apparatus 500.

In the encryption device 500, the public key acquisition unit 510 acquires the public keys (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) of the decryption device 600 (S510). Public keys (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) are recorded in the recording unit 590. Power operation unit 520, {0,1, ..., p- 1} randomly selects the signature generation key r1, r2, t1, t2 ^{_{from, u = g 1 r1 g 2}} r2, v = g 1 t1 g 2 t2 Is calculated (S520). Power operation unit ^{_{520, y 1 r1 y 2 r2 z}} 1 t1 z 2 t2 is also calculated. (U, v) is the signature verification key, and y ₁ ^r1 y ₂ ^r2 z ₁ ^t1 z ₂ ^t2 is the key of the common key encryption function SymEnc. The signature generation key (r1, r2, t1, t2) is a one-time signature private key and a random number used for public key encryption. Plaintext encryption unit 530, _{w =} ^SymEnc the ^{_{(y 1 r1 y 2 r2 z}} 1 t1 z 2 t2, m) is calculated, obtaining w (S530). The signature calculation unit 540 calculates H (u, v, w) by the H calculation unit 541 (S541). The remainder adding unit 542 calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp, and generates a signature (σ1, σ2) (S542). In this process, the signature generation key (r1, r2, t1, t2) is used as a secret key for a one-time signature. The ciphertext transmission unit 550 transmits (u, v, w, σ1, σ2) to the decryption apparatus 600 as ciphertext (S550).

In the decryption device 600, the ciphertext receiving unit 610 receives the ciphertext (u, v, w, σ1, σ2) from the encryption device 500 (S610). The signature verification unit 620 confirms that the signature (σ1, σ2) is the correct signature for (u, v, w) (the validity of the ciphertext), uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ ^It is verified whether ^σ2 is satisfied (S620). If it is established, the power calculation means of the plaintext decryption unit 630 calculates u ^x v ^s (S631). Then, the decryption unit 632 calculates m = SymDec (u ^x v ^s , w) to obtain plain text m (S632). If step S620 is not established, the decoding process ends.

It will be described that encryption and decryption are correctly performed in the above-described processing. If u, v, σ1, and σ2 are correctly created, the expression of step S620 (an expression for verifying the validity of the ciphertext) is established as follows.
uv ^{H (u, v, w)} = g ₁ ^r1 g ₂ ^r2 (g ₁ ^t1 g ₂ ^t2 ) ^{H (u, v, w)
_{= G 1 r1 + H (u}} , v, w) t1 g 2 r2 + H (u, v, w) t2
= G ₁ ^σ1 g ₂ ^σ2
If this expression is true, the key _{^{y 1 r1 y 2 r2 z 1}} t1 z 2 t2 of common key encryption function _{^{SymEnc (y 1 r1 y 2 r2}} z 1 t1 z 2 t2, m) used in the step S530, the following Can be transformed.
_{^{y 1 r1 y 2 r2 z 1}} t1 z 2 t2 = g 1 xr1 g 2 xr2 g 1 sr1 g 2 sr2
= (G ₁ ^r1 g ₂ ^r2 ) ^x (g ₁ ^t1 g ₂ ^t2 ) ^s
= U ^x v ^s
That is, the key u ^x v ^s of the common key decryption function SymDec (u ^x v ^s , c) used in step S632 is the same as the common key encryption function SymEnc (y ₁ ^r1 y ₂ ^r2 z ₁ ^t1 z ₂ ^t2 , m). Same as key. Therefore, encryption and decryption are correctly performed by the above-described processing.

Note that if either the encryption device 500 or the decryption device 600 records either u or v and the other of u and v is generated by individual encryption processing, the encryption processing can be speeded up. it can.
Also in this modification, since the private key of the one-time signature is also used as a random number for public key cryptography, the validity of the ciphertext can be verified only with public information. In addition, since pairing is not necessary, an efficient encryption method can be realized.

[Modification 2]
In the second modification of the second embodiment, G is a mapping from a predetermined {0, 1,..., P−1} ² to {0, 1,. For G, for example, a one-way function such as a hash function may be used. The meanings of the other symbols are the same as in the second embodiment.

  FIG. 13 shows a functional configuration example of the encryption apparatus according to the second modification, and FIG. 14 shows a flow of encryption processing. FIG. 15 shows a functional configuration example of the decoding apparatus according to the second modification, and FIG. 16 shows a flow of decoding processing. The encryption device 700 includes a public key acquisition unit 710, a power operation unit 720, a plaintext encryption unit 730, a signature calculation unit 740, a ciphertext transmission unit 750, and a recording unit 790. The power calculation unit 720 also includes G calculation means. The signature calculation unit 740 has H calculation means 741 and remainder addition means 742. The decryption apparatus 800 includes a ciphertext receiving unit 810, a signature verification unit 820, a plaintext decryption unit 830, a secret key / public key generation unit 870, a public key disclosure unit 880, and a recording unit 890. The plaintext decryption unit 630 includes a G calculation unit 831, a power operation unit 832, and a decryption unit 833.

Decryption apparatus 800 generates secret keys x and s by secret key / public key generation unit 870 in advance and records them in recording unit 890. Also, the secret key / public key generation unit 870 selects g ₁ and g ₂ , calculates y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , and (g ₁ , g ₂ , y ₁ , y ₂ ) As a public key. The public key public unit 880 publishes public keys (g ₁ , g ₂ , y ₁ , y ₂ ). The plain text m is recorded in advance in the recording unit 790 of the encryption apparatus 700.

In the encryption device 700, the public key acquisition unit 710 acquires the public keys (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device 800 (S710). Public keys (g ₁ , g ₂ , y ₁ , y ₂ ) are recorded in the recording unit 790. Power operation unit 720, {0,1, ..., p- 1} randomly selects the signature generation key r1, r2, t1, t2 ^{_{from, u = g 1 r1 g 2}} r2, v = g 1 t1 g 2 t2 Is calculated (S720). The G calculation means 721 of the power calculation unit 720 calculates G (u, v). The power operation unit 720, further ^{_{y 1 r1 + G (u,}} v) t1 y 2 r2 + G (u, v) t2 also calculated. (U, v) is the signature verification key, and y ₁ ^{r1 + G (u, v) t1} y ₂ ^{r2 + G (u, v) t2} is the key of the common key encryption function SymEnc. The signature generation key (r1, r2, t1, t2) is a one-time signature private key and a random number used for public key encryption. Plaintext encryption unit ^{_{730, w = SymEnc (y 1 r1}} + G (u, v) t1 y 2 r2 + G (u, v) t2, m) by calculation of obtaining w (S730). The signature calculation unit 740 calculates H (u, v, w) by the H calculation unit 741 (S741). The remainder adding means 742 calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp, and generates a signature (σ1, σ2) (S742). In this process, the signature generation key (r1, r2, t1, t2) is used as a secret key for a one-time signature. The ciphertext transmission unit 750 transmits (u, v, w, σ1, σ2) to the decryption apparatus 800 as ciphertext (S750).

In the decryption apparatus 800, the ciphertext receiving unit 810 receives the ciphertext (u, v, w, σ1, σ2) from the encryption apparatus 700 (S810). The signature verification unit 820 confirms that the signature (σ1, σ2) is the correct signature for (u, v, w) (the validity of the ciphertext), and uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ ^It is verified whether ^σ2 is satisfied (S820). If established, the G calculation means 831 of the plaintext decryption unit 830 calculates G (u, v) (S831), and the power calculation means 832 calculates u ^x v ^{G (u, v) x} (S832). Then, the decryption unit 833 calculates m = SymDec (u ^x v ^{G (u, v) x} , w) to obtain plain text m (S833). If step S820 is not established, the decoding process ends.

It will be described that encryption and decryption are correctly performed in the above-described processing. If u, v, σ1, and σ2 are correctly created, the expression of step S820 (an expression for verifying the validity of the ciphertext) is established as follows.
uv ^{H (u, v, w)} = g ₁ ^r1 g ₂ ^r2 (g ₁ ^t1 g ₂ ^t2 ) ^{H (u, v, w)
_{= G 1 r1 + H (u}} , v, w) t1 g 2 r2 + H (u, v, w) t2
= G ₁ ^σ1 g ₂ ^σ2
If this equation is satisfied, the common key encryption function SymEnc used in step _{^{S730 (y 1 r1 + G (}} u, v) t1 y 2 r2 + G (u, v) t2, m) of the key ^{_{y 1 r1 + G (u,}} v) t1 y ₂ ^{r2 + G (u, v) t2} can be modified as follows.
_{^{y 1 r1 + G (u,}} v) t1 y 2 r2 + G (u, v) t2 = g 1 x (r1 + G (u, v) t1) g 2 x (r2 + G (u, v) t2)
_{^{= (G 1 r1 g 2 r2}} ) x (g 1 t1 g 2 t2) G (u, v) x
= U ^x v ^{G (u, v) x}
That is, the common key decryption function SymDec used in step ^{S832 (u x v G (u} , v) x, c) the key ^{u x v G (u, v} ) of ^x, the common key encryption function SymEnc ^{_(y 1 r1 + G} ₍ ^{u, v) t1} y ₂ ^{r2 + G (u, v) t2} , m) is the same key. Therefore, encryption and decryption are correctly performed by the above-described processing.

  Note that if either the encryption device 700 or the decryption device 800 records one of u and v and the other of u and v is generated in each encryption processing, the encryption processing is expected to speed up. it can.

  In this modified example, the private key of the one-time signature is also used as a random number for public key cryptography, so that the validity of the ciphertext can be verified only with public information. In addition, since pairing is not necessary, an efficient encryption method can be realized.

  Note that the above embodiment is implemented by causing the recording unit 2020 of the computer illustrated in FIG. 17 to read a program that executes each step of the above method and causing the control unit 2010, the input unit 2030, the output unit 2040, and the like to operate. it can. In addition, as a method of causing the computer to read, the program is recorded on a computer-readable recording medium, and the program recorded on the server or the like is read into the computer through a telecommunication line or the like. There is a method to make it.

The figure which shows the function structural example of the encryption apparatus of 1st Embodiment. The figure which shows the processing flow of the encryption apparatus of 1st Embodiment. The figure which shows the function structural example of the decoding apparatus of 1st Embodiment. The figure which shows the processing flow of the decoding apparatus of 1st Embodiment. The figure which shows the function structural example of the encryption apparatus of 2nd Embodiment. The figure which shows the processing flow of the encryption apparatus of 2nd Embodiment. The figure which shows the function structural example of the decoding apparatus of 2nd Embodiment. The figure which shows the processing flow of the decoding apparatus of 2nd Embodiment. The figure which shows the function structural example of the encryption apparatus of the modification 1. The figure which shows the processing flow of the encryption apparatus of the modification 1. The figure which shows the function structural example of the decoding apparatus of the modification 1. The figure which shows the processing flow of the decoding apparatus of the modification 1. The figure which shows the function structural example of the encryption apparatus of the modification 2. The figure which shows the processing flow of the encryption apparatus of the modification 2. The figure which shows the function structural example of the decoding apparatus of the modification 2. The figure which shows the processing flow of the decoding apparatus of the modification 2. The figure which shows the function structural example of a computer.

Claims (18)

When f and h are one-way functions and m is plaintext,
A public step in which the decryption device generates a secret key SK and a public key PK in advance and discloses the public key PK;
The encryption device selects a random number R, calculates a signature verification key U = f (R), calculates w = h (PK, R, m), creates a signature Σ using the random number R, An encryption step of transmitting (U, w, Σ);
The decryption device receives the ciphertext (U, w, Σ), verifies that Σ is a correct signature for (U, w) using the signature verification key U, and if the verification is successful, the secret key SK A public key encryption method including a decryption step of obtaining plaintext m from (U, w) using G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x∈ {0, 1,..., P−1}, H is predetermined {0, 1,. , P−1} ³ to {0, 1,..., P−1}, m is plaintext, SymEnc (K, m) is a common key encryption function that encrypts plaintext m using the key K, SymDec When (K, c) is a common key decryption function for decrypting ciphertext c using key K,
The decryption device generates a secret key x in advance and records it in the recording unit, selects g ₁ and g ₂ , calculates y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , and (g ₁ , g ₂ , y ₁ , y ₂ ) recorded in the recording unit and published as a public key;
The encryption device randomly selects r1, r2, t1, t2 from {0, 1,..., P−1}, and u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , w = SymEnc (Y ₁ ^r1 y ₂ ^r2 , m), σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp is calculated, and ciphertext (u, v, w, σ1) , Σ2) for transmitting,
The decryption device receives the ciphertext (u, v, w, σ1, σ2), verifies whether uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ ^σ2 is satisfied, and if it is satisfied, m = A public key encryption method having a decrypting step of calculating SymDec (u ^x , w) and obtaining plaintext m. G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, and H is predetermined {0, 1 ,..., P-1} ³ to {0, 1,..., P-1}, m is plaintext, and SymEnc (K, m) is encrypted using the key K. , SymDec (K, c) is a common key decryption function for decrypting ciphertext c using key K,
The decryption device generates secret keys x and s in advance and records them in the recording unit, selects g ₁ and g ₂ , and y ₁ = g ₁ ^X , y ₂ = g ₂ ^X , z ₁ = g ₁ ^s , Z ₂ = g ₂ ^s , and (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) are recorded in the recording unit and published as a public key,
The encryption device randomly selects r1, r2, t1, t2 from {0, 1,..., P−1}, and u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , w = SymEnc ^{_{(y 1 r1 y 2 r2 z}} 1 t1 z 2 t2, m), σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) and t2 modp calculates the ciphertext (u , V, w, σ1, σ2),
The decryption device receives the ciphertext (u, v, w, σ1, σ2), verifies whether uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ ^σ2 is satisfied, and if it is satisfied, m = A public key encryption method including a decrypting step of calculating SymDec (u ^x v ^s , w) and obtaining plaintext m. G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, and H is predetermined {0, 1 ,..., P-1} ³ to {0, 1,..., P-1}, G is predetermined {0, 1,..., P-1} ² to {0, 1,. -1}, m is plaintext, SymEnc (K, m) is a common key encryption function that encrypts plaintext m using key K, and SymDec (K, c) is encrypted using ciphertext c using key K When using a common key decryption function to decrypt,
The decryption device generates secret keys x and s in advance and records them in the recording unit, selects g ₁ and g ₂ , calculates y ₁ = g ₁ ^X , y ₂ = g ₂ ^X , and (g ₁ , G ₂ , y ₁ , y ₂ ) in the recording unit and publishing as a public key,
The encryption device randomly selects r1, r2, t1, t2 from {0, 1,..., P−1}, and u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , w = SymEnc ^{_{(y 1 r1 + G (u}} , v) t1 y 2 r2 + G (u, v) t2, m), σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) calculate t2 modp An encryption step for transmitting ciphertext (u, v, w, σ1, σ2);
The decryption device receives the ciphertext (u, v, w, σ1, σ2), verifies whether uv ^{H (u, v, w)} = g ₁ ^σ1 g ₂ ^σ2 is satisfied, and if it is satisfied, m = SymDec (u ^x v ^{G (u, v) x} , w) is calculated, and a public key encryption method including a decryption step of obtaining plaintext m. When f and h are one-way functions and m is plaintext,
A recording unit for recording information;
A public key acquisition unit that acquires the public key PK of the decryption device and records the public key PK in the recording unit;
A signature verification key calculator that selects a random number R and calculates a signature verification key U = f (R);
a plaintext encryption unit for calculating w = h (PK, R, m);
A signature calculator that creates a signature Σ using a random number R;
An encryption device comprising: a ciphertext transmission unit that transmits ciphertext (U, w, Σ). G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x∈ {0, 1,..., P−1}, y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , (g ₁ , g ₂ , y ₁ , y ₂ ) is the public key of the decryption device, H is determined in advance from {0, 1,..., P−1} ³ to {0, 1,. -1}, m is plaintext, and SymEnc (K, m) is a common key encryption function that encrypts plaintext m using the key K.
A recording unit for recording information;
A public key acquisition unit that acquires a public key (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device and records the public key in the recording unit;
Choose r1, r2, t1, t2 randomly from {0,1, ..., p-1} and calculate u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , y ₁ ^r1 y ₂ ^r2 A power calculator to be
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^r1 y ₂ ^r2 , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
An encryption device comprising: G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , z ₁ = g ₁ ^s , z ₂ = g ₂ ^s , (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) are the public key of the decryption device, and H is predetermined {0,1, ..., p-1} ³ to {0,1, ..., p-1}, m is plaintext, and SymEnc (K, m) is encrypted with plaintext m using key K When the common key encryption function is
A recording unit for recording information;
A public key acquisition unit that acquires a public key (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) of the decryption device, and records it in the recording unit;
{0,1, ..., p-1 } randomly select _{r1, r2, t1, t2,} u = g 1 r1 g 2 r2, v = g 1 t1 g 2 t2, y 1 r1 y 2 r2 z 1 a power calculator for calculating ^t1 z ₂ ^t2 ;
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^r1 y ₂ ^r2 z ₁ ^t1 z ₂ ^t2 , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
An encryption device comprising: G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , (g ₁ , g ₂ , y ₁ , y ₂ ) is the public key of the decryption device, H is determined in advance from {0, 1,..., P−1} ³ to {0, 1,. , P−1}, G is defined in advance from {0, 1,..., P−1} ² to {0, 1,..., P−1}, m is plaintext, SymEnc (K, When m) is a common key encryption function for encrypting plaintext m using a key K,
A recording unit for recording information;
A public key acquisition unit that acquires a public key (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device and records the public key in the recording unit;
R1, r2, t1, t2 are selected randomly from {0, 1,..., P−1}, and u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , y ₁ ^{r1 + G (u, v)} a power calculator for calculating ^t1 y ₂ ^{r2 + G (u, v) t2} ,
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^{r1 + G (u, v) t1} y ₂ ^{r2 + G (u, v) t2} , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
An encryption device comprising: SK is a private key, PK is a public key, f and h are one-way functions, R is a random number, U = f (R) is a signature verification key, and w = h (PK, R, m) is encrypted as plaintext m Information, Σ as a signature,
A recording unit for recording information such as a secret key SK and a public key PK;
A ciphertext receiving unit for receiving ciphertext (U, w, Σ);
A signature verification unit that verifies, using the signature verification key U, that Σ is a correct signature for (U, w);
And a plaintext decryption unit that obtains plaintext m from (U, w) using a secret key SK. G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x∈ {0, 1,..., P−1}, y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , H is a predetermined mapping from {0, 1,..., P-1} ³ to {0, 1,..., P-1}, m is plaintext, SymDec (K, c) is key K When a common key decryption function for decrypting ciphertext c is used,
A recording unit for recording information such as a secret key x and a public key (g ₁ , g ₂ , y ₁ , y ₂ );
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
and a plaintext decryption unit that calculates m = SymDec (u ^x , w). G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , z ₁ = g ₁ ^s , z ₂ = g ₂ ^s , H from predetermined {0, 1,..., P−1} ³ to {0, 1,. When a mapping, m is plaintext, and SymDec (K, c) is a common key decryption function for decrypting ciphertext c using key K,
A recording unit for recording information such as secret keys x and s, public keys (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ );
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
and a plaintext decryption unit that calculates m = SymDec (u ^x v ^s , w). G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , mapping from {0, 1,..., P−1} ³ with a predetermined H to {0, 1,..., P−1}, {0, 1,. p-1} ² to {0, 1,..., p-1}, m is a plaintext, and SymDec (K, c) is a common key decryption function for decrypting ciphertext c using key K sometimes,
A recording unit for recording information such as secret keys x and s, public keys (g ₁ , g ₂ , y ₁ , y ₂ ),
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
A plaintext decryption unit that calculates m = SymDec (u ^x v ^{G (u, v) x} , w). When f and h are one-way functions and m is plaintext,
It consists of an encryption device and a decryption device,
The encryption device is:
An encryption device recording unit for recording information;
A public key acquisition unit that acquires a public key PK of the decryption device and records the public key PK in the encryption device recording unit;
A signature verification key calculator that selects a random number R and calculates a signature verification key U = f (R);
a plaintext encryption unit for calculating w = h (PK, R, m);
A signature calculator that creates a signature Σ using a random number R;
A ciphertext transmission unit that transmits ciphertext (U, w, Σ),
The decoding device
A decryption device recording unit for recording information such as a secret key SK and a public key PK;
A ciphertext receiving unit for receiving ciphertext (U, w, Σ);
A signature verification unit that verifies, using the signature verification key U, that Σ is a correct signature for (U, w);
And a plaintext decryption unit that obtains plaintext m from (U, w) using a secret key SK. G is a finite group where the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x∈ {0, 1,..., P−1}, y ₁ = g ₁ ^X and y ₂ = g ₂ ^X , (g ₁ , g ₂ , y ₁ , y ₂ ) is the public key of the decryption device, H is determined in advance from {0, 1,..., P−1} ³ to {0, 1,. -1}, m is plaintext, SymEnc (K, m) is a common key encryption function that encrypts plaintext m using key K, and SymDec (K, c) is encrypted using ciphertext c using key K When using a common key decryption function to decrypt,
It consists of an encryption device and a decryption device,
The encryption device is:
An encryption device recording unit for recording information;
A public key acquisition unit that acquires public keys (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device and records the public keys in the encryption device recording unit;
Choose r1, r2, t1, t2 randomly from {0,1, ..., p-1} and calculate u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , y ₁ ^r1 y ₂ ^r2 A power calculator to be
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^r1 y ₂ ^r2 , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
With
The decoding device
A decryption device recording unit for recording information such as a secret key x and a public key (g ₁ , g ₂ , y ₁ , y ₂ );
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
and a plaintext decryption unit for calculating m = SymDec (u ^x , w). G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , z ₁ = g ₁ ^s , z ₂ = g ₂ ^s , (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) are the public key of the decryption device, and H is predetermined {0,1, ..., p-1} ³ to {0,1, ..., p-1}, m is plaintext, and SymEnc (K, m) is encrypted with plaintext m using key K When the common key encryption function, SymDec (K, c) is a common key decryption function for decrypting the ciphertext c using the key K,
It consists of an encryption device and a decryption device,
The encryption device is:
An encryption device recording unit for recording information;
A public key acquisition unit that acquires a public key (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ ) of the decryption device and records it in the encryption device recording unit;
{0,1, ..., p-1 } randomly select _{r1, r2, t1, t2,} u = g 1 r1 g 2 r2, v = g 1 t1 g 2 t2, y 1 r1 y 2 r2 z 1 a power calculator for calculating ^t1 z ₂ ^t2 ;
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^r1 y ₂ ^r2 z ₁ ^t1 z ₂ ^t2 , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
With
The decoding device
A decryption device recording unit for recording information such as secret keys x and s, public keys (g ₁ , g ₂ , y ₁ , y ₂ , z ₁ , z ₂ );
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
^{m = SymDec (u x v s} , w) public key encryption system, characterized in that it comprises a plaintext decryption unit for calculating a. G is a finite group in which the discrete logarithm problem of order p is difficult, g ₁ and g ₂ are generators of G, x, sε {0, 1,..., P−1}, y ₁ = g ₁ ^X , y ₂ = G ₂ ^X , (g ₁ , g ₂ , y ₁ , y ₂ ) is the public key of the decryption device, H is determined in advance from {0, 1,..., P−1} ³ to {0, 1,. , P−1}, G is defined in advance from {0, 1,..., P−1} ² to {0, 1,..., P−1}, m is plaintext, SymEnc (K, m) is a common key encryption function for encrypting plaintext m using key K, and SymDec (K, c) is a common key decryption function for decrypting ciphertext c using key K.
It consists of an encryption device and a decryption device,
The encryption device is:
An encryption device recording unit for recording information;
A public key acquisition unit that acquires a public key (g ₁ , g ₂ , y ₁ , y ₂ ) of the decryption device and records it in the encryption device recording unit;
R1, r2, t1, t2 are selected randomly from {0, 1,..., P−1}, and u = g ₁ ^r1 g ₂ ^r2 , v = g ₁ ^t1 g ₂ ^t2 , y ₁ ^{r1 + G (u, v)} a power calculator for calculating ^t1 y ₂ ^{r2 + G (u, v) t2} ,
a plaintext encryption unit for calculating w = SymEnc (y ₁ ^{r1 + G (u, v) t1} y ₂ ^{r2 + G (u, v) t2} , m);
a signature calculator that calculates σ1 = r1 + H (u, v, w) t1 modp, σ2 = r2 + H (u, v, w) t2 modp;
A ciphertext transmitting unit for transmitting ciphertext (u, v, w, σ1, σ2);
With
The decoding device
A decryption device recording unit for recording information such as secret keys x and s, public keys (g ₁ , g ₂ , y ₁ , y ₂ );
A ciphertext receiving unit for receiving ciphertext (u, v, w, σ1, σ2);
a signature verification unit that verifies whether uv ^{H (u, v, w)} = g ₁ ^σ ₁ g ₂ ^σ ₂ holds;
public key encryption system, characterized in that it comprises ^{m = SymDec (u x v G} (u, v) x, w) and a plaintext decryption unit for calculating a.   The program which implement | achieves each structure part of the apparatus in any one of Claim 5 to 16 with a computer. A computer-readable recording medium on which the program according to claim 17 is recorded.

Images