JP2011061306A - Information sharing system, method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information sharing technique with a smaller amount of operations while safety equivalent to a conventional information sharing system is maintained. <P>SOLUTION: A secret information generator in a first information sharing device uses exchange information Y=G<SP>y</SP>received from a second information sharing device to generate first secret information Z<SB>1</SB>=(YB<SB>1</SB>)<SP>x+a1</SP>and second secret information Z<SB>2</SB>=(YB<SB>2</SB>)<SP>x+a2</SP>. A secret information synthesizer in the first information sharing device calculates an output value when the first secret information Z<SB>1</SB>and the second secret information Z<SB>2</SB>generated by the secret information generator in the first information sharing device, are inputted into a predetermined function H. A secret information generator in the second information sharing device uses exchange information X=G<SP>x</SP>received from the first information sharing device to generate first secret information Z<SB>1</SB>=(XA<SB>1</SB>)<SP>y+b1</SP>and second secret information Z<SB>2</SB>=(XA<SB>2</SB>)<SP>y+b2</SP>. A secret information synthesizer in the second information sharing device calculates an output value when the first secret information Z<SB>1</SB>and the second secret information Z<SB>2</SB>generated by the secret information generator in the second information sharing device, are inputted into the predetermined function H. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a cryptographic technique, and more particularly to a technique for sharing information such as a secret key between two entities.

  The NAXOS method is known as an information sharing method that is safe against a man-in-the-middle attack and can prove the safety assuming the difficulty of the gap Diffie-Hellman problem (see Non-Patent Document 1, for example). ). In the NAXOS method, each information sharing device performs group power multiplication four times.

  Also, the NAXOS + method is known as an information sharing method that is safe against man-in-the-middle attacks and can be proved by assuming the difficulty of the Diffie-Hellman problem and is safer than the NAXOS method. (For example, see Non-Patent Document 2). In the NAXOS + system, each information sharing apparatus performs group power multiplication five times.

B. LaMacchia, K. Lauter, A. Mityagin, “Stronger Security of Authenticated Key Exchange”, ProveSec 2007, LNCS 4784, Springer Berlin, 2007 J. Lee, J. Park, “Authenticated Key Exchange Secure underthe Computational Diffie-Hellman Assumption”, Preprint, http://eprint.iacr.org/2008/344/

  Conventional information sharing methods are safe against man-in-the-middle attacks, but have the problem of a large amount of computation.

  It is an object of the present invention to provide an information sharing system, method, and program having a smaller amount of computation while maintaining the same level of safety as a conventional information sharing system.

In order to share information between the first information sharing apparatus and the second information sharing apparatus, the security parameter k is a predetermined positive integer, and the group <G> is a cyclic group generated by the generation source G And the secret keys a ₁ and a ₂ of the first information sharing apparatus are positive integer random numbers of ₂ k bits or more, and the public keys A ₁ and A ₂ of the first information sharing apparatus are A ₁ = G ^a1 and A ₂ = As G ^a2 , the secret keys b ₁ and b ₂ of the second information sharing device are positive integer random numbers of ₂ k bits or more, and the public keys B ₁ and B ₂ of the second information sharing device are B ₁ = G ^b1 , B _{As 2} = ^Gb2 , the random number generation unit of the first information sharing apparatus generates a positive integer random number x of 2 k bits or more. The exchange information generation unit of the first information sharing apparatus generates exchange information X = G ^x using the random number x. The transmission / reception unit of the first information sharing apparatus transmits the exchange information X to the second information sharing apparatus. Using the exchange information Y received by the secret information generation unit of the first information sharing device from the second information sharing device, the first secret information Z ₁ = (YB ₁ ) ^{x + a1} and the second secret information Z ₂ = (YB ₂ ) ^{x + a2} Is generated. Output when secret information synthesizing unit of the first information sharing device is input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H secret information generating unit has generated the first information sharing device Calculate the value. The random number generation unit of the second information sharing apparatus generates a positive integer random number y of 2 k bits or more. The exchange information generation unit of the second information sharing apparatus generates exchange information Y = G ^y using the random number y. The transmission / reception unit of the second information sharing apparatus transmits the exchange information Y to the first information sharing apparatus. Using the exchange information X received from the first information sharing device by the secret information generation unit of the second information sharing device, the first secret information Z ₁ = (XA ₁ ) ^{y + b1} and the second secret information Z ₂ = (XA ₂ ) ^{y + b2} Is generated. And information for calculating the output value when the secret information synthesizing unit of the second information sharing device is input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H.

  The number of multiplications to be performed by each of the first information sharing apparatus and the second information sharing apparatus is equal to or less than the number of power multiplications in the conventional information sharing system, or power multiplication 1 when the number of power multiplications is the same as in the conventional information sharing system. The average calculation amount per time can be made smaller than that of the conventional information sharing method. Therefore, the calculation amount for information sharing becomes small.

The functional block diagram of the example of an information sharing system. The functional block diagram of the example of a 1st information sharing apparatus. The functional block diagram of the example of a 2nd information sharing apparatus. The flowchart of the example of the information sharing method of 1st embodiment. The flowchart of the example of the information sharing method of 2nd embodiment. Flow chart of power multiplication by binary method.

  Hereinafter, embodiments of the present invention will be described in detail.

[First embodiment]
The information sharing system and method according to the present invention share information K between the first information sharing apparatus A and the second information sharing apparatus B exemplified in FIG. The first information sharing apparatus A and the second information sharing apparatus are connected by a communication path that does not always keep the secret of the communication content.

The first information sharing apparatus A is given an identifier ID _A which is an arbitrary bit string, and the second information sharing apparatus _B is given an identifier ID _B which is an arbitrary bit string, and the first information sharing apparatus A And the second information sharing apparatus B knows each other's identifier.

  The security parameter k is a positive integer that is appropriately set according to the required security level. The group <G> is a cyclic group in which Diffie-Hellman problem is difficult, and is generated by the generation source G. For example, a group used in elliptical El Gamal encryption is preferable. H is a predetermined function. For example, a hash function such as SHA-256.

  FIG. 2 is a functional block diagram of an example of the first information sharing apparatus A, and FIG. 3 is a functional block diagram of an example of the second information sharing apparatus B. FIG. 4 is a diagram showing a processing flow of the information sharing method of this embodiment.

First, the first information sharing apparatus A generates a secret key (a ₁ , a ₂ ) and a public key (A ₁ , A ₂ ) (step a 1 to step a 3), and the second information sharing apparatus B receives a secret key (b ₁ , b ₂ ) and public keys (B1, B2) are generated (step b1 to step b3). These steps a1 to a3 and steps b1 to b3 are performed in advance as preparation for information sharing.

The random number generator 12 of the first information sharing apparatus A generates random numbers a ₁ and a ₂ of ₂ k bits or more (step a1). These random numbers a ₁ and a ₂ are secret keys of the first information sharing apparatus A, and are secretly managed so as not to leak outside the first information sharing apparatus A.

The public key generation unit 13 generates public keys A ₁ and A ₂ defined by A ₁ = G ^a1 and A ₂ = G ^a2 using the random numbers a ₁ and a ₂ (step a2).

The transmission / reception unit 14 transmits the public key (A ₁ , A ₂ ) to the second information sharing apparatus B (step a3).

The random number generation unit 22 of the second information sharing apparatus B generates random numbers b ₁ and b ₂ of ₂ k bits or more (step b1). These random numbers b ₁ and b ₂ are secret keys of the second information sharing apparatus B, and are secretly managed so as not to leak outside the second information sharing apparatus B.

The public key generation unit 23 generates public keys B ₁ and B ₂ defined by B ₁ = G ^b1 and B ₂ = G ^b2 using the random numbers b ₁ and b ₂ (step b2).

  The transmission / reception unit 24 transmits the public key (B1, B2) to the second information sharing apparatus A (step b3).

  In order to share the information K, the first information sharing apparatus A and the second information sharing apparatus B perform the following steps A1 to A6 and B1 to B6.

  The random number generation unit 12 of the first information sharing apparatus A generates a random number x of 2k bits or more (step A1). The generated random number x is sent to the exchange information generation unit 15 and the secret information generation unit 16.

Exchanging information generating unit 15 generates replacement information X defined by X = ^{G x} (Step A2). The generated exchange information X is sent to the transmission / reception unit 14.

  The transmission / reception unit 14 transmits the exchange information X to the second information sharing device B (step A3). The transmission / reception unit 24 of the second information sharing apparatus B determines whether or not the exchange information X that has been sent is an element of the group <G>, and if it is not an element of the group <G>, shares the information K. To cancel the process.

  The random number generation unit 22 of the second information sharing apparatus B generates a random number y of 2k bits or more (step B1). The generated random number y is sent to the exchange information generation unit 25 and the secret information generation unit 26.

The exchange information generation unit 25 generates exchange information Y defined by Y = G ^y (step B2). The generated exchange information Y is sent to the transmission / reception unit 24.

  The transmission / reception unit 24 transmits the exchange information Y to the first information sharing apparatus A (step B3). The first information sharing apparatus A determines whether or not the exchange information Y sent is an element of the group <G>. If the exchange information Y is not an element of the group <G>, the first information sharing apparatus A performs a procedure for sharing the information K. Cancel.

The secret information generation unit 16 of the first information sharing apparatus A generates the first secret information Z ₁ defined by Z ₁ = (YB ₁ ) ^{x + a1} using the exchange information Y (step A4). Also, the secret information generation unit 16 generates the second secret information Z ₂ defined by Z ₂ = (YB ₂ ) ^{x + a2} using the exchange information Y (step A5). The generated first secret information Z ₁ and second secret information Z ₂ are sent to the secret information combining unit 17.

The secret information combining unit 17, an output value when the input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H is calculated and the shared information K (step A6). The function H is, for example, a hash function H (Z ₁ , Z ₂ , X, etc.) having the first secret information Z ₁ , the second secret information Z ₂ , the exchange information X, the exchange information Y, the identifier ID _A, and the identifier ID _B as inputs. Y, ID _A , ID _B ).

The secret information generation unit 26 of the second information sharing apparatus B generates the first secret information Z ₁ defined by Z ₁ = (XA ₁ ) ^{y + b1} using the exchange information X (step B4). Further, the secret information generation unit 26 generates the second secret information Z ₂ defined by Z ₂ = (XA ₂ ) ^{y + b2} using the exchange information X (step B5). The generated first secret information Z ₁ and second secret information Z ₂ are sent to the secret information combining unit 27.

The secret information combining unit 27, an output value when the input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H is calculated and the information K to be shared (step A6) . Function H, for example, the first secret information _{Z 1,} the second secret information _{Z 2,} exchange information X, exchanging information Y, a hash function _H (Z ₁ to enter an identifier ID _A and the identifier ID _B, Z 2, X, Y, ID _A , ID _B ). As the function H of the second information sharing apparatus B, the same function as the function H of the first information sharing apparatus A is used.

The first secret information Z ₁ = (YB ₁ ) ^{x + a1} generated by the first information sharing apparatus A matches the first secret information Z ₁ = (XA ₁ ) ^{y + b1} generated by the second information sharing apparatus B. This is because (YB ₁ ) ^{x + a 1} = (G ^y G ^{b 1} ) ^{x + a 1} = G ^{(y + b 1) (x + a 1)} = (G ^x G a ¹ ) ^{y + b 1} = (XA ₁ ) ^{y + b} ₁ Similarly, the second secret information Z ₂ = (YB ₂ ) ^{x + a2} generated by the first information sharing apparatus A and the second secret information Z ₂ = (XA ₂ ) ^{y + b2} generated by the second information sharing apparatus B match. To do. For this reason, the information K generated by the first information sharing apparatus A and the information K generated by the second information sharing apparatus B match.

Each of the first information sharing apparatus A and the second information sharing apparatus B of the first embodiment can share the information K only by performing the multiplication of the group <G> three times. The first information sharing apparatus A will be described as an example. The first information sharing apparatus A (1) calculates exchange information X = G ^x (step A2), (2) first secret information Z ₁ = (YB ₁ ) Calculation of ^{x + a1} (step A4), (3) Second secret information Z ₂ = (YB ₂ ) Information K can be shared by performing only three power multiplications of calculation of ^{x + a2} (step A5). .

  Thus, according to the first embodiment, the number of multiplications (3 times) to be performed by each of the first information sharing apparatus A and the second information sharing apparatus B is the number of multiplications (3 times) in the conventional information sharing system ( 4 times), and the amount of calculation for information sharing is small.

  Although proof is omitted, the security of the information sharing system and the information sharing method of the first embodiment can be described assuming the difficulty of the gap Diffie-Hellmann problem. That is, the safety of the information sharing system of the first embodiment is equivalent to the safety of the NAXOS system.

[Second Embodiment]
The information sharing system and method according to the second embodiment is safe against man-in-the-middle attacks, and can prove the safety assuming the difficulty of the Diffie-Hellman problem, and is more secure than the first embodiment. It is an object of the present invention to provide an information sharing system and method that are high and have the same level of safety as that of the NAXOS + system while reducing the amount of calculation. Hereinafter, a different part from 1st embodiment is demonstrated and duplication description is abbreviate | omitted about the same part.

  The functional blocks of the first information sharing apparatus A and the second information sharing apparatus B of the second embodiment are the functions of the first information sharing apparatus A and the second information sharing apparatus B of the first embodiment illustrated in FIGS. Although it is the same as the block, the functions of the secret information generating units 16 and 26 and the secret information combining units 17 and 27 are different as will be described later.

  FIG. 5 illustrates a processing flow of the information sharing method of the second embodiment. The first information sharing apparatus A performs the processing of step A7 and step A8 after performing the processing of step a1 to step a3 and step A1 to A5 as in the first embodiment.

In other words, the secret information generation unit 16 of the first information sharing apparatus A generates the first secret information Z ₁ and the second secret information Z _2, and the third secret information defined by Z ₃ = (YB ₁ ) ^{x + a2} Z ₃ is generated (step A7), and the fourth secret information Z ₄ defined by Z ₄ = (YB ₂ ) ^{x + a1} is generated (step A8). The generated third secret information Z ₃ and fourth secret information Z ₄ are sent to the secret information combining unit 17.

The secret information combining unit 17 calculates an output value when the first secret information Z ₁ , the second secret information Z ₂ , the third secret information Z ₃ and the fourth secret information Z ₄ are input to a predetermined function H. Thus, the shared information K is set (step A6). Function H inputs, for example, first secret information Z ₁ , second secret information Z ₂ , third secret information Z ₃ , fourth secret information Z ₄ , exchange information X, exchange information Y, identifier ID _A and identifier ID _B A hash function H (Z ₁ , Z ₂ , Z ₃ , Z ₄ , X, Y, ID _A , ID _B ).

Further, the secret information generation unit 26 of the second information sharing apparatus B generates the first secret information Z ₁ and the second secret information Z _2, and the third secret information defined by Z ₃ = (XA ₁ ) ^{x + b 2.} Z ₃ is generated (step B 7), and fourth secret information Z ₄ defined by Z ₄ = (XA ₂ ) ^{x + b 1} is generated (step B 8). The generated third secret information Z ₃ and fourth secret information Z ₄ are sent to the secret information combining unit 17.

The secret information combining unit 27 calculates an output value when the first secret information Z ₁ , the second secret information Z ₂ , the third secret information Z _3, and the fourth secret information Z ₄ are input to a predetermined function H. Thus, the shared information K is set (step B6). Function H inputs, for example, first secret information Z ₁ , second secret information Z ₂ , third secret information Z ₃ , fourth secret information Z ₄ , exchange information X, exchange information Y, identifier ID _A and identifier ID _B A hash function H (Z ₁ , Z ₂ , Z ₃ , Z ₄ , X, Y, ID _A , ID _B ). As the function H of the second information sharing apparatus B, the same function as the function H of the first information sharing apparatus A is used.

Each of the second information sharing apparatus A and the second information sharing apparatus B of the second embodiment can share the information K only by performing the multiplication of the group <G> five times. The first information sharing apparatus A will be described as an example. The first information sharing apparatus A (1) calculates exchange information X = G ^x (step A2), (2) first secret information Z ₁ = (YB ₁ ) Calculation of ^{x + a1} (Step A4), (3) Calculation of second secret information Z ₂ = (YB ₂ ) ^{x + a2} (Step A5), (4) Calculation of third secret information Z ₃ = (YB ₁ ) ^{y + a2} ( Steps A7) and (5) The fourth secret information Z ₄ = (YB ₂ ) ^{y + a1} is calculated (step A8) by five power multiplications to share the information K.

  The number of power multiplications (5 times) of the second embodiment is the same as the number of power multiplications (5 times) of the conventional NAXOS + method, but the average amount of calculation per power multiplication is higher than that of the conventional NAXOS + method. Can be small.

  Specifically, each of the second information sharing apparatus A and the second information sharing apparatus B uses the intermediate calculation result of the same base power multiplication that has already been performed when the power multiplication is performed, thereby overlapping calculation. It is possible to reduce the average amount of calculation per multiplication that should be omitted.

The first information sharing apparatus A will be described as an example. When calculating the first secret information Z ₁ = (YB ₁ ) ^{x + a1} and the third secret information Z ₃ = (YB ₁ ) ^{y + a2} , the bottom is YB ₁ The second secret information Z ₂ = (YB ₂ ) ^{x + a2} and the fourth secret information Z ₄ = (YB ₂ ) ^{y + a1} are common to YB ₂ when calculating the second secret information Z ₂ = (YB ₂ ) ^{x + a2} . Therefore, when the multiplication of the first secret information Z ₁ = (YB ₁ ) ^{x + a1} has already been performed, the first secret information Z ₃ is calculated when calculating the third secret information Z ₃ = (YB ₁ ) ^{y + a2.} By reusing the intermediate calculation result for the exponentiation of ₁ = (YB ₁ ) ^{x + a1} , the amount of computation of the third secret information Z ₃ = (YB ₁ ) ^{y + a2} can be reduced. In addition, when power multiplication of the second secret information Z ₂ = (YB ₂ ) ^{x + a2} has already been performed, the second secret information Z ₄ is calculated when calculating the fourth secret information Z ₄ = (YB ₂ ) ^{y + a1.} By reusing the intermediate calculation result for the exponentiation of ₂ = (YB ₂ ) ^{x + a2, the amount} of calculation of the fourth secret information Z ₄ = (YB ₂ ) ^{y + a1} can be reduced.

Hereinafter, the reuse of the calculation result during the power multiplication by the binary method will be described. When performing a power multiplication of the base Q to the power of s (= s _I s _I-1 ... S ₀ ) by the binary method, the processing of the flowchart of FIG. s _I s _I-1 ... s ₀ represents the integer s in binary, and each s _i (i = I,..., 0) is 0 or 1.

  First, Q is substituted for R, 1 is substituted for T, 0 is substituted for i, and each variable is initialized (step S1).

It is determined whether or not s _i is 1 (step S2). If s _i is 1, T × R is calculated and substituted for T (step S3). If s _i is not 1, the process of step S4 is performed without performing the process of step S3. X is an operation defined by the group <G>.

R × R is calculated and substituted for R (step S4).
It is determined whether i is I (step S5). If i is I, the process is terminated. T is the operation result of the power multiplication of the base Q to the power of s (= s _I s _I-1 ... S ₀ ). If i is not I, i is incremented by 1 (step S6), that is, i + 1 is substituted for i, and the process returns to step S2.

When the secret information generation unit 16 of the first information sharing apparatus A performs power multiplication by the binary method illustrated in FIG. 6, the calculation result of R × R in step S4 can be reused. This is because the calculation of R × R in step S4 depends only on the base Q and does not depend on the index s _I ... S ₀ . The secret information generation unit 16 stores, for example, the R × R calculation result generated when the first secret information Z ₁ = (YB ₁ ) ^{x + a1} is multiplied in the temporary storage unit 161. Then, when calculating the third secret information Z ₃ = (YB ₁ ) ^{y + a2} , R × R is read by reading the calculation result of R × R from the temporary storage unit 161 instead of performing the calculation of R × R in step S4. The calculation of R is omitted.

  It is known that the calculation amount of T × R in step S3 is about I / 2, and the calculation amount of R × R in step S4 is about I (see, for example, Reference 1). Therefore, the amount of calculation for the base to be calculated for the first time is about 3I / 2 (= (I / 2) + I). However, in the case where exponentiation is performed again for the same base as that base, the calculation of R × R in step S4 is performed. By omitting, the amount of computation can be reduced to about I / 2.

[Reference 1] A. Menezes, P. Oorschot, S. Vanstone, “Handbook of Applied Cryptography,”, Revised Reprint with Updates, CRC Press, 1997.
In the conventional NAXOS +, since it is necessary to perform multiplication of five different powers from each other, the calculation amount is about 15 I / 2 (= 5 × (3I / 2)), whereas in the second embodiment, five times. Since the intermediate calculation result for the same base power multiplication already performed in two power multiplications among the power multiplications can be reused, the amount of computation is about 11I / 2 (= 3 × (3I / 2) + 2 × (I / 2)). Therefore, the amount of calculation can be reduced to about 73% (= (11I / 2) / (15I / 2)) by reusing the calculation result on the way.

  In the above example, the case of performing power multiplication by the binary method has been described as an example, but the amount of calculation has been described. However, even when power multiplication is performed by another method, intermediate calculations for the same base power multiplication that have already been performed are performed. The amount of calculation can be reduced by reusing the result. For example, when power multiplication is performed by the method described in Reference 2, the calculation amount is reduced by about 2 / compared with the NAXOS + method by reusing the intermediate calculation result of the same power multiplication already performed. Can be 3.

[Reference 2] David M'Raihi and Acm Press and David Naccache, “Batch Exponentiation: A Fast DLP-based Signature Generation Strategy”, 1966, ACM
Although the proof is omitted, the security of the information sharing system and the information sharing method of the second embodiment can be described assuming the difficulty of the Diffie-Hellmann problem. That is, the security of the information sharing system of the second embodiment is equivalent to the security of the NAXOS + system.

[Modifications, etc.]
In FIG. 2 and FIG. 3, data is directly exchanged between the respective units, but data may be exchanged via the storage units 11 and 21. That is, data generated or received by each unit may be stored in the storage units 11 and 21, and each unit may read the data from the storage units 11 and 21.

  Each of the first information sharing apparatus A and the second information sharing apparatus B can be realized by a computer. In this case, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on a computer, each processing function in these devices is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. In this embodiment, these apparatuses are configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  The present invention is not limited to the above-described embodiment, and can be modified as appropriate without departing from the spirit of the present invention. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes.

A first information sharing device B second information sharing device 11 storage unit 12 random number generation unit 13 public key generation unit 14 transmission / reception unit 15 exchange information generation unit 16 secret information generation unit 17 secret information combination unit 21 storage unit 22 random number generation unit 23 Public key generation unit 24 Transmission / reception unit 25 Exchange information generation unit 26 Secret information generation unit 27 Secret information synthesis unit

Claims (9)

In the information sharing system for sharing information between the first information sharing device and the second information sharing device,
The security parameter k is a predetermined positive integer, the group <G> is a cyclic group generated by the generator G, and the secret keys a ₁ and a ₂ of the first information sharing apparatus are positive integers of 2k bits or more. Random numbers are used, the public keys A ₁ and A ₂ of the first information sharing device are A ₁ = G ^a1 and A ₂ = G ^a2, and the secret keys b ₁ and b ₂ of the second information sharing device are ₂ k bits or more. It is a positive integer random number, and public keys B ₁ and B ₂ of the second information sharing apparatus are set as B ₁ = G ^b1 and B ₂ = G ^b2 ,
The first information sharing device includes:
A random number generator for generating a positive integer random number x of 2 k bits or more;
An exchange information generating unit that generates exchange information X = G ^x using the random number x,
A transmission / reception unit for transmitting the exchange information X to the second information sharing device;
A secret information generating unit that generates first secret information Z ₁ = (YB ₁ ) ^{x + a1} and second secret information Z ₂ = (YB ₂ ) ^{x + a2} using the exchange information Y received from the second information sharing device;
And secret information combining unit for calculating the output value when the input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H secret information generating unit has generated the first information sharing apparatus,
Including
The second information sharing apparatus is
A random number generator for generating a positive integer random number y of 2 k bits or more;
An exchange information generating unit that generates exchange information Y = G ^y using the random number y;
A transmission / reception unit for transmitting the exchange information Y to the first information sharing device;
A secret information generating unit that generates first secret information Z ₁ = (XA ₁ ) ^{y + b1} and second secret information Z ₂ = (XA ₂ ) ^{y + b2} using the exchange information X received from the first information sharing device;
And secret information combining unit to the information to calculate the output value when the input to the first secret information Z ₁ and the second secret information Z ₂ a predetermined function H,
including,
An information sharing system characterized by this. The information sharing system according to claim 1,
The secret information generation unit of the first information sharing apparatus further generates third secret information Z ₃ = (YB ₁ ) ^{y + a2} and fourth secret information Z ₄ = (YB ₂ ) ^{y + a1} ,
The secret information combining unit of the first information sharing device includes first secret information Z ₁ , second secret information Z ₂ , third secret information Z _3, and fourth generated by the secret information generation unit of the first information sharing device. Calculate the output value when secret information Z ₄ is input to a predetermined function H;
The secret information generation unit of the second information sharing apparatus further generates third secret information Z ₃ = (XA ₁ ) ^{y + b2} and fourth secret information Z ₄ = (XA ₂ ) ^{y + b1} ;
The secret information combining unit of the second information sharing device includes first secret information Z ₁ , second secret information Z ₂ , third secret information Z _3, and fourth generated by the secret information generation unit of the second information sharing device. Calculating an output value when the secret information Z ₄ is input to a predetermined function H;
An information sharing system characterized by this. The information sharing system according to claim 1,
A predetermined bit string ID _A is an identifier of the first information sharing apparatus, and a predetermined bit string ID _B is an identifier of the second information sharing apparatus,
The function H is a hash function having the first secret information Z ₁ , the second secret information Z ₂ , the exchange information X, the exchange information Y, the identifier ID _A, and the identifier ID _B as inputs,
The secret information combining unit of the first information sharing device includes the first secret information Z ₁ , the second secret information Z ₂ , the exchange information X, and the exchange information Y generated by the secret information generation unit of the first information share device. Calculating an output value when the identifier ID _A and the identifier ID _B are input to the function H;
An information sharing system characterized by this. The information sharing system according to claim 2,
A predetermined bit string ID _A is an identifier of the first information sharing apparatus, and a predetermined bit string ID _B is an identifier of the second information sharing apparatus,
The function H includes the first secret information Z ₁ , the second secret information Z ₂ , the third secret information Z ₃ , the fourth secret information Z ₄ , the exchange information X, the exchange information Y, and the identifier ID. _A hash function having _A and the identifier ID _B as inputs,
The secret information combining unit of the first information sharing device includes first secret information Z ₁ , second secret information Z ₂ , third secret information Z ₃ , and fourth generated by the secret information generation unit of the first information sharing device. Calculating an output value when the secret information Z ₄ , the exchange information X, the exchange information Y, the identifier ID _A, and the identifier ID _B are input to the function H;
An information sharing system characterized by this. In the information sharing system according to claim 2 or 4,
At least one of the secret information generation unit of the first information sharing device and the secret information generation unit of the second information sharing device reuses the intermediate calculation result for the same power multiplication already performed,
An information sharing system characterized by this. In the information sharing method for sharing information between the first information sharing device and the second information sharing device,
The security parameter k is a predetermined positive integer, the group <G> is a cyclic group generated by the generator G, and the secret keys a ₁ and a ₂ of the first information sharing apparatus are positive integers of 2k bits or more. Random numbers are used, the public keys A ₁ and A ₂ of the first information sharing device are A ₁ = G ^a1 and A ₂ = G ^a2, and the secret keys b ₁ and b ₂ of the second information sharing device are ₂ k bits or more. It is a positive integer random number, and public keys B ₁ and B ₂ of the second information sharing apparatus are set as B ₁ = G ^b1 and B ₂ = G ^b2 ,
A random number generation step in which the random number generation unit of the first information sharing apparatus generates a positive integer random number x of 2 k bits or more;
An exchange information generating step in which the exchange information generating unit of the first information sharing apparatus generates exchange information X = G ^x using the random number x;
A transmission / reception step in which the transmission / reception unit of the first information sharing device transmits the exchange information X to the second information sharing device;
The secret information generation unit of the first information sharing device uses the exchange information Y received from the second information sharing device to use the first secret information Z ₁ = (YB ₁ ) ^{x + a1} and the second secret information Z ₂ = (YB ₂ ) a secret information generation step of generating ^{x + a2} ;
The secret information combining unit of the first information sharing device, entered into the first secret information Z ₁ and the second secret information Z ₂ a predetermined function H secret information generating unit has generated the first information sharing device A secret information synthesizing step for calculating an output value of the case,
A random number generation step in which the random number generation unit of the second information sharing apparatus generates a positive integer random number y of 2 k bits or more;
An exchange information generating step in which an exchange information generating unit of the second information sharing apparatus generates exchange information Y = G ^y using the random number y;
A transmitting / receiving step in which the transmitting / receiving unit of the second information sharing device transmits the exchange information Y to the first information sharing device;
The secret information generation unit of the second information sharing device uses the exchange information X received from the first information sharing device to use the first secret information Z ₁ = (XA ₁ ) ^{y + b1} and the second secret information Z ₂ = (XA ₂ ) a secret information generation step of generating ^{y + b2} ;
Confidential information confidential information synthesizing unit of the second information sharing apparatus, an information for calculating the output value when the input to the first secret information Z ₁ and the second secret information Z ₂ a predetermined function H A synthesis step;
An information sharing method comprising: The information sharing method according to claim 6,
The secret information generation step of the first information sharing device further generates third secret information Z ₃ = (YB ₁ ) ^{y + a2} and fourth secret information Z ₄ = (YB ₂ ) ^{y + a1} ,
The secret information combining step of the first information sharing apparatus includes the first secret information Z ₁ , the second secret information Z ₂ , the third secret information Z _3, and the fourth information generated by the secret information generation unit of the first information sharing apparatus. Calculate the output value when secret information Z ₄ is input to a predetermined function H;
The secret information generation step of the second information sharing device further generates third secret information Z ₃ = (XA ₁ ) ^{y + b2} and fourth secret information Z ₄ = (XA ₂ ) ^{y + b1} ,
The secret information combining step of the second information sharing device includes the first secret information Z ₁ , the second secret information Z ₂ , the third secret information Z ₃ and the fourth secret information generated by the secret information generation unit of the second information sharing device. Calculating an output value when the secret information Z ₄ is input to a predetermined function H;
An information sharing method characterized by the above. The information sharing method according to claim 7,
At least one of the secret information generation step of the first information sharing device and the secret information generation step of the second information sharing device reuses the intermediate calculation result on the same power multiplication that has already been performed,
An information sharing method characterized by the above. In an information sharing program for causing a computer to function as a first information sharing device that shares information between a first information sharing device and a second information sharing device,
The security parameter k is a predetermined positive integer, the group <G> is a cyclic group generated by the generator G, and the secret keys a ₁ and a ₂ of the first information sharing apparatus are positive integers of 2k bits or more. Random numbers are used, the public keys A ₁ and A ₂ of the first information sharing device are A ₁ = G ^a1 and A ₂ = G ^a2, and the secret keys b ₁ and b ₂ of the second information sharing device are ₂ k bits or more. It is a positive integer random number, and public keys B ₁ and B ₂ of the second information sharing apparatus are set as B ₁ = G ^b1 and B ₂ = G ^b2 ,
The first information sharing device includes:
A random number generator for generating a positive integer random number x of 2 k bits or more;
An exchange information generating unit that generates exchange information X = G ^x using the random number x,
A transmission / reception unit for transmitting the exchange information X to the second information sharing device;
Using the exchange information Y = G ^y (y is a random number) received from the second information sharing apparatus, first secret information Z ₁ = (YB ₁ ) ^{x + a1} and second secret information Z ₂ = (YB ₂ ) ^{x + a2} are generated. A secret information generator to
And secret information combining unit for calculating the output value when the input to the first confidential information Z ₁ and the second secret information Z ₂ a predetermined function H secret information generating unit has generated the first information sharing apparatus,
including,
An information sharing program characterized by that.

Images