JP2011147060A - Id base authentication key exchange system, authentication key exchange method, authentication key exchange device and program thereof, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an ID base authentication key exchange system capable of certifying security. <P>SOLUTION: Authentication key exchange devices A and B which exchange authentication keys with each other are respectively given private keys D<SB>A</SB>=Q<SB>A</SB><SP>s</SP>and D<SB>B</SB>=Q<SB>B</SB><SP>s</SP>from a key issuing device in advance, and the authentication key exchange device A generates Z<SP>yA</SP>and X<SB>A</SB>=g<SP>yA</SP>by using a short term secrete key y<SB>A</SB>, and generates authentication key generation parameters σ<SB>1</SB>=e(D<SB>A</SB>Z<SP>yA</SP>, Q<SB>B</SB>X<SB>B</SB>), σ<SB>2</SB>=e(D<SB>A</SB>, Q<SB>B</SB>), and σ<SB>3</SB>=X<SB>B</SB><SP>yA</SP>from X<SB>B</SB>received from B and generated Q<SB>B</SB>=H<SB>1</SB>(ID<SB>B</SB>), and calculates a common key K=H(σ<SB>1</SB>, σ<SB>2</SB>, σ<SB>3</SB>, C<SB>m</SB>). The device B generates Z<SP>yB</SP>and X<SB>B</SB>=g<SP>yB</SP>by using a short term private key y<SB>B</SB>, and generates authentication key generation parameters σ<SB>1</SB>=e(Q<SB>A</SB>X<SB>A</SB>, D<SB>B</SB>Z<SP>yB</SP>), σ<SB>2</SB>=e(Q<SB>A</SB>, D<SB>B</SB>), and σ<SB>3</SB>=X<SB>A</SB><SP>yB</SP>from X<SB>A</SB>received from A and generated Q<SB>A</SB>=H<SB>1</SB>(ID<SB>A</SB>), and calculates a common key K=H(σ<SB>1</SB>, σ<SB>2</SB>, σ<SB>3</SB>, C<SB>m</SB>). <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to authentication key exchange in the field of information security technology, in particular, an ID-based authentication key exchange system, an authentication exchange method used therefor, an authentication key exchange device, a program thereof, and a recording medium.

  As a technology for securely exchanging information between two parties over a network where security is not guaranteed, the two parties share a common secret key (hereinafter referred to as a common key) and share information with each other. There is a technique of encrypting and transmitting with a key and decrypting received encrypted information with a common key. In such a shared key encryption method, it is necessary to securely share (key exchange) a shared key between two parties in advance. As one of the techniques, an ID-based authentication key exchange method using a pairing technique has been proposed (Non-Patent Document 1).

This ID-based authentication key exchange method will be described below. User U _A, the terminal apparatus and the key issuing apparatus U _B is connected via a network, the user U _A, and performs key exchange between U _B. The key issuing device is a public parameter
G, G _T : a cyclic group whose order is a prime number q of k bits,
g: G generation source,
g _T = e (g, g): G _T generator,
e (g, g): Bilinear function with G × G → G _T pairing,
H: Hash function for converting arbitrary bit length information {0, 1} * into k bit length information {0, 1} ^k ,
H ₁ : Hash function for converting arbitrary bit length information {0, 1} * into G elements,
ID _prot : Name of the key exchange method,
Is open to the public.

The key issuing device randomly selects a master key sεZ _q and discloses the master public key Z = g ^s εG. In addition, for the identifier ID _i ∈ {0, 1} * given by the user U _i , the user information
Q _i = H ₁ (ID _i ) ∈ G
And the user secret key using the master secret key s
D _i = Q _i ^s ∈G
Is generated and given to the user U _i . Here, i is an index for distinguishing users, and here, i = A and i = B for the users U _A and U _B , respectively.

The user U _A having identifier ID _A and user private key D _A = Q _A ^s ∈G, user U _B having an identifier ID _B and user private key D _B = Q _B ^s ∈G the authentication in the following manner Perform key exchange.
Step S1: The user U _A randomly selects the short-term secret key y _A ∈Z _q and the short-term public key

を計算し、(ID_prot, ID_A, ID_B, X_A)をユーザU_Bに送る。
ステップＳ２：ユーザU_Bは(ID_prot, ID_A, ID_B, X_A)を受信し、短期秘密鍵y_B∈Z_qをランダムに選択し、短期公開鍵

And (ID _prot , ID _A , ID _B , X _A ) is sent to user U _B.
Step S2: The user U _B receives (ID _prot , ID _A , ID _B , X _A ), selects the short-term secret key y _B ∈Z _q at random, and the short-term public key

を計算し、(ID_prot, ID_A, ID_B, X_A, X_B)をユーザU_Aに送る。
ステップＳ３：ユーザU_Bは共有鍵生成パラメータ

And (ID _prot , ID _A , ID _B , X _A , X _B ) is sent to user U _A.
Step S3: User U _B is a shared key generation parameter

を計算し、共有鍵

Calculate the shared key

を計算する。
ステップＳ４：ユーザU_Aは(ID_prot, ID_A, ID_B, X_A, X_B)を受信し、共有鍵生成パラメータ

Calculate
Step S4: The user U _A receives (ID _prot , ID _A , ID _B , X _A , X _B ), and generates a shared key generation parameter

を計算し、共有鍵

Calculate the shared key

を計算する。ここで、ユーザU_Aが式(6) により計算した共有鍵Ｋと、ユーザU_Bが式(3) により計算した共有鍵Ｋが互いに同じものとなることが次のように証明される。

Calculate Here, it is proved as follows that the shared key K calculated by the user U _{A according} to the equation (6) and the shared key K calculated by the user U _{B according} to the equation (3) are the same.

First, it is known that a pairing function e (V, W) defined by G × G → G _T with respect to arbitrary points V and W on G has the following properties.

e (aV, bW) = e (V, W) ^ab = e (bV, aW) (7)
So user information

とおき、

Toki,

を使えば、ユーザU_Bの共有鍵生成パラメータσ₁及びσ₃は、

, The shared key generation parameters σ ₁ and σ ₃ of user U _B are

となる。一方、ユーザU_Aの共有鍵生成パラメータσ₁及びσ₂は、

It becomes. On the other hand, the shared key generation parameters σ ₁ and σ ₂ of the user U _A are

となり、これらはユーザU_Bの式(8), (9)により計算した共有鍵生成パラメータと一致する。従って、ユーザU_A側とユーザU_B側の式(3) 及び(6) による共有鍵Ｋの計算結果も一致する。これにより共有鍵Ｋが両者U_A，U_B間で共有されることが証明された。

Next, these equations of the user U _B (8), consistent with the shared key generation parameters calculated by (9). Therefore, the calculation results of the shared key K according to the equations (3) and (6) on the user U _A side and the user U _B side also coincide. This proves that the shared key K is shared between both U _A and U _B.

L. Chen, Z. Cheng, N.P. Smart, "Identity-based key agreement protocols from parings", Int. J. Inf. Sec. 6 (4): 213-241 (2007)

However, in the conventional technique described above, the short-term private key _{x A, eCK (extended Canetti-} Krawzcyk) in consideration of the leakage of x _B model (Reference:. B LaMacchia, K. Lauter and A. Mityagin, "Stronger security of authenticated key exchange "in W. Susilo, JK Liu and Y. Mu, editors, Provable Security: First International Conference, ProvSec 2007, Vol. 4784 of LNCS, pages 1-16, Springer Verlag, 2007) There was a problem that I could not. SUMMARY OF THE INVENTION An object of the present invention is to provide an ID-based authentication key exchange system, an authentication key exchange method, an authentication key exchange device, and a program and recording thereof that can prove safety in an eCK model that can maintain safety even if a short-term secret key is leaked To provide a medium.

According to the first aspect of the present invention, authentication keys are exchanged with each other having identifiers ID _A and ID _B , where G and G _T are cyclic groups having a prime number q as an order and g is a generator of G. The authentication key exchange devices A and B have user secret keys D _A = calculated beforehand from the key issuing device using the master secret key s from Q _A = H ₁ (ID _A ) and Q _B = H ₁ (ID _B ), respectively. Q _A ^s and D _B = Q _B ^s are given, and the authentication key exchange apparatus A generates the secret key information Z ^yA and the short-term public key X _A = g ^yA using the short-term secret key y _A , and the authentication key It receives X _B from the exchange unit _{^{B, Z yA, X a,}} X B, D a and Q _B = the H ₁ (ID _B), bilinear function and pairing _{G × G → G T e (} g , g) to generate authentication key generation parameters σ ₁ = e (D _A Z ^yA , Q _B X _B ), σ ₂ = e (D _A , Q _B ), σ ₃ = X _B ^yA K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) is calculated. The authentication key exchange device B generates secret key information Z ^yB , short-term public key X _B = g ^yB using the short-term secret key y _B , receives X _A from the authentication key exchange device _A, and receives Z ^yB , X _A , Authentication generation parameters σ ₁ = e (Q _A X _A , D _B Z ^yB ), σ ₂ = e (Q _A , D _B ), σ ₃ = from X _B , D _B and Q _A = H ₁ (ID _A ) X _A ^yB is generated, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) is calculated.

According to the second aspect of the present invention, authentication keys are exchanged with each other having identifiers ID _A and ID _B , where G and G _T are cyclic groups having a prime number q as the order and g is a generator of G. The authentication key exchange devices A and B have user secret keys D _A = calculated beforehand from the key issuing device using the master secret key s from Q _A = H ₁ (ID _A ) and Q _B = H ₁ (ID _B ), respectively. Q _A ^s and D _B = Q _B ^s are given, and the authentication key exchange apparatus A generates the secret key information Z ^yA and the short-term public key X _A = g ^yA using the short-term secret key y _A , and X _A And public key information e _A = H ₂ (X _A ), e _B = H ₂ (X _B ) is generated from X _B received from the authentication key exchange apparatus B, and Z ^yA , X _A , X _B , D _A , From e _A , e _B and Q _B = H ₁ (ID _B ), using the bilinear function e (g, g) with G × G → G _T as the pairing, the authentication key generation parameter σ ₁ = e (D _A ^eA Z ^yA , Q _B X _B ), σ ₂ = e (D _A Z ^yA , Q _B ^eB X _B ), σ ₃ = X _B ^yA and generate the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) is calculated. The authentication key exchange apparatus B uses the short-term secret key y _B to generate secret key information Z ^yB and short-term public key X _B = g ^yB , and public key information e from X _B and X _A received from the authentication key exchange apparatus A _A = H ₂ (X _A ), e _B = H ₂ (X _B ) is generated, and from Z ^yB , X _A , X _B , D _B , e _A , e _B and Q _A = H ₁ (ID _A ) Authentication generation parameters σ ₁ = e (Q _A ^eA X _A , D _B Z ^yB ), σ ₂ = e (Q _A X _A , D _B ^eB Z ^yB ), σ ₃ = X _A ^yB = H (σ ₁ , σ ₂ , σ ₃ , C _m ) is calculated.

In the prior art, e (g, g) ^sqAqB cannot be calculated from the shared key generation parameter σ ₁ = e (g, g) ^{s (qA + yA) (qB + yB)} , σ ₃ = g ^yAyB and y _A Although the eCK model could not prove the security, according to the present invention, the three shared key generation parameters σ ₁ , σ ₂ , and σ ₃ are used so that e (g, g) ^sqAqB can be calculated. Proof of sex becomes possible.

The block diagram which shows the structure of the authentication key exchange system by this invention. The block diagram which shows the function structure of the key issuing apparatus in this invention. The block diagram which shows the function structure of one authentication key exchange apparatus which performs the key exchange in 1st Example. The block diagram which shows the function structure of the other authentication key exchange apparatus which performs the key exchange in 1st Example. The flowchart which shows the procedure of the authentication key exchange in 1st Example. The block diagram which shows the function structure of one authentication key exchange apparatus which performs the key exchange in 2nd Example. The block diagram which shows the function structure of the other authentication key exchange apparatus which performs the key exchange in 2nd Example. The flowchart which shows the procedure of the authentication key exchange in 2nd Example.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[First embodiment]
FIG. 1 is a block diagram showing an outline of an ID-based authentication key exchange system (hereinafter referred to as an authentication key exchange system) in which the present invention is implemented. The authentication key exchange system includes a key issuing device 100 and a plurality of terminal devices 200A and 200B connected to each other via a network. Each terminal device 200A, 200B has an authentication key exchange device 20A, 20B according to the present invention. The authentication key exchange is performed between any two terminal devices. In the figure, only two terminal devices are shown. The terminal devices 200A and 200B are assumed to be used by users U _A and U _B , respectively. Since the present invention relates only to the authentication key exchange, the following description will be made assuming that the authentication key exchange devices 20A and 20B are connected to the network. Further, identifiers ID _A and ID _B possessed by users U _A and U _B are also identifiers of authentication key exchange apparatuses 20A and 20B for convenience.

Key issuing apparatus 100 generates a user private key D _A from the authentication key exchange unit 20A receives an identifier ID _A of the user U _A, giving the authentication key exchange unit 20A. Similarly, to generate a user private key D _B from the authentication key exchange unit 20B receives the identifier ID _B of the user U _B, giving the authentication key exchange unit 20B. The authentication key exchange devices 20A and 20B perform authentication key exchange according to the authentication key exchange method of the present invention using the given user secret keys D _A and D _B , respectively.

FIG. 2 is a block diagram showing the functional configuration of the key issuing device 100. The master secret key selection unit 110, the master public key generation unit 120, the reception unit 130, the hash unit 140, and the user secret key generation unit 150 The transmission unit 160, the control unit 10, and the public parameter storage unit 11. The public parameter storage unit 11 is similar to the above-described conventional technique,
G, G _T : a cyclic group whose order is a prime number q of k bits,
g: G generation source,
g _T = e (g, g): G _T generator,
e (g, g): Bilinear function with G × G → G _T pairing,
H: Hash function for converting arbitrary bit length information {0, 1} * into k bit length information {0, 1} ^k ,
H ₁ : Hash function for converting arbitrary bit length information {0, 1} * into G elements,
ID _prot : Name of the key exchange method,
Are stored, and these public parameters are public. An example of a bilinear function that can be used as a pairing function is an elliptic curve (Reference 1: "IEEE P1636.3TM / D1 Draft Standard for Identity-based Public-key Cryptography Using Parings", [URL: http://grouper.ieee.org/groups/1363/IBC/material/P1363.3-D1-200805.pdg]). The control unit 10 controls the operations of the units 110 to 160 according to the user secret key issuing procedure program. In the key issuing device 100, the master secret key selection unit 110 randomly selects the master secret key s from the remainder group Z _q based on the prime number q. select. The master public key generation unit 120 generates and publicizes the master public key Z = q ^s ∈G by raising the prime number q to the power of the master secret key s. Z∈G means that Z is an element of the group G. When the identifier ID _i is received as a secret key issue request from the user U _i by the receiving unit 130, the hash unit 140 performs a hash calculation process on the identifier U _i to obtain user information Q _i = H ₁ (ID _i ). The user secret key generation unit 150 generates a user secret key D _i = Q _i ^s εG by raising the user information Q _i with the master secret key s, and transmits the user secret key D _i = Q _i ^s εG to the user U _i . Note that i is an index for distinguishing a plurality of users. For example, for users U _A and U _B , i = A and i = B, respectively.

When the user secret key D _i generated by the key issuing device 100 in the example of FIG. 2 is sent to the user U _i , for example, it may be sent after being encrypted by SSL (Secure Socket Layer) to ensure safety. Alternatively, the user U _i may receive at a terminal directly connected to the key issuing device 100 through a dedicated line, or the key issuing device 100 carries a recording medium on which the user secret key D _i is recorded to the user U _i. Alternatively, the user U _i may receive the recording medium directly from the key issuing device 100.

Figure 3 shows a functional block diagram of the authentication key exchange unit 20A in the terminal device 200A of the user U _A. The authentication key exchange apparatus 20A in the first embodiment includes a storage unit 21A, a short-term secret key selection unit 22A, a short-term public key generation unit 23A, a transmission unit 24A, a power unit 25A, a reception unit 26A, a user An information generation unit 27A, a pairing calculation unit 28A, a shared key calculation unit 29A, and a control unit 201A that controls operations of these units are configured. The public parameter (G, G _T , g, g _T , e, H, H ₁ , ID _prot ), the master public key Z, the identifier ID _A of the user U _A , and the like are stored in advance in the storage unit 21A. Information necessary for the arithmetic processing of each unit is read and used.

Send authentication key exchange unit 20A from the transmission unit 24A identifier ID _A of the user U _A to the key issuing apparatus 100 as the secret key issue request, the user's private key D _A, issued from the key issuing apparatus 100 received by the receiver 26A Is done. Short-term secret key selecting unit 22A selects the short-term private key y _A randomly from the remainder group Z _q for prime q. The short-term public key generation unit 23A generates a short-term public key X _A = g ^yA by raising g to the power of the short-term secret key y _A. Short-term public key X _A is transmitted together with the identifier U _A from the transmitter unit 24A to the authentication key exchange unit 20B of the user U _B. Power unit 25A is raised to the power of the master public key Z in the short-term secret key y _A, to produce a Z ^yA.

On the other hand, the short-term public key X _B and the identifier ID _{B of the} user U _B are received by the receiving unit 26A from the authentication key exchange device 20B, and the user information generating unit 27A hashes the identifier ID _B to obtain the user information Q _B = H ₁ ( ID _B ) is generated. The pairing calculation unit 28A calculates the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ using these y _A , Z ^yA , D _A , X _B , and Q _B as follows.

共有鍵計算部２９Ａはこれら共有鍵生成パラメータσ₁、σ₂、σ₃と共有情報C_mを使ってハッシュ演算により共有鍵
K=H(σ₁, σ₂, σ₃, C_m) (15)
を計算し、出力する。共有情報として例えばC_m=(ID_prot, ID_A, ID_B, X_A, X_B)を使う場合は、ID_protは使用している鍵交換方式を特定し、ID_A, ID_Bは鍵交換を行う２者を特定し、X_A, X_Bはセッションを特定する。これらの予め決めた任意の組み合わせを共有情報として使用してもよいし、更に他の情報を加えてもよい。このような共有情報を埋め込むことにより、ユーザU_AとU_B以外のユーザ間で偶然に同じ共有鍵Ｋが生成されてしまうことを防ぐことができる。ハッシュの対象である情報σ₁, σ₂, σ₃, C_mの入力順序は、両認証鍵交換装置２０Ａ，２０Ｂで同じ順序をとる限り、どのような順序でもかまわない。なお、この第１実施例の共有鍵生成パラメータσ₁とσ₃は、従来技術における共有鍵パラメータσ₁とσ₃とそれぞれ同じであるが、この発明の特徴は共有鍵パラメータσ₂が更に設けられていることである。

The shared key calculation unit 29A uses the shared key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m to perform a shared key by hash calculation.
K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) (15)
Is calculated and output. For example, when using C _m = (ID _prot , ID _A , ID _B , X _A , X _B ) as shared information, ID _prot specifies the key exchange method used, and ID _A , ID _B is the key exchange X _A and X _B specify a session. These predetermined combinations may be used as shared information, or other information may be added. By embedding such shared information, it is possible to prevent the same shared key K from being accidentally generated between users other than the users U _A and U _B. The order of input of the information σ ₁ , σ ₂ , σ ₃ , and C _m that is the object of hashing may be any order as long as both authentication key exchange apparatuses 20A and 20B take the same order. Note that shared key generation parameter sigma ₁ and sigma ₃ of the first embodiment is a shared key parameter sigma ₁ and sigma ₃ in the prior art are each the same, wherein the further provided with a shared key parameter sigma ₂ of the present invention It is being done.

Figure 4 shows a functional block diagram of the authentication key exchange unit 20B in the terminal device 200B of the user U _B to perform authentication and key exchange with the user U _A. The basic configuration is the same as the configuration shown in FIG. 3. The storage unit 21B, the short-term secret key selection unit 22B, the short-term public key generation unit 23B, the transmission unit 24B, the power unit 25B, the reception unit 26B, The configuration includes a user information generation unit 27B, a pairing calculation unit 28B, a shared key calculation unit 29B, and a control unit 201B that controls operations of these units. The public parameter (G, G _T , g, g _T , e, H, H ₁ , ID _prot ), the master public key Z, the identifier ID _B of the user U _B , etc. are stored in the storage unit 21B in advance. Information necessary for the arithmetic processing of each unit is read and used.

Send authentication key exchange device 20B from the transmitting unit 24B identifier ID _B of the user U _B in the key issuing device 100 as the secret key issue request, the user private key D _B issued from the key issuing apparatus 100 received by the receiver 26B Is done. The short-term secret key selection unit 22B randomly selects the short-term secret key y _B from the residue group Z _q for the prime number q. The short-term public key generation unit 23B generates a short-term public key X _B = g ^yB by ^raising g to the power of the short-term secret key y _B. Short-term public key X _B is transmitted together with the identifier U _B from the transmitting unit 24A to the authentication key exchange unit 20A of the user U _A. Power unit 25B is raised to the power of the master public key Z with short secret key y _B, it generates the secret key information Z ^yB.

On the other hand, the short-term public key X _A and the identifier ID _{A of the} user U _A are received by the receiving unit 26B from the authentication key exchange device 20A, and the user information generating unit 27B hashes the identifier ID _A to obtain user information Q _A = H ₁ ( ID _A ) is generated. The pairing calculation unit 28B calculates the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ as follows using these y _B , Z ^yB , D _B , X _A , and Q _A.

共有鍵計算部２９Ｂはこれら共有鍵生成パラメータσ₁、σ₂、σ₃と共有情報C_mを使ってハッシュ演算により共有鍵
K=H(σ₁, σ₂, σ₃, C_m) (19)
を計算し、出力する。共有情報C_mとしては、ユーザU_Aの使用した共有情報C_mと同じもの、例えばC_m=(ID_prot, ID_A, ID_B, X_A, X_B)を使用する。

The shared key calculation unit 29B uses these shared key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m to perform a shared key by hash calculation.
K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) (19)
Is calculated and output. The shared information C _m, the same as the shared information C _m Using the user U _A, used for example _{C m = (ID prot, ID} A, ID B, X A, X B) a.

Here, the shared key K calculated by the equation (15) by the user U _{A using the} equations (12), (13), (14) and the user U _B are represented by the equations (16), (17), (18). It is proved as follows that the shared keys K calculated by the equation (19) using

とおき、

Toki,

を使えば、ユーザU_Bの共有鍵生成パラメータσ₁, σ₂, σ₃は、

, The shared key generation parameters σ ₁ , σ ₂ , σ ₃ of user U _B are

となる。一方、ユーザU_Aの共有鍵生成パラメータσ₁, σ₂, σ₃は

It becomes. On the other hand, the shared key generation parameters σ ₁ , σ ₂ , σ ₃ of user U _A are

となり、これらはユーザU_Bの式(20), (21), (22)により計算した共有鍵生成パラメータと一致する。従って、ユーザU_A側とユーザU_B側の共有鍵Ｋの計算結果も一致する。これにより共有鍵Ｋが両者U_A，U_B間で共有されることが証明された。

These coincide with the shared key generation parameters calculated by the equations (20), (21), and (22) of the user U _B. Therefore, the calculation results of the shared key K on the user U _A side and the user U _B side also match. This proves that the shared key K is shared between both U _A and U _B.

By the way, in the above-mentioned prior art, two shared key generation parameters σ ₁ and σ ₃ are used, and in this case, it is impossible to prove the security when the short-term secret keys y _A and y _B are leaked. Met. In the present invention, a shared key generation parameter σ ₂ is newly added. Briefly, short secret key y _A for this parameter sigma _2, does not include the y _B, it is not possible also to calculate the parameter sigma ₂ as knowing the short-term private key y _A, a y _B Therefore, the shared key K cannot be calculated, and the security is high.

The security of authentication key exchange is based on gapBDH (Bilinear Diffie-Hellman) assumption. The gap BDH assumption is an assumption that it is difficult to calculate BDH (U, V, W) from U, V, WεG while accessing the DBDH oracle. Where BDH (U, V, W) = e (g, g) ^logUlogVlogW and DBDH oracle is uvw = for input (g ^u , g ^v , g ^w , e (g, g) ^x ) An Oracle that returns b = 1 when x, otherwise returns b = 0. For example, the master public key Z is U, q _A = log (Q _A ) is randomly selected, and the user secret key D _A is Z ^qA . The short-term public key X _A of the user U _A and V, the information Q _B of the user U _B and W.

If the attacker is DBDH (Z, Q _A X _A , Q _B X _B , σ ₁ ) = 1, DBDH (Z, Q _A , Q _B , σ ₂ ) = 1, e (X _A , X _B ) = sigma is _3, and X _a = V, σ ₁ is Q _B = W, σ _2, assuming that can calculate the sigma _3, can be calculated as follows answer gapBDH problems.

ここで

here

であり、log(Q_A)は計算できるので、gapBDH問題の答えを計算することができる。よって、攻撃者がσ₁, σ₂, σ₃を計算することができると、計算困難であるはずのgapBDH問題の答えを計算できてしまうことになり、仮定に矛盾する。つまり、攻撃者がσ₁, σ₂, σ₃を計算することはできないことが示され、eCKモデルでの安全性の証明ができる。

Since log (Q _A ) can be calculated, the answer to the gapBDH problem can be calculated. Therefore, if an attacker can calculate σ ₁ , σ ₂ , and σ ₃ , the answer to the gapBDH problem, which should be difficult to calculate, can be calculated, which contradicts the assumption. In other words, it is shown that the attacker cannot calculate σ ₁ , σ ₂ , σ _3, and can prove the safety with the eCK model.

Figure 5 shows an authentication and key exchange procedure between the authentication key exchange unit 20B of the user U _A authentication key exchange unit 20A and the user U _B of the first embodiment. It is assumed that the authentication key exchange devices 20A and 20B are given user secret keys D _A and D _B generated as described above from the key issuing device 100, respectively.

Authentication key exchange unit 20A in step S11A, select the short secret key y _A randomly from the remainder group Z _q by prime q, the short-term public key X _A = g ^yA calculated at step S12A, the information (ID in step S13A _prot , ID _A , ID _B , X _A ) are transmitted to the authentication key exchange device 20B.

Authentication key exchange unit 20B in step S11B, select the short secret key y _B at random from the remainder group Z _q by prime q, it calculates a short-term public key X _B = g ^yB at step S12B, the received information in step S13B information including _{X B (ID prot, ID a} , ID B, X a, X B) to the authentication key exchange unit 20A as.

Master public key Z to be raised to the power of short-term private key y _A generates secret key information Z ^yA, user information by hashing the further identifier _{ID B Q B = H 1 (} ID authentication key exchange unit 20A Step S14A _B ) is generated. Next, using the public parameters and the received information in step S15A, the shared key generation parameters σ ₁ , σ ₂ , σ ₃ are calculated by equations (12), (13), (14), and in step S16A, the equation (15 ) To calculate and output the shared key K.

In step S14B, the authentication exchange apparatus 20B generates the secret key information Z ^yB by raising the master public key Z to the power of the short-term secret key y _B , and further ^performs hash processing on the identifier ID _A to obtain user information Q _A = H ₁ (ID _A ) Is generated. Next, the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ are calculated by the equations (16), (17), and (18) using the public parameters and the received information in step S15B, and in step S16B, the shared key K Is calculated by equation (19) and output.

The authentication key exchange shown in FIG. 5 is performed for each session. Therefore, for each session, a short-term secret key y _A , y _B , a short-term public key X _A , X _B and a shared key K are newly generated, and the session is terminated. They are discarded. Thus, step S16A, the shared key generation parameter sigma ₁ as a hash of the object in the shared key calculation of S16B, sigma _2, shared information C _m = (ID _prot included with _{σ 3, ID A, ID B} , X A, X B ) Short-term public keys X _A and X _B are also information for specifying the current session.
[Second Embodiment]
The overall configuration of the authentication key exchange system in the second embodiment of the present invention is the same as that in FIG. 1, and the configuration and processing functions of the key issuing device are the same as those in FIG. However, the public parameter storage unit 11 is added with a hash function H ₂ : {0, 1} * → Z _q for converting information of an arbitrary bit length into a remainder group element by q in addition to the public parameter shown above. ing.

Figure 6 shows a functional block diagram of the authentication key exchange unit 20A of the user U _A in the second embodiment. The authentication key exchange apparatus 20A in the second embodiment includes a storage unit 21A, a short-term secret key selection unit 22A, a short-term public key generation unit 23A, a transmission unit 24A, a power unit 25A, a reception unit 26A, a user An information generation unit 27A, a hash unit 281A, a pairing calculation unit 282A, a shared key calculation unit 29A, and a control unit 201A that controls the operations of these units are configured.

The storage unit 21A has public parameters (G, G _T , g, g _T , e, H, H ₁ , H ₂ , ID _prot ) including the hash function H ₂ , a master public key Z, and an identifier of the user U _A. ID _{A and the} like are stored in advance, and information necessary for calculation processing of each unit is read and used. This configuration is different from the configuration of FIG. 3 in that a hash unit 281A is further added to the configuration of FIG. 3 and a pairing calculation unit 282A is provided instead of the pairing calculation unit 28A. It is.

Send authentication key exchange unit 20A from the transmission unit 24A identifier ID _A of the user U _A to the key issuing apparatus 100 as the secret key issue request, the user's private key D _A, issued from the key issuing apparatus 100 received by the receiver 26A Is done. Short-term secret key selecting unit 22A selects the short-term private key y _A randomly from the remainder group Z _q for prime q. The short-term public key generation unit 23A generates a short-term public key X _A = g ^yA by raising g to the power of the short-term secret key y _A. Short-term public key X _A is transmitted together with the identifier U _A from the transmitter unit 24A to the authentication key exchange unit 20B of the user U _B. Power unit 25A will power the master public key Z with short secret key y _A, and generates the secret key information Z ^yA.

On the other hand, the short-term public key X _B and the identifier ID _{B of the} user U _B are received by the receiving unit 26A from the authentication key exchange device 20B, and the user information generating unit 27A hashes the identifier ID _B to obtain the user information Q _B = H ₁ ( ID _B ) is generated. The hash unit 281A added in the second embodiment processes the generated short-term public key X _A and the received short-term public key X _B with the hash function H ₂ , respectively, and public key information e _A = H ₂ (X _A ) , e _B = H ₂ (X _B ) is generated and given to the pairing calculation unit 282A. The pairing calculation unit 282A calculates the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ using y _A , Z ^yA , D _A , X _B , Q _B , e _A , and e _B as follows.

これら共有鍵生成パラメータσ₁, σ₂は第１実施例におけるσ₁, σ₂と異なるが、共有鍵生成パラメータσ₃は同じである。共有鍵計算部２９Ａはこれら共有鍵生成パラメータσ₁、σ₂、σ₃と共有情報C_mを使ってハッシュ演算により共有鍵
K=H(σ₁, σ₂, σ₃, C_m) (33)
を計算し、出力する。共有情報C_mとしてはID_prot, ID_A, ID_B, X_A, X_B)の任意の組み合わせを使用してもよいし、更に他の情報を加えてもよい。

These shared key generation parameter sigma _1, sigma ₂ is ₁ sigma in the first embodiment, sigma ₂ and different, the common key generation parameter sigma ₃ are the same. The shared key calculation unit 29A uses the shared key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m to perform a shared key by hash calculation.
K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) (33)
Is calculated and output. As the shared information C _m , any combination of ID _prot , ID _A , ID _B , X _A , X _B ) may be used, and other information may be added.

Figure 7 shows a functional block diagram of the authentication key exchange unit 20B in the terminal device 200B of the user U _B to perform authentication and key exchange with the user U _A. The basic configuration is the same as the configuration in FIG. 6, and the storage unit 21B, the short-term secret key selection unit 22B, the short-term public key generation unit 23B, the transmission unit 24B, the power unit 25B, the reception unit 26B, The configuration includes a user information generation unit 27B, a hash unit 281B, a pairing calculation unit 282B, a shared key calculation unit 29B, and a control unit 201B that controls operations of these units. The public parameter (G, G _T , g, g _T , e, H, H ₁ , ID _prot ), the master public key Z, the identifier ID _B of the user U _B , etc. are stored in the storage unit 21B in advance. Information necessary for the arithmetic processing of each unit is read and used.

Send authentication key exchange device 20B from the transmitting unit 24B identifier ID _B of the user U _B in the key issuing device 100 as the secret key issue request, the user private key D _B issued from the key issuing apparatus 100 received by the receiver 26B Is done. The short-term secret key selection unit 22B randomly selects the short-term secret key y _B from the residue group Z _q for the prime number q. The short-term public key generation unit 23B generates a short-term public key X _B = g ^yB by ^raising g to the power of the short-term secret key y _B. Short-term public key X _B is transmitted together with the identifier U _B from the transmitting unit 24A to the authentication key exchange unit 20A of the user U _A. Power unit 25B is raised to the power of the master public key Z with short secret key y _B, it generates the secret key information Z ^yB.

On the other hand, the short-term public key X _A and the identifier ID _{A of the} user U _A are received by the receiving unit 26B from the authentication key exchange device 20A, and the user information generating unit 27B hashes the identifier ID _A to obtain user information Q _A = H ₁ ( ID _A ) is generated. The hash unit 281B processes the received short-term public key X _A and the generated short-term public key X _B with the hash function H ₂ , respectively, and public key information e _A = H ₂ (X _A ), e _B = H ₂ ( X _B ) is generated and given to the pairing calculation unit 282B. The pairing calculation unit 282B calculates the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ as follows using these y _B , Z ^yB , D _B , X _A , Q _A , e _A , and e _B.

共有鍵計算部２９Ｂはこれら共有鍵生成パラメータσ₁、σ₂、σ₃と共有情報C_mを使ってハッシュ演算により共有鍵
K=H(σ₁, σ₂, σ₃, C_m) (37)
を計算し、出力する。共有情報C_mとしては、ユーザU_Aの使用した共有情報C_mと同じもの、例えばC_m=(ID_prot, ID_A, ID_B, X_A, X_B)を使用する。

The shared key calculation unit 29B uses these shared key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m to perform a shared key by hash calculation.
K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) (37)
Is calculated and output. The shared information C _m, the same as the shared information C _m Using the user U _A, used for example _{C m = (ID prot, ID} A, ID B, X A, X B) a.

Here, the user U _A uses the equations (30), (31), (32) and the shared key K calculated by the equation (33), and the user U _B has the equations (34), (35), (36). It is proved as follows that the shared keys K calculated by the equation (37) using

とおき、

Toki,

を使えば、ユーザU_Bの共有鍵生成パラメータσ₁, σ₂, σ₃は、

, The shared key generation parameters σ ₁ , σ ₂ , σ ₃ of user U _B are

It becomes. On the other hand, the shared key generation parameters σ ₁ , σ ₂ , σ ₃ of user U _A are

These coincide with the shared key generation parameters calculated by the equations (38), (39), and (40) of the user U _B. Therefore, the calculation results of the shared key K on the user U _A side and the user U _B side also match. This proves that the shared key K is shared between both U _A and U _B.

Figure 8 shows the authentication and key exchange procedure between the authentication key exchange unit 20B of the user U _A authentication key exchange unit 20A and the user U _B of the second embodiment. It is assumed that the authentication key exchange devices 20A and 20B are given user secret keys D _A and D _B generated as described above from the key issuing device 100, respectively.

Authentication key exchange unit 20A in step S11A, select the short secret key y _A randomly from the remainder group Z _q by prime q, the short-term public key X _A = g ^yA calculated at step S12A, the information (ID in step S13A _prot , ID _A , ID _B , X _A ) are transmitted to the authentication key exchange device 20B.

Authentication key exchange unit 20B in step S11B, select the short secret key y _B at random from the remainder group Z _q by prime q, it calculates a short-term public key X _A = g ^yB at step S12B, the received information in step S13B information including _{X B (ID prot, ID a} , ID B, X a, X B) to the authentication key exchange unit 20A as.

Master public key Z to be raised to the power of short-term private key y _A generates secret key information Z ^yA, user information by hashing the further identifier _{ID B Q B = H 1 (} ID authentication key exchange unit 20A Step S14A _B ) is generated. Next, in step S15'A, the short-term public keys X _A and X _B are hashed to generate public key information e _A = H ₂ (X _A ) and e _B = H ₂ (X _B ), and further publicized Using the parameters and the received information, the shared key generation parameters σ ₁ , σ ₂ , σ ₃ are calculated by the equations (30), (31), (32), and the shared key K is hashed K = H ( (σ ₁ , σ ₂ , σ ₃ , ID _prot , ID _A , ID _B , X _A , X _B ) are calculated and output.

In step S14B, the authentication exchange apparatus 20B generates the secret key information Z ^yB by raising the master public key Z to the power of the short-term secret key y _B , and further ^performs hash processing on the identifier ID _A to obtain user information Q _A = H ₁ (ID _A ) Is generated. Next, in step S15'B, the short-term public keys X _A and X _B are hashed to generate public key information e _A = H ₂ (X _A ) and e _B = H ₂ (X _B ), and further publicized Using the parameters and the received information, the shared key generation parameters σ ₁ , σ ₂ , σ ₃ are calculated by the equations (39), (40), (41), and the shared key K is hashed K = H (σ in step S16B. ₁ , σ ₂ , σ ₃ , ID _prot , ID _A , ID _B , X _A , X _B ) are output.
[Modification]
The shared key generation parameters σ ₁ , σ ₂ , and σ ₃ by the pairing calculation unit 282A in the authentication key exchange apparatus 20A of FIG. 6 which is the second embodiment are replaced with the previous equations (30), (31), and (32). Next formula

のように規定し、図７の認証鍵交換装置２０Ｂにおけるペアリング演算部282Bによる共有鍵生成パラメータσ₁, σ₂, σ₃を前式(34), (35), (36)の代わりに次式

And the shared key generation parameters σ ₁ , σ ₂ , and σ ₃ by the pairing calculation unit 282B in the authentication key exchange apparatus 20B of FIG. 7 are replaced with the previous equations (34), (35), and (36). Next formula

のように規定してもよい。ペアリング演算部282Aの共有鍵生成パラメータσ₁, σ₂の式(44), (45)は、第２実施例のペアリング演算部２８Ａの共有鍵生成パラメータσ₁, σ₂の式(30), (31)と比べ、Q_BとQ_B ^eBとが入れ替わっているだけである。同様に、ペアリング演算部282Bの共有鍵生成パラメータσ₁, σ₂の式(47), (48)は、第２実施例のペアリング演算部２８Ｂの共有鍵生成パラメータσ₁, σ₂の式(34), (35)と比べ、D_BとD_B ^eBが入れ替わっているだけである。この変形実施例の場合も第２実施例と同様に、ペアリング演算部282Aにおける共有鍵生成パラメータσ₁, σ_2, σ₃とペアリング演算部282Bにおける共有鍵生成パラメータσ₁, σ₂, σ₃は共にそれぞれ、

It may be defined as follows. Formulas (44) and (45) of the shared key generation parameters σ ₁ and σ ₂ of the pairing calculation unit 282A are expressed by equations (30) of the shared key generation parameters σ ₁ and σ ₂ of the pairing calculation unit 28A of the second embodiment (30 ) And (31), Q _B and Q _B ^eB are just interchanged. Similarly, the shared key generation parameter sigma ₁ pairing calculation unit 282B, sigma ₂ of formula (47), (48), shared key generation parameters sigma ₁ pairing computation unit 28B of the second embodiment, the sigma ₂ equation (34), is only interchanged and compared, D _B and D _B ^eB (35). In the case of this modified embodiment, as in the second embodiment, the shared key generation parameters σ ₁ , σ _2, σ ₃ in the pairing calculation unit 282A and the shared key generation parameters σ ₁ , σ ₂ , σ ₃ is both

となることが容易に証明できる。

It can be proved easily.

  In the embodiment of the ID-based authentication key exchange system according to the present invention described above, each authentication key exchange device may be configured to be executed by a computer according to a program recorded on a recording medium.

  The present invention can be used for security of communication via a network.

Claims (14)

Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements a second hash function H _1, the master public key Z generated by exponentiation of g by the master secret key s of the key issuing device is randomly selected from the remainder group Z _q by q, it is published via the network Authentication key exchange device that exchanges authentication keys with other authentication key exchange devices,
In the authentication key exchange device, the key issuing device performs user information Q _A = H ₁ (ID _A ) generated by hashing the identifier ID _A of the authentication key exchange device with the second hash function H _1. The user secret key D _A = Q _A ^s generated by raising the power with the secret key ^s is given,
The authentication key exchange device
_A short-term secret key selection unit that randomly selects a short-term secret key y _A from the remainder group Z _{q of the} prime number q;
_A short-term public key generation unit that generates the short-term public key X _A by raising the generator g with a short-term secret key y _A ;
_A power to generate the secret key information Z ^yA by raising the master public key Z with the short-term secret key y _A ;
_A transmission unit for transmitting information including the short-term public key X _A to the other authentication key exchange device;
A receiving unit that receives information including the short-term public key X _B from the other authentication key exchange device;
A user information generating unit that generates the user information Q _B = H ₁ (ID _B ) by hashing the identifier ID _B of the other authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameter using Z ^yA , X _A , X _B , D _A , Q _B

A pairing operation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the other authentication key exchange devices are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m )
And an authentication key exchange device. Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements a second hash function H _1, the master public key Z generated by exponentiation of g by the master secret key s of the key issuing device is randomly selected from the remainder group Z _q by q, it is published via the network Authentication key exchange device that exchanges authentication keys with other authentication key exchange devices,
In the authentication key exchange device, the key issuing device has generated the user information Q _B = H ₁ (ID _B ) generated by hashing the identifier ID _B of the authentication key exchange device with the second hash function H _1. A user secret key D _B = Q _B ^s generated by raising the power with the secret key ^s is given,
The authentication key exchange device
A short-term secret key selection unit that randomly selects a short-term secret key y _B from the remainder group Z _{q of the} prime number q;
A short-term public key generation unit that generates the short-term public key X _B by raising the generator g to the power of the short-term secret key y _B ;
A power to generate the secret key information Z ^yB by ^{powering the} master public key Z with the short-term secret key y _B ;
A transmission unit that transmits information including the short-term public key X _B to the other authentication key exchange device;
_A receiving unit for receiving information including the short-term public key X _A from the other authentication key exchange device;
_A user information generator for generating user information Q _A = H ₁ (ID _A ) by hashing the identifier ID _A of the other authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameters using Z ^yB , X _A , X _B , D _B , Q _A

A pairing operation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the other authentication key exchange devices are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m )
And an authentication key exchange device. Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements a second hash function H _1, the master public key Z generated by exponentiation of g by the master secret key s of the key issuing device is randomly selected from the remainder group Z _q by q, it is published via the network An ID-based authentication key exchange system in which the first authentication key exchange device and the second authentication key exchange device exchange authentication keys,
In the first authentication key exchange device, the first user information Q _A = H generated by the key issuing device hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H _{1. 1 A} first user secret key D _A = Q _A ^s generated by raising (ID _A ) to the power of the master secret key s is given. 2 Generated by powering the second user information Q _B = H ₁ (ID _B ) generated by hashing the second identifier ID _B of the authentication key exchange device with the second hash function H ₁ with the master secret key s Second user secret key D _B = Q _B ^s
The first authentication key exchange device includes:
A first short-term secret key selecting unit that selects the first short-term private key y _A randomly from the remainder group Z _q by prime q,
_A short-term public key generation unit that generates the first short-term public key X _A by raising the generator g with the first short-term secret key y _A ;
_A first power part for generating the first secret key information Z ^yA by raising the master public key Z with the first short-term secret key y _A ;
_A first transmitter that transmits information including the first short-term public key X _A to the second authentication key exchange device;
A first receiver for receiving information including the second short-term public key X _B from the second authentication key exchange device;
A first user information generating unit that generates a second user information Q _B = H ₁ (ID _B ) by hashing the second identifier ID _B of the second authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameter using Z ^yA , X _A , X _B , D _A , Q _B

A first pairing calculation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the second authentication key exchange apparatus are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) to generate and output,
And
The second authentication key exchange device includes:
A second short-term secret key selection unit that randomly selects a second short-term secret key y _B from the remainder group Z _{q of the} prime number q;
A second short-term public key generation unit that generates a second short-term public key X _B and the generator g raised to the power of the second short-term private key y _B,
A second power unit for generating the second secret key information Z ^yB by ^{raising the} master public key Z with the second short-term secret key y _B ;
A second transmitter for transmitting information including the second short-term public key X _B to the first authentication key exchange device;
_A second receiving unit for receiving information including the first short-term public key X _A from the first authentication key exchange device;
_A second user information generation unit for generating a first user information Q _A = H ₁ (ID _A ) by hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameters using Z ^yB , X _A , X _B , D _B , Q _A

A second pairing calculation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the first authentication key exchange apparatus are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) to generate and output,
An ID-based authentication key exchange system comprising: Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements a second hash function H _1, the master public key Z generated by exponentiation of g by the master secret key s of the key issuing device is randomly selected from the remainder group Z _q by q, it is published via the network An ID-based authentication key exchange method in which the first authentication key exchange device and the second authentication key exchange device exchange authentication keys,
In the first authentication key exchange device, the first user information Q _A = H generated by the key issuing device hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H _{1. 1 A} first user secret key D _A = Q _A ^s generated by raising (ID _A ) to the power of the master secret key s is given. 2 Generated by powering the second user information Q _B = H ₁ (ID _B ) generated by hashing the second identifier ID _B of the authentication key exchange device with the second hash function H ₁ with the master secret key s Second user secret key D _B = Q _B ^s
_A first short-term public key generation step in which the first authentication key exchange apparatus randomly selects a first short-term secret key y _A from the remainder group Z _q with a prime number q and calculates a first short-term public key X _A = g ^yA ; _A first transmission step of transmitting information including the first short-term public key X _A to the second authentication key exchange device;
_A second short-term public key generation step in which the second authentication key exchange device randomly selects a second short-term secret key y _B from the remainder group Z _{q of the} prime number q and calculates a second short-term public key X _A = g ^yB ; A second transmission step of transmitting information including the second short-term public key X _B to the first authentication key exchange device;
A first receiving step in which the first authentication key exchange apparatus receives information including the second short-term public key X _B from the second authentication key exchange apparatus; and the master public key Z is used as the first short-term secret key y _A. A first secret key information generation step for generating the first secret key information Z ^yA by ^powering with the second hash value H ₁ by hashing the second identifier ID _B with the second hash function H _{1 and} second user information Q _B = H ₁ The first user information generation step for generating (ID _B ), and the shared key generation parameters σ ₁ , σ ₂ , σ ₃ using the above Z ^yA , X _A , X _B , D _A , Q _B

A first pairing calculation step for calculating by the above, a first shared key calculation step for calculating and outputting the shared key K by hashing the information including the shared key generation parameter with the first hash function H, and
_A second receiving step in which the second authentication key exchange apparatus receives information including the first short-term public key X _A from the first authentication key exchange apparatus; and the master public key Z is used as the second short-term secret key y _B. A second secret key information generation step for generating the second secret key information Z ^yB by a power, and the first user information Q _A = H by hashing the first identifier ID _A with the second hash function H _{1 1} Second user information generation step for generating (ID _A ), and the shared key generation parameters σ ₁ , σ ₂ , σ ₃ using the above Z ^yB , X _A , X _B , D _B , Q _A

A second pairing calculation step of calculating by the above, a second shared key calculation step of generating and outputting a shared key K by hashing the information including the shared key generation parameter with the first hash function H,
An ID-based authentication key exchange method comprising: Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements A second hash function H ₁ , a third hash function H ₂ that converts information {0, 1} * of an arbitrary bit length into elements of a remainder group Z _q by _q , and a key issuing device uses a remainder group Z _q by _q The master public key Z generated by raising the power of g with the master secret key s randomly selected from the public key is disclosed, and is an authentication key exchange device that exchanges authentication keys with other authentication key exchange devices via the network. Yes,
In the authentication key exchange device, the key issuing device performs user information Q _A = H ₁ (ID _A ) generated by hashing the identifier ID _A of the authentication key exchange device with the second hash function H _1. The user secret key D _A = Q _A ^s generated by raising the power with the secret key ^s is given,
The authentication key exchange device
_A short-term secret key selection unit that randomly selects a short-term secret key y _A from the remainder group Z _{q of the} prime number q;
_A short-term public key generation unit that generates the short-term public key X _A by raising the generator g with a short-term secret key y _A ;
_A power to generate the secret key information Z ^yA by raising the master public key Z with the short-term secret key y _A ;
_A transmission unit for transmitting information including the short-term public key X _A to the other authentication key exchange device;
A receiving unit that receives information including the short-term public key X _B from the other authentication key exchange device;
The generated short-term public key X _A and the received short-term public key X _B are hashed by the third hash function H ₂ , respectively, and first public key information e _A = H ₂ (X _A ) and second public key information a hash part that generates e _B = H ₂ (X _B );
A user information generating unit that generates the user information Q _B = H ₁ (ID _B ) by hashing the identifier ID _B of the other authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameters using Z ^yA , X _A , X _B , D _A , Q _B , e _A , e _B

A pairing operation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the other authentication key exchange devices are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m )
And an authentication key exchange device. 6. The authentication key exchange apparatus according to claim 5, wherein the pairing calculation unit replaces the authentication key generation parameter.

An authentication key exchange apparatus characterized by calculating Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements A second hash function H ₁ , a third hash function H ₂ that converts information {0, 1} * of an arbitrary bit length into elements of a remainder group Z _q by _q , and a key issuing device uses a remainder group Z _q by _q The master public key Z generated by raising the power of g with the master secret key s randomly selected from the public key is disclosed, and is an authentication key exchange device that exchanges authentication keys with other authentication key exchange devices via the network. Yes,
In the authentication key exchange device, the key issuing device has generated the user information Q _B = H ₁ (ID _B ) generated by hashing the identifier ID _B of the authentication key exchange device with the second hash function H _1. A user secret key D _B = Q _B ^s generated by raising the power with the secret key ^s is given,
The authentication key exchange device
A short-term secret key selection unit that randomly selects a short-term secret key y _B from the remainder group Z _{q of the} prime number q;
A short-term public key generation unit that generates the short-term public key X _B by raising the generator g to the power of the short-term secret key y _B ;
A power to generate the secret key information Z ^yB by ^{powering the} master public key Z with the short-term secret key y _B ;
A transmission unit that transmits information including the short-term public key X _B to the other authentication key exchange device;
_A receiving unit for receiving information including the short-term public key X _A from the other authentication key exchange device;
The received short-term public key X _A and the generated short-term public key X _B are each hashed with a third hash function H ₂ to obtain first public key information e _A = H ₂ (X _A ) and second public key information. a hash part that generates e _B = H ₂ (X _B );
_A user information generator for generating user information Q _A = H ₁ (ID _A ) by hashing the identifier ID _A of the other authentication key exchange device with the second hash function H ₁ ;
Authentication key generation parameters using Z ^yB , X _A , X _B , D _B , Q _A , e _A , e _B

A pairing operation unit for generating
The authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the other authentication key exchange devices are hashed by the first hash function H, and the shared key K = H (σ ₁ , σ ₂ , σ ₃ , C _m )
And an authentication key exchange device. 8. The authentication key exchange apparatus according to claim 7, wherein the pairing calculation unit is replaced with the shared key generation parameter.

An authentication key exchange apparatus characterized by calculating Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements A second hash function H ₁ , a third hash function H ₂ that converts information {0, 1} * of an arbitrary bit length into elements of a remainder group Z _q by _q , and a key issuing device uses a remainder group Z _q by _q And a master public key Z generated by raising g with a master secret key s randomly selected from the public key, and the first authentication key exchange device and the second authentication key exchange device exchange authentication keys via the network. An ID-based authentication key exchange system that performs
In the first authentication key exchange device, the first user information Q _A = H generated by the key issuing device hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H _{1. 1 A} first user secret key D _A = Q _A ^s generated by raising (ID _A ) to the power of the master secret key s is given. 2 Generated by powering the second user information Q _B = H ₁ (ID _B ) generated by hashing the second identifier ID _B of the authentication key exchange device with the second hash function H ₁ with the master secret key s Second user secret key D _B = Q _B ^s
The first authentication key exchange device includes:
A first short-term secret key selecting unit that selects the first short-term private key y _A randomly from the remainder group Z _q by prime q,
_A short-term public key generation unit that generates the first short-term public key X _A by raising the generator g with the first short-term secret key y _A ;
_A first power part for generating the first secret key information Z ^yA by raising the master public key Z with the first short-term secret key y _A ;
_A first transmitter that transmits information including the first short-term public key X _A to the second authentication key exchange device;
A first receiver for receiving information including the second short-term public key X _B from the second authentication key exchange device;
The generated first short-term public key X _A and the received second short-term public key X _B are each hashed with a third hash function H ₂ to obtain first public key information e _A = H ₂ (X _A ) and 2 public key information e _B = H ₂ (X _B ) to generate a first hash part,
A first user information generating unit that generates a second user information Q _B = H ₁ (ID _B ) by hashing the second identifier ID _B of the second authentication key exchange device with the second hash function H ₁ ;
The ^{_{Z yA, X A, X B}} , D A, Q B, e A, first authentication key generation parameters with e _B

A first pairing calculation unit for generating
The first authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the second authentication key exchange apparatus are hashed by the first hash function H, and the shared key K = H ( σ ₁ , σ ₂ , σ ₃ , C _m ) are generated and output,
And
The second authentication key exchange device includes:
A second short-term secret key selection unit that randomly selects a second short-term secret key y _B from the remainder group Z _{q of the} prime number q;
A second short-term public key generation unit that generates a second short-term public key X _B and the generator g raised to the power of the second short-term private key y _B,
A second power unit for generating the second secret key information Z ^yB by ^{raising the} master public key Z with the second short-term secret key y _B ;
A second transmitter for transmitting information including the second short-term public key X _B to the first authentication key exchange device;
_A second receiving unit for receiving information including the first short-term public key X _A from the first authentication key exchange device;
The received first short-term public key X _A and the generated second short-term public key X _B are hashed with a third hash function, respectively, and first public key information e _A = H ₂ (X _A ) and second public A second hash part for generating key information e _B = H ₂ (X _B );
_A second user information generation unit for generating a first user information Q _A = H ₁ (ID _A ) by hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H ₁ ;
The ^{_{Z yB, X A, X B}} , D B, Q A, e A, the second authentication key generation parameters with e _B

A second pairing calculation unit for generating
The second authentication key generation parameters σ ₁ , σ ₂ , σ ₃ and the shared information C _m shared with the first authentication key exchange apparatus are hashed by the first hash function H to share the key K = H (σ ₁ , σ ₂ , σ ₃ , C _m ) generating and outputting a second shared key calculation unit,
An ID-based authentication key exchange system comprising: 10. The ID-based authentication key exchange system according to claim 9, wherein the first pairing calculation unit is replaced with the shared key generation parameter.

And the second pairing calculation unit replaces the shared key generation parameter with

An ID-based authentication key exchange system characterized by calculating Preliminary number q, cyclic group G and G _T with prime q as the order, generator g of cyclic group G, bilinear function e (g, g) with G × G → G _T pairing, arbitrary bits First hash function H that converts length information {0, 1} * into k-bit length information {0, 1} ^k and arbitrary bit-length information {0, 1} * are converted into G elements A second hash function H ₁ , a third hash function H ₂ that converts information {0, 1} * of an arbitrary bit length into elements of a remainder group Z _q by _q , and a key issuing device uses a remainder group Z _q by _q And a master public key Z generated by raising g with a master secret key s randomly selected from the public key, and the first authentication key exchange device and the second authentication key exchange device exchange authentication keys via the network. ID-based authentication key exchange method for performing
In the first authentication key exchange device, the first user information Q _A = H generated by the key issuing device hashing the first identifier ID _A of the first authentication key exchange device with the second hash function H _{1. 1 A} first user secret key D _A = Q _A ^s generated by raising (ID _A ) to the power of the master secret key s is given. 2 Generated by powering the second user information Q _B = H ₁ (ID _B ) generated by hashing the second identifier ID _B of the authentication key exchange device with the second hash function H ₁ with the master secret key s Second user secret key D _B = Q _B ^s
_A first short-term public key generation step in which the first authentication key exchange apparatus randomly selects a first short-term secret key y _A from the remainder group Z _q with a prime number q and calculates a first short-term public key X _A = g ^yA ; _A first transmission step of transmitting information including the first short-term public key X _A to the second authentication key exchange device;
_A second short-term public key generation step in which the second authentication key exchange device randomly selects a second short-term secret key y _B from the remainder group Z _{q of the} prime number q and calculates a second short-term public key X _A = g ^yB ; A second transmission step of transmitting information including the second short-term public key X _B to the first authentication key exchange device;
The short-term public that the first authentication key exchange device receives a first reception step of receiving information including the second short-term public key X _B from the second authentication key exchange unit, and generated the short public key X _A The first public key information e _A = H ₂ (X _A ) and the second public key information e _B = H ₂ (X _B ) are generated by hashing the key X _B with the third hash function H ₂ . A hash step, a first secret key information generation step of generating the first secret key information Z ^yA by raising the master public key Z to the power of the first short-term secret key y _A , and the second identifier ID _B as the first identifier A first user information generation step of generating second user information Q _B = H ₁ (ID _B ) by hashing with two hash functions H ₁ , and Z ^yA , X _A , X _B , D _A , Q _B , Using e _A and e _B , the first shared key generation parameters σ ₁ , σ ₂ , and σ ₃ are

A first pairing calculation step for calculating by the above, a first shared key calculation step for calculating and outputting the shared key K by hashing the information including the first shared key generation parameter with the first hash function H, and
_A second receiving step in which the second authentication key exchange device receives information including the first short-term public key X _A from the first authentication key exchange device; and the generated first short-term public key X _A The second short-term public key X _B is hashed with a third hash function, respectively, to generate first public key information e _A = H ₂ (X _A ) and second public key information e _B = H ₂ (X _B ). A second hash step, a second secret key information generation step of generating the second secret key information Z ^yB by ^{raising the} master public key Z with the second short-term secret key y _B , and the first identifier ID _{A A} second user information generating step of generating first user information Q _A = H ₁ (ID _A ) by hashing with the second hash function H _1; and Z ^yB , X _A , X _B , D _B , Q _{Using A} , e _A , e _B , the second shared key generation parameters σ ₁ , σ ₂ , σ ₃ are

A second pairing calculation step for calculating by the above, a second shared key calculation step for generating and outputting a shared key K by hashing the information including the second shared key generation parameter with the first hash function H,
And an authentication key exchange method. 12. The authentication key exchange method according to claim 11, wherein the first pairing calculation step is performed instead of the first shared key generation parameter.

And the second pairing calculation step is performed in place of the second shared key generation parameter,

An ID-based authentication key exchange method characterized by calculating   A program that causes a computer to function as the authentication key exchange apparatus according to any one of claims 1, 2, 5, 6, 7, and 8.   A computer-readable recording medium on which the program according to claim 13 is recorded.

Images