JP2011253148A - Commitment system, commitment generation device, commitment acquisition device, commitment generation method, commitment acquisition method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide commitment system of which the calculation amount and the communication amount are less, by which one piece of common information is repeatedly used, and general-purpose coupling is possible.SOLUTION: A commitment generation device Paccepts input of common reference data crs and secret information s, generates (X of G), (a(1), a(2) of Z/qZ), (rof G), (A=g(i,1)*g(i,2)*ε(1, r) of G), and outputs A, X to a commitment acquisition device P. The Paccepts the input of the crs, and generates (b of Z/qZ) to be output to the P. The Pgenerates (B=ε((g), 1) of G), generates (C=(g(0)*B*X)*ε(1, r) of G), outputs a(1), a(2), rand C to the P, and stores history information sid, the secret information s and an origin r. The Pstores history information sid'.

Description

  The present invention relates to a basic technology of information security technology, and particularly relates to commitment.

  A cryptographic commitment is an electronic “sealing hand”. A commitment is made by the committer and its receiver. The committing party keeps the information confidential to the recipient, but deposits the information in a form that cannot be changed when the information is disclosed later. Commitment basically satisfies these two characteristics (confidentiality and binding).

  Examples of applications where commitments come to mind immediately are electronic janken and coin-throwing (of course, you can use shogi or samurai), but the range of practical applications is far wider. Since commitment is the most basic cryptographic primitive, it is frequently used in higher-level cryptographic protocols. In recent years, commitments have been increasingly used in more complex combinations to bring cryptographic protocols closer to the real environment. In such a complex combination, the commitment made with the classic cryptographic security model cannot satisfy confidentiality and constraint. A universal combinable commitment is a commitment designed to satisfy confidentiality and binding even when the commitment is used in such a complex combination (for example, (See Patent Documents 1 and 4).

  It is known that common information (crs) that can be accessed by both the committer and the receiver is absolutely necessary in order to construct a universally connectable commitment (see Non-Patent Document 2, for example). In the commitment method, due to technical problems, this common information must be disposable for each commitment (that is, new common information is required for the number of commitments), and the same common information is used continuously without being disposable. Can be divided into methods that can Of course, the commitment method, which can continue to use common information for a long time, is more practical.

  Next, there is evaluation from the viewpoint of the amount of calculation and communication amount of commitment that can be combined. Naturally, the smaller the amount of calculation and communication, the higher the practicality.

  Conventional non-patent literatures 1, 2, 3, and 5 have been known as general-purpose combinable commitment methods that can repeatedly use one piece of common information.

R. Canetti, "Universally composable security: A new paradigm for cryptographic protocols", In Proceedings of the 42th IEEE Annual Symposium on Foundations of Computer Science (FOCS'01), pages 136-145, Oct 2001. R. Canetti and M. Fischlin, "Universally composable commitments", In J. Kilian, editor, Advances in Cryptology | CRYPTO 2001, volume 2139 of Lecture Notes in Computer Science, pages 19-40, Springer-Verlag, 2001. R. Canetti, Y. Lindell, R. Ostrovsky, and A. Sahai, "Universally composable two-party and multi-party secure computation", In Proceedings of the 34th annual ACM Symposium on Theory of Com-puting (STOC'02) , pages 494-503, 2002. Ran Canetti, "Universally composable security: A new paradigm for cryptograpic protocols", Technical report, Cryptology ePrint Archive, Report 2000/067, 2005. Preliminary version appeared in FOCS'01. I. Damg_ard and J. Nielsen, "Perfect hiding and perfect binding universally composable commitment schemes with constant expansion factor", In Advances in Cryptology | CRYPTO2002, pages 581-596, 2002.

  However, the conventional system excluding Non-Patent Document 5 has a plaintext space of O (k) bits (k is a security parameter, k = 2048,160, etc.) for committing 1-bit secret information, and a selective encryption At least two public key ciphers that are safe against sentence attacks were required. In other words, the conventional method excluding Patent Document 5 requires an information amount of O (k) bits to commit 1-bit secret information, and is inefficient. On the other hand, in the method of Non-Patent Document 5, the efficiency is improved because only O (k) bits are required to commit the secret information of k bits. However, the method of Non-Patent Document 5 can be configured only on the RSA public key cryptosystem which modulo the composite number N (product of two large prime numbers), and the security parameter is limited to a large k = 2048. There is a problem that.

  The present invention has been made in view of these points, and an object of the present invention is to provide a commitment method that can be combined universally and can use a single piece of common information repeatedly with a small amount of calculation and communication.

In order to solve the above problem, in the commitment according to the first aspect of the present invention, n (n ≧ 1) commitment generation devices P (i) (i∈ {1,..., N}) and commitment acquisition devices The following processing is performed according to P _j (j ≠ i). First, the commitment generator P _i has the public key pk of the homomorphic public key cryptosystem and the elements g (0), g (1,1), g (1,2), ... of the finite commutative group G _c ... , g (n, 1), g (n, 2) ∈G _c and secret information s∈ {0,1, ..., L} (L, q is 0 <L ≦ Integer that satisfies q) is accepted. The commitment generator P _i generates an arbitrary element X∈G _c of a finite commutative group G _{c and} an arbitrary element of a remainder ring Z / qZ modulo a positive integer q a (1), a (2) Generate ∈Z / qZ, generate an arbitrary element r _a ∈G _r of the finite commutative group G _r , and _let G _m be a finite commutative group that is a cyclic group of order q, and the finite commutative group G _m the origin and g _m, the unity of the finite Allowed換群G _m and 1 _m, to the public the encryption function key pk and the plaintext M∈G _m and the original r∈G _r homomorphic public-key cryptography Te ε _pk (M, r) in the case of the homomorphic function for outputting ∈G _c, based on a = g a finite friendly換群 ^{_{G c (i, 1) a}} (1) · g (i, 2) a ⁽²⁾ · ε _pk (1 _m , r _a ) εG _c is generated, and elements A and X are output to the commitment acquisition device P _j . The commitment acquisition device P _j receives input of the common reference data crs, generates an arbitrary element b∈Z / qZ of the remainder ring Z / qZ, and outputs the element b to the commitment generation device P _i . The commitment generator P _i generates B = ε _pk ((g _m ) ^b , 1 _r ) εG _c when the unit element of the finite commutative group G _r is 1 _r, and the finite commutative group G generates random original r _c ∈G _r of _r, secret information s∈ {0,1, ..., L} as commit object, finite-friendly換群G _c of the original C = ^(g (0) ( ^{a (1) + a (2))}・ B ・ X) ^s・ ε _pk (1 _m , r _c ) ∈G _c and commit the elements a (1), a (2), r _a , C Output to the acquisition device P _j and store the first history information sid including the elements A, X, a (1), a (2), r _a , b, C, the secret information s, and the element r _c . Commitment acquisition device P _j is based on A, X, a (1) , a (2), r a, b, and stores the second log information sid 'including C.

The de commitment first aspect of the present invention, the commitment generator P _i is the first history information sid and secret information s the original r _c and outputs the commitment acquisition device P _j, commitment acquisition device P _j , The first history information sid and the second history information sid 'match, and the secret information s and the source r _c are C = (g (0) ^{(a (1) + a (2))} · B · X) ^s · ε _pk (1 _m , r _c ) εG _c , B = ε _pk ((g _m ) ^b , 1 _r ) εG _c is satisfied, the secret information s is approved.

In the first aspect of the present invention, based on ^{C = (g (0) (} a (1) + a (2)) · B · X) s · ε pk (1 m of the finite-friendly換群G _c, The secret information s to be committed is concealed by r _c ) ∈G _c , but when the secret information s is k bits, the bit length of C can be expressed as O (k). Further, there is no limitation on what homomorphic public key cryptosystem is used as the encryption function ε _pk (M, r). Furthermore, the common reference data crs can be used for each of n (n ≧ 1) commitment generation devices P (i) (i∈ {1,..., N}).

In the commitment according to the second aspect of the present invention, first, the commitment generation device P _i has a public key pk of the homomorphic public key cryptosystem and k finite commutative groups G _c (k is a positive integer). Vector vg (0) = (g (0,1), ..., g (0, k)), vg (1,1) = (g (1,1,1),. .., g (1,1, k)), vg (1,2) = (g (1,2,1), ..., g (1,2, k)), ..., vg ( n, 1) = (g (n, 1,1), ..., g (n, 1, k)), vg (n, 2) = (g (n, 2,1), ..., g (n, 2, k)) and common reference data crs, and the remainder ring Z / q _w Z modulo positive integer q _w (w = 1, ..., k) vs (w) The secret information vector vs = (vs (1),..., Vs (k)) ∈Πw _{= 1} ^k Z / q _w Z having εZ / q _w Z as each element is accepted. Commitment generator P _i, produce any original X∈G _c of the finite-friendly換群G _c, any source a (1, w) ∈Z / q w Z a residue ring Z / q _w Z each An element vector va (1) = (a (1,1), ..., a (1, k)) ∈Π _{w = 1} ^k Z / q _w Z and the remainder ring Z / q _w Z Vector va (2) = (a (2,1), ..., a (2, k)) ∈Π _{w = 1} ^{k with} elements a (2, w) ∈Z / q _w Z Z / q _w Z and any element r _a ∈G _r of the finite commutative group G _r and G _m is the direct product G _m = G _m of the cyclic group G _{m, w} of order q _{w , 1} × ... × G _{m, k is} a finite commutative group _, the generator of the cyclic group G _{m, w} is g _{m, w} , the unit of the finite commutative group G _m is 1 _m , The encryption function of the isomorphic public key cryptosystem is a homomorphic function that outputs ε _pk (M, r) ∈ G _c for the public key pk, plaintext M∈G _m and element r∈G _r , and vg (i, t) ^{va (t)} = (g (i, t, 1) ^{a (t, 1)} , ..., g (i, t, k) ^{a (t, k)} ) (t∈ {1,2} ) and in the case where, based on a = vg finite friendly換群 ^{_{G c (i, 1) va}} (1) · vg (i, 2) va (2) · ε pk (1 m, r a) ∈G c And the original A, X Output to the element acquisition device P _j . The commitment acquisition device P _j accepts input of the common reference data crs, and a vector vb = (b () having an arbitrary element b (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z as an element. 1), ..., b (k)) ∈Πw _{= 1} ^k Z / q _w Z is generated, and the vector vb is output to the commitment generator P _i . The commitment generator P _i uses B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G when the unit of the finite commutative group G _r is 1 _r. generates _c, produce any original r _c ∈G _r finite friendly換群G _r, as the commit target secret information vector vs, the original C = (vg (0 finite friendly換群G _c) ^{(va (1) + va (2))}・ B ・ X) ^vs・ ε _pk (1 _m , r _c ) ∈G _c and generates va (1), va (2), r _a , C as commitment acquisition device and outputs the _{P j, a, X, va} (1), va (2), r a, vb, stores a first history information sid and secret information vector vs the original r _c including C. Commitment acquisition device _{P j, A, X, va} (1), va (2), r a, vb, storing the second history information sid 'including C.

The de commitment second aspect of the present invention, the commitment generator P _i is the first history information sid and secret information vector vs and the original r _c and outputs the commitment acquisition device P _j, commitment acquisition device P _j However, the first history information sid and the second history information sid ′ match, and the secret information vector vs and the element r _c are C = (vg (0) ^{(va (1) + va (2))} · B ・ X) ^vs・ ε _pk (1 _m , r _c ) ∈G _c , B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G _c Approve the secret information vector vs.

In the second aspect of the present invention, based on ^{C = (vg (0) (} va (1) + va (2)) · B · X) vs · ε pk (1 m of the finite-friendly換群G _c, The secret information vector vs = (vs (1), ..., vs (k)) ∈Π _{w = 1} ^k Z / q _w Z is concealed by r _c ) ∈G _c , but the secret information vector When each element of vs is k bits, the bit length of C can be expressed as O (k). Further, there is no limitation on what homomorphic public key cryptosystem is used as the encryption function ε _pk (M, r) εG _c . Furthermore, the common reference data crs can be used for each of n (n ≧ 1) commitment generation devices P (i) (i∈ {1,..., N}).

  In the present invention, it is possible to realize a commitment method that can be combined universally and that can use a single piece of common information repeatedly with a small amount of calculation and communication.

FIG. 1 is a diagram for explaining the overall configuration of the commitment system according to the embodiment. FIG. 2 is a diagram for explaining a functional configuration of the commitment generation device according to the first embodiment. FIG. 3 is a diagram for explaining a functional configuration of the commitment acquisition apparatus according to the first embodiment. FIG. 4 is a diagram for explaining a functional configuration of the common reference data generation device according to the first embodiment. FIG. 5 is a diagram for explaining a commitment (sealing hand) process according to the first embodiment. FIG. 6A is a diagram for describing a decommitment (opening) process according to the first embodiment. FIG. 6B is a diagram for describing common reference data generation processing according to the first embodiment. FIG. 7 is a diagram for explaining a functional configuration of the commitment generation device according to the second embodiment. FIG. 8 is a diagram for explaining a functional configuration of the commitment acquisition apparatus according to the second embodiment. FIG. 9 is a diagram for explaining a functional configuration of the common reference data generation device according to the second embodiment. FIG. 10 is a diagram for explaining a commitment (sealing hand) process according to the second embodiment. FIG. 11A is a diagram for explaining a decommitment (opening) process according to the second embodiment. FIG. 11B is a diagram for describing common reference data generation processing according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
First, a first embodiment of the present invention will be described.

<Definition>
G _m , G _r , and G _c each represent a finite commutative (finite abel) group. G _{m in} this embodiment is a cyclic group of order q (q is a positive integer) with g _m ∈G _m as a generator. That is, G _m = <g _m > and q = # G _m . Furthermore, the identity element of the finite-friendly換群G _m expressed as 1 _m, representing the identity element of the finite-friendly換群G _r and 1 _r. Specific examples of the finite commutative groups G _m , G _r , and G _c include, for example, a group formed by rational points on an elliptic curve and a multiplicative group of a finite field. G _m, G _r, to G _c can be all identical to each other, G _m, G _r, may be different part of G _c from each other, all different G _m, G _r, G _c from each other May be. In this embodiment, the operations defined on the finite commutative groups G _m , G _r , G _c are expressed in a multiplicative manner. For example, Omega ^chi ∈G _c to the original Omega∈G _c original χ∈Zq / Z and finite friendly換群G _c of residue ring Z / qZ for a positive integer q modulo a finite relative Omega∈G _c the defined operation in abelian G _c means applying χ _{times, Ω 1, Ω 1 · Ω} 2 ∈G c for Omega ₂ ∈G _c includes Omega ₁ ∈G _c and Omega ₂ ∈G _c Means that the operation defined by the finite commutative group G _c is performed. There are various specific methods for realizing a group of rational points on an elliptic curve and a multiplicative group of a finite field on a computer, and in fact, it can be implemented by a computer using such a group. There are many encryption methods.

  Π = (Gen, Enc, Dec) represents a homomorphic public key cryptosystem. Specifically, Π is a set of three algorithms Gen, Enc, and Dec, and each algorithm satisfies the following properties.

Gen is a key generation algorithm, which is a stochastic algorithm that receives a security parameter k (k is a positive integer) and generates and outputs a corresponding public key / private key pair (pk, sk). Enc is an encryption algorithm that takes a public key pk and plaintext M∈G _m as inputs, internally generates random numbers r∈G _r, and assigns them to the homomorphic function ε _pk (M, r) ∈G _c This is a probabilistic algorithm that calculates and outputs the resulting ciphertext c. Dec is a decryption algorithm, which receives the secret key sk and the ciphertext c and calculates and outputs plaintext M = Dec _sk (c). When ε _pk : G _m × G _r → G _c is seen as a function, G _m , G _r , G _c is a finite abelian group, and ε _pk is a homomorphic function (ie , For any x, y∈G _m , y, z∈G _r , ε _pk (x, y) · ε _pk (y, z) = ε _pk (x · y, y · z) is satisfied) , _Εpk as an encryption function is called a homomorphic public key cryptosystem. When ε _pk is a homomorphic function, ε _pk (x, y) ^Z = ε _pk (x ^Z , y ^Z ) is satisfied with respect to zεZ (Z represents an integer set).

  Specific examples of the homomorphic public key cryptosystem include, for example, El Gamal cipher (Reference Document 1 “T. El Gamal,“ A public key cryptosystem and a signature scheme based on discrete logarithms ”, In IEEE Transactions on Information Theory, IT -31, pages 469-472, 1985.) and Damgard-Juric ciphers (reference 2 “I. Damg_ard and M. Jurik,“ A generalization, a simpli_cation and some applications of Paillier's probabilistic public-key system ”, In K. Kim, editor, 4th International Workshop on Practice and Theory in Public Key Cryptography-PKC'01, volume 1992 of Lecture Notes in Computer Science, pages 125-140, february 2001. In this embodiment, any homomorphic public key cryptosystem may be used.

<Configuration>
The commitment system 1 (FIG. 1) according to the first embodiment includes n (n ≧ 1) commitment generation devices 110-i (P (i): i∈ {1,..., N}) and commitment acquisition. A device 120-j ( _Pj : (j ≠ i)) and a common reference data generation device 130. The commitment generation device 110-i, the commitment acquisition device 120-j, and the common reference data generation device 130 can exchange information via a network, a portable recording medium or the like (hereinafter referred to as “network or the like”). In FIG. 1, for the sake of convenience of description, the commitment generation device 110-i and the commitment acquisition device 120-j are shown one by one, but there may be a plurality of them. Also, a configuration in which a plurality of common reference data generation devices 130 exist may be used.

<Configuration of commitment generation device 110-i>
The commitment generation apparatus 110-i (FIG. 2) of this embodiment includes a storage unit 111, input units 112a and 112b, an output unit 113, arbitrary element generation units 114a, 114b, 114c, and 114f, and calculation units 114d and 114e. , 114 g and a control unit 115.

  The commitment generation device 110-i is a special or dedicated computer including a CPU (central processing unit), RAM (random-access memory), ROM (read-only memory), etc. and a special program. Device. That is, the storage unit 111 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input units 112a and 112b and the output unit 113 are communication devices, input / output interfaces, The arbitrary element generation units 114a, 114b, 114c, and 114f, the calculation units 114d, 114e, and 114g, and the control unit 115 are output ports and the like, which are CPUs that execute special programs that are read. Further, at least part of the arbitrary element generation units 114a, 114b, 114c, and 114f, the calculation units 114d, 114e, and 114g, and the control unit 115 may be configured by an integrated circuit. The commitment generation device 110-i executes each process under the control of the control unit 115, the data obtained by each process is stored in the storage unit 111, and the stored data is read out as necessary. Used for each process.

<Configuration of commitment acquisition apparatus 120-j>
The commitment acquisition apparatus 120-j (FIG. 3) of this embodiment includes a storage unit 121, an input unit 122, an output unit 123, an arbitrary element generation unit 124a, calculation units 124b and 124d, and determination units 124b and 124c, 124e and a control unit 125.

  The commitment acquisition device 120-j is a special device configured by a known or dedicated computer including a CPU, a RAM, a ROM, and the like and a special program, for example. That is, the storage unit 121 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input unit 122 and the output unit 123 are communication devices, input / output interfaces, and input / output ports The arbitrary element generation unit 124a, the calculation units 124b and 124d, the determination units 124b, 124c, and 124e, and the control unit 125 are a CPU that executes a read special program. Further, at least part of the arbitrary element generation unit 124a, the calculation units 124b and 124d, the determination units 124b, 124c, and 124e, and the control unit 125 may be configured by an integrated circuit. The commitment acquisition device 120-j executes each process under the control of the control unit 125, the data obtained by each process is stored in the storage unit 121, and the stored data is read out as necessary. Used for each process.

<Common Reference Data Generation Device 130>
The common reference data generation device 130 (FIG. 4) of this embodiment includes a storage unit 131, an input unit 132, an output unit 133, a key generation unit 134a, an arbitrary element generation unit 134b, a calculation unit 134c, and a control unit. 135.

  The common reference data generation device 130 is a special device configured by a known or dedicated computer including a CPU, RAM, ROM, and the like and a special program, for example. That is, the storage unit 131 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input unit 132 and the output unit 133 are a communication device, an input / output interface, and an input / output port. The key generation unit 134a, the arbitrary element generation unit 134b, the calculation unit 134c, and the control unit 135 are a CPU that executes a read special program. In addition, at least a part of the key generation unit 134a, the arbitrary element generation unit 134b, the calculation unit 134c, and the control unit 135 may be configured by an integrated circuit. The common reference data generation device 130 executes each process under the control of the control unit 135, the data obtained by each process is stored in the storage unit 131, and the stored data is read out as necessary. Used for each process.

<Common reference data generation processing>
The common reference data generation process of this embodiment will be described using FIG. 6B.

First, the security parameter k and the integer L (L is a positive integer satisfying 0 <L ≦ q) are input to the input unit 132 of the common reference data generating apparatus 130 (FIG. 4) (step S1301). The security parameter k and the integer L are input to the key generation unit 134a. The key generation unit 134a operates the above-described key generation algorithm Gen to generate a public key / private key pair (pk, sk) corresponding to the security parameter k, and outputs the public key pk and the integer L to the calculation unit 134c. The secret key sk is discarded (step S1302). Then, any source generating unit 134b is randomly element g of the finite-friendly換群_{G c (0), g (} 1,1), g (1,2), ..., g (n, 1), g (n, 2) ∈G _c (in other words, g (0), g (i, t) ∈G _c (i = 1, ..., n, t = 1,2)) It outputs to 134c (step S1303). Next, the calculation unit 134c uses the common reference data.
crs = (Π, pk, L, g _m , g (0), g (1,1), g (1,2), ..., g (n, 1), g (n, 2))… (1)
And output to the output unit 133 (step S1304). The output unit 133 outputs the common reference data crs to each commitment generation device 110-i and commitment acquisition device 120-j, and sends the common reference data crs to each commitment generation device 110-i and commitment acquisition device 120-j via a network or the like. (Step S1305).

<Commitment (sealing) processing>
The commitment process according to this embodiment will be described with reference to FIG.

The common reference data crs is input to the input unit 112a of the commitment generation device 110-i (FIG. 2) and stored in the storage unit 111 (step S1101). Further, the common reference data crs is input to the input unit 122 of the commitment acquisition device 120-j (FIG. 3) and stored in the storage unit 121 (step S1201). Note that steps S1101 and S1201 may be executed before the commitment process, and if the common reference data crs is already stored in the storage units 111 and 121, steps S1101 and S1201 can be omitted. . Further, P _i representing the commitment generation device 110-i and P _j representing the commitment acquisition device 120-j are the storage unit 111 of the commitment generation device 110-i (FIG. 2) and the commitment acquisition device 120-j (FIG. 3). ) Storage unit 121.

  Next, the secret information sε {0, 1,..., L} to be committed (L, q is an integer satisfying 0 <L ≦ q) is input to the input unit 112b of the commitment generation device 110-i (FIG. 2). Is input and stored in the storage unit 111 (step S1102).

Then, any element generation unit 114c is, any original X∈G _c of the finite-friendly換群G _c and randomly generated and stored in the storage unit 111 (step S1103), any element generation unit 114a is a positive integer Arbitrary elements a (1) and a (2) ∈Z / qZ of the remainder ring Z / qZ modulo q are randomly generated and stored in the storage unit 111 (step S1104), and the arbitrary element generation unit 114b Then, an arbitrary element r _a ∈G _r of the finite commutative group G _r is randomly generated and stored in the storage unit 111 (step S1105). Calculating unit 114d from the storage unit 111 a (1), a ( 2), r a, crs of g (i, 1), reads out g (i, 2), elements of the finite-friendly換群G _c
A = g (i, 1) ^{a (1)}・ g (i, 2) ^{a (2)}・ ε _pk (1 _m , r _a ) ∈G _c … (2)
Is calculated and stored in the storage unit 111 (step S1106).

  A and X stored in the storage unit 111 are sent to the output unit 113, and the output unit 113 outputs A and X to the commitment acquisition device 120-j (step S1107). A and X are input to the input unit 122 of the commitment acquisition device 120-j (FIG. 3) via a network or the like, and stored in the storage unit 121 (step S1202).

  Next, the arbitrary element generation unit 124a of the commitment acquisition device 120-j randomly generates an arbitrary element bεZ / qZ of the remainder ring Z / qZ and stores it in the storage unit 121 (step S1203). B stored in the storage unit 121 is input to the output unit 123, and the output unit 123 outputs b to the commitment generation device 110-i (step S1204). b is input to the input unit 112a of the commitment generation device 110-i (FIG. 2) via a network or the like and stored in the storage unit 111 (step S1108).

Next, the calculation unit 114e reads b and g _{m of} crs from the storage unit 111,
B = ε _pk ((g _m ) ^b , 1 _r ) εG _c (3)
Is stored in the storage unit 111 (step S1109).

Next, the arbitrary element generation unit 114f generates an arbitrary element r _c εG _r of the finite commutative group G _r and stores it in the storage unit 111 (step S1110). Further, the calculation unit 114g reads g (0) of a (1), a (2), B, X, s, crs from the storage unit 111, sets the secret information s as a commit target, and uses the finite commutative group G _c Origin of
C = (g (0) ^{(a (1) + a (2))}・ B ・ X) ^s・ ε _pk (1 _m , r _c ) εG _c (4)
Is stored in the storage unit 111 (step S1111).

Next, a (1), a (2), r _a , C stored in the storage unit 111 are input to the output unit 113, and the output unit 113 receives (a (1), a (2), r _a ), C is output to the commitment acquisition device 120-j (step S1112). Note that the storage unit 111 of the commitment generator 110-i, the history information including A, X, a (1) , a (2), r a, b, C, P i, P j, the
sid = (P _i , P _j , A, X, a (1), a (2), r _a , b, C)… (5)
And (s, r _c ) are stored.

(A (1), a (2), r _a ), C output from the output unit 113 are input to the input unit 122 of the commitment acquisition device 120-j (FIG. 3) via the network or the like, It is stored in the storage unit 121 (step S1205). Next, the determination unit 124b reads out g (i, 1) and g (i, 2) of A, a (1), a (2), crs from the storage unit 121,
A = g (i, 1) ^{a (1)}・ g (i, 2) ^{a (2)}・ ε _pk (1 _m , r _a )… (6)
It is determined whether or not the condition is satisfied (step S1206). Here, if it is determined that the expression (6) is satisfied, the history information stored in the storage unit 121
sid '= (P _i , P _j , A, X, a (1), a (2), r _a , b, C)… (7)
Is stored and the commitment process is normally terminated (step S1207). On the other hand, if it is determined that the expression (6) is not satisfied, the history information stored in the storage unit 121 is discarded and the commitment process is terminated with an error (step S1208).

<Decommitment (opening) processing>
The decommitment process of this embodiment will be described with reference to FIG. 6A.

First, history information sid and (s, r _c ) are input from the storage unit 111 of the commitment generation device 110-i (FIG. 2) to the output unit 113, and the output unit 113 outputs the history information sid ′ and (s, r _c). ) To the commitment acquisition device 120-j (step S1121). History information sid and (s, r _c) and is input to the input unit 122 of a network of commitments acquisition device 120-j (FIG. 3) is stored in the storage unit 121 (step S1211).

Next, the determination unit 124c reads the history information sid and sid ′ from the storage unit 121,
sid = sid '… (8)
It is determined whether or not the condition is satisfied (step S1212). Here, when it is determined that the expression (8) is not satisfied, the de-commitment by the commitment generation device 110-i is rejected, and the process ends in error (step S1215). On the other hand, if it is determined that the expression (8) is satisfied, then the calculation unit 124d reads g _{m of} b and crs from the storage unit 121.
B = ε _pk ((g _m ) ^b , 1 _r ) εG _c (9)
Is generated and input to the determination unit 124e (step S1213). The determination unit 124e further reads g (0) of a (1), a (2), X, s, crs from the storage unit 121, and the secret information s and the source r _c are obtained.
C = (g (0) ^{(a (1) + a (2))}・ B ・ X) ^s・ ε _pk (1 _m , r _c ) εG _c (10)
It is determined whether or not the condition is satisfied (step S1214). Here, when it is determined that the expression (10) is not satisfied, the de-commitment by the commitment generation device 110-i is rejected, and the process ends in error (step S1215). On the other hand, when it is determined that the expression (10) is satisfied, the secret information s is approved by approving the decommitment by the commitment generation device 110-i, the determination result is output, and the processing is terminated normally ( Step S1216).

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In the second embodiment, the plaintext space of the public key cryptosystem of the first embodiment is changed to a vector space. Below, it demonstrates centering on difference with 1st Embodiment.

<Definition>
Also in this embodiment, G _m , G _r , and G _c each represent a finite commutative (finite abel) group. However, G _m in this embodiment is from the direct product G _m = G _{m, 1} × ... × G _{m, k} of the cyclic group G _{m, w} of order q _w (w = 1, ..., k) (Any finite abelian group can be generalized in this form). That is, the generation source of the cyclic group G _{m, w} is g _{m, w} and G _m = <g _{m, 1} > × ... × <g _{m, k} >. If the order of the cyclic group G _{m, w} is q _w , #G _m = _{Πw = 1} ^k q _w . Further, a generator vg _m of the finite commutative group G _m is defined as vg _m = (g _{m, 1} , ..., g _{m, k} ). Furthermore, the identity element of the finite-friendly換群G _m expressed as 1 _m, representing the identity element of the finite-friendly換群G _r and 1 _r. Specific examples of G _{m, w} , G _r , and G _c are, for example, a group of rational points on an elliptic curve, a multiplicative group of a finite field, and the like. G _{m, w} , G _r , G _c may all be the same as each other, or part of G _{m, w} , G _r , G _c may be different from each other, G _{m, w} , G _r , G _c may be all different from each other. Also in this embodiment, the operations defined on the finite commutative groups G _m , G _r and G _c are expressed in a multiplicative manner.

  Π = (Gen, Enc, Dec) represents a homomorphic public key cryptosystem. The definitions of Gen, Enc, and Dec are the same as in the first embodiment. A specific example of the homomorphic public key cryptosystem used in this embodiment is the same as that of the first embodiment such as El Gamal encryption and Damgard-Juric encryption. Also in this embodiment, any homomorphic public key cryptosystem may be used.

<Configuration>
The commitment system 2 (FIG. 1) of the second embodiment includes n (n ≧ 1) commitment generation devices 210-i (P (i): i∈ {1,..., N}) and commitment acquisition. A device 220-j ( _Pj : (j ≠ i)) and a common reference data generation device 230. The commitment generation device 210-i, the commitment acquisition device 220-j, and the common reference data generation device 230 can exchange information via a network or the like. In FIG. 1, for the sake of convenience, one commitment generation device 210-i and one commitment acquisition device 220-j are shown one by one, but there may be a plurality of these. Also, a configuration in which a plurality of common reference data generation devices 230 exist may be used.

<Configuration of Commitment Generation Device 210-i>
The commitment generation device 210-i (FIG. 7) of this embodiment includes a storage unit 211, input units 212a and 212b, an output unit 213, arbitrary element generation units 214a, 114b, 114c, and 114f, and calculation units 214d and 214e. , 214 g and a control unit 115.

  The commitment generation device 210-i is a special device configured by a known or dedicated computer including a CPU, RAM, ROM, and the like and a special program, for example. That is, the storage unit 211 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input units 212a and 212b and the output unit 213 include a communication device, an input / output interface, and an input unit. The arbitrary element generation units 214a, 114b, 114c, 114f, the calculation units 214d, 214e, 214g, and the control unit 115 are CPUs that execute the read special programs. Moreover, at least a part of the arbitrary element generation units 214a, 114b, 114c, 114f, the calculation units 214d, 214e, 214g, and the control unit 115 may be configured by an integrated circuit. The commitment generation device 210-i executes each process under the control of the control unit 115, the data obtained by each process is stored in the storage unit 211, and the stored data is read out as necessary. Used for each process.

<Configuration of Commitment Acquisition Device 220-j>
The commitment acquisition apparatus 220-j (FIG. 8) of this embodiment includes a storage unit 221, an input unit 222, an output unit 223, an arbitrary element generation unit 224a, arithmetic units 224b and 224d, and determination units 224b and 224c, 224e and a control unit 125.

  The commitment acquisition device 220-j is a special device configured by a known or dedicated computer including a CPU, a RAM, a ROM, and the like and a special program, for example. That is, the storage unit 221 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input unit 222 and the output unit 223 include a communication device, an input / output interface, and an input / output port. The arbitrary element generation unit 224a, the calculation units 224b and 224d, the determination units 224b, 224c, and 224e, and the control unit 125 are a CPU that executes a read special program. Further, at least part of the arbitrary element generation unit 224a, the calculation units 224b and 224d, the determination units 224b, 224c, and 224e, and the control unit 125 may be configured by an integrated circuit. The commitment acquisition device 220-j executes each process under the control of the control unit 125, the data obtained in each process is stored in the storage unit 221, and the stored data is read out as necessary. Used for each process.

<Common Reference Data Generation Device 230>
The common reference data generation device 230 (FIG. 9) of this embodiment includes a storage unit 231, an input unit 232, an output unit 233, a key generation unit 134a, an arbitrary element generation unit 234b, a calculation unit 234c, and a control unit. 135.

  The common reference data generation device 230 is a special device configured by a known or dedicated computer including a CPU, RAM, ROM, and the like and a special program, for example. That is, the storage unit 231 is, for example, a RAM, a cache memory, a register, a hard disk, or a storage area that combines at least a part of them, and the input unit 232 and the output unit 233 include a communication device, an input / output interface, and an input / output port The key generation unit 134a, the arbitrary element generation unit 234b, the calculation unit 234c, and the control unit 135 are a CPU that executes a read special program. In addition, at least a part of the key generation unit 134a, the arbitrary element generation unit 234b, the calculation unit 234c, and the control unit 135 may be configured by an integrated circuit. The common reference data generation device 230 executes each process under the control of the control unit 135, the data obtained by each process is stored in the storage unit 231, and the stored data is read out as necessary. Used for each process.

<Common reference data generation processing>
The common reference data generation process of this embodiment will be described using FIG. 11B.

First, the security parameter k is input to the input unit 232 of the common reference data generation device 230 (FIG. 9) (step S2301). The security parameter k is input to the key generation unit 134a. The key generation unit 134a operates the above-described key generation algorithm Gen to generate a public key / private key pair (pk, sk) corresponding to the security parameter k, and calculates the public key pk from the calculation unit 234c and the arbitrary element generation unit. The secret key sk is discarded (step S2302). Next, the arbitrary element generation unit 234b inputs the generation element g _m = (g _{m, 1} , ..., g _{m, k} ) to Enc _pk , and a vector
vg (0) = (g (0,1), ..., g (0, k))… (11)
Is output to the calculation unit 234c. That is, the arbitrary element generation unit 234b generates a random number r _w εG _r (w = 1,..., K),
g (0, w) = ε _pk (g _{m, w} , r _w ) εG _c (12)
To obtain the element g (0, w) (w = 1,..., K) of the finite commutative group G _c and set it as each element of the vector vg (0). Note that the generator g _m = (g _{m, 1} , ..., g _{m, k} ) is not input to Enc _pk to obtain the vector vg (0), but any element of the finite commutative group G _c The vector vg (0) may be obtained by randomly determining g (0, w) (w = 1,..., k). The arbitrary element generation unit 234b randomly determines an arbitrary element g (i, w) (i = 1,..., N, w = 1,..., K) of the finite commutative group G _c. , Vg (i, t) = (g (i, t, 1), ..., g (i, t, k)) ∈G _c ^k (t = 1,2), vg (1,1) , vg (1,2),... vg (n, 1), vg (n, 2) are generated and output to the calculation unit 234c. That is, any element generation unit 234b includes a vector vg (0), each of which is k pieces of the original elements of the finite-friendly換群_{G c = (g (0,1)} , ..., g (0, k) ), vg (1,1) = (g (1,1,1), ..., g (1,1, k)), vg (1,2) = (g (1,2,1), ..., g (1,2, k)), ..., vg (n, 1) = (g (n, 1,1), ..., g (n, 1, k)), vg (n, 2) = (g (n, 2,1)..., g (n, 2, k)) is selected and output to the computing unit 234c (step S2303).

Next, the calculation unit 234c receives the common reference data.
crs = (Π, pk, L, vg _m , vg (0), vg (1,1), vg (1,2), ..., vg (n, 1), vg (n, 2))… (13)
And output to the output unit 233 (step S2304). The output unit 233 outputs the common reference data crs to each commitment generation device 210-i and commitment acquisition device 220-j, and sends it to each commitment generation device 210-i and commitment acquisition device 220-j via a network or the like. (Step S2305).

<Commitment (sealing) processing>
The commitment process of this embodiment will be described with reference to FIG.

The common reference data crs is input to the input unit 212a of the commitment generation device 210-i (FIG. 7) and stored in the storage unit 211 (step S2101). Further, the common reference data crs is input to the input unit 222 of the commitment acquisition device 220-j (FIG. 8) and stored in the storage unit 221 (step S2201). Note that steps S2101 and S2201 may be executed before the commitment process, and if the common reference data crs is already stored in the storage unit 212, steps S2101 and S2201 may be omitted. Further, P _i representing the commitment generation device 210-i and P _j representing the commitment acquisition device 220-j are the storage unit 211 of the commitment generation device 210-i (FIG. 7) and the commitment acquisition device 220-j (FIG. 8). ) Storage unit 221.

Next, the element vs (w) of the remainder ring Z / q _w Z modulo a positive integer q _w (w = 1,..., K) is input to the input unit 212b of the commitment generator 210-i (FIG. 7). ) ∈Z / q _w Z as secret information vectors vs = (vs (1), ..., vs (k)) ∈Πw _{= 1} ^k Z / q _w Z are input and the storage unit 211 (Step S2102). In this embodiment, the secret information vector vs = (vs (1),..., Vs (k)) ∈Πw _{= 1} ^k Z / q _w Z is the commit target.

Next, the arbitrary element generation unit 114c randomly generates an arbitrary element XεG _c of the finite commutative group G _c and stores it in the storage unit 211 (step S2103). Also, the arbitrary element generation unit 214a generates a vector va (1) = (a (1,1)) having each element of an arbitrary element a (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z. , ..., a (1, k)) ∈Π _{w = 1} ^k Z / q _w Z and any element a (2, w) ∈Z / q _w Z of the remainder ring Z / q _w Z A vector va (2) = (a (2,1), ..., a (2, k)) ∈Π _{w = 1} ^k Z / q _w Z is generated and stored in the storage unit 211. (Step S2104). Further, the arbitrary element generation unit 114b randomly generates an arbitrary element r _a ∈G _r of the finite commutative group G _r and stores it in the storage unit 211 (step S1105). Calculating unit 214d from the storage unit 211 va (1), va ( 2), r a, vg of crs (i, 1), reads out vg (i, 2), elements of the finite-friendly換群G _c
A = vg (i, 1) ^{va (1)}・ vg (i, 2) ^{va (2)}・ ε _pk (1 _m , r _a ) εG _c (14)
Is calculated and stored in the storage unit 211 (step S2106). Where vg (i, t) ^{va (t)} = (g (i, t, 1) ^{a for} va (t) = (a (t, 1), ..., a (t, k)) ^{(t, 1)} , ..., g (i, t, k) ^{a (t, k)} ) (t∈ {1,2}).

  A and X stored in the storage unit 211 are sent to the output unit 213, and the output unit 213 outputs A and X to the commitment acquisition device 220-j (step S1107). A and X are input to the input unit 222 of the commitment acquisition device 220-j (FIG. 8) via the network or the like, and stored in the storage unit 221 (step S1202).

Next, the arbitrary element generation unit 224a of the commitment acquisition device 220-j uses the vector vb = (b) with each element of an arbitrary element b (1, w) εZ / q _w Z of the remainder ring Z / q _w Z. (1),..., B (k)) ∈Πw _{= 1} ^k Z / q _w Z is generated and generated and stored in the storage unit 221 (step S2203). The vb stored in the storage unit 221 is input to the output unit 223, and the output unit 223 outputs vb to the commitment generation device 210-i (step S2204). vb is input to the input unit 212a of the commitment generation device 210-i (FIG. 7) via a network or the like and stored in the storage unit 211 (step S2108).

Next, the calculation unit 214e reads vb and crs vg _m = (g _{m, 1} , ..., g _{m, k} ) from the storage unit 211,
B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G _c … (15)
Is stored in the storage unit 211 (step S2109).

Next, the arbitrary element generation unit 114f generates an arbitrary element r _c εG _r of the finite commutative group G _r and stores it in the storage unit 211 (step S1210). Further, the calculation unit 214g reads vg (0) of va (1), va (2), B, X, vs, crs from the storage unit 211, sets the secret information vector vs as a commit target, and uses the finite commutative group G origin of _c
C = (vg (0) ^{(va (1) + va (2))}・ B ・ X) ^vs・ ε _pk (1 _m , r _c ) εG _c (16)
Is stored in the storage unit 211 (step S2111). However, for the vector α = (α (1), ..., a (k)) and the vector β = (β (1), ..., β (k)), α ^β = (α ( 1) ^{β (1)} , ..., a (k) ^{β (k)} ).

Then, stored in the storage unit 211 va (1), va ( 2), r a, C are input to the output unit 213, an output unit 213, (va (1), va (2), r a ), C is output to the commitment acquisition device 220-j (step S2112). Note that the storage unit 211 of the commitment generator 210-i, the history information including A, X, va (1) , va (2), r a, vb, C, P i, P j, the
_{sid = (P i, P j} , A, X, va (1), va (2), r a, vb, C) ... (17)
And (vs, r _c ) are stored.

Output from the output unit 213 (va (1), va (2), r a), C , via a network or the like is input to the input unit 222 of the commitments acquisition device 220-j (FIG. 8), It is stored in the storage unit 221 (step S2205). Next, the determination unit 224b reads out vg (i, 1) and vg (i, 2) of A, va (1), va (2), crs from the storage unit 221;
A = vg (i, 1) ^{va (1)}・ vg (i, 2) ^{va (2)}・ ε _pk (1 _m , r _a ) εG _c (18)
It is determined whether or not the condition is satisfied (step S2206). Here, if it is determined that the expression (18) is satisfied, the history information stored in the storage unit 221 is stored.
_{sid '= (P i, P} j, A, X, va (1), va (2), r a, vb, C) ... (19)
Is stored and the commitment process is normally terminated (step S2207). On the other hand, if it is determined that the expression (18) is not satisfied, the history information stored in the storage unit 221 is discarded and the commitment process is terminated with an error (step S2208).

<Decommitment (opening) processing>
The decommitment process according to this embodiment will be described with reference to FIG. 11A.

First, history information sid and (vs, r _c ) are input from the storage unit 211 of the commitment generation device 210-i (FIG. 7) to the output unit 213, and the output unit 213 receives the history information sid ′ and (vs, r _c). ) To the commitment acquisition device 220-j (step S2121). The history information sid and (vs, r _c ) are input to the input unit 222 of the commitment acquisition device 220-j (FIG. 8) via a network or the like and stored in the storage unit 221 (step S2211).

Next, the determination unit 224c reads the history information sid and sid ′ from the storage unit 221, and the equation (8)
sid = sid '… (20)
It is determined whether or not the condition is satisfied (step S1212). Here, when it is determined that the expression (20) is not satisfied, the de-commitment by the commitment generation device 210-i is rejected, and the process ends in error (step S2215). On the other hand, when it is determined that the expression (20) is satisfied, the arithmetic unit 224d then reads vg _m = (g _{m, 1} ,..., G _{m, k} ) of vb, crs from the storage unit 221. And
B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G _c … (21)
Is generated and input to the determination unit 224e (step S2213). Determining unit 224e further from the storage unit 221 va (1), va ( 2), X, vs, reads vg (0) of the crs, and the secret vs the original r _c
C = (vg (0) ^{(va (1) + va (2))}・ B ・ X) ^vs・ ε _pk (1 _m , r _c ) εG _c (22)
It is determined whether or not the condition is satisfied (step S2214). Here, when it is determined that the expression (22) is not satisfied, the de-commitment by the commitment generation device 210-i is rejected, and the process ends in error (step S2215). On the other hand, if it is determined that the expression (22) is satisfied, the secret information vector vs is approved by approving the decommitment by the commitment generation device 210-i, and the determination result is output to terminate the processing normally. (Step S2216).

[Modifications, etc.]
The present invention is not limited to the embodiment described above. For example, in the first embodiment, the example of the common reference data crs is exemplified by the formula (1), but pk, g (0), g (1,1), g (1,2),. , g (n, 1), g (n, 2) may be used as the common reference data crs. For example, if pk, g (0), g (1,1), g (1,2), ..., g (n, 1), g (n, 2) are included, the common reference data crs May not include at least some elements of the formula (1), or may include elements other than the formula (1). Similarly, in the second embodiment, the equation (13) is illustrated as an example of the common reference data crs, but pk, vg (0), vg (1,1), vg (1,2),. ., vg (n, 1), and other data including vg (n, 2) may be used as the common reference data crs. For example, if pk, vg (0), vg (1,1), vg (1,2), ..., vg (n, 1), vg (n, 2) are included, the common reference data crs May not include at least some of the elements of formula (13), or may include elements other than formula (13).

In the first embodiment, A as in Equation (5), X, a ( 1), a (2), r a, b, C, P i, is exemplified history information including P _j, the , a, X, a (1 ), a (2), r a, b, or as history information and other information including C. Similarly, in the second embodiment, A as in Equation (17), X, va ( 1), va (2), r a, exemplified _{vb, C, P i, P} j, the history information including the but, a, X, va (1 ), va (2), r a, vb, or as history information and other information including C.

  In addition, the information generated randomly in each of the above embodiments may be information selected in a predetermined order (the selection order is not disclosed).

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording device and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

1,2 Commitment system 110-i, 210-i Commitment generation device 120-i, 220-i Commitment acquisition device 130, 230 Common reference data generation device

Claims (16)

n (n ≧ 1) commitment generation devices P (i) (i∈ {1, ..., n}) and commitment acquisition devices P _j (j ≠ i),
The commitment generator P _i is
Homomorphic public key cryptography public key pk and finite commutative group G _c elements g (0), g (1,1), g (1,2), ..., g (n, 1), g a first input unit that receives input of common reference data crs including (n, 2) ∈G _c ;
A second input unit that accepts input of secret information s∈ {0,1, ..., L} (L, q is an integer satisfying 0 <L ≦ q);
A first optional element generation unit for generating an arbitrary original X∈G _c of the finite-friendly換群G _c,
A second arbitrary element generator for generating arbitrary elements a (1), a (2) ∈Z / qZ of a remainder ring Z / qZ modulo a positive integer q;
A third arbitrary element generator for generating an arbitrary element r _a ∈G _r of the finite commutative group G _r ;
G _m is a finite commutative group that is a cyclic group of order q, the generator of the finite commutative group G _m is g _m , the unit element of the finite commutative group G _m is 1 _m, and the homomorphism When the encryption function of the public key cryptosystem is a homomorphic function that outputs ε _pk (M, r) εG _c for the public key pk, plaintext M∈G _m and element r∈G _r , A first operation that generates an element A = g (i, 1) ^{a (1)} · g (i, 2) ^{a (2)} · ε _pk (1 _m , r _a ) εG _c of the finite commutative group G _c And
A first output unit that outputs the elements A and X to the commitment acquisition device P _j ,
The commitment acquisition device P _j is
A third input unit for receiving input of the common reference data crs;
A fourth arbitrary element generator for generating an arbitrary element b∈Z / qZ of the remainder ring Z / qZ;
A second output unit that outputs the element b to the commitment generation device P _i ,
The commitment generator P _i is
A second computing unit for generating B = ε _pk ((g _m ) ^b , 1 _r ) εG _c when the unit element of the finite commutative group G _r is 1 _r ;
A fifth arbitrary element generator for generating an arbitrary element r _c ∈G _r of the finite commutative group G _r ;
Using the secret information s∈ {0,1, ..., L} as a commit target, the element C = (g (0) ^{(a (1) + a (2))} · B of the finite commutative group G _c A third arithmetic unit for generating X) ^s · ε _pk (1 _m , r _c ) εG _c ;
A third output unit for outputting the elements a (1), a (2), r _a , C to the commitment acquisition device P _j ;
The source A, X, a (1) , a (2), r a, b, a first storage unit for storing said original r _c as the first history information sid and the secret information s including C, and In addition,
The commitment acquisition device P _j is
A second storage unit for storing second history information sid ′ including the elements A, X, a (1), a (2), r _a , b, C;
A commitment system characterized by that. The commitment system of claim 1,
The commitment generator P _i is
Further comprising a fourth output unit for outputting said first history information sid and the secret information s and the original r _c to the Commitment acquisition device P _j,
The commitment acquisition device P _j is
The first history information sid and the second history information sid ′ match, and the secret information s and the element r _c are C = (g (0) ^{(a (1) + a (2))}・ B ・ X) ^s・ ε _pk (1 _m , r _c ) ∈G _c , B = ε _pk ((g _m ) ^b , 1 _r ) ∈G _c And further comprising:
A commitment system characterized by that. n (n ≧ 1) commitment generation devices P _i (i∈ {1, ..., n}) and commitment acquisition devices P _j (j ≠ i),
The commitment generator P _i is
A vector vg (0) = (g (0,1),..., Whose elements are elements of the homomorphic public key cryptosystem public key pk and k finite commutative groups G _c (k is a positive integer). .., g (0, k)), vg (1,1) = (g (1,1,1), ..., g (1,1, k)), vg (1,2) = ( g (1,2,1), ..., g (1,2, k)), ..., vg (n, 1) = (g (n, 1,1), ..., g ( n, 1, k)), vg (n, 2) = (g (n, 2,1), ..., g (n, 2, k)) 1 input unit,
Secret information vector vs = (vs) with elements vs (w) ∈Z / q _w Z of the remainder ring Z / q _w Z modulo a positive integer q _w (w = 1, ..., k) (1), ..., vs (k)) ∈Πw _{= 1} ^k Z / q _w Z
A first optional element generation unit for generating an arbitrary original X∈G _c of the finite-friendly換群G _c,
A vector va (1) = (a (1,1), ..., a (1) with each element of an arbitrary element a (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z , k)) ∈Π _{w = 1} ^k Z / q _w Z and a vector va (2) with each element of an arbitrary element a (2, w) ∈Z / q _w Z of the remainder ring Z / q _w Z ) = (a (2,1), ..., a (2, k)) ∈Πw _{= 1} ^k Z / q _w Z,
A third arbitrary element generator for generating an arbitrary element r _a ∈G _r of the finite commutative group G _r ;
G _m is a direct product G _m = G _{m, 1} × ... × G _{m, k} of a cyclic group G _{m, w} of order q _w , and the generator of the cyclic group G _{m, w} G _{m, w} , the unit element of the finite commutative group G _m is 1 _m, and the encryption function of the homomorphic public key cryptosystem is the public key pk, plaintext M∈G _m and element r∈G _r and ε _pk (M, r) homomorphic function for outputting ∈G _c ^{respect, vg (i, t) va} (t) = (g (i, t, 1) a (t, 1), .. ., g (i, t, k) a (t, k)) ( in case of the t∈ {1,2}), based on a = vg of the finite-friendly換群 ^{_{G c (i, 1) va}} ( ^{1) · vg (i, 2} ) va (2) · ε pk (1 m, and a first arithmetic unit for generating a r _a) ∈G _c,
A first output unit that outputs the elements A and X to the commitment acquisition device P _j ,
The commitment acquisition device P _j is
A third input unit for receiving input of the common reference data crs;
A vector vb = (b (1), ..., b (k)) ∈Π _w with each element of an arbitrary element b (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z _{= 1} ^k Z / q _w Z, a fourth arbitrary element generator,
A second output unit that outputs the vector vb to the commitment generator P _i ,
The commitment generator P _i is
A second unit for generating B = ε _pk ( _{Πw = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) εG _c when the unit element of the finite commutative group G _r is 1 _r An arithmetic unit;
A fifth arbitrary element generator for generating an arbitrary element r _c ∈G _r of the finite commutative group G _r ;
The secret information vector vs as the commit object, based on ^{C = (vg (0) (} va (1) + va (2)) · B · X) vs · ε pk (1 m of the finite-friendly換群G _c, a third arithmetic unit for generating r _c ) ∈G _c ;
The va (1), and va (2), r _a, the third output unit for outputting the C to the Commitment acquisition device P _j,
Wherein A, X, va (1) , va (2), r a, vb, a first storage unit for storing said original r _c as the first history information sid and the secret information vector vs including C, and In addition,
The commitment acquisition device P _j is
Wherein A, X, va (1) , va (2), further comprising a second storage unit for storing a r _a, vb, second historical information sid containing C ',
A commitment system characterized by that. The commitment system of claim 3,
The commitment generator P _i is
Further comprising a fourth output unit for outputting said first history information sid and the secret information vector vs with the original r _c to the Commitment acquisition device P _j,
The commitment acquisition device P _j is
The first history information sid and the second history information sid ′ match, and the secret information vector vs and the element r _c are C = (vg (0) ^{(va (1) + va (2) )}・ B ・ X) ^vs・ ε _pk (1 _m , r _c ) ∈G _c , B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G _c A determination unit that approves the secret information vector vs.
A commitment system characterized by that. Homomorphic public key cryptography public key pk and finite commutative group G _c elements g (0), g (1,1), g (1,2), ..., g (n, 1), g a first input unit that receives input of common reference data crs including (n, 2) ∈G _c ;
A second input unit that accepts input of secret information s∈ {0,1, ..., L} (L, q is a positive integer satisfying 0 <L ≦ q);
A first optional element generation unit for generating an arbitrary original X∈G _c of the finite-friendly換群G _c,
A second arbitrary element generator for generating arbitrary elements a (1), a (2) ∈Z / qZ of the remainder ring Z / qZ modulo the positive integer q;
A third arbitrary element generator for generating an arbitrary element r _a ∈G _r of the finite commutative group G _r ;
G _m is a finite commutative group that is a cyclic group of order q, the generator of the finite commutative group G _m is g _m , the unit element of the finite commutative group G _m is 1 _m, and the homomorphism When the encryption function of the public key cryptosystem is a homomorphic function that outputs ε _pk (M, r) εG _c for the public key pk, plaintext M∈G _m and element r∈G _r , Elements of the finite commutative group G _c A = g (i, 1) ^{a (1)}・ g (i, 2) ^{a (2)}・ ε _pk (1 _m , r _a ) ∈G _c (i∈ {1, ..., n}, n ≧ 1)
A first output unit for outputting the elements A and X to the commitment acquisition device P _j ;
A third input unit for receiving an input of the element b∈Z / qZ of the remainder ring Z / qZ;
A second computing unit for generating B = ε _pk ((g _m ) ^b , 1 _r ) εG _c when the unit element of the finite commutative group G _r is 1 _r ;
A fourth arbitrary element generation unit for generating an arbitrary element r _c ∈G _r of the finite commutative group G _r ;
Using the secret information s∈ {0,1, ..., L} as a commit target, the element C = (g (0) ^{(a (1) + a (2))} · B of the finite commutative group G _c A third arithmetic unit for generating X) ^s · ε _pk (1 _m , r _c ) εG _c ;
A second output unit that outputs the elements a (1), a (2), r _a , C to the commitment acquisition device P _j ;
The source A, X, a (1) , and _{a (2), r a,} b, a storage unit for storing the first history information sid including C and the secret information s and the original r _c,
A commitment generator. The commitment generation device according to claim 5,
Further comprising a third output unit for outputting said first history information sid and the secret information s and the original r _c to the Commitment acquisition device P _j,
A commitment system characterized by that. Homomorphic public key cryptography public key pk and finite commutative group G _c elements g (0), g (1,1), g (1,2), ..., g (n, 1), g a first input unit that receives input of common reference data crs including (n, 2) ∈G _c ;
A second input unit for receiving an input of the element A, X∈G _c of the finite commutative group G _c ;
A first arbitrary element generator for generating an arbitrary element b∈Z / qZ of a remainder ring Z / qZ modulo a positive integer q;
An output unit for outputting the element b to the commitment generation device P _i ;
Arbitrary element a (1), a (2) ∈Z / qZ of the remainder ring Z / qZ, element r _a ∈G _r of finite commutative group G _r , element _C of the finite commutative group G _c A third input unit for receiving an input of ∈ G _c ;
A storage unit for storing the original A, X, a (1) , a (2), r a, b, second historical information sid containing C ',
A commitment acquisition device. The commitment acquisition device according to claim 7,
First history information sid, secret information s∈ {0,1, ..., L} (L, q is an integer satisfying 0 <L ≦ q), element r _c ∈G of finite commutative group G _r A fourth input unit that accepts an input of
The first history information sid and the second history information sid ′ match, and the secret information s and the element r _c are C = (g (0) ^{(a (1) + a (2))}・ B ・ X) ^s・ ε _pk (1 _m , r _c ) ∈G _c , B = ε _pk ((g _m ) ^b , 1 _r ) ∈G _c And
Commitment acquisition device A vector vg (0) = (g (0,1),.., Whose elements are elements of a homomorphic public key cryptosystem public key pk and k finite commutative groups G _c (k is a positive integer). .., g (0, k)), vg (1,1) = (g (1,1,1), ..., g (1,1, k)), vg (1,2) = ( g (1,2,1), ..., g (1,2, k)), ..., vg (n, 1) = (g (n, 1,1), ..., g ( n, 1, k)), vg (n, 2) = (g (n, 2,1), ..., g (n, 2, k)) 1 input unit,
Secret information vector vs = (vs) with elements vs (w) ∈Z / q _w Z of the remainder ring Z / q _w Z modulo a positive integer q _w (w = 1, ..., k) (1), ..., vs (k)) ∈Πw _{= 1} ^k Z / q _w Z
A first optional element generation unit for generating an arbitrary original X∈G _c of the finite-friendly換群G _c,
A vector va (1) = (a (1,1), ..., a (1) with each element of an arbitrary element a (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z , k)) ∈Π _{w = 1} ^k Z / q _w Z and a vector va (2) with each element of an arbitrary element a (2, w) ∈Z / q _w Z of the remainder ring Z / q _w Z ) = (a (2,1), ..., a (2, k)) ∈Πw _{= 1} ^k Z / q _w Z,
A third arbitrary element generator for generating an arbitrary element r _a ∈G _r of the finite commutative group G _r ;
G _m is a direct product G _m = G _{m, 1} × ... × G _{m, k} of a cyclic group G _{m, w} of order q _w , and the generator of the cyclic group G _{m, w} G _{m, w} , the unit element of the finite commutative group G _m is 1 _m, and the encryption function of the homomorphic public key cryptosystem is the public key pk, plaintext M∈G _m and element r∈G _r and ε _pk (M, r) homomorphic function for outputting ∈G _c ^{respect, vg (i, t) va} (t) = (g (i, t, 1) a (t, 1), .. , g (i, t, k) ^{a (t, k)} ) (t∈ {1,2}, i∈ {1, ..., n}, n ≧ 1) A first arithmetic unit for generating an element A = vg (i, 1) ^{va (1)} · vg (i, 2) ^{va (2)} · ε _pk (1 _m , ra) εG _c of _a permutation group G _c ; ,
A first output unit that outputs the elements A and X to the commitment acquisition device P _j ;
A vector vb = (b (1), ..., b (k)) ∈Π _w with each element of an arbitrary element b (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z _A third input unit that accepts an input of _{= 1} ^k Z / q _w Z;
A second unit for generating B = ε _pk ( _{Πw = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) εG _c when the unit element of the finite commutative group G _r is 1 _r An arithmetic unit;
A fourth arbitrary element generation unit for generating an arbitrary element r _c ∈G _r of the finite commutative group G _r ;
The secret information vector vs as the commit object, based on ^{C = (vg (0) (} va (1) + va (2)) · B · X) vs · ε pk (1 m of the finite-friendly換群G _c, a third arithmetic unit for generating r _c ) ∈G _c ;
The va (1), and va (2), r _a, the second output unit for outputting the C to the Commitment acquisition device P _j,
Wherein A, X, va (1) , and _{va (2), r a,} vb, storage unit for storing said original r _c as the first history information sid and the secret information vector vs containing C,
A commitment generator. The commitment generation device according to claim 9, comprising:
Further comprising a third output unit for outputting said first history information sid and the secret information vector vs with the original r _c to the Commitment acquisition device P _j,
A commitment generation device characterized by that. A vector vg (0) = (g (0,1),..., Whose elements are elements of the homomorphic public key cryptosystem public key pk and k finite commutative groups G _c (k is a positive integer). .., g (0, k)), vg (1,1) = (g (1,1,1), ..., g (1,1, k)), vg (1,2) = ( g (1,2,1), ..., g (1,2, k)), ..., vg (n, 1) = (g (n, 1,1), ..., g ( n, 1, k)), vg (n, 2) = (g (n, 2,1), ..., g (n, 2, k)) 1 input unit,
A second input unit for receiving an input of element A, X∈G _c of the finite commutative group G _c ;
Vector vb = with each element b (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z modulo a positive integer q _w (w = 1, ..., k) (b (1), ..., b (k)) ∈Π _{w = 1} ^k Z / q _w Z
A first output unit for outputting the vector vb to the commitment generator P _i ;
A vector va (1), va (2) ∈Π _{w = 1} ^k Z / q _w Z having elements a (1, w) ∈Z / q _w Z of the remainder ring Z / q _w Z as elements, a third input unit for receiving the original r _a ∈G _r of the finite-friendly換群G _r, the inputs of the original C of the finite-friendly換群G _c,
Said A, X, va (1) , va (2), r a, vb, storage unit for storing the second history information sid 'containing C,
A commitment acquisition device. The commitment acquisition device according to claim 11,
First history information sid and elements of remainder ring Z / q _w Z modulo positive integer q _w (w = 1, ..., k) vs (w) ∈Z / q _w Z secret information vector vs = (vs (1), ..., vs (k)) and ^{_{∈Π w = 1 k Z / q}} w Z, and any of the original _{r c} ∈G r of the finite Allowed換群G _r of A fourth input unit for receiving input;
The first history information sid and the second history information sid ′ match, and the secret information vector vs and the element r _c are C = (vg (0) ^{(va (1) + va (2) )}・ B ・ X) ^vs・ ε _pk (1 _m , r _c ) ∈G _c , B = ε _pk (Π _{w = 1} ^k (g _{m, w} ) ^{b (w)} , 1 _r ) ∈G _c A determination unit that approves the secret information vector vs;
A commitment acquisition device.   A commitment generation method for executing processing as the commitment generation device according to any one of claims 5, 6, 9, and 10.   A commitment acquisition method for executing processing as the commitment acquisition device according to claim 7, 8, 11, or 12.   The program for functioning a computer as a commitment production | generation apparatus in any one of Claim 5, 6, 9 or 10.   The program for functioning a computer as a commitment acquisition apparatus in any one of Claim 7, 8, 11 or 12.

Images