JP2013157711A - Key exchange device, key exchange system, key exchange method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key exchange device realizing a key exchange method having a calculation amount smaller than that of a conventional one by responding to asymmetric pairing.SOLUTION: A key exchange device includes: an identifier transmitting unit 21 for transmitting an identifier to a key generation station 1; a secret key receiving unit 22 for receiving first and second secret keys generated using the transmitted identifier from the key generation station 1; a short term secret key generating unit 24 for randomly selecting a short term secret key; a short term public key generating unit 25 for calculating first and second short term public keys by using the generated short term secret key; a key exchange unit 26 for transmitting the identifier, an identifier of a key exchange device on a mating side of key exchange, the first and second short term public keys to the key exchange device on the mating side, and receiving the identifier, the identifier of the key exchange device on the mating side of key exchange, first and second short term public keys generated by the key exchange device on the mating side from the key exchange device on the mating side; and a common key generating unit 27 for calculating a common key.

Description

  The present invention relates to an application technology of information security technology, and relates to a key exchange device, a key exchange system, a key exchange method, and a program that share a common session key between two parties.

  Non-patent document 1 is known as a conventional key exchange method. The key exchange system of Non-Patent Document 1 realizes high security against all non-obvious leak patterns of long-term and short-term secret keys.

Atsushi Fujioka, Koutarou Suzuki, Berkant Ustaoglu: EphemeralKey Leakage Resilient and Efficient ID-AKEs That Can Share Identities, Private and Master Keys.Pairing 2010: 187-205

  In the key exchange method of Non-Patent Document 1, since the system is configured so that the shared key matches using a generator from the same group (assuming symmetric pairing), it corresponds to asymmetric pairing. It was not possible to configure the system so that the shared keys match using the generators from the two groups. On the other hand, it is known that asymmetric pairing has a smaller calculation amount and higher efficiency than symmetric pairing, and a key exchange method corresponding to asymmetric pairing has not been realized. Therefore, an object of the present invention is to provide a key exchange device that realizes a key exchange method with a smaller calculation amount than a conventional key exchange method by supporting asymmetric pairing.

Key exchange apparatus of the present invention, kbit (k is an arbitrary natural number) _g 1, _{g 2} is _{G 1, G 2,} and _{G T, G 1, G 2} of the origin is the number of number of cyclic group containing the If, as a generator of _{G T g T = e (g} 1, g 2), asymmetric pairing e: and _{G 1 × G 2 → G T} , the hash function ^{H: {0,1} * → {} 0 , 1} ^k , H ₁ : {0, 1} ^* → G ₁ , H ₂ : {0, 1} ^* → G ₂ , arbitrarily selected master secret key

First master public key generated from

And the second master public key

Are used as public parameters. In addition, m polynomial groups with i = 1,..., M

Because

The coefficient of the polynomial group satisfying is used.

The key exchange apparatus of the present invention includes an identifier transmission unit, a secret key reception unit, a short-term secret key generation unit, a short-term public key generation unit, a key exchange unit, and a shared key generation unit. The identifier transmission unit transmits an identifier ID _A that is an identifier of the key exchange device (an identifier of a key exchange device that is a partner that performs key exchange with the key exchange device is ID _B ) to the key generation station. The private key receiver

_{A first} secret key D _{A, 1} generated as

The second private key D _{A, 2} generated received from the key generation station as. The short-term secret key generator

Select at random. The short-term public key generation unit uses the generated short-term secret key y _A to generate the first short-term public key.

And the second short-term public key

Calculate The key exchange unit transmits the identifier ID _A , the identifier ID _B , the first short-term public key YA _{, 1} , and the second short-term public key YA _{, 2} to the counterpart key exchange device, and from the counterpart key exchange device The identifier ID _A , the identifier ID _B , the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} generated by the counterpart key exchange apparatus are received. Shared key generator

Calculate the shared key

Calculate

  According to the key exchange apparatus of the present invention, it is possible to realize a key exchange method with a smaller calculation amount than the conventional key exchange method by supporting asymmetric pairing.

1 is a block diagram illustrating a configuration of a key exchange system according to a first embodiment. 5 is a flowchart illustrating the operation of the key exchange system according to the first embodiment. FIG. 3 is a block diagram illustrating a configuration of a key exchange system according to a second embodiment. 9 is a flowchart illustrating the operation of the key exchange system according to the second embodiment. FIG. 9 is a block diagram illustrating a configuration of a key exchange system according to a third embodiment. 10 is a flowchart illustrating the operation of the key exchange system according to the third embodiment.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

<Points of the present invention>
The present invention solves the problem that asymmetric pairing is not supported as follows. _{G 1,} G 2, G _T the kbit (k is an arbitrary natural number) number of number of cyclic groups q elements _{of, g 1,} g ₂ and _G 1, _{G 2} of the _{origin, g T = e (g 1} , g ₂₎ the _{G T} origin, e: the _{G 1} × _{G 2} → _{G T} and asymmetric pairing. Long secret key and short public key of the user U _A is the first user made in any of the original one of G _1, G _2, the long-term private key and short public key of the user U _B is the other user G ₁ , G ₂ , a group different from the group used for generating the user U _A 's long-term secret key and short-term public key, and using these asymmetric pairing values as shared values, A scheme based on is constructed.

  With reference to FIG. 1 and FIG. 2, the key exchange system 10 of Example 1 which is a basic structural example of this invention is demonstrated in detail. FIG. 1 is a block diagram showing the configuration of the key exchange system 10 of this embodiment. FIG. 2 is a flowchart showing the operation of the key exchange system 10 of this embodiment. As shown in FIG. 1, a key exchange system 10 according to the present embodiment includes a key generation station 1 and two or more key exchange devices 2. One key exchange device 2 is assumed to exist for each user belonging to the group. FIG. 1 shows two key exchange devices 2 (2A, 2B) for convenience. Therefore, in the example of FIG. 1, it is assumed that at least two users can operate one of the key exchange devices (2A, 2B) one by one. In the example of FIG. 1, for convenience, two key exchange devices 2 are used. However, the number of key exchange devices 2 is not limited to this, and may be any number as long as two or more. The key generation station 1 includes a master secret key generation unit 11, a master secret key storage unit 12, a parameter disclosure unit 13, a master public key disclosure unit 14, an identifier reception unit 15, a secret key generation unit 16, and a secret A key transmission unit 17. The key exchange device 2 includes an identifier transmission unit 21, a secret key reception unit 22, an identifier storage unit 23, a short-term secret key generation unit 24, a short-term public key generation unit 25, a key exchange unit 26, and a shared key generation. Part 27.

  The key exchange system 10 of the present embodiment will be described according to the operation of each device and each component. First, m polynomials such as

think of. Here, c _{i, j, k} (i = 1,..., M, j, k = 0, 1) may be constants, short-term public keys, public keys, user IDs, public parameters, etc. It may be a number determined depending on.

M polynomials above

so,

The following authentication key exchange method using

Configure.

_{G 1,} G 2, G _T the kbit (k is an arbitrary natural number) number of number of cyclic groups q elements _{of, g 1,} g ₂ and _G 1, _{G 2} of the _{origin, g T = e (g 1} , g ₂₎ the _{G T} origin, e: the _{G 1} × _{G 2} → _{G T} and asymmetric pairing. H: {0, 1} ^* → {0, 1} ^k and H ₁ : {0, 1} ^* → G ₁ and H ₂ : {0, 1} ^* → G ₂ is a hash function. The parameter disclosure unit 13 of the key generation station 1 discloses G ₁ , G ₂ , G _T , g ₁ , g ₂ , g _T , e, H, H ₁ , H ₂ as the public parameter 5 (S 13). At this time, the public parameter 5 is made public by storing it in a storage area or the like of a server permitted to access from the key exchange device 2. The master secret key generation unit 11 of the key generation station 1

Are randomly selected (S11). The master secret key storage unit 12 stores the master secret key generated by the master secret key generation unit 11 (S12). The master secret key storage unit 12 may be omitted as appropriate, or may be realized as a temporary memory or a buffer. The master public key public unit 14 uses the master secret key z stored in the master secret key storage unit 12 to generate the first master public key.

And the second master public key

Is disclosed as public parameter 5 (S14). Here, G ₁ , G ₂ , G _T , g ₁ , g ₂ , g _T , e, H, H ₁ , and H ₂ published by the parameter disclosure unit 13 are not restricted in browsing, but are disclosed as master public keys. The first master public key and the second master public key disclosed by the unit 14 are limited in browsing. Specifically, the first master public key and the second master public key can be viewed between users belonging to the same group (for example, a company organization), but viewed from users who do not belong to the group. It is impossible.

Here, i is a natural number of 2 or more representing the number of users belonging to the group, the i-th user belonging to the group is represented as user U _i, and the terminal operated by user U _i is referred to as key exchange device 2 i. The identifier transmitter 21 of the key exchange device 2i of the user U _i transmits the identifier ID _i to the key generation station 1 (S21). The example of FIG. 1 is an example in which two key exchange devices 2 are provided for convenience. Therefore, the identifier transmission unit 21 of the key exchange device 2A and the identifier transmission unit 21 of the key exchange device 2B transmit the identifier ID _A to the key generation station 1. , ID _B is transmitted. The identifier receiving unit 15 of the key generation station 1 receives an identifier from any user (key exchange device) U _i.

Is received (S15). In the example of FIG. 1, the identifier receiving unit 15 of the key generation station 1, the identifier ID _A from the key exchange apparatus 2A, respectively receive the identifier ID _B from the key exchange apparatus 2B. The secret key generation unit 16 of the key generation station 1 uses the hash functions H ₁ and H ₂ for the identifier received by the identifier reception unit 15.

When,

And the first secret key using the master secret key z

And the second secret key

Is generated (S16). In the example of FIG. 1, the secret key generation unit 16 of the key generation station 1 uses the first secret key for the identifiers ID _A and ID _B.

And the second secret key

Is generated. Next, the secret key transmitter 17 of the key generation station 1 transmits the first secret key D _{i, 1} and the second secret key D _{i, 2} to the key exchange device 2i (S17). In the example of FIG. 1, the secret key transmission unit 17 of the key generation station 1 uses the first secret key D _{A, 1} and the second secret key D _{A, 2} to the key exchange device 2A as the first secret key. The key DB _{, 1} and the second secret key DB _{, 2} are transmitted to the key exchange device 2B, respectively. Next, the secret key receiving unit 22 of the key exchange device 2 _i of the user U _i receives the first secret key D _{i, 1} and the second secret key D _{i, 2} transmitted from the key generation station 1. (S22). In the example of FIG. 1, the secret key receiving unit 22 of the key exchange device 2A receives the first secret key DA _{, 1} and the second secret key DA _{, 2} transmitted from the key generation station 1, The secret key receiving unit 22 of the key exchange device 2B receives the first secret key DB _{, 1} and the second secret key DB _{, 2} transmitted from the key generation station 1.

Hereinafter, an authentication key exchange operation between the key exchange apparatuses 2A and 2B and a shared key K generation operation will be described with reference to the example of FIG. The identifier storage unit 23 of the key exchange device 2A stores the identifiers of all users belonging to the same group. Since in the least user _{U A,} the user _{U B} the example of FIG. 1 belonging to the same group, the identifier storage unit 23 at least a user _{U A} identifier ID _A, the identifier ID _B of the user _{U B} is stored . The identifier storage unit 23 is not an essential component. For example, if key exchange devices that wish to exchange keys exchange identifiers with each other in advance, the key exchange device 2 does not necessarily have to store all identifiers of all users belonging to the group. Because. First, the short-term secret key generation unit 24 of the key exchange device 2A

Are randomly selected (S24). Next, the short-term public key generation unit 25 of the key exchange device 2A uses the short-term secret key y _A to generate the first short-term public key.

And the second short-term public key

Is calculated (S25). Next, the key exchange unit 26 of the key exchange device 2A acquires ID _A and ID _B from the identifier storage unit 23, and receives the first short-term public key Y _{A, 1} and the second short-term public key generation unit 25 from the second short-term public key generation unit 25. to obtain the short-term public key _{Y a, 2, (ID a} , ID B, Y a, 1, Y a, 2) and transmits the key exchange apparatus 2B (S26a).

The key exchange unit 26 of the key exchange device 2B receives (ID _A , ID _B , Y _{A, 1} , Y _{A, 2} ) from the key exchange device 2A (S26b). As in the key exchange device 2A, the short-term secret key generation unit 24

Are randomly selected (S24). Next, the short-term public key generation unit 25 of the key exchange apparatus 2B, by using the short-term private key y _B, the first short-term public key

And the second short-term public key

Is calculated (S25). Next, the key exchange unit 26 of the key exchange device 2B acquires ID _A and ID _B from the identifier storage unit 23, and receives the first short-term public key Y _{B, 1} and the second short-term public key generation unit 25 from the second short-term public key generation unit 25. The short-term public key Y _{B, 2} is acquired, and (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} ) is transmitted to the key exchange device 2A (S26a). The shared key generation unit 27 of the key exchange device 2B

Calculate the shared key

Is calculated (S27).

The key exchange unit 26 of the key exchange device 2A receives (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} ) (S26b). The shared key generation unit 27 of the key exchange device 2A

Calculate the shared key

Is calculated (S27).

  The shared value calculated by the shared key generation unit 27 of the key exchange device 2A is

It becomes. On the other hand, the shared value calculated by the shared key generation unit 27 of the key exchange device 2B is

Since both shared values match, the shared key K matches.

As described above, in the key exchange system 10 of this embodiment, the master public key public unit 14 of the key generation station 1, the secret key generation unit 16, and the short-term public key generation unit 25 of the key exchange device 2 each have two types (first , 2) a master public key, a secret key, and a short-term public key are generated using two types of cyclic groups G ₁ and G ₂ as generators, and a secret key and a short-term public key generator of one user are generated, The other user's private key and the short-term public key generation source are set as different groups, and the shared key K generated in the shared key generation unit 27 of each key exchange device 2 is matched with each other by using these groups. The key exchange based on asymmetric pairing was realized.

  Hereinafter, with reference to FIGS. 3 and 4, the key exchange system 20 according to the second embodiment, which is an example of an expanded configuration of the key exchange system 10 according to the first embodiment, will be described in detail. FIG. 3 is a block diagram showing the configuration of the key exchange system 20 of this embodiment. FIG. 4 is a flowchart showing the operation of the key exchange system 20 of this embodiment. As shown in FIG. 3, the key exchange system 20 of this embodiment includes a key generation station 1 and two or more key exchange devices 3. As in the first embodiment, it is assumed that there is one key exchange device 3 for each user belonging to the group. Although FIG. 3 illustrates the key exchange device 3 as two (3A, 3B) for convenience, the number of the key exchange device 3 is not limited to this, and may be any number as long as two or more.

  Since the key generation station 1 of the key exchange system 20 of this embodiment is exactly the same as the key generation station 1 of the first embodiment, the description thereof is omitted. The key exchange device 3 of the key exchange system 20 of the present embodiment includes an identifier transmission unit 21, a secret key reception unit 22, an identifier storage unit 23, a short-term secret key generation unit 24, a short-term public key generation unit 25, A key exchange unit 36, a shared key generation unit 37, a non-interaction zero knowledge proof unit 38, and a non-interaction zero knowledge verification unit 39 are provided. Regarding the identifier transmission unit 21, the secret key reception unit 22, the identifier storage unit 23, the short-term secret key generation unit 24, and the short-term public key generation unit 25 that are components common to the key exchange device 2 of the first embodiment. In order to perform the same operation as each component having the same number in the first embodiment, the description is omitted.

Hereinafter, operations of the key exchange unit 36, the shared key generation unit 37, the non-interaction zero knowledge proof unit 38, and the non-interaction zero knowledge verification unit 39 will be described. The non-interactive zero knowledge proof unit 38 of the key exchange device 3A indicates that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{A, 1} and the second short-term public key Y _{A, 2} is equal. A non-interactive zero knowledge proof π _A is generated (S38). The key exchange unit 36 of the key exchange device 3A acquires ID _A and ID _B from the identifier storage unit 23, and the first short-term public key Y _{A, 1} and the second short-term public key from the short-term public key generation unit 25. Y _{A, 2} is acquired, non-dialogue zero knowledge proof π _A is acquired from the non-dialogue zero knowledge proof unit 38, and (ID _A , ID _B , Y _{A, 1} , Y _{A, 2} , π _A ) is the key The data is transmitted to the exchange device 3B (S36a). The non-interactive zero knowledge proof part 38 of the key exchange device 3B indicates that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal. A non-interactive zero knowledge proof π _B is generated (S38). The key exchange unit 36 of the key exchange device 3B acquires ID _A and ID _B from the identifier storage unit 23, and the first short-term public key Y _{B, 1} and the second short-term public key from the short-term public key generation unit 25. Y _{B, 2} is acquired, the non-dialog zero knowledge proof π _B is acquired from the non-dialog zero knowledge proof unit 38, and (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} , π _B ) is the key The data is transmitted to the exchange device 2A (S36a). The key exchange unit 36 of the key exchange device 3A receives (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} , π _B ) from the key exchange device 3B (S36b). The key exchange unit 36 of the key exchange device 3B receives (ID _A , ID _B , Y _{A, 1} , Y _{A, 2} , π _A ) from the key exchange device 3A (S36b). Next, the non-dialog zero knowledge verification unit 39 of the key exchange device 3A verifies whether the non-dialog zero knowledge proof π _B received from the key exchange device 3B is correct (S39). Similarly, the non-interactive zero knowledge verification unit 39 of the key exchange device 3B verifies whether the non-interactive zero knowledge proof π _A received from the key exchange device 3A is correct (S39). The shared key generation unit 37 of the key exchange device 3A generates the shared key K only when it is verified that the non-interaction zero knowledge proof π _B is correct (S30Y) (S37). Similarly, the shared key generation unit 37 of the key exchange device 3B generates the shared key K only when it is verified that the non-interaction zero knowledge proof π _A is correct (S30Y) (S37).

  As described above, the key exchange system 20 according to the present embodiment has the effect of the key exchange system 10 according to the first embodiment by providing the key exchange device 3 with the non-dialog zero knowledge proof unit 38 and the non-dialog zero knowledge verification unit 39. In addition, it can be verified through the verification of the non-interactive zero knowledge proof that the discrete logarithms of the first and second short-term public keys are equal.

  Hereinafter, with reference to FIGS. 5 and 6, the key exchange system 30 of the third embodiment, which is an example of an expanded configuration of the key exchange system 10 of the first embodiment, will be described in detail. FIG. 5 is a block diagram showing the configuration of the key exchange system 30 of this embodiment. FIG. 6 is a flowchart showing the operation of the key exchange system 30 of this embodiment. As shown in FIG. 5, the key exchange system 30 according to the present embodiment includes a key generation station 1 and two or more key exchange devices 4. As in the first embodiment, it is assumed that there is one key exchange device 4 for each user belonging to the group. For convenience, FIG. 5 illustrates two key exchange devices 4 (4A, 4B). However, the number of key exchange devices 4 is not limited to this, and may be any number as long as two or more.

  Since the key generation station 1 of the key exchange system 30 of the present embodiment is exactly the same as the key generation station 1 in the first embodiment, a description thereof will be omitted. The key exchange device 4 of the key exchange system 30 of the present embodiment includes an identifier transmission unit 21, a secret key reception unit 22, an identifier storage unit 23, a short-term secret key generation unit 24, a short-term public key generation unit 25, A key exchange unit 46, a shared key generation unit 47, and a pairing short-term public key verification unit 49 are provided. Regarding the identifier transmission unit 21, the secret key reception unit 22, the identifier storage unit 23, the short-term secret key generation unit 24, and the short-term public key generation unit 25 that are components common to the key exchange device 2 of the first embodiment. In order to perform the same operation as each component having the same number in the first embodiment, the description is omitted.

Hereinafter, operations of the key exchange unit 46, the shared key generation unit 47, and the pairing short-term public key verification unit 49 will be described. First, the key exchange unit 46 of the key exchange device 4A acquires ID _A and ID _B from the identifier storage unit 23, and the first short-term public key Y _{A, 1} and the second short-term public key Y from the short-term public key generation unit 25. It acquires the public key _{Y a, 2, (ID a} , ID B, Y a, 1, Y a, 2) and transmits the key exchange apparatus 4B (S46a). The key exchange unit 46 of the key exchange device 4B acquires ID _A and ID _B from the identifier storage unit 23, and the first short-term public key Y _{B, 1} and the second short-term public key from the short-term public key generation unit 25. Y _{B, 2} is acquired and (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} ) is transmitted to the key exchange device 2A (S46a). The key exchange unit 46 of the key exchange device 4A receives (ID _A , ID _B , Y _{B, 1} , Y _{B, 2} ) from the key exchange device 4B (S46b). The key exchange unit 46 of the key exchange device 4B receives (ID _A , ID _B , Y _{A, 1} , Y _{A, 2} ) from the key exchange device 4A (S46b).

The pairing short-term public key verification unit 49 of the key exchange device 4B verifies that the discrete logarithms for the bases g ₁ and g ₂ of the short-term public keys Y _{A, 1} and Y _{A, 2} are equal as follows. The pairing short-term public key verification unit 49 of the key exchange device 4B

When,

Using pairing, the discrete logarithm for the bases g ₁ and g ₂ of

(S49).

Only when it is verified that the discrete logarithms for the bases g ₁ and g ₂ of the short-term public keys Y _{A, 1} and Y _{A, 2} are equal (S40Y), the shared key generation unit 47 of the key exchange device 4B Is generated (S47).

The pairing short-term public key verification unit 49 of the key exchange device 4A verifies that the discrete logarithms for the bases g ₁ and g ₂ of the short-term public keys Y _{B, 1} and Y _{B, 2} are equal as follows. The pairing short-term public key verification unit 49 of the key exchange device 4A

When,

Using pairing, the discrete logarithm for the bases g ₁ and g ₂ of

(S49).

Only when it is verified that the discrete logarithm with respect to the bases g ₁ and g ₂ of the short-term public keys Y _{B, 1} and Y _{B, 2} is equal (S40Y), the shared key generation unit 47 of the key exchange device 4A has the shared key K Is generated (S47).

  As described above, the key exchange system 30 according to the present embodiment includes the first and second key exchange devices 4 in addition to the effects of the key exchange system 10 according to the first embodiment by including the pairing short-term public key verification unit 49. It can be verified using pairing that the discrete logarithms of the two short-term public keys are equal.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

<Appendix>
Hereinafter, a practical example of the polynomial p _i (i = 1,..., M) when m = 3 and 4 will be simply described.

<When m = 3>

<When m = 4>

Claims (15)

kbit (k is an arbitrary natural number) and _{G 1,} G 2, _{G T} is the number of number of cyclic groups containing _of the _g 1, _{g 2} is G 1, _{G 2} of the origin, in generator of _{G T} there _{g T = e (g 1,} g 2), asymmetric pairing _{e: G 1 × G 2 →} G T and, a hash function ^{H: {0,1} * → {} 0,1} k, H 1: {0,1} ^* → G ₁ , H ₂ : {0,1} ^* → G ₂ and arbitrarily selected master secret key

First master public key generated from

And the second master public key

As public parameters,
m polynomial groups with i = 1,..., m

Because

A key exchange device using coefficients of a polynomial group satisfying
An identifier transmitting unit that transmits an identifier ID _A that is an identifier of the key exchange device (identifier of the key exchange device that is a partner that performs key exchange with the key exchange device as ID _B ) to the key generation station;

_{A first} secret key D _{A, 1} generated as

_A secret key receiving unit that receives the second secret key D _{A, 2} generated as follows from the key generation station;
Short-term secret key

A short-term secret key generator that randomly selects
Using the generated short-term secret key y _A , a first short-term public key

And the second short-term public key

A short-term public key generation unit for calculating
The identifier ID _A , the identifier ID _B , the first short-term public key Y _{A, 1} , and the second short-term public key Y _{A, 2} are transmitted to the partner-side key exchange device, and the partner-side key exchange device _A key exchange unit that receives the identifier ID _A , the identifier ID _B , the first short-term public key Y _{B, 1} generated by the counterpart key exchange device, and the second short-term public key Y _{B, 2} ;
Shared value

Calculate the shared key

A shared key generation unit for calculating
A key exchange device comprising: The key exchange device according to claim 1,
Non-interaction generating non-interactive zero knowledge proof π _A indicating that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{A, 1} and the second short-term public key Y _{A, 2} is equal Zero knowledge proof part,
Non-dialogue for verifying a non-dialogue zero knowledge proof π _B indicating that the discrete logarithm for the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal A zero knowledge verification unit,
The key exchange unit transmits the non-interactive zero knowledge proof π _A to the counterparty key exchange device, receives the non-interactive zero knowledge proof π _B from the counterpart key exchange device,
The shared key generation unit calculates the shared key when the verification result of the non-interaction zero knowledge verification unit is correct. The key exchange device according to claim 1,
Pairing short-term public key verification that verifies that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal using pairing Further comprising
The shared key generation unit calculates the shared key when the verification result of the pairing short-term public key verification unit is correct. The key exchange device according to any one of claims 1 to 3,
Where m is 3,
The polynomial group

A key exchange device characterized by that. The key exchange device according to any one of claims 1 to 3,
Assuming that m is 4,
The polynomial group

A key exchange device characterized by that. m polynomial groups with i = 1,..., m

Because

A key exchange system using coefficients of a polynomial group satisfying
The key exchange system comprises a key generation station and two or more key exchange devices,
The key generation station is
kbit (k is an arbitrary natural number) and _{G 1,} G 2, _{G T} is the number of number of cyclic groups containing _of the _g 1, _{g 2} is G 1, _{G 2} of the origin, in generator of _{G T} there _{g T = e (g 1,} g 2), asymmetric pairing _{e: G 1 × G 2 →} G T and, a hash function ^{H: {0,1} * → {} 0,1} k, H 1: {0, 1} ^* → G ₁ , H ₂ : {0, 1} ^* → G ₂
Optionally master secret key

A master secret key generation unit for selecting
First master public key

And the second master public key

And a master public key public part that publishes
An identifier receiving unit that receives an identifier ID _A or an identifier ID _B from the key exchange device;
First and second secret keys for the received identifier ID _A or identifier ID _B

Or the first and second secret keys

A secret key generation unit for generating
A secret key transmission unit that transmits the generated first and second secret keys to a corresponding key exchange device;
The key exchange device is:
An identifier transmitter that transmits an identifier ID _A that is an identifier of the key exchange device (identifier of a key exchange device that is a partner to perform key exchange with the key exchange device is ID _B ) to the key generation station;
A secret key receiving unit for receiving the first and second secret keys from the key generation station;
Short-term secret key

A short-term secret key generator that randomly selects
Using the generated short-term secret key y _A , a first short-term public key

And the second short-term public key

A short-term public key generation unit for calculating
The identifier ID _A , the identifier ID _B , the first short-term public key YA _{, 1} , and the second short-term public key YA _{, 2} are transmitted to the partner-side key exchange device, and from the partner-side key exchange device _A key exchange unit that receives the identifier ID _A , the identifier ID _B , the first short-term public key Y _{B, 1} , and the second short-term public key Y _{B, 2} generated by the counterpart key exchange device;
Shared value

Calculate the shared key

A shared key generation unit for calculating
A key exchange system comprising: The key exchange system according to claim 6, wherein
The key exchange device is
Non-interaction generating non-interactive zero knowledge proof π _A indicating that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{A, 1} and the second short-term public key Y _{A, 2} is equal Zero knowledge proof part,
Non-dialogue verifying non-dialog zero knowledge proof π _B indicating that the discrete logarithm for the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal A zero knowledge verification unit,
The key exchange unit transmits the non-interactive zero knowledge proof π _A to the counterparty key exchange device, receives the non-interactive zero knowledge proof π _B from the counterpart key exchange device,
The key exchange system, wherein the shared key generation unit calculates the shared key when the verification result of the non-interaction zero knowledge verification unit is correct. The key exchange system according to claim 6, wherein
The key exchange device is
Pairing short-term public key verification that verifies that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal using pairing Further comprising
The key exchange system, wherein the shared key generation unit calculates the shared key when a verification result of the pairing short-term public key verification unit is correct. kbit (k is an arbitrary natural number) and _{G 1,} G 2, _{G T} is the number of number of cyclic groups containing _of the _g 1, _{g 2} is G 1, _{G 2} of the origin, in generator of _{G T} there _{g T = e (g 1,} g 2), asymmetric pairing _{e: G 1 × G 2 →} G T and, a hash function ^{H: {0,1} * → {} 0,1} k, H 1: {0,1} ^* → G ₁ , H ₂ : {0,1} ^* → G ₂ and arbitrarily selected master secret key

First master public key generated from

And the second master public key

As public parameters,
m polynomial groups with i = 1,..., m

Because

A key exchange method executed by a key exchange device using coefficients of a polynomial group satisfying
An identifier transmission step of transmitting an identifier ID _A which is an identifier of the key exchange device (identifier of the key exchange device which is a partner side which performs key exchange with the key exchange device is ID _B ) to the key generation station;

_{A first} secret key D _{A, 1} generated as

Receiving a _second secret key D _{A, 2} generated as a secret key from the key generation station;
Short-term secret key

A short-term secret key generation step of randomly selecting
Using the generated short-term secret key y _A , a first short-term public key

And the second short-term public key

A short-term public key generation step for calculating
The identifier ID _A , the identifier ID _B , the first short-term public key Y _{A, 1} , and the second short-term public key Y _{A, 2} are transmitted to the partner-side key exchange device, and the partner-side key exchange device _A key exchange step of receiving the identifier ID _A , the identifier ID _B , the first short-term public key Y _{B, 1} generated by the counterpart key exchange device, and the second short-term public key Y _{B, 2} ;
Shared value

Calculate the shared key

A shared key generation step for calculating
A key exchange method characterized by comprising: The key exchange method according to claim 9, comprising:
Non-interaction generating non-interactive zero knowledge proof π _A indicating that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{A, 1} and the second short-term public key Y _{A, 2} is equal Zero knowledge proof step,
Non-dialogue for verifying a non-dialogue zero knowledge proof π _B indicating that the discrete logarithm for the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal A zero knowledge verification step,
In the key exchange step, the non-dialog zero knowledge proof π _A is transmitted to the counterpart key exchange device, and the non-dialog zero knowledge proof π _B is received from the counterpart key exchange device;
In the shared key generation step, the shared key is calculated when the verification result of the non-interaction zero knowledge verification step is correct. The key exchange method according to claim 9, comprising:
Pairing short-term public key verification that verifies that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal using pairing And further comprising steps
In the shared key generation step, the shared key is calculated when the verification result of the pairing short-term public key verification step is correct. m polynomial groups with i = 1,..., m

Because

A key exchange method executed by a key generation station and a key exchange device using coefficients of a polynomial group satisfying
The key generation station is
kbit (k is an arbitrary natural number) and _{G 1,} G 2, _{G T} is the number of number of cyclic groups containing _of the _g 1, _{g 2} is G 1, _{G 2} of the origin, in generator of _{G T} there _{g T = e (g 1,} g 2), asymmetric pairing _{e: G 1 × G 2 →} G T and, a hash function ^{H: {0,1} * → {} 0,1} k, H 1: {0, 1} ^* → G ₁ , H ₂ : {0, 1} ^* → G ₂
Optionally master secret key

A master secret key generation step of selecting
First master public key

And the second master public key

A master public key public step for publishing
An identifier receiving step of receiving an identifier ID _A or an identifier ID _B from the key exchange device;
First and second secret keys for the received identifier ID _A or identifier ID _B

Or the first and second secret keys

A secret key generation step for generating
Performing the secret key transmission step of transmitting the generated first and second secret keys to the corresponding key exchange device;
The key exchange device is:
An identifier transmission step of transmitting to the key generation station an identifier ID _A that is an identifier of the key exchange device (identifier of the key exchange device that is a counterpart to perform key exchange with the key exchange device is ID _B );
A secret key receiving step of receiving the first and second secret keys from the key generation station;
Short-term secret key

A short-term secret key generation step of randomly selecting
Using the generated short-term secret key y _A , a first short-term public key

And the second short-term public key

A short-term public key generation step for calculating
The identifier ID _A , the identifier ID _B , the first short-term public key YA _{, 1} , and the second short-term public key YA _{, 2} are transmitted to the partner-side key exchange device, and from the partner-side key exchange device _A key exchange step of receiving the identifier ID _A , the identifier ID _B , the first short-term public key Y _{B, 1} , and the second short-term public key Y _{B, 2} generated by the counterpart key exchange device;
Shared value

Calculate the shared key

A shared key generation step for calculating
The key exchange method characterized by performing. The key exchange method according to claim 12, comprising:
The key exchange device is
Non-interaction generating non-interactive zero knowledge proof π _A indicating that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{A, 1} and the second short-term public key Y _{A, 2} is equal Zero knowledge proof step,
Non-dialogue for verifying a non-dialogue zero knowledge proof π _B indicating that the discrete logarithm for the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal A further zero knowledge verification step,
In the key exchange step, the non-dialog zero knowledge proof π _A is transmitted to the counterpart key exchange device, and the non-dialog zero knowledge proof π _B is received from the counterpart key exchange device;
In the shared key generation step, the shared key is calculated when the verification result of the non-interaction zero knowledge verification unit is correct. The key exchange method according to claim 12, comprising:
The key exchange device is
Pairing short-term public key verification that verifies that the discrete logarithm with respect to the bases g ₁ and g ₂ of the first short-term public key Y _{B, 1} and the second short-term public key Y _{B, 2} is equal using pairing Perform further steps,
In the shared key generation step, the shared key is calculated when the verification result of the pairing short-term public key verification step is correct.   The program for functioning a computer as a key exchange apparatus in any one of Claim 1 to 5.

Images