JP2017003961A - Secret computing device and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a secret computing device using a secret circuit that is reduced in a size of the circuit.SOLUTION: A secret computing device obtains an inverse image by a trap door unidirectional substitution of an image based on a value corresponding to an input label based on each original of a domain of each gate and an output key of the gate based on each of an output value when the original is input into the gate, and obtains an input key according to each original using the inverse image. Furthermore, a secret output label making a secret of an output label based on the output value when the original is input into the gate is obtained by using the input key.EFFECT: It is not necessary to store an encrypted message of the output key in a circuit in comparison with a conventional secret computing device, and therefore a size of a secret circuit can be reduced.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an application technology of information security technology, and more particularly to a calculation technology using a secret circuit.

  Non-Patent Document 1 discloses a conventional technique of a two-party calculation method using a secret circuit. In the secret circuit of Non-Patent Document 1, an input key and an input label corresponding to the input truth value of each gate constituting the circuit before concealment are set, and an output corresponding to the combination of the input truth value of each gate. An output key and an output label corresponding to the truth value of are set. The output key and the output label are encrypted by common key encryption so that they can be decrypted by a combination of input keys. The output of the gate becomes the input of the next gate.

  In the calculation using the concealment circuit, the ciphertext of the gate is decrypted using the input key and the input label corresponding to the combination of the truth values of the inputs of each gate, and the output key and the output label are obtained. The output key and the output label are used as the input key and the input label at the next gate, and the ciphertext of the next gate is similarly decrypted to obtain the next output key and the output label. By repeating this, the output label of the gate at the final stage is obtained. This output label corresponds to the operation result.

Benny Pinkas, Thomas Schneider, Nigel P. Smart, Stephen C. Williams, “Secure Two-Party Computation Is Practical,” ASIACRYPT 2009, 250-267.

  In the conventional method, the output key of each gate and the ciphertext of the output label must be stored, and there is a problem that the size of the concealment circuit is large. An object of the present invention is to reduce the size of a secret circuit.

  An image trap corresponding to a value corresponding to an input label corresponding to each original element in the domain of each gate and an output key of the gate corresponding to each output value when the element is input to the gate. An inverse image is obtained by door unidirectional replacement, and an input key corresponding to each of the original is obtained using the inverse image. Further, using the input key, a concealed output label is obtained by concealing the output label corresponding to the output value when the source is input to the gate.

  Thereby, it is not necessary to store the ciphertext corresponding to the output key of each gate, and the size of the secret circuit can be reduced.

FIG. 1 is a block diagram illustrating a configuration of a secret calculation system according to an embodiment. FIG. 2 is a block diagram illustrating the configuration of the secret calculation apparatus according to the embodiment. FIG. 3 is a block diagram illustrating the configuration of the secret calculation apparatus according to the embodiment. FIG. 4 is a flowchart illustrating the circuit concealment method according to the first embodiment. FIG. 5 is a flowchart illustrating the circuit concealment method according to the first embodiment. FIG. 6 is a flowchart illustrating an input value encoding method according to the first embodiment. FIG. 7 is a flowchart illustrating the calculation method of the secret circuit according to the first embodiment. 8A and 8B are conceptual diagrams illustrating the circuit to be concealed. FIG. 9 is a block diagram illustrating the configuration of the secret calculation apparatus according to the embodiment. FIG. 10 is a block diagram illustrating the configuration of the secret calculation apparatus according to the embodiment. FIG. 11 is a flowchart illustrating the circuit concealment method according to the second embodiment. FIG. 12 is a flowchart illustrating the calculation method of the secret circuit according to the second embodiment. FIG. 13 is a diagram for explaining a secret circuit according to the second embodiment. FIG. 14 is a flowchart illustrating the preprocessing of the third embodiment. FIG. 15 is a flowchart illustrating the preprocessing of the third embodiment. FIG. 16 is a flowchart illustrating the circuit concealment method according to the third embodiment. FIG. 17 is a flowchart illustrating the calculation method of the secret circuit according to the third embodiment. FIG. 18 is a flowchart illustrating the preprocessing of the fourth embodiment. FIG. 19 is a flowchart illustrating the calculation method of the secret circuit according to the fourth embodiment.

Embodiments of the present invention will be described below.
[Overview]
In the generation of the concealment circuit, a value corresponding to the input label corresponding to each of the elements in the domain of each gate, an output key of the gate corresponding to each of the output values when the element is input to the gate, An inverse image is obtained by unidirectional replacement of the trap door according to the image, and an input key corresponding to each of the original is obtained using the inverse image. Further, using the input key, a concealed output label is obtained by concealing the output label corresponding to the output value when the source is input to the gate.

  In the case of a normal one-way map, it is difficult to obtain an inverse image from the image. On the other hand, in the case of trap door unidirectional replacement, a reverse image can be obtained from the image by using the trap door which is secret information. An example of trapdoor unidirectional replacement is an encryption function of a public key cryptosystem such as RSA cryptography, and an example of trapdoor is a secret key of a public key cryptosystem. In this embodiment, such a trapdoor unidirectional replacement is used, a value corresponding to an input label corresponding to each truth value of an input value of each gate, and an output key corresponding to each truth value of an output value corresponding thereto. Then, the input key corresponding to the truth value of the input corresponding to each truth value is set in the reverse direction to conceal the circuit. As a result, without saving the ciphertext of the output key, the decryption process using the input key corresponding to the truth value corresponding to the input label supports the output value corresponding to the truth value corresponding to the input label. A secret circuit capable of restoring the output key to be configured can be configured. That is, in the secret calculation using this secret circuit, an output key of the gate corresponding to the value corresponding to the input label corresponding to the input value of the gate and the image by the trap door unidirectional replacement of the input key of the gate is obtained. By using the concealment output label corresponding to the output value of the gate and the input key of the gate, an output label corresponding to the output value of the gate can be obtained. Thus, since it is not necessary to save the ciphertext of the output key, the size of the secret circuit can be reduced.

  In the generation of the concealment circuit according to the first embodiment described later, an inverse image is obtained by unidirectional replacement of the image, which is an exclusive OR of the value corresponding to the input label and the output key, and the inverse image is used. Set each input key. As a result, the “value corresponding to the input label” is regarded as the ciphertext of the output key, and the decryption process using the input key corresponding to the truth value corresponding to the input label as the decryption key results in the truth value corresponding to the input label. A secret circuit capable of restoring the output key corresponding to the corresponding output value can be configured. That is, in the secret calculation using this secret circuit, the exclusive OR of the value corresponding to the input label and the value that is an image obtained by trapdoor unidirectional replacement of the input key of the gate is used as the output key of the gate. Since this “value corresponding to the input label” can be obtained from the input label, it is not necessary to store it.

  In the generation of the concealment circuit of the second embodiment described later, (1) by a point comprising a plurality of points corresponding to each gate and an output key corresponding to the first value which is one of a predetermined value and an output value. A first formula that is determined is obtained, and (2) a second formula that is determined by the points including the plurality of points and an output key corresponding to the second value that is one of the predetermined value and the output value is obtained. However, the first value and the second value are different. Further, in the generation of the concealment circuit, (3) an image which is a value obtained by substituting a value corresponding to an input label corresponding to an element whose output value when inputted to the gate becomes the first value into the first integer The value obtained by substituting the value corresponding to the input label corresponding to the element in which the output value when input to the gate becomes the second value into the second integer, by the trapdoor unidirectional replacement of A reverse image is obtained by unidirectional replacement of the trap door of an image, and each input key is set using the reverse image. As a result, a secret circuit that can restore the output key corresponding to the output value corresponding to the truth value corresponding to the input label by the decryption process using the input key corresponding to the truth value corresponding to the input label as the decryption key is configured. it can. That is, in the concealment calculation using the concealment circuit, by polynomial interpolation, a plurality of points corresponding to the gate, and a value corresponding to the input label and a value that is an image obtained by trap door unidirectional replacement of the input key of the gate are obtained. It is possible to obtain an integer formula determined by a certain point and substitute a predetermined value into the formula to obtain an output key of the gate. “A plurality of points according to the gate” can be determined for the gate, and “value corresponding to the input label” and “input key” can be determined from the input label and the input key, respectively. Therefore, it is not necessary to store them.

  The setting of the concealment output label when generating the concealment circuit is performed based on the input key set as described above. For example, the output label may be concealed with a value corresponding to the input key to obtain a concealed output label, or a value representing a bit position corresponding to the “source of the domain of the gate” of the bit string corresponding to the input key It may be a concealment output label. Although it is necessary to store the concealment output label, the size of the concealment circuit can be made smaller than that of the prior art in which the ciphertext of both the label and the output key is stored.

[First Embodiment]
Next, a first embodiment will be described with reference to the drawings.
<Configuration>
As illustrated in FIG. 1, the secure calculation system 1 of the present embodiment includes a secure calculation device 11 that generates a secure circuit, and a secure calculation device 12 that performs a secure calculation using the secure circuit.

<Secret calculation device 11>
As illustrated in FIG. 2, the secure calculation device 11 according to the present embodiment includes a communication unit 1111, an input unit 1112, a storage unit 112, a control unit 113, an initial setting unit 114, an input wire setting unit 115, a replacement bit setting unit 1161, Input label setting unit 1162, mapping unit 1171, inverse image unit 1172, input key generation unit 1173, input key / label table setting unit 1174, label concealment unit 1181, output label table setting unit 1182, encoding unit 1191, separation unit 1192 and a lost communication processing unit 1193.

<Secret calculation device 12>
As illustrated in FIG. 3, the secure calculation device 12 according to this embodiment includes a communication unit 1211, an input unit 1212, a storage unit 122, a control unit 123, a lost communication processing unit 124, a separation unit 125, a setting unit 126, and an input wire setting. Section 1271, mapping section 1272, output key generation section 1273, separation section 1274, label restoration section 1275, and output value generation section 128.

  Each of the secret computing devices includes, for example, a communication device, a processor (hardware processor) such as a CPU (central processing unit), and a memory such as a random-access memory (RAM) and a read-only memory (ROM). It is an apparatus configured by a dedicated computer executing a predetermined program. The computer may include a single processor and memory, or may include a plurality of processors and memory. This program may be installed in a computer, or may be recorded in a ROM or the like in advance. In addition, some or all of the processing units are configured using an electronic circuit that realizes a processing function without using a program, instead of an electronic circuit (circuitry) that realizes a functional configuration by reading a program like a CPU. May be. In addition, an electronic circuit constituting one device may include a plurality of CPUs. The secret calculation devices 11 and 12 perform each process under the control of the control units 113 and 123, respectively. In addition, data obtained in each unit is stored in a memory (not shown) one by one, and read and used as necessary.

<Pretreatment>
Based on the security parameter k, which is a positive integer, the following preprocessing is performed.
A one-way map H that maps an arbitrary-length bit value to a k-bit value: {0,1} ^* → {0,1} ^k , and a one-way map H that maps an arbitrary-length bit value to a one-bit value ': {0, 1} ^* → {0, 1} is set. An example of a one-way map is a hash function. For example, a cryptographic hash function can be a one-way map. H is a one-way map with a key, and H ′ is a one-way map without a key. A common key encryption function or a public key encryption function may be used as the one-way map. The one-way map may be a function or an algorithm.

The circuit f to be concealed input to the concealment calculation device 11 is stored in the storage unit 112. The circuit f is a mapping (function) that outputs a 1-bit output value Y∈ {0,1} to an n-bit input value Z∈ {0,1} ⁿ (f: {0,1} ⁿ → {0,1}). However, n is an even number of 2 or more, n = 4 may be sufficient, and n> = 6 may be sufficient. u is an integer of 1 or more, and u ≧ 3 may be satisfied. FIG. 8B is an example of n = 10 and u = 9.

As illustrated in FIGS. 8A and 8B, the circuit f includes u gates G (n + 1),..., G (n + u). The gate G (i) (where i∈ {n + 1,..., N + u}) is a 2-input 1-output logic gate (G (i): {0, 1} × {0, 1} → {0, 1) }). A set of gates G (n + 1),..., G (n + u) is denoted as G _set : = {G (n + 1),..., G (n + u)}. A set of n / 2 gates G (n + 1),..., G (3n / 2) on the input side is denoted as G _input : = {G (n + 1),..., G (3n / 2)}. However, “α: = β” means that α is β. Examples of gates are AND gates, OR gates, XOR gates, and the like.

An input variable to the gate G (i) is called an input wire, and an output variable is called an output wire. Each gate G (i) has two input wires and one output wire. Input wires and output wires are collectively referred to as wires. The input wires of the gate G (i) are denoted as W (A (i)) and W (B (i)), and the output wires are denoted as W (i). A set of wires of the gates G (n + 1),..., G (n + u) is expressed as W _set : = {W (1),..., W (n + u)}. However, A (i) <B (i) <i, A (n + 1) = 1, B (n + 1) = 2,..., A (3n / 2) = n−1, B (3n / 2) = n,..., A (n + u) = n + u-2, B (n + u) = n + u-1. The input wires W (A (n + 1)) = W (1), W (B (n + 1)) = W (of n / 2 gates G (n + 1),..., G (3n / 2) belonging to the set G _input 2),..., W (A (3n / 2)) = W (n−1), W (B (3n / 2)) = W (n) is set to W _input : = {W (1),. , W (n)}. The output wire W (n + u) of the gate G (n + u) is expressed as W _output : = W (n + u). A _set : = {A (n + 1),..., A (n + u)}, and B _set : = {B (n + 1),..., B (n + u)}. The circuit f is expressed as (n, u, A _set , B _set , G _set ).

Input wires W (1),..., W (n) of the gates belonging to the set G _input are input wires of the circuit f and correspond to the n-bit input value Z. The gate G (ν) (however, ν∈ {n + 1, ... , n + u-1}) output wires W ([nu) of each one of the gate _{G (ω) ∈G set \ {} G (n + 1), ... , G (n + u−1)} input wires W (A (ω)) or W (B (ω)). However, “α \ β” represents a complement of the set β in the set α. Since ν <ω, different output wires do not become the same input wire, and a single output wire does not become a plurality of input wires. An output wire W (n + u) of the gate G (n + u) is an output wire of the circuit f and corresponds to the output value Y.

Types of gates G (μ) (where μ∈ {n + 1,..., N + u}) and input values I (A (μ)), I of input wires W (A (μ)) and W (B (μ)) In response to (B (μ)) ε {0,1}, the output value G _μ (I (A (μ)), I (B (μ))) ε {0,1} of the output wire W (μ) is Determined. That is, the logical operation result at the gate G (μ) for I (A (μ)) and I (B (μ)) is G _μ (I (A (μ)), I (B (μ))). . For example, when the gate G (μ) is an AND gate, I (A (μ)), I (B (μ)), G _μ (I (A (μ)), I (B (μ))) The relationship is as follows.

<Secret circuit generation processing>
The generation process of the secret circuit of this embodiment will be described with reference to FIGS. 4 and 5.
First, the initial setting unit 114 of the secret computing device 11 (FIG. 2) traps one-way replacement E _ι : F _q → F _{q in} which the element of the finite field F _q of order _q is copied to the element of F _q and its Select trapdoor t _ι . However, q is a positive integer, for example, a prime number. Unless the trap door t _ι is used, it is difficult to obtain a reverse image of the trap door unidirectional replacement. On the other hand, by using the trap door t _ι , an inverse image of the trap door unidirectional replacement can be obtained in polynomial time. The trapdoor unidirectional replacement may be a function or an algorithm. The initial setting unit 114 selects and outputs the H key R at random (for example, uniform random) (step S100).

Further, the initial setting unit 114 refers to the circuit f stored in the storage unit 112, selects two elements of the finite field F _q at random (for example, uniform random), and selects them as the output key K ⁰ _{n + u.} , K ¹ _{n + u} ∈ F _q is set and output. However, the output key K ⁰ _{n + u} corresponds to G _{n + u} (I (A (n + u)), I (B (n + u))) = 0, and the output key K ¹ _{n + u} is G _{n + u} (I (A (n + u)), I (B (n + u))) = 1 (step S101).

を表す。出力ラベルＬ^０ _ｎ＋ｕはＧ_ｎ＋ｕ（Ｉ（Ａ（ｎ＋ｕ）），Ｉ（Ｂ（ｎ＋ｕ）））＝０に対応し、出力ラベルＬ^１ _ｎ＋ｕはＧ_ｎ＋ｕ（Ｉ（Ａ（ｎ＋ｕ）），Ｉ（Ｂ（ｎ＋ｕ）））＝１に対応する。λ_ｎ＋ｕ＝０であってもよいし、λ_ｎ＋ｕ＝１であってもよい（ステップＳ１０２）。さらに制御部１１３がｉ：＝ｎ＋ｕに設定する（ステップＳ１０３）。 Next, the initial setting unit 114 sets replacement bits λ _{n + u} , output labels L ⁰ _{n + u} : = λ _{n + u} , L ¹ _{n + u} : = λ _{n + u} (+) 1. Where α (+) β is the exclusive OR of α and β

Represents. The output label L ⁰ _{n + u} corresponds to G _{n + u} (I (A (n + u)), I (B (n + u))) = 0, and the output label L ¹ _{n + u} is G _{n + u} (I (A (n + u)), I ( B (n + u))) = 1. λ _{n + u} = 0 or λ _{n + u} = 1 may be set (step S102). Further, the control unit 113 sets i: = n + u (step S103).

でもある。同様に、入力ラベルＬ^ｂ _Ｂは、ゲートＧ（ｉ）の入力ワイヤＷ（Ｂ）となる別のゲートＧ（ｉ”）（ただし、ｉ≠ｉ”，ｉ”∈｛ｎ＋１，…，ｎ＋ｕ−１｝）の出力ワイヤＷ（ｉ”）の出力ラベル

でもある（ステップＳ１０６）。 The input wire setting unit 115 sets A: = A (i) and B: = B (i) (step S104). The replacement bit setting unit 1161 randomly selects replacement bits λ _A and λ _B ε {0, 1} for the input wires W (A) and W (B) (step S105). The input label setting unit 1162 sets the input labels L ^a _A and L ^b _B ε {0, 1} for all (a, b) ε {0, 1} ² as follows. However, aε {0,1} is an input value of the input wire W (A), and bε {0,1} is an input value of the input wire W (B).
L ^a _A : = λ _A (+) a
L ^b _B : = λ _B (+) b
That is, the input label setting unit 1162 sets and outputs the input labels (L ^a _A , L ^b _B ) corresponding to the elements (a, b) of the domain of the gate G (i). As illustrated in FIG. 8A and FIG. 8B, the input label L ^a _A includes another gate G (i ′) (where i ≠ i ′, which is the input wire W (A) of the gate G (i). i′∈ {n + 1,..., n + u−1}) output wire W (i ′) output label

But there is. Similarly, the input label L ^b _B indicates that another gate G (i ″) (where i ≠ i ″, i ″ ε {n + 1,..., N + u−) that becomes the input wire W (B) of the gate G (i). 1}) output label of output wire W (i ″)

(Step S106).

The mapping unit 1171 uses the key R to generate and output c _x : = H (R, i | x) for x = 0, 1, 2, 3 and i. However, H (R, i | x) is an image obtained by inputting i | x to H corresponding to R. α | β represents a connection between α and β. x corresponds to four combinations of (L ^a _A , L ^b _B ) (step S107).

を得て出力する。すなわち、逆像部１１７２は、ゲートＧ（ｉ）の定義域の元（ａ，ｂ）のそれぞれに応じた入力ラベル（Ｌ^ａ _Ａ，Ｌ^ｂ _Ｂ）に対応する値

と、元（ａ，ｂ）がゲートＧ（ｉ）に入力された際の出力値Ｇ_ｉ（ａ，ｂ）のそれぞれに応じたゲートＧ（ｉ）の出力鍵

と、に応じた像

のトラップドア一方向性置換Ｅ_ιによる逆像を得て出力する。本形態の逆像部１１７２は、入力ラベル（Ｌ^ａ _Ａ，Ｌ^ｂ _Ｂ）に対応する値と当該「出力鍵」との排他的論理和である像のトラップドア一方向性置換による逆像を得て出力する（ステップＳ１０８）。 The inverse image unit 1172 refers to the circuit f stored in the storage unit 112, uses E _ι , t _ι , L ^a _A , L ^b _B , K ⁰ _i , and K ¹ _i and uses all (a, b). For ∈ {0,1} ² , the inverse image

And output. That is, the inverse image unit 1172 has values corresponding to the input labels (L ^a _A , L ^b _B ) corresponding to the respective elements (a, b) of the domain of the gate G (i).

And an output key of the gate G (i) corresponding to each of the output values G _i (a, b) when the element (a, b) is input to the gate G (i)

And statues according to

A reverse image of the trap door unidirectional replacement E _ι is obtained and output. The inverse image unit 1172 of this embodiment performs an inverse image by trapdoor unidirectional replacement of an image that is an exclusive OR of the value corresponding to the input label (L ^a _A , L ^b _B ) and the “output key”. Obtain and output (step S108).

この連立方程式はガウスの消去法等の周知の方法を用いて解くことができる。なお、図８Ａおよび図８Ｂに例示するように、入力鍵Ｋ^０ _Ａ，Ｋ^１ _Ａは、それぞれ、ゲートＧ（ｉ）の入力ワイヤＷ（Ａ）となる別のゲートＧ（ｉ’）（ただし、ｉ≠ｉ’，ｉ’∈｛ｎ＋１，…，ｎ＋ｕ−１｝）の出力ワイヤＷ（ｉ’）の出力鍵Ｋ^０ _ｉ’，Ｋ^１ _ｉ’でもある。同様に、入力鍵Ｋ^０ _Ｂ，Ｋ^１ _Ｂは、それぞれ、ゲートＧ（ｉ）の入力ワイヤＷ（Ｂ）となる別のゲートＧ（ｉ”）（ただし、ｉ≠ｉ”，ｉ”∈｛ｎ＋１，…，ｎ＋ｕ−１｝）の出力ワイヤＷ（ｉ”）の出力鍵Ｋ^０ _ｉ”，Ｋ^１ _ｉ”でもある（ステップＳ１０９）。 The input key generation unit 1173 uses the inverse images P ₀ , P ₁ , P ₂ , and P ₃ obtained in step S108 to solve the following simultaneous equations and responds to each of a, bε {0, 1}. The input keys K ⁰ _A , K ¹ _A , K ⁰ _B , and K ¹ _B ∈ F _q are obtained and output.

This simultaneous equation can be solved using a known method such as Gaussian elimination. As illustrated in FIGS. 8A and 8B, each of the input keys K ⁰ _A and K ¹ _A has another gate G (i ′) (however, the input wire W (A) of the gate G (i)) , I ≠ i ′, i′∈ {n + 1,..., N + u−1}) are also output keys K ⁰ _{i ′} and K ¹ _{i ′} of the output wire W (i ′). Similarly, each of the input keys K ⁰ _B and K ¹ _B has another gate G (i ″) (where i ≠ i ″, i ″ ∈ {) serving as the input wire W (B) of the gate G (i). n + 1,..., n + u−1}) are also output keys K ⁰ _{i ″} and K ¹ _{i ″} of the output wire W (i ″) (step S109).

The input key / label table setting unit 1174 receives the input keys K ⁰ _A , K ¹ _A , K ⁰ _B , K ¹ _B and the input labels L ⁰ _A , L ¹ _A , L ⁰ _B , L ¹ _B, and inputs A table ^e _[a] with respect _{^{to: = (K 0 a | L}} 0 a, K 1 a | L 1 a) set the table e ^[B] with respect to _{^{B: = (K 0 B |}} L 0 B , K ¹ _B | L ¹ _B ) is set and output (step S110).

を設定して出力する。すなわち、ラベル秘匿化部１１８１は、入力鍵Ｋ^ａ _Ａ，Ｋ^ｂ _Ｂに対応する値Ｈ’（Ｋ^ａ _Ａ｜Ｋ^ｂ _Ｂ）で出力ラベルＬ_ｉ ^{Ｇｉ（ａ，ｂ）}を秘匿化してこれらの秘匿化出力ラベルｂ_０，ｂ_１，ｂ_２，ｂ_３を得る。出力ラベルＬ_ｉ ^{Ｇｉ（ａ，ｂ）}は、元（ａ，ｂ）がゲートＧ（ｉ）に入力された際の出力値Ｇ_ｉ（ａ，ｂ）に対応する。図８Ａおよび図８Ｂに例示するように、ｉ≠ｎ＋ｕの場合、ゲートＧ（ｉ）の出力ラベルＬ_ｉ ^{Ｇｉ（ａ，ｂ）}は、このゲートＧ（ｉ）の出力ワイヤＷ（ｉ）を入力ワイヤＷ（Ａ（ω））とする他のゲートＧ（ω）の入力ラベルＬ_Ａ（ω） ^ａ’であるか（ただし、ａ’∈｛０，１｝）、出力ワイヤＷ（ｉ）を入力ワイヤＷ（Ｂ（ω））とする他のゲートＧ（ω）の入力ラベルＬ_Ｂ（ω） ^ｂ’である（ただし、ｂ’∈｛０，１｝）。なお、上付き添え字の「Ｇｉ（ａ，ｂ）」は「Ｇ_ｉ（ａ，ｂ）」を意味する（ステップＳ１１１）。 The label concealment unit 1181 refers to the circuit f stored in the storage unit 112 and uses the input keys K ⁰ _A , K ¹ _A , K ⁰ _B , K ¹ _B and the output label L _i ^{Gi (a, b)} . , For all (a, b) ε {0,1} ² , the concealment output label as

Set and output. That is, the label concealment unit 1181 conceals the output label L _i ^{Gi (a, b)} with the value H ′ (K ^a _A | K ^b _B ) corresponding to the input keys K ^a _A and K ^b _B. The concealment output labels b ₀ , b ₁ , b ₂ , b ₃ are obtained. The output label L _i ^{Gi (a, b)} corresponds to the output value G _i (a, b) when the element (a, b) is input to the gate G (i). As illustrated in FIGS. 8A and 8B, when i ≠ n + u, the output label L _i ^{Gi (a, b)} of the gate G (i) inputs the output wire W (i) of the gate G (i). Whether the input label LA _(ω) ^{a ′} of the other gate G (ω) as the wire W (A (ω)) (where a′∈ {0, 1}), the output wire W (i) is The input label L _{B (ω)} ^{b ′} of the other gate G (ω) as the input wire W (B (ω)) (where b′∈ {0, 1}). The superscript “Gi (a, b)” means “G _i (a, b)” (step S111).

The output label table setting unit 1182 uses the concealment output labels b ₀ , b ₁ , b ₂ , and b ₃ and uses the concealment output labels L [i]: = (b ₀ , b ₁ , b ₂ , b ₃ ). Obtain and output (step S112).

  The control unit 113 determines whether i = n + 1 (step S113). If i = n + 1 is not satisfied, the control unit 113 sets i: = i−1 (i−1 is a new i), and returns the process to step S104 (step S114). On the other hand, if i = n + 1, the control unit 113 causes the process of step S115 to be executed.

In step S115, the input key / label table setting unit 1174 outputs L [n + 1], ..., L [n + u] as L: = {L [n + 1], ..., L [n + u]} ( Step S115). Next, the input key / label table setting unit 1174 receives e [A (3n / 2 + 1)], e [B (3n / 2 + 1)],..., E [A (n + u)], e [B (n + u) )] Is output as a table e: = {e [A (3n / 2 + 1)], e [B (3n / 2 + 1)],..., E [A (n + u)], e [B (n + u)]} (Step S116). The communication unit 1111 receives R, L, ι, e, and λ _{n + u} as inputs, and outputs the secret circuit F: = (R, L, ι), table e, and label decryption key d: = λ _{n + u} . However, ι is information for specifying E _ι . The secret circuit F: = (R, L, ι), the table e, and the label decryption key d: = λ _{n + u} are transmitted to the secret calculation device 12, received by the communication unit 1211 of the secret calculation device 12 (FIG. 3), and stored. The data is stored in the unit 122 (step S117).

The input key / label table setting unit 1174 of the secret calculation device 11 (FIG. 2)
e [1]: = e [A (n + 1)]
e [2]: = e [B (n + 1)]
...
e [n-1]: = e [A (3n / 2)]
e [n]: = e [B (3n / 2)]
Is stored in the storage unit 112 (step S118).

<Encoding process of input value of circuit f>
The input value encoding process of this embodiment will be described with reference to FIG.
Hereinafter, each bit of the input value Zε {0,1} ⁿ of the circuit f is expressed as x _j ε {0,1} (where jε {1,..., N}). The input unit 1112 of the secret computing device 11 (FIG. 2) includes a true subset sub ₁ of the set {x ₁ ,..., X _n }: = {x _{u (1) ,. )} ⊂ {x 1, ...} , x n} is input. However, P is an integer greater than or equal to 1, and is {u (1),..., U (P)} ⊂ {1,..., N} (step S121). The control unit 113 sets p: = 1 (step S122).

The separation unit 1192 extracts e [u (p)] stored in the storage unit 112 and e [u (p)] = (e ₀ , e ₁ ): = (K ⁰ _{u (p)} | L ^{0. _{u (p), K 1 u}} (p) | L 1 u (p)) in the separation (Perth) and outputs (step S123).

を得て出力する（ステップＳ１２４）。 The encoding unit 1191 uses x _{u (1)} and (e ₀ , e ₁ ),

Is obtained and output (step S124).

The control unit 113 determines whether p = P (step S126). If p = P is not satisfied, the control unit 113 sets p: = p + 1 (p + 1 is a new p), and returns the process to step S123 (step S125). On the other hand, if p = P, X [x _{u (1)} ],..., X [x _{u (P)} ] is sent to the communication unit 1111, and the communication unit 1111 receives X [x _{u (1)} ], ..., X [x _{u (P)} ] are transmitted to the secure computing device 12 (step S127).

X [x _{u (1)} ],..., X [x _{u (P)} ] are received by the communication unit 1211 of the secure computing device 12 (FIG. 3) and stored in the storage unit 122. Since the secret calculation device 12 does not hold e [1],..., E [n], X [x _{u (p)} ] (where p∈ {1,..., P}) It is impossible to know the value of x _j corresponding to (step S128).

The input unit 1212 of the secret calculation device 12 (FIG. 3) includes a true subset sub ₂ of the set {x ₁ ,..., X _n }: = {x _{v (1) ,. )} ⊂ {x 1, ...} , x n} is input. However, Q is an integer greater than or equal to 1, {v (1), ..., v (Q)} ⊂ {1, ..., n}, {1, ..., n} = { u (1), ..., u (P)} ∪ {v (1), ..., v (Q)}. For example, {u (1),..., U (P)} ∩ {v (1),..., V (Q)} is an empty set, but this may not be an empty set (step S129). ). The control unit 113 sets q: = 1 (step S130).

を得る。紛失通信処理部１２４は紛失通信処理部１１９３にｘ_ｖ（ｑ）を開示することなく、紛失通信処理部１１９３は

を紛失通信処理部１２４に開示することなく、紛失通信処理部１２４がＸ［ｖ（ｑ）］を得る。紛失通信には周知の方法を用いればよい（例えば、非特許文献１参照）。この紛失通信の一例を示す。
（１）紛失通信処理部１２４はｘ_ｖ（ｑ）に対応する公開鍵ｐｋ（ｘ_ｖ（ｑ））および秘密鍵ｓｋ（ｘ_ｖ（ｑ））ならびにランダムなＰＫ（ｘ_ｖ（ｑ）（＋）１）を生成し、紛失通信処理部１１９３に送信する。
（２）紛失通信処理部１１９３は、ｐｋ（０）を用いてｅ_０を暗号化した暗号文ＥＮＣ（ｐｋ（０），ｅ_０）およびｐｋ（１）を用いてｅ_１を暗号化した暗号文ＥＮＣ（ｐｋ（１），ｅ_１）を紛失通信処理部１２４に送る。
（３）紛失通信処理部１２４は、秘密鍵ｓｋ（ｘ_ｖ（ｑ））を用いて暗号文ＥＮＣ（ｐｋ（０），ｅ_０）およびＥＮＣ（ｐｋ（１），ｅ_１）を復号する。これらのうち、ＥＮＣ（ｐｋ（ｖ（ｑ）），ｅ_ｖ（ｑ））のみが正しく復号され、Ｘ［ｖ（ｑ）］：＝ｅ_ｖ（ｑ）が得られる（ステップＳ１３１）。 The lost communication processing unit 124 uses _{xv (q} ) to perform lost communication (OT: Oblivious transfer) with the lost communication processing unit 1193 through the communication unit 1211 and the communication unit 1111 of the secret computing device 11 (FIG. 2). corresponding to x _{v (q)}

Get. The lost communication processing unit 124 does not disclose _{xv (q)} to the lost communication processing unit 1193, and the lost communication processing unit 1193

Is not disclosed to the lost communication processing unit 124, and the lost communication processing unit 124 obtains X [v (q)]. What is necessary is just to use a well-known method for lost communication (for example, refer nonpatent literature 1). An example of this lost communication is shown.
(1) loss public key pk communication processing unit 124 corresponding to _{x v (q) (x v} (q)) and a private key sk _{(x v (q))} and random _{PK (x v (q)} (+ ) 1) is generated and transmitted to the lost communication processing unit 1193.
(2) The lost communication processing unit 1193 uses the ciphertext ENC (pk (0), e ₀ ) obtained by encrypting e ₀ using pk (0) and the cipher obtained by encrypting e ₁ using pk (1). The sentence ENC (pk (1), e ₁ ) is sent to the lost communication processing unit 124.
(3) The lost communication processing unit 124 decrypts the ciphertexts ENC (pk (0), e ₀ ) and ENC (pk (1), e ₁ ) using the secret key sk (x _{v (q)} ). Of these, only ENC (pk (v (q)), _{ev (q)} ) is correctly decoded, and X [v (q)]: = _{ev (q)} is obtained (step S131).

The control unit 123 determines whether q = Q (step S132). If q = Q is not satisfied, the control unit 123 sets q: = q + 1 (q + 1 is set as a new q), and returns the process to step S131 (step S133). On the other hand, if q = Q, the control unit 123 stores X [ _{xv (1)} ],..., X [ _{xv (Q)} ] in the storage unit 122 (step S134).

<Concealment calculation using concealment circuit>
The secret calculation process using the secret circuit of this embodiment will be described with reference to FIG.
First, the separation unit 125 of the secret calculation device 12 (FIG. 3) reads the secret circuit F: = (R, L, ι) from the storage unit 122, separates it into R, L, and ι and outputs it (step). S141). The control unit 123 sets j: = 1 (step S142).

The setting unit 126 reads X [x _j ] from the storage unit 122, obtains and outputs an input key _j and an input label L _j that satisfy K _j | L _j : = X [x _j ]. The input key K _j and the input label L _j correspond to x _j . That is, when x _j = 0, K _j : = K ⁰ _j and L _j : = L ⁰ _j , and when x _j = 1, K _j = K ¹ _j and L _j : = L ¹ _j (Step S143). The control unit 123 determines whether j = n (step S144). If j = n is not satisfied, the control unit 123 sets j: = j + 1 (j + 1 is a new j), and returns the process to step S143 (step S145). On the other hand, if j = n, the control unit 123 sets i: = n + 1 (step S146).

After the process of step S146, the input wire setting unit 1271 sets A: = A (i) and B: = B (i) (step S147). Mapping unit 1272, using the input label _{L A, L B, x:} = give 2L A + _{L B} (step _{S148), R, i, c} x with x: = H (R, i | x) and Obtain and output (step S149). The control unit 123 determines whether x = 0 (step S150). The output key generation unit 1273 identifies E _i using ι, and if x = 0, K _i : = E _i (K _A + 2K _B ) (+) c _x is obtained from K _A , K _B and c _x. If x ≠ 0, K _i : = E _i (K _A + K _B ) (+) c _x is obtained from K _A , K _B and c _x and output (step S 152). That is, the output key generation unit 1273 traps the value c _x corresponding to the input labels L _A and L _B according to the input value of the gate G (i) and the input keys K _A and K _B of the gate G (i). obtain the output key _{K i} of the gate corresponding to the image _{E i (K a + 2K B} ) or _{E i (K a + K B} ) by one-way permutation E _i. In other words, the output key generation unit 1273 of the present embodiment uses the value c _x corresponding to the input labels L _A and L _B and the trap door unidirectional replacement E _i of the input keys K _A and K _B of the gate G (i). The exclusive OR with the value E _i (K _A + K _B ) which is an image is set as the output key K _i of the gate G (i). As illustrated in FIGS. 8A and 8B, the output key K _ν (where ν∈ {n + 1,..., N + u−1}) of the gate G (ν) is the output wire W ( An input key K _{A (ν ′)} or K _{B (ν ′)} of another gate G (ν ′) using ν) as an input wire.

The label restoration unit 1275 reads the concealment output label L [i] included in L from the storage unit 122 and separates it into L [i]: = (b ₀ , b ₁ , b ₂ , b ₃ ) (step S153). . Label restoration unit 1275, an input key _K A, _{K B,} and using a concealed output label _{b x,} and outputs the resulting output label _{L i} as follows.
L _i : = H ′ (K _A | K _B ) (+) b _x (2)
That is, the label recovery unit 1275, using the input key _K A, _{K B} of the gate G concealed output label corresponding to the input values of (i) _{b x} and the gate G (i), the output value of the gate G (i) An output label L _i corresponding to is obtained and output. As illustrated in FIGS. 8A and 8B, the output label L _ν (where ν∈ {n + 1,..., N + u−1}) of the gate G (ν) is the output wire W ( a 'input label _{L a} of) _([nu' other gate G that receives wires _ν) (ν) or _{L B (ν ') (step} S154).

  The controller 123 determines whether i = n + u (step S155). If i = n + u is not satisfied, the control unit 123 sets i: = i + 1 (i + 1 is set as a new i), and returns the process to step S147 (step S156).

On the other hand, if i = n + u, the output value generation unit 128 uses the output label L _{n + u} and the label decryption key d: = λ _{n + u} read from the storage unit 122 to obtain Y: = L _{n + u} (+) λ _{n + u} . (Step S157).

<Features of First Embodiment>
As described above, in this embodiment, since it is not necessary to store the ciphertext corresponding to the output key of each gate, the size of the concealment circuit can be reduced, and the communication amount is changed from O (k · u) to O (k u).

[Second Embodiment]
Next, a second embodiment will be described. In the following, differences from the items described so far will be mainly described, and the same reference numerals will be used for the items already described to simplify the description.
<Configuration>
As illustrated in FIG. 1, the secure calculation system 2 of this embodiment includes a secure calculation device 21 that generates a secure circuit, and a secure calculation device 22 that performs a secure calculation using the secure circuit.

<Secret calculation device 21>
As illustrated in FIG. 9, the secure calculation device 21 according to the present embodiment includes a communication unit 1111, an input unit 1112, a storage unit 112, a control unit 113, an initial setting unit 114, an input wire setting unit 115, a replacement bit setting unit 1161, Input label setting unit 1162, complementing units 2171a and 2171b, inverse image unit 2172, input key generating unit 1173, input key / label table setting unit 1174, label concealing unit 1181, output label table setting unit 1182, encoding unit 1191, A separation unit 1192 and a lost communication processing unit 1193 are included.

<Secret calculation device 22>
As illustrated in FIG. 10, the secure calculation device 22 of this embodiment includes a communication unit 1211, an input unit 1212, a storage unit 122, a control unit 123, a lost communication processing unit 124, a separation unit 125, a setting unit 126, and an input wire setting. A unit 1271, a mapping unit 2272, an output key generation unit 2273, a complement unit 2274, a label restoration unit 1275, and an output value generation unit 128.

<Pretreatment>
The same as in the first embodiment.

<Secret circuit generation processing>
The generation process of the secret circuit of this embodiment will be described with reference to FIG.
First, the secret calculation device 21 (FIG. 9) executes the processing of steps S100 to S106 described in the first embodiment. Next, the complementing unit 2171a uses the key R and the output key K ⁰ _i , and (4, H (R, i | 4)), (5, H (R, i | 5)), (-1, K ⁰ _i ) is complemented by a polynomial, and a quadratic polynomial P passing through these three points is obtained and output (FIG. 13). That is, the complementing unit 2171a includes a plurality of points (4, H (R, i | 4)), (5, H (R, i | 5)) corresponding to the gate G (i), and a predetermined value (− 1) and a first polynomial expression (P) determined by a point (−1, K ⁰ _i ) consisting of an output key K ⁰ _i corresponding to the first value (0) which is one of the output values (0, 1) And output. P corresponds to the case where the value of the output wire of the gate G (i) is 0 (step S2071).

The complementing unit 2171b uses the key R and the output key K ¹ _i , and (4, H (R, i | 4)), (5, H (R, i | 5)), (-1, K ¹ _i ). To obtain a quadratic polynomial Q that passes through these three points and outputs it (FIG. 13). That is, the complementing unit 2171b includes a plurality of points (4, H (R, i | 4)), (5, H (R, i | 5)) corresponding to the gate G (i), and a predetermined value (− 1) and a second integer (Q) determined by a point (−1, K ¹ _i ) consisting of an output key K ¹ _i corresponding to the second value (1) which is one of the output values (0, ¹ ) And output. Q corresponds to the case where the value of the output wire of the gate G (i) is 1 (step S2072).

を得て出力する。すなわち、逆像部２１７２は、ゲートＧ（ｉ）の定義域の元（ａ，ｂ）のそれぞれに応じた入力ラベルＬ^ａ _Ａ，Ｌ^ｂ _Ｂに対応する値２Ｌ^ａ _Ａ＋Ｌ^ｂ _Ｂと、元（ａ，ｂ）がゲートＧ（ｉ）に入力された際の出力値Ｇ_ｉ（ａ，ｂ）のそれぞれに応じた出力鍵Ｋ^０ _ｉまたはＫ^１ _ｉと（上述のようにＰは出力鍵Ｋ^０ _ｉに応じて定まり、Ｑは出力鍵Ｋ^１ _ｉに応じて定まる）、に応じた像

のトラップドア一方向性置換Ｅ_ιによる逆像を得て出力する。言い換えると、逆像部２１７２は、ゲートＧ（ｉ）に入力された際の出力値Ｇ_ｉ（ａ，ｂ）が第１値（０）となる元（ａ，ｂ）に応じた入力ラベルＬ^ａ _Ａ，Ｌ^ｂ _Ｂに対応する値２Ｌ^ａ _Ａ＋Ｌ^ｂ _Ｂを第１整式（Ｐ）に代入して得られる値である像

のトラップドア一方向性置換Ｅ_ιによる逆像、および、ゲートＧ（ｉ）に入力された際の出力値Ｇ_ｉ（ａ，ｂ）が第２値（１）となる元（ａ，ｂ）に応じた入力ラベルＬ^ａ _Ａ，Ｌ^ｂ _Ｂに対応する値２Ｌ^ａ _Ａ＋Ｌ^ｂ _Ｂを第２整式（Ｑ）に代入して得られる値である像

のトラップドア一方向性置換による逆像を得る。図１３に、ゲートＧ（ｉ）がＡＮＤゲートであり、λ_Ａ＝λ_Ｂ＝０である場合の像Ｐ（０），Ｐ（１），Ｐ（２），Ｑ（３）を例示する（ステップＳ２０８）。 The inverse image unit 2172 refers to the circuit f stored in the storage unit 112, uses E _ι , t _ι , L ^a _A , L ^b _B , P, Q, and uses all (a, b) ε {0, 1} For ² ,

And output. That is, the inverse image unit 2172 has a value 2L ^a _A + L ^b _B corresponding to the input labels L ^a _A and L ^b _B corresponding to the respective elements (a, b) of the domain of the gate G (i), The output key K ⁰ _i or K ¹ _i corresponding to each of the output values G _i (a, b) when (a, b) is input to the gate G (i) (P is the output key as described above) Depending on K ⁰ _i and Q is determined according to the output key K ¹ _i )

A reverse image of the trap door unidirectional replacement E _ι is obtained and output. In other words, the inverse image unit 2172 has the input label L corresponding to the element (a, b) whose output value G _i (a, b) is the first value (0) when input to the gate G (i). ^a _a, the image is a value obtained values corresponding to ^{_{L b B 2L a a + L}} b B are substituted into the first polynomial (P)

Of the trap door unidirectional replacement E _ι and the output value G _i (a, b) when input to the gate G (i) becomes the second value (1) (a, b) An image which is a value obtained by substituting the value 2L ^a _A + L ^b _B corresponding to the input labels L ^a _A and L ^b _B according to the second integer (Q)

A reverse image is obtained by unidirectional replacement of the trapdoor. FIG. 13 illustrates images P (0), P (1), P (2), and Q (3) when the gate G (i) is an AND gate and λ _A = λ _B = 0 ( Step S208).

  The subsequent processing is the same as steps S111 to S118 described in the first embodiment except that the secret calculation devices 11 and 12 are replaced with the secret calculation devices 21 and 22.

<Encoding process of input value of circuit f>
The same as in the first embodiment.

<Concealment calculation using concealment circuit>
The secret calculation process using the secret circuit of this embodiment will be described with reference to FIG.
First, the secret calculation device 22 (FIG. 10) executes the processes of steps S141 to S148 and S150 described in the first embodiment. However, instead of the mapping unit 1272, the mapping unit 2272 executes the process of step S148. Thereafter, the complementing unit 2274 uses E to identify E _i , and if x = 0, obtains V: = (x, E _i (K _A + 2K _B )) from x and K _A , K _B and outputs it If x ≠ 0, V: = (x, E _i (K _A + K _B )) is obtained and output from x and K _A , K _B (step S252). Next, the complementing unit 2274 uses R, i, and V and performs polynomial interpolation on (4, H (R, i | 4)), (5, H (R, i | 5)), V to obtain a quadratic order. A polynomial U is generated. That is, the complementing unit 2274 supports a plurality of points (4, H (R, i | 4)), (5, H (R, i | 5)) corresponding to the gate G (i), and input labels. _A point V consisting of a value E _i (K _A + 2K _B ) or E _i (K _A + 2K _B ) which is an image obtained by trap door unidirectional replacement of the input key x = 2L _A + L _B and the input key of the gate G (i) An equation U determined by is obtained. For example, in the example of FIG. 13, U = Q when x = 2L _A + L _B = 3, and U = P when x = 0, 1, 2 (step S253). The output key generation unit 2273 obtains and outputs the output key K _i : = U (−1). That is, the output key generation unit 2273 obtains and outputs the output key K _i of the gate G (i) by substituting the predetermined value (−1) into the equation U. In other words, the output key generating unit 2273, the input value of the gate G (i) of (a, b) input label according to the _L A, a value corresponding to _{L B x = 2L A + L} B and the gate G (i) input key _K a, the trapdoor one-way permutation E _i image _{E i (K a + 2K B} ) by the _{K B} and obtained outputs an output key _{K i} of the gate G (i) corresponding to (step S254).

  The subsequent processing is the same as steps S154 to S157 described in the first embodiment.

<Features of Second Embodiment>
As described above, in this embodiment, since it is not necessary to store the ciphertext corresponding to the output key of each gate, the size of the secret circuit can be reduced and the communication amount can also be reduced.

[Third Embodiment]
The third embodiment is a modification of the first embodiment. In the first embodiment, after the circuit f to be concealed is specified, each gate of the circuit f is concealed. In this embodiment, a general AND gate, an OR gate, an XOR, and the like are concealed before the concealment target circuit f is specified, and the concealment target circuit f is changed using the concealed gate. Conceal. Thereby, it is possible to reduce the amount of calculation when concealing the circuit f to be concealed.

<Configuration>
As illustrated in FIG. 1, the secure calculation system 3 of this embodiment includes a secure calculation device 31 that generates a secure circuit, and a secure calculation device 32 that performs a secure calculation using the secure circuit.

<Secret calculation device 31>
As illustrated in FIG. 2, the secure calculation device 31 of this embodiment includes a communication unit 1111, an input unit 1112, a storage unit 112, a control unit 113, an initial setting unit 314, an input wire setting unit 315, a replacement bit setting unit 1161, Input label setting unit 1162, mapping unit 3171, inverse image unit 3172, input key generation unit 3173, input key / label table setting unit 3174, label concealment unit 3181, output label table setting unit 3182, encoding unit 1191, separation unit 1192, a lost communication processing unit 1193, and a secret circuit configuration unit 3183.

<Secret calculation device 32>
As illustrated in FIG. 3, the secure calculation device 32 of this embodiment includes a communication unit 1211, an input unit 1212, a storage unit 122, a control unit 123, a lost communication processing unit 124, a separation unit 125, a setting unit 126, and an input wire setting. A unit 1271, a mapping unit 3272, an output key generation unit 1273, a restoration unit 3273, a separation unit 1274, a label restoration unit 1275, and an output value generation unit 128.

<Pretreatment>
The differences from the preprocessing of the first embodiment are that the circuit f to be concealed is not stored in the storage unit 112 and that a plurality of general gates are concealed. Others are the same as the first embodiment.

A general gate concealment process performed in this embodiment will be described with reference to FIGS. 14 and 15. In this embodiment, S is a positive integer greater than or equal to u, and S general gates are represented as G ′ (1),..., G ′ (S). The gate G ′ (s) (where sε {1,..., S}) is a 2-input 1-output logic gate (G ′ (s): {0, 1} × {0, 1} → {0 , 1}). For example, G ′ (1),..., G ′ (S ₁ ) is an AND gate, G ′ (S ₁ +1),..., G ′ (S ₂ ) is an OR gate, and G ′ (S ₂ +1), ..., G '(S) is an XOR gate. The input wires of the gate G ′ (s) are denoted as W (A ′ (s)) and W (B ′ (s)), and the output wires are denoted as W (s). The type of the gate G ′ (s) (where s∈ {1,..., S}) and the input value I (A ′ (s) of the input wires W (A ′ (s)) and W (B ′ (s)) )), I (B ′ (s)) ∈ {0, 1}, the output value G ′ _s (I (A ′ (s)), I (B ′ (s))) of the output wire W (s) ) ∈ {0, 1} is determined. That is, the logical operation results at the gate G ′ (s) for I (A ′ (s)) and I (B ′ (s)) are G ′ _s (I (A ′ (s)), I (B ′ ( s))).

First, the initial setting unit 314 of the concealment computing device 31 (FIG. 2) is of order q finite field _{F q} of based on _F trapdoor one-way permutation copy the original _q E _iota of: _{F q} → _{F q} and Select trapdoor t _ι . The initial setting unit 314 selects and outputs the H key R at random (for example, uniformly random) (step S100). Next, the control unit 113 sets s: = S (step S303).

  The input wire setting unit 315 sets A: = A ′ (s) and B: = B ′ (s) (step S304).

The initial setting unit 314 randomly selects two elements of the finite field F _q (for example, uniform random), sets them as output keys K ⁰ _s and K ¹ _s ∈ F _q , and outputs them. However, the output key K ⁰ _s corresponds to G ′ _s (I (A ′ (s)), I (B ′ (s))) = 0, and the output key K ¹ _s is G ′ _s (I (A ′). (S)), I (B ′ (s))) = 1 (step S301).

Further, the initial setting unit 314 sets the replacement bit λ _s , output label L ⁰ _s : = λ _s , L ¹ _s : = λ _s (+) 1. The output label L ⁰ _s corresponds to G ′ _s (I (A ′ (s)), I (B ′ (s))) = 0, and the output label L ¹ _s is G ′ _s (I (A ′ (s )), I (B ′ (s))) = 1. That is, the output label L ⁰ _s corresponds to the output key K ⁰ _s , and the output key K ¹ _s corresponds to the output label L ¹ _s . λ _s = 0 or λ _s = 1 may be set (step S305).

The replacement bit setting unit 1161 randomly selects replacement bits λ _A and λ _B ε {0, 1} for the input wires W (A) and W (B) (step S105). The input label setting unit 1162 sets the input labels L ^a _A and L ^b _B ε {0, 1} for all (a, b) ε {0, 1} ² as follows. However, aε {0,1} is an input value of the input wire W (A), and bε {0,1} is an input value of the input wire W (B) (step S106).
L ^a _A : = λ _A (+) a
L ^b _B : = λ _B (+) b

The mapping unit 3171 generates and outputs c _x : = H (R, s | x) for x = 0, 1, 2, 3 and s using the key R (step S307).

を得て出力する（ステップＳ３０８）。 The inverse image unit 3172 uses E _ι , t _ι , L ^a _A , L ^b _B , K ⁰ _i , K ¹ _i , and for all (a, b) ε {0, 1} ²

Is obtained and output (step S308).

The input key generation unit 3173 solves the following simultaneous equations using the inverse images P ₀ , P ₁ , P ₂ , and P ₃ obtained in step S308, and responds to each of a, b∈ {0, 1}. The input keys K ⁰ _A , K ¹ _A , K ⁰ _B , and K ¹ _B εF _q are obtained and output (step S309).

を設定して出力する。出力ラベルＬ_ｓ ^{Ｇ’s（ａ，ｂ）}は、元（ａ，ｂ）がゲートＧ’（ｓ）に入力された際の出力値Ｇ’_ｓ（ａ，ｂ）に対応する。なお、上付き添え字の「Ｇ’ｓ（ａ，ｂ）」は「Ｇ’_ｓ（ａ，ｂ）」を意味する（ステップＳ３１１）。 The label concealment unit 3181 uses the input keys K ⁰ _A , K ¹ _A , K ⁰ _B , K ¹ _B and the output label L _s ^{G ′} _s ^{(a, b)} , and all (a, b) ε {0, 1 } For ² , the concealment output label as follows

Set and output. The output label L _s ^G ′ _s (a, b) corresponds to the output value G ′ _s (a, b) when the element (a, b) is input to the gate G ′ (s). The superscript “G ′ _s (a, b)” means “G ′ _s (a, b)” (step S311).

The output label table setting unit 3182 uses the concealment output labels b ₀ , b ₁ , b ₂ , and b ₃ and uses the concealment output labels L [s]: = (b ₀ , b ₁ , b ₂ , b ₃ ). Obtain and output (step S312).

The input key / label table setting unit 3174 includes input keys K ⁰ _A , K ¹ _A , K ⁰ _B , K ¹ _B , input labels L ⁰ _A , L ¹ _A , L ⁰ _B , L ¹ _B , and an output key K _s. ⁰ , K _s ¹ , output labels L ⁰ _s , L ¹ _s , and concealed output label L [s] are input, and the gate is set to G ′ (s) with (G ′ (s); K ⁰ _{A ^{| L 0 A, K 1 A}} | L 1 A, K 0 B | L 0 B, K 1 B | L 1 B, K 0 s | L 0 s, K 1 s | L 1 s, L [s]) Is stored in the storage unit 113 (step S3121).

  The control unit 113 determines whether s = 1 (step S3092). If not s = 1, the control unit 113 sets s: = s-1 (s-1 is set as a new s), and returns the process to step S304 (step S3093). On the other hand, if s = 1, the process ends.

<Secret circuit generation processing>
The secret circuit generation processing of this embodiment will be described with reference to FIG.
A circuit f to be concealed: = (n, u, A _set , B _set , G _set ) is input to the _cipher calculation device 31 and stored in the storage unit 112. Thereafter, first, the control unit 113 sets i: = n + u (step S303).

The input wire setting unit 315 sets A: = A (i) and B: = B (i) (step S104). The concealment circuit configuration unit 3183 refers to the concealment target circuit f stored in the storage unit 112, and performs one logical operation that is the same as the gate G (i) εG _set constituting the circuit f. ') (Where s'ε {1,..., S}) is selected (step S3071), and a mapping s ′ = map (i) that maps i to s ′ is set. map may be a table that associates s ′ with i, or may be a function that obtains s ′ from i (step S3072). Further, the secret circuit configuration unit 3183 is configured as follows: K ⁰ _A , L ⁰ _A , K ¹ _A , L ¹ _A , K ⁰ _B , L ⁰ _B , K ¹ _B , L ¹ _B , K ⁰ _i , L ⁰ _i , K ¹ _i , L ⁰ _i , and L [i] are set (step S3073).
^{_{K 0 A: = K 0 A}} (s '), L 0 A: = L 0 A (s')
K ¹ _A : = K ¹ _{A (s ′)} , L ¹ _A : = L ¹ _{A (s ′)}
K ⁰ _B : = K ⁰ _{B (s ′)} , L ⁰ _B : = L ⁰ _{B (s ′)}
K ¹ _B : = K ¹ _{B (s ′)} , L ¹ _B : = L ¹ _{B (s ′)}
K ⁰ _i : = K ⁰ _{s ′} , L ⁰ _i : = L ⁰ _{s ′}
K ¹ _i : = K ¹ _{s ′} , L ⁰ _i : = L ⁰ _{s ′}
L [i]: = L [s ′]

The input key / label table setting unit 3174 receives the input keys K ⁰ _A , K ¹ _A , K ⁰ _B , K ¹ _B and the input labels L ⁰ _A , L ¹ _A , L ⁰ _B , L ¹ _B, and inputs A table ^e _[a] with respect _{^{to: = (K 0 a | L}} 0 a, K 1 a | L 1 a) set the table e ^[B] with respect to _{^{B: = (K 0 B |}} L 0 B , K ¹ _B | L ¹ _B ) is set and output (step S310).

  The control unit 113 determines whether i = n + 1 (step S113). If i = n + 1 is not satisfied, the control unit 113 sets i: = i−1 (i−1 is a new i), and returns the process to step S104 (step S114). On the other hand, if i = n + 1, the control unit 113 causes the process of step S313 to be executed.

In step S313, the concealment circuit configuration unit 3183 refers to the concealment target circuit f stored in the storage unit 112, and all cε {0, 1}, i′ε {n + 1,. . . , N + u−1}, the following encryption processing is performed.
(A) The output wire W (i ′) of the gate G (i ′) ∈G _set is connected to another gate G (i ″) ∈G _set (where i ″ ≠ i ′ and i ″ ∈ {3n / 2 + 1,. , N + u}), the secret circuit constituting unit 3183 uses the output key K ^c _{i ′} of the gate G (i ′) as a common key, and uses the common key encryption. In accordance with the scheme, the input key K ^c _{A (i ″)} of the gate G (i ″) is encrypted, and the ciphertext E _A (i ″, c): = Enc (K ^c _{i ′} , K ^c _{A (i ″) )} ) Is obtained and output. Furthermore, in this case, the concealment circuit configuration unit 3183 uses the output label L ^c _{i ′} of the gate G (i ′) as a common key, and in accordance with the common key cryptosystem, the input label L ^c _{A of the} gate G (i ″). _{(I ″)} is encrypted, and the ciphertext EL _A (i ″, c): = Enc (L ^c _{i ′} , L ^c _{A (i ″)} ) is obtained and output.
(B) The output wire W (i ′) of the gate G (i ′) ∈G _set is connected to another gate G (i ″) ∈G _set (where i ″ ≠ i ′ and i ″ ∈ {n + 1,... , N + u}) input wire W (B (i ″)), the concealment circuit constituting unit 3183 uses the output key K ^c _{i ′} of the gate G (i ′) as a common key, and uses the common key encryption method. Accordingly, the input key K ^c _{B (i ″)} of the gate G (i ″) is encrypted, and the ciphertext E _B (i ″, c): = Enc (K ^c _{i ′} , K ^c _{A (i ″)} ) And output. Furthermore, in this case, the concealment circuit configuration unit 3183 uses the output label L ^c _{i ′} of the gate G (i ′) as a common key, and in accordance with the common key cryptosystem, the input label L ^c _{B of the} gate G (i ″). _{(I ″)} is encrypted, and the ciphertext EL _B (i ″, c): = Enc (L ^c _{i ′} , L ^c _{B (i ″)} ) is obtained and output (step S313).

Thereafter, the processes of steps S115 and S116 described in the first embodiment are performed. Next, the communication unit 1111 includes the concealment circuit F: = (R, L, ι), the table e, the label decryption key d: = λ _{n + u} , the mapping map, and the encryption table {(E _A (i ″, 0) | L ⁰ _{i ′} ), (E _A (i ″, 1) | L ¹ _{i ′} ), (EL _A (i ″, 0) | L ⁰ _{i ′} ), (EL _A (i ″, 1) | L ¹ _{i ′} )} or {(E _B (i ″, 0) | L ⁰ _{i ′} ), (E _B (i ″, 1) | L ¹ _{i ′} ), (EL _B (i ″, 0) | L ⁰ _{i ′} ), (EL _B (i ″, 1) | L ¹ _{i ′} )} is output. However, ι is information for specifying E _ι . These are transmitted to the secure calculation device 32, received by the communication unit 1211 of the secure calculation device 32 (FIG. 3), and stored in the storage unit 122 (step S317). Thereafter, the process of step S118 described in the first embodiment is performed, and the process ends.

<Encoding process of input value of circuit f>
The same as in the first embodiment.

<Concealment calculation using concealment circuit>
The secret calculation process using the secret circuit of the present embodiment will be described with reference to FIG.
First, instead of the secret calculation device 12, the secret calculation device 32 (FIG. 3) executes the processing of steps S141 to S148 described in the first embodiment. Next, the mapping unit 3272 obtains and outputs c _x : = H (R, map (i) | x) using R, i, x, and map (step S349). Next, instead of the secret calculation device 12, the secret calculation device 32 executes the processing from step S150 to S155 described in the first embodiment.

If i = n + u is not satisfied in step S155, the restoration unit 3273 performs (KA _{(i ")} , LA _(i") ) or (KB _{(i ")} , LB _(i") ) as follows. Output.
(A) When the output wire W (i) of the gate G (i) is the input wire W (A (i ″)) of the other gate G (i ″), the restoration unit 3273 has K _i , L _i , E _A (i ″), EL _A (i ″) to K _{A (i ″)} : = Dec (K _i , E _A (i ″))
L _{A (i ″)} : = Dec (L _i , EL _A (i ″))
And output.
(B) When the output wire W (i) of the gate G (i) is the input wire W (B (i ″)) of the other gate G (i ″), the restoration unit 3273 has K _i , L _i , From E _B (i ″), EL _B (i ″) to K _{B (i ″)} : = Dec (K _i , E _B (i ″))
L _{B (i ″)} : = Dec (L _i , EL _B (i ″))
And output.
However, when L _i = L ⁰ _i , E _A (i ″) = E _A (i ″, 0) and E _B (i ″) = E _B (i ″, 0), and L _i = L ¹ _{For i} , E _A (i ″) = E _A (i ″, 1) and E _B (i ″) = E _B (i ″, 1). Dec (α, β) means a value obtained by decrypting the ciphertext β in accordance with the same common key cryptosystem as in step S313 using α as a common key (step S3551). Thereafter, after the process of step S156, the process returns to step S147.

  On the other hand, if i = n + u in step S155, the process in step S157 is executed and the process is terminated.

[Fourth Embodiment]
The fourth embodiment is a modification of the second embodiment. In this embodiment, a general gate is concealed before the circuit f to be concealed is specified, and the circuit f to be concealed is concealed using the concealed gate. Thereby, it is possible to reduce the amount of calculation when concealing the circuit f to be concealed.

<Configuration>
As illustrated in FIG. 1, the secure calculation system 4 of this embodiment includes a secure calculation device 41 that generates a secure circuit, and a secure calculation device 42 that performs a secure calculation using the secure circuit.

<Secret calculation device 41>
As illustrated in FIG. 9, the secure calculation device 41 of the present embodiment includes a communication unit 1111, an input unit 1112, a storage unit 112, a control unit 113, an initial setting unit 314, an input wire setting unit 315, a replacement bit setting unit 1161, Input label setting unit 1162, complementing units 4171a and 4171b, inverse image unit 4172, input key generating unit 3173, input key / label table setting unit 3174, label concealing unit 3181, output label table setting unit 3182, encoding unit 1191, It has a separation unit 1192, a lost communication processing unit 1193, and a secret circuit configuration unit 3183.

<Secret calculation device 42>
As illustrated in FIG. 10, the secure calculation device 42 according to the present embodiment includes a communication unit 1211, an input unit 1212, a storage unit 122, a control unit 123, a lost communication processing unit 124, a separation unit 125, a setting unit 126, and an input wire setting. A unit 1271, a mapping unit 4272, an output key generation unit 2273, a complement unit 4274, a restoration unit 3273, a label restoration unit 1275, and an output value generation unit 128.

<Pretreatment>
The differences from the preprocessing of the first embodiment are that the circuit f to be concealed is not stored in the storage unit 112 and that a plurality of general gates are concealed. Others are the same as the first embodiment.

を得て出力する（ステップＳ４０８）。 A general gate concealment process performed in this embodiment will be described with reference to FIG. First, the secret calculation device 41 (FIG. 9) executes the processes of steps S100, S303, S304, S301, S105, S305, and S106 described above. Next, the complement unit 4171a uses the key R and the output key K ⁰ _s, and uses (4, H (R, s | 4)), (5, H (R, s | 5)), (−1, K ^0. _s ) is subjected to polynomial interpolation to obtain and output a quadratic polynomial P passing through these three points (step S4071). Further, the complementing unit 4171b uses the key R and the output key K ¹ _s, and uses (4, H (R, s | 4)), (5, H (R, s | 5)), (−1, K ¹ _s). ) To obtain a quadratic polynomial Q that passes through these three points and outputs it (step S4072). Further, the inverse image portion 2172 uses E _ι , t _ι , L ^a _A , L ^b _B , P, and Q, and for all (a, b) ε {0, 1} ² ,

Is obtained and output (step S408).

  Thereafter, similarly to the third embodiment, the processes of steps S109, S311, S3121, and S3092 are executed. The process returns to step S304 (step S3093). On the other hand, if s = 1, the process ends.

<Secret circuit generation processing>
The same as in the third embodiment.

<Encoding process of input value of circuit f>
The same as in the first embodiment.

<Concealment calculation using concealment circuit>
The secret calculation process using the secret circuit of this embodiment will be described with reference to FIG.
First, instead of the secret calculation device 22, the secret calculation device 42 (FIG. 10) executes the processing of steps S141 to S148, S150, S251, and S252. Thereafter, the complementing unit 4274 uses R, i, V, and map, and (4, H (R, map (i) | 4)), (5, H (R, map (i) | 5)), V And a quadratic polynomial U is generated (step S453).

  Thereafter, the processes of steps S254, S153 to S155 are executed. If i = n + u is not satisfied in step S155, the process returns to step S147 after the processes of steps S3551 and S156. If i = n + u in step S155, the process of step S157 is executed and the process is terminated.

を満たす秘匿化出力ラベル

を設定してもよい。ただし、Ｈ”は任意長ビットの値をｋビット（ｋ＞３）の値に写す一方向性写像Ｈ”：｛０，１｝^＊→｛０，１｝^ｋである。一方向性写像の例はハッシュ関数である。共通鍵暗号関数または公開鍵暗号関数を一方向性写像として用いてもよい。一方向性写像は、関数であってもよいし、アルゴリズムであってもよい。また［α］_βはαのβに対応するビット位置（例えば先頭からβ＋１ビット目）のビット値を表す。すなわち、秘匿化出力ラベルが、入力鍵に対応するビット列の元（ａ，ｂ）に応じたビット位置を表してもよい。この場合、ステップＳ１５４では、式（２）に代えて、以下のように出力ラベルＬ_ｉを得る。

[Modifications, etc.]
In addition, this invention is not limited to the above-mentioned embodiment. For example, instead of equation (1) in step S111, for all (a, b) ε {0, 1} ² ,

Concealed output label that satisfies

May be set. Here, H ″ is a one-way map H ″: {0, 1} ^* → {0, 1} ^k that maps an arbitrary-length bit value to a k-bit (k> 3) value. An example of a one-way map is a hash function. A common key encryption function or a public key encryption function may be used as the one-way map. The one-way map may be a function or an algorithm. [Α] _β represents a bit value of a bit position (for example, β + 1 bit from the head) corresponding to _β of α. That is, the concealment output label may represent a bit position corresponding to the element (a, b) of the bit string corresponding to the input key. In this case, in step S154, the output label L _i is obtained as follows instead of the equation (2).

In the embodiment described ^above, with _L a ^{A, L} _b with ^{2L a} _A ^{+ L} _{b B} as a value corresponding to _{B, L A, 2L A +} L B as a value corresponding to the _{L B.} However, instead of 2L ^a _A + L ^b _B , another injective map g (L ^a _A , L ^b _B ): {0,1} ² → {0,1} is used, and instead of 2L _A + L _B g (L _A , L _B ) may be used.

この場合、ステップＳ１５０〜Ｓ１５２に代えて、ｘ＝１であればＫ_Ａ，Ｋ_Ｂおよびｃ_ｘからＫ_ｉ：＝Ｅ_i（Ｋ_Ａ＋Ｋ_Ｂ）（＋）ｃ_ｘを得て出力し、ｘ≠１であればＫ_Ａ，Ｋ_Ｂおよびｃ_ｘからＫ_ｉ：＝Ｅ_i（Ｋ_Ａ＋２Ｋ_Ｂ）（＋）ｃ_ｘを得て出力すればよい。ステップＳ１５０，Ｓ２５１，Ｓ２５２に代えて、ｘ＝１であれば、ｘおよびＫ_Ａ，Ｋ_ＢからＶ：＝（ｘ，Ｅ_i（Ｋ_Ａ＋２Ｋ_Ｂ））を得て出力し、ｘ≠１であれば、ｘおよびＫ_Ａ，Ｋ_ＢからＶ：＝（ｘ，Ｅ_i（Ｋ_Ａ＋Ｋ_Ｂ））を得て出力すればよい。 Further, instead of the simultaneous equations for K ⁰ _A , K ¹ _A , K ⁰ _B , and K ¹ _B exemplified in step S110, P ₀ , P ₁ , P ₂ , P ₃ , K ⁰ _A , K ¹ _A , K ⁰ _B, ^K with ^{_{K 1 B 0 a, K 1}} a, K 0 B, may be used other simultaneous equations for ^K _{1 B.} In this case, according to P _{x on} the left side of the simultaneous equations to be used and the expression on the right side where the equal sign is established, the expressions for K _A and K _B corresponding to x in steps S150, S151, S152, S251, and S252. Can be changed. For example, the following simultaneous equations may be used.

In this case, instead of steps S150 to S152, if x = 1, K _i : = E _i (K _A + K _B ) (+) c _x is obtained and output from K _A , K _B and c _x , x If ≠ 1, K _i : = E _i (K _A + 2K _B ) (+) c _x may be obtained from K _A , K _B and c _x and output. Instead of steps S150, S251 and S252, if x = 1, V: = (x, E _i (K _A + 2K _B )) is obtained from x and K _A , K _B and output, and x ≠ 1 If there is, V: = (x, E _i (K _A + K _B )) may be obtained from x and K _A , K _B and output.

  When a plurality of circuits f exist in parallel, the above-described processing may be performed independently for each circuit. The polynomial of the second embodiment may be a monomial. Further, instead of concealing all the gates of the circuit f by one secret calculation device, the gates of the circuit f may be shared by a plurality of secret calculation devices. For example, a secret calculation device that is different for each gate may perform the above-described concealment process.

Also, λ _{n + u} = 0 may be used. In this case, Y: = L _{n + u} may be used instead of step S157.

  In addition, instead of each device exchanging information via a network, at least a part of the devices may exchange information via a portable recording medium. Alternatively, at least some of the devices may exchange information via a non-portable recording medium.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  When the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  This program is distributed, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads a program stored in its own recording device and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and each time the program is transferred from the server computer to the computer. The processing according to the received program may be executed sequentially. The above-described processing may be executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. Good.

  In the above embodiment, the processing functions of the apparatus are realized by executing a predetermined program on a computer. However, at least a part of these processing functions may be realized by hardware.

11, 12, 21, 22 Secret calculation device

Claims (8)

An image trap corresponding to a value corresponding to an input label corresponding to each element of the domain of the gate and an output key of the gate corresponding to each output value when the element is input to the gate A reverse image part for obtaining a reverse image by door one-way replacement;
An input key generation unit that obtains an input key corresponding to each of the originals using the inverse image;
A label concealment unit that obtains a concealed output label using the input key and concealing an output label according to an output value when the source is input to the gate;
A secret computing device. The secret calculation device according to claim 1,
The secret image calculation apparatus, wherein the inverse image unit obtains an inverse image by trapdoor unidirectional replacement of the image, which is an exclusive OR of a value corresponding to the input label and the output key. The secret calculation device according to claim 1,
A first complement that obtains a first formula determined by a plurality of points according to the gate and a point consisting of a predetermined value and the output key according to a first value that is one of the output values;
A second complementing unit that obtains a second equation determined by the plurality of points and a point formed by the predetermined value and the output key corresponding to a second value that is one of the output values;
Unlike the first value and the second value,
The inverse image portion is a value obtained by substituting a value corresponding to an input label corresponding to the element whose output value when input to the gate is the first value into the first integer. Substitute an image of the image by the trapdoor unidirectional replacement, and a value corresponding to the input label corresponding to the element in which the output value when input to the gate becomes the second value is substituted into the second integer The secret calculation apparatus which obtains the reverse image by trapdoor unidirectional replacement | exchange of the said image which is the value obtained by this. The secret calculation device according to any one of claims 1 to 3,
The output label concealment unit conceals the output label with a value corresponding to the input key to obtain the concealed output label, or represents a bit position corresponding to the source of the bit string corresponding to the input key A secret calculation device for obtaining the concealment output label. An output key generating unit for obtaining an output key of the gate according to a value corresponding to an input label according to an input value of the gate and an image obtained by trap door unidirectional replacement of the input key of the gate;
Using a concealment output label according to the output value of the gate and an input key of the gate, a label restoration unit for obtaining an output label according to the output value of the gate;
A secret computing device. The secret calculation device according to claim 5,
The secret key calculation apparatus, wherein the output key generation unit uses, as an output key of the gate, an exclusive OR of a value corresponding to the input label and a value that is an image obtained by trapdoor unidirectional replacement of the input key of the gate . The secret calculation device according to claim 5,
The output key generation unit
A plurality of points according to the gate, and a complementing unit for obtaining an equation determined by a point consisting of a value corresponding to the input label and a value that is an image obtained by trapdoor unidirectional replacement of the input key of the gate;
And a substituting unit that obtains an output key of the gate by substituting a predetermined value into the formula.   A program for causing a computer to function as the secret calculation device according to claim 1.

Images