JP2022056275A - Cryptographic decryption system, cryptographic decryption method, and cryptographic decryption program - Google Patents

Abstract

To provide a cryptographic decryption system capable of eliminating key management while reducing computational load and cost.SOLUTION: The cryptographic decryption system includes: a cryptographic generator 100 having a cryptographic generation unit 101 that operates to generate ciphertext; and a decoder 200 having a decoding unit 201 that receives a ciphertext from the cryptographic generator 100 and decrypts the ciphertext into plaintext. The cryptographic generation unit 100 and the decoder 200 include a cryptographic side common key generator 102 and a decryption side common key generator 202 respectively for each generating an identical common key by exchanging notification information generated by a one-dimensional mapping operation. The cryptographic generation unit 101 performs cryptographic generation based on the common key, and the decoding unit performs a series of decryption processing based on the common key.SELECTED DRAWING: Figure 2

Description

The present invention relates to a cryptographic decryption system, a cryptographic decryption method, and a cryptographic decryption program.

Since the one-dimensional map has a chaotic property, a random number generator and a common key cryptographic method have been proposed as shown in Patent Document 1. However, in 1D mapping, statistical indicators are shown in terms of random number performance, but security indicators are not shown at this stage in terms of security, and appropriate key implementation methods and cryptography to ensure security are shown. The method has not been clarified.

Patent Document 2 (Japanese Patent Laid-Open No. 2002-08638) discloses an arithmetic compression encryption device. This arithmetic type compression encryption device encodes the symbol based on the appearance probability of the symbol output from the model device that predicts the appearance probability of the symbol. Further, this arithmetic type compression encryption device compresses and encrypts the output code by controlling a dynamic piecewise linear map based on the appearance probability of the input symbol with an encryption key. According to this device, high security can be obtained without impairing the original data compression rate due to arithmetic coding, and the output code can be efficiently disturbed by a simple process.

Patent Document 3 discloses that a new chaotic time series capable of high-speed calculation is searched for, and a chaotic generator, a chaotic encryption device, or the like is realized by using this chaotic time series. This chaos generator is a means for setting a prime number mi [i = 1 to L, L ≧ 1] for a function fi (n) [i = 1 to L, L ≧ 1] that rapidly increases as the variable n increases. And the initial value calculation means for deriving the remainder ri (n0) [i = 1 to L, L ≧ 1] from fi (n0) with respect to the initial value n0 of the variable n, and fi (n + 1). In the calculation of, the iterative arithmetic means for deriving the remainder ri (n + 1) derived by the method of the prime number mi using the remainder ri (n), and the remainder ri (n) [i] while sequentially increasing the variable n from n0. = 1 to L, L ≧ 1], it is composed of a chaotic signal output means that outputs a chaotic time series Xn having a unique value. As a result, a reproducible chaotic time-series signal is output at high speed, and a highly secure encryption device or the like is realized.

Patent Document 4 discloses a cryptographic communication system suitable for encrypting and transmitting information. The transmitting device and the receiving device of the cryptographic communication system generate a private key and a public key, respectively, generate a random number based on the current time, create a session key using the generated random number, and use RSA encryption technology. Use to share the session key. The shared session key is also used for random number encryption, and the session key is authenticated by matching the original random number when the encrypted random number is decrypted. The information to be transmitted is transmitted by vector stream cipher with the authenticated session key, and the communication can be kept secret.

Patent Document 5 discloses a cryptographic generator. This device has a parameter generation means that generates a parameter string used for chaos calculation based on key data, a chaos noise generation means that performs chaos calculation using the generated parameter sequence to obtain chaos noise, and a ciphertext of chaos noise. It includes an exclusive OR circuit that performs an operation applied to information to obtain a ciphertext, and a feedback path that feeds back the ciphertext obtained by the exclusive OR circuit to the chaos noise generating means. In the above-mentioned chaos noise generating means, chaos calculation is performed based on the fed-back ciphertext to obtain chaos noise. This configuration makes it impossible to decipher another ciphertext from one pair of plaintext and ciphertext.

The above-mentioned common key cryptosystem requires key management, and when the communication partner is N to N, N (N-1) keys are required, so that key management is costly.

Japanese Unexamined Patent Publication No. 2016-081274 Republished 2002 No. 50838 Gazette Japanese Unexamined Patent Publication No. 2005-17612 Japanese Unexamined Patent Publication No. 2006-67412 Japanese Unexamined Patent Publication No. 2008-197685

上記合同算術の式を説明する。生成元ｇと、べき乗ｒ、法Ｐと余りｙからなり、例えば“ｇ＝２、ｒ＝１１、Ｐ＝１１”と値を設定した場合、式（１）は、２１１≡２（ｍｏｄ １１）になり、２１１＝２０４８を１１で割ると余りが２となることを示し、１１の法（ｍｏｄｕｌｏ）をとった剰余は２となる。 <Diffie-Hellman key sharing method>
Conventionally, a Diffie-Hellman key sharing method is known as a key sharing method. This method is known as the key sharing algorithm that solves the key delivery problem for the first time in history. FIG. 1 is a sequence of Diffie-Hellman key sharing methods.
Here, a case where the encryption generator and the decryption device share a secret common key will be described. The cipher generator and the decryption device communicate with each other and agree on the joint arithmetic expression of the equation (1) with respect to the generator g and the prime number P as the modulo (S11).

The formula of the above modal arithmetic will be described. It consists of a generator g, a power r, a method P, and a remainder y. For example, when the values are set as "g = 2, r = 11, P = 11", the equation (1) is 211≡2 (mod 11). When 211 = 2048 is divided by 11, the remainder is 2, and the remainder after the modulo 11 method is 2.

The encryption generator generates a number (natural number) Sa of 2 or more and less than P known only by the encryption generator as confidential information (S12). The decoding device generates a number (natural number) Sb of 2 or more and less than P known only by the decoding device as confidential information (S13). The encryption generator sets the generator g agreed with the decryptor and the prime number P to be the law in the equation (1). The encryption generator executes an operation according to the following equation (2) in which the number Sa, which is secret information, is set to the power r of the equation (1), and generates a remainder ya. The generated ya is transmitted to B as notification information (S14).

On the other hand, the decoding device sets the number Sb, which is secret information, to the power r of the equation (1), executes the operation according to the following equation (3), and generates the remainder yb. The decryption device transmits the generated yb as notification information to the encryption generation device (S15).

上記において、ｙｂはｇＳｂをＰで法を取った値のためｙｂにｇＳｂを当てはめると、

が成り立っている。 Next, the secret information (common key) shared by the encryption generator and the decryption device is generated.
The encryption generator receives the notification information yb from the decryption device, sets the notification information yb as the generation source g of the equation (1), and sets the number Sa known only by the encryption generator (user of the encryption generator, etc.) to the equation (1). ) Is set to the power r, and the remainder Ca is generated (S16).
When the processing is expressed by an equation, it becomes the following equation (4).

In the above, since yb is a value obtained by formulating gSb by P, when gSb is applied to yb,

Is established.

上記において、ｙａはｇＳａをＰで法を取った値のためｙａにｇＳａを当てはめると

が成り立っている。 On the other hand, the decryption side receives the notification information ya from the encryption generator, sets the notification information ya as the generator g of the equation (2), and sets the number Sb known only to the compound device (user of the decryption device, etc.) to a power. It is set to r and the remainder Cb is generated (S17).
When the processing is expressed by an equation, it becomes the following equation (6).

In the above, since ya is a value obtained by formulating gSa by P, when gSa is applied to ya,

Is established.

The remainder Ca and Cb obtained by the cryptographic generator and the decryption device have the relationship of the following equation (8), and the cryptographic generator and the decryption device share the same number "Ca = Cb" between A and B. Can be used as a key.

According to the above-mentioned Diffie-Hellman key sharing method, although it is possible to eliminate the need for key management, there is a problem that an operation for obtaining a remainder is required, an operation load becomes large, and an operation cost increases.

In the present embodiment, it is possible to eliminate the need for key management, and to reduce the calculation load and the calculation cost.

The encryption / decryption system according to the present embodiment has a cipher generator having a cipher generator that generates an cipher by calculation, and a decryption unit that receives an cipher from the cipher generator and decrypts the cipher into plain text. In a cryptographic decryption system including a decryption device, the cryptographic generation device and the decryption device exchange notification information generated by each of them by a one-dimensional mapping calculation to generate the same common key. It is characterized in that a generation unit and a decryption side common key generation unit are provided, the encryption generation unit performs encryption generation based on the common key, and the decryption unit performs decryption processing based on the common key.

Diffie-Hellman key sharing method sequence diagram. The block diagram of the encryption / decryption system which concerns on 1st Embodiment of this invention. Configuration diagram of a computer system that realizes the encryption generator according to the first embodiment of the present invention. Map of Bernoulli shift map. The figure of the time series with the horizontal axis of i of the Bernoulli shift map by the equation (9) and the vertical axis of xi + 1. The figure which shows the numerical value of the joint arithmetic result by a certain value. A map of the Bernoulli shift map by the five equations of equation (10). The figure which shows the transition of the value which performed the repetition by giving the initial value X0 = 1/11 to the equation (10) and the value which set "g = 5" of the equation (9), and set the prime number P = 11 as a method. .. The figure which shows the source code of the program which described the formula (11) of the Bernoulli shift mapping which was made into an integer arithmetic, and the formula (1) of a joint arithmetic operation in C language. The figure which shows the calculation result which executed the program of FIG. The figure which shows the example which calculated by putting the numerical value concretely about the Diffie-Hellman key sharing by the Bernoulli shift mapping. Flow chart until the cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 generate a common key. The figure which shows the position of each point on an arc when the initial value θ0 = π / 11 is set and the phase is changed by π / 11 in a circle. The figure which shows the result of having calculated "2nθ0" by setting the initial value θ0 = π / 11 in the formula (13). The figure which shows the example (forward elimination) of finding the 4th-order one-variable polynomial using "Gauss-Jordan method". The figure which shows the example (backward substitution) of finding the 4th-order one-variable polynomial using "Gauss-Jordan method". The figure which shows the one-variable polynomial which has the degree of degree 2 or more equivalent to "sin2G2θ" and the map when G is shaken from 2 to 9 and each coefficient is obtained by using the Gauss-Jordan method. Flowchart of how to calculate key sharing by one-variable polynomial. FIG. 16 is a diagram showing specific movements of numerical values by executing the flowchart shown in FIG. The figure which sets “P = 19” in the formula (24) and shows the value of “Xi” calculated up to “n = 7”. The block diagram of the encryption / decryption system which concerns on the 2nd Embodiment of this invention. The flowchart which shows the session key generation of the encryption / decryption system which concerns on 2nd Embodiment of this invention. The figure which shows the specific numerical value which executed the flowchart of FIG. 18A. The flowchart which shows the operation in the case where the encryption generation unit 101 and the decryption unit 201 of the second embodiment of the present invention realize a system by common key cryptography using a common key CK and a session key SK. The figure which shows the processing example which put the concrete numerical value into the encryption and the decryption in the flowchart of FIG. The block diagram which described the processing content of each part of the encryption / decryption system of 2nd Embodiment. The block diagram of the encryption / decryption system which concerns on 3rd Embodiment of this invention. The flowchart which shows the process of the update key generation in 2nd Embodiment. The flowchart which shows the main part of the process of the update key generation of FIG. The figure which shows the processing shown in FIG. 23 described in the C language program. The figure which shows the 1st fluctuation pattern example of the inclination coefficient G in the generation process of the update key which concerns on 2nd Embodiment of this invention using a specific calculated value. The figure which shows the 2nd fluctuation pattern example of the slope coefficient G in the generation process of the update key which concerns on 2nd Embodiment using the specific calculated value. The figure which shows the generation process of the update key which concerns on 2nd Embodiment using the specific calculated value. It is a figure which shows the example which executed the process A program of FIG. 8 (a) when the inclination coefficient G was fixed without changing, using concrete numerical values. A flowchart showing the operation of an encryption / decryption system that outputs a key, encrypts it, and decrypts it. It is a figure which shows the processing when the processing of FIG. 28 is performed using the specific numerical value. The figure which shows the procedure for finding the integer solution of a linear indefinite equation with the numerical value of an example. The block diagram of the encryption / decryption system which concerns on 4th Embodiment of this invention. A one-variable polynomial (28) generated from a common key and its map diagram. The flowchart which shows the process of updating a key using the formula (28). The figure which shows the example of the calculation which performed the key update by the equation (29) by the flowchart of FIG. The figure which shows another method for the generation of a one-variable polynomial.

Hereinafter, the encryption / decryption system, the encryption / decryption method, and the encryption / decryption program according to the first to third embodiments of the present invention will be described with reference to the accompanying drawings. In each figure, the same components are designated by the same reference numerals, and duplicate description will be omitted. FIG. 2 is a block diagram showing a first embodiment of a cryptographic decryption system. The encryption / decryption system according to the first embodiment includes a encryption generation device 100 and a decryption device 200.

The cipher generation device 100 includes a cipher generation unit 101 that generates a ciphertext by calculation, and a cipher side common key generation unit 102. The decryption device 200 includes a decryption unit 201 that receives a ciphertext from the encryption generation device 100 and decrypts the ciphertext into plaintext, and a decryption side common key generation unit 202. The cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 exchange notification information generated by each of them by a one-dimensional mapping operation to generate the same common key.

FIG. 2A is a configuration diagram of a computer system that realizes the encryption generator 100 according to the first embodiment of the present invention. FIG. 2A is also a configuration diagram of a computer system that realizes the decoding device 200 according to the first embodiment of the present invention. The encryption generation device 100 and the decryption device 200 according to the embodiment of the present invention can be configured by, for example, a personal computer, a workstation, or another computer system as shown in FIG. 2A. This computer system relates to the present embodiment and other embodiments by controlling each part based on a program or data stored in the main memory 11 or read into the main memory 11 by the CPU 10 and executing necessary processing. It operates as a code generator 100 or a decryption device 200.

An external storage interface 13, an input interface 14, a display interface 15, and a communication interface 16 are connected to the CPU 10 via a bus 12. A program such as a state change detection program and an external storage device 23 in which necessary data and the like are stored are connected to the external storage interface 13. An input device 24 such as a keyboard as an input device for inputting commands and data and a mouse 22 as a pointing device are connected to the input interface 14.

A display device 25 having a display screen such as an LED or an LCD is connected to the display interface 15. Ports 26-1, 26-2, ..., 26-m for obtaining notification information and ciphertext are connected to the communication interface 16. In the encryption / decryption system according to the present embodiment, when the encryption generation device 100 and the decryption device 200 communicate with each other, one port 26-1, 26-2, ..., 26-m is used. can do. The computer system may be provided with other configurations, and the configuration of FIG. 2A is only an example. The configuration by this computer system is not limited to this first embodiment, but is also adopted in the configuration as each embodiment after the second embodiment and as a modification thereof.

As an example of a one-dimensional map, the Bernoulli shift map can be mentioned, and it was found that the Bernoulli shift map and the above-mentioned modal arithmetic are synchronized.
<About Bernoulli shift mapping>
The Bernoulli shift map is defined by the following equation (9).

FIG. 3 is a map of the Bernoulli shift map. FIG. 4 is a time series in which i of the Bernoulli shift map according to the above equation (9) is the horizontal axis and xi + 1 is the vertical axis.
In FIG. 4, "initial value x0 = 0.234" is set, and since "x0 <0.5", the calculation of "x1 = 2x0" is performed to obtain x1 = 0.468, and "x1 <0.5". Therefore, the calculation of "x2 = 2x1" is performed to obtain "x2 = 0.936", and then "x3, x4, ..." And the open interval (0,1) are repeated and the transition is shown. ing.

<Synchronization of Bernoulli shift mapping and modal arithmetic>
The synchronization between Bernoulli shift mapping and modal arithmetic is described.
The initial value x0 of the equation (9) is set to the repeated value of xi when "1/11" is set, and the arithmetic expression (1) is set to "g = 2", and the prime number P = 11 is set as the method. FIG. 5 shows the value of the remainder when the index r on the left side is set and swung from 0 to 11.
For equation (1), the larger the exponent r, the larger the digit becomes. Therefore, by taking the modulo method in the joint arithmetic, the result of multiplying a certain value Q is multiplied by another value Q, and the remainder is obtained. Is calculated using this technique because it has the property of being equal to the remainder of the original multiplication (Q3) and can be calculated with a reduced number of digits.

FIG. 5 is a diagram showing a time series comparison between the Bernoulli shift map and the joint arithmetic. Comparing the numerical value of the numerator in the fraction, which is the calculation result Xi of the Bernoulli shift map shown in FIG. 5 (a), with the number of remainders obtained by the joint arithmetic in FIG. 5 (b), it is found that they are the same and are synchronized. I understand.
Considering an indivisible number, when the improper fraction (2i / 11) is, for example, i = 6, 64/11 = 55/11 + 9/11 = 5 + 9/11, and the mixed fraction is a multiple of 11 and 5 is grouped out. This is because 9 in the numerator of the true fraction (9/11) is also shown as the remainder of the division of 11.
From the above, it can be seen from FIG. 5 that the Bernoulli shift mapping returns to 1/11 and x0 at the time of x10 and is repeated with a period length of 10.

Next, consider an equation of a Bernoulli shift map in which the generating source g of the equation (1) is a numerical value other than 2. As an example, consider the case of g = 5, and the Bernoulli shift map synchronized with this is an equation consisting of the following equation (10). The map of equation (10) is shown in FIG.

FIG. 7 shows a value obtained by giving an initial value X0 = 1/11 to the equation (10) and repeating it, and a value in which “g = 5” of the equation (1) is set and a prime number P = 11 is set as a method. It is a figure which shows the transition. Referring to FIG. 7 as in the case of g = 2, comparing the numerator of the repeat Xi in the formula (9) shown in FIG. 7 (a) with the number of remainders by the joint arithmetic shown in FIG. 7 (b). , It can be seen that they are the same value and are synchronized. This is also because in fraction operations, the numerator of the true fraction points to the remainder of the modal arithmetic, and no matter what the tilt coefficient is, the numerator of the true fraction and the remainder of the modal arithmetic have the same value. .. In FIG. 7A, X5 = 1/11, and it can be seen that the cycle length is repeated at 5 because it returns to the initial value X0.

Considering the above comprehensively, it can be seen that the numerator of the true fraction of the iterated value of the Bernoulli shift map corresponds to the remainder of the modal arithmetic and is synonymous with the remainder of the modal arithmetic. From the above, it was shown that the modal arithmetic that takes the power method of the generator g can be replaced with the Bernoulli shift map, and the power of the joint arithmetic corresponds to the number of iterations of the Bernoulli shift map.

<Integer arithmetic of Bernoulli shift map>
Next, consider the integer arithmetic of the Bernoulli shift map.
Up to this point, the Bernoulli shift map has dealt with the open interval (0,1), but by multiplying the interval by a prime number P to make it an open interval (0, P) so that integer operations can be performed, it is equivalent to the remainder of the power arithmetic. Xi can be obtained.
The Bernoulli shift map, in which the slope coefficient is set to "G" and is expanded from "1" to the open section (0, P) and converted into an integer operation, the linear equations of each tilt coefficient G are put together as shown in the following equation (11). It shall be expressed briefly. In this specification, the same reference numerals are used for "G" simply as "G" as in the case of the "slope coefficient G" and the "generation source G" Gauss-Jordan method, but "x" used in the equation. It means that it is a certain numerical value, not a special numerical value, so it is not distinguished in the case of "slope coefficient G", "generation source G", Gauss-Jordan method, etc. Use "G".

The subscript k of "Mk" indicates a variable for each range for selecting each linear expression of the equation (11) (the number of linear expressions is G), and k is inclined from "0" (M0 = 0). It represents a natural number up to a coefficient G (Mk + 1 = G).
For example, if P = 1 (no enlargement), the equation (9) is obtained with the slope coefficient G = 2, and the equation (10) is obtained with the slope coefficient G = 5.

FIG. 8 is a source code of a program in which the formula (11) of the Bernoulli shift mapping converted into an integer arithmetic and the formula (1) of the joint arithmetic are described in C language. FIG. 8 (a) is of a Bernoulli shift map and FIG. 8 (b) is of a modal arithmetic operation.
FIG. 9 is a calculation result obtained by executing the program of FIG. FIG. 9A shows the result of Xi in which the slope coefficient G = 5, the maximum interval P = 11, the number of repetitions r = 11 are set in the Bernoulli shift mapping equation (11), and repetition is performed up to X10. In FIG. 9 (b), the power of the left side is changed to "0, 1, 2, ..., 10" (set to r = 11) with the generator g = 5 and the method P = 11 of the joint arithmetic expression (1). It shows the remainder of the result of dividing each power of 5 by the method 11. It can be confirmed that in both FIGS. 9 (a) and 9 (b), the number of iterations “i” of the Bernoulli shift map and the value of the power correspond to each other and have the same solution.

In the program of the Bernoulli shift mapping formula (11) of FIG. 8A, the section (0, P) is divided so that the boundary “P × Mk / G” or “P × Mk + 1 / G” of each section is divisible. Further, by multiplying by G, the maximum interval (0, G × P) is set, and the boundary of each interval can be handled only by an integer. In a specific example, the boundary value of the interval is "0/5, 11/5, 22/5, 33/5, 44, 5, 55/5" from the equation (11), but since it is not divisible, it is multiplied by 5. The value of "0,11,22,33,44,55" is obtained as a boundary value and stored in the memory (array interval [G]). The value "P × Mk" to be subtracted is selected by the search process of the section corresponding to the value of Xi (in the program of FIG. 8, all the cases are searched in descending order and the search ends when the search is completed).

Therefore, in the "printf" statement that outputs the calculation result in the program to the monitor, Xi is divided by G and then output, and the return value of the function is also Xi divided by G.
The arithmetic operation by the equation (1) is performed by multiplying the remainder of the method 11 by g = 5 to obtain the remainder of the method 11, as shown in the source code shown in FIG. 8 (b) implemented in C language. The method of performing the remainder arithmetic by repeating multiplication by g = 5 is used.

<Diffie-Hellman key sharing by Bernoulli shift mapping>
FIG. 10 is an example of Diffie-Hellman key sharing by Bernoulli shift mapping, which is calculated by specifically inputting numerical values. It has already been shown that the modular arithmetic of Eq. (1) and the Bernoulli shift mapping of Eq. (11) converted into integers are equivalent sequences. The operation is performed by the process A in the Bernoulli shift mapping program of FIG. 8A according to the equation (11), and the Diffie-Hellman key sharing is performed.
The cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 shown in FIG. 10 have the coefficient G and the prime number P of the equation (11) that are mutually agreed in advance, and the generator g = 5 of the equation (1). Set the prime number P = 83 having the same calculation accuracy as the prime number P which is the method of (1). The cryptographic side common key generation unit 102 sets the number Sa = 8, which is secret information, and the decryption side common key generation unit 202 sets the number Sb = 17, which is secret information.

The left side of FIG. 10 is the processing of the cryptographic side common key generation unit 102, and the cryptographic side common key generation unit 102 has an inclination coefficient G = 5 corresponding to the generation source g of the equation (1) and the equation (1) in the equation (11). (S21), a prime number P = 83 having a calculation accuracy equivalent to that of the prime number P according to the above method is set. The cryptographic side common key generation unit 102 sets the number Sa = 8, which is secret information known only to the cryptographic side common key generation unit 102, to the number of iterations r of the mapping, sets the initial value X0 = 1, and repeats the mapping to 8. As a result of the rounds, X8 = 27 (S22). X8 = 27 obtained by the cryptographic side common key generation unit 102 is transmitted to the decryption side common key generation unit 202 as notification information (S23).

On the other hand, the right side of FIG. 10 is the processing of the decryption-side common key generation unit 202, and the decoding-side common key generation unit 202 has a slope coefficient G = 5 corresponding to the generation source g of the equation (1) and calculation accuracy in the equation (11). The prime number P = 83 is set (S24). The decoding side common key generation unit 202 sets the number Sb = 17, which is secret information known only to the decoding side common key generation unit 202, to the number of iterations r of the mapping, and sets the initial value X0 = 1 to repeat the mapping. As a result of performing 17 times, "X17 = 76" is obtained (S25). The "X17 = 76" obtained by the decryption-side common key generation unit 202 is transmitted to the encryption-side common key generation unit 102 as notification information (S26).

Next, the secret information shared by the encryption side common key generation unit 102 and the decryption side common key generation unit 202 is generated from the notification information sent and received by the encryption side common key generation unit 102 and the decryption side common key generation unit 202. Executes the processing of.
The cryptographic side common key generation unit 102 sets “76” received from the decryption side common key generation unit 202 in the equation (11) as a slope coefficient G = 76 (S27). The prime number P = 83, which is the calculation accuracy, is set, and the cryptographic side common key generation unit 102 sets the number Sa = 8, which is secret information known only to the cryptographic side common key generation unit 102, to the number of iterations r of the mapping, and the initial value. The mapping is repeated by setting X0 = 1 (S27). As a result, X8 = 36 is obtained (S27A).

On the other hand, the decryption side common key generation unit 202 sets “27” received from the encryption side common key generation unit 102 in the equation (4) as the slope coefficient G = 27 (S28). The prime number P = 83, which is the calculation accuracy, is set, and the decoding side common key generation unit 202 sets the secret information Sb = 17, which is known only to the decoding side common key generation unit 202, to the number of iterations r of the mapping, and the initial value X0 = 1. It is set to and the mapping is repeated (S28). As a result, X17 = 36 is obtained (S28A). The cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 can share the secret information "36" common to each other without directly transmitting it to the other party. This is used in the common key cryptosystem as the common key of the encryption side common key generation unit 102 and the decryption side common key generation unit 202.
FIG. 10A is a flowchart until the cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 generate a common key. In the block of the first line, each confidential information is generated and two agreed numerical values (here, G and P) are retained. In the block of the second line, the encryption side common key generation unit 102 and the decryption side common key generation unit 202 each generate notification information by Bernoulli shift mapping, and the notification information is exchanged. In the block of the third line, the common key is generated by the Bernoulli shift mapping using the exchanged notification information and the secret information kept secret by each.
The above is an example of performing the Diffie-Hellman key sharing method by Bernoulli shift mapping, and the calculation of the division remainder can be completed by subtraction, and the calculation cost can be expected to be reduced.
The above is the case where the Diffie-Hellman key sharing method is performed by Bernoulli shift mapping, it can be configured by hardware, and the configuration circuit of the hardware is such that the arithmetic circuit of the division remainder is a subtraction circuit, and the hardware. It is possible to simplify the configuration of the circuit and simplify the circuit.

The cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 each hold different unique secret information and also hold two numerical values (in this embodiment, a slope coefficient G and a prime number P). , Each performs a one-dimensional mapping calculation using the above secret information and the above two numerical values to generate notification information.
Further, when the encryption side common key generation unit 102 and the decryption side common key generation unit 202 receive the notification information, the encryption side common key generation unit 102 and the decryption side common key generation unit 202 generate a common key by a one-dimensional mapping calculation using the notification information and the secret information.

Regarding the security of the Diffie-Hellman key sharing method, when P is a large prime number in equation (1), it is easy to find the remainder y from "g, r, and P", but the bottom is g from "g, y, and P." It is said that it is very difficult to obtain the logarithm r of y, which is called the discrete logarithm problem. At present, no method for efficiently solving the discrete logarithm problem has been found, and it is regarded as the basis of safety.
Regarding the bit digits of the prime number P currently used, the generator g and the prime number P set published in RFC3526 (More Modular Exponential (MODEP) Diffie-Hellman groups for Internet Key Exchange (IKE), May 2003). Is present, and the digit of the prime number P is 1536 bits (1536 bit MODP group) or more, and it is recommended to use 2048 bits or more.

特開２０１９－１６８９６３「乱数生成装置」にて示されるように、式（１２）は以下の式（１３）に変換できる。 <Key sharing method by one-dimensional mapping of one-variable polynomial>
In the above embodiment, it has been shown that the one-dimensional mapping of common key generation is performed by the Bernoulli shift mapping, but this one-dimensional mapping can be a one-dimensional mapping of a one-variable polynomial.
In the Bernoulli shift map of equation (11), it is a linear equation in which the power multiplier of the term "x" is "1". A new example of key sharing using a polynomial having a second or higher degree as a one-dimensional map, such as a logistic map, is shown.
The logistic map becomes the following recurrence formula (12), and the power of Xi is quadratic.

As shown in JP-A-2019-168963 "Random number generator", the equation (12) can be converted into the following equation (13).

Ｘ１は

となるため、

より

三角関数の加法定理より

のため、最終的に

が得られる。同様に求めたＸ１を式（１２）に代入することでＸ２は

が得られ、Ｘ３，Ｘ４，…と繰り返していくことで写像の回数を示す添え字を“ｎ”とすると

が導かれ、“ｎ”回目の写像の値が位相 “２ｎθ” により一意にわかるロジスティック写像の式（１３）に変形できる。 The initial value X0 of the logistic map equation (12) is substituted as the case of the trigonometric function sin2θ.

X1 is

Because it becomes

Than

From the addition theorem of trigonometric functions

Because of

Is obtained. By substituting the similarly obtained X1 into the equation (12), X2 can be obtained.

Is obtained, and if the subscript indicating the number of mappings is set to "n" by repeating X3, X4, ...

Is derived, and the value of the "n" th map can be transformed into the logistic map equation (13) in which the value of the map is uniquely known by the phase "2nθ".

Focus on the phase "2nθ" in equation (13). FIG. 11 is a diagram showing the positions of each point on the arc when the phase is changed by π / 11, and the values of the points on the arc at positions symmetrical to the left and right with respect to π / 2 have the same value. Take. Here, for example, if the initial value θ0 = π / 11 is set and “2nθ0” is calculated, it can be seen that the phase returns to the original θ0 = π / 11 when “n = 10” as shown in FIG. From Fermat's little theorem expressed by the following equation (14) in elementary number theory, this is a power "n = P-1" with a prime number P = 11 and a generator G = 2, that is, phase θ at n = 10. Returns to π / 11. This phenomenon can also be understood from the above-mentioned mechanism showing the mechanism of synchronization between the joint arithmetic and the Bernoulli shift map.

Due to the periodicity of this phase, the logistic mapping of equations (12) and (13) is always "π / P" when the prime number P is set to the initial value θ0 = π / P and the mapping is performed “P-1” times. It is estimated that even if any other source G of "2" is given as the source G, it will return to "π / P" when the mapping is repeated "P-1" times. To.

Next, create a one-variable polynomial using only one variable "X" as in equation (12), which is equivalent to "Xn = sin2Gnθ" given an arbitrary positive integer to the generator G of equation (14). Think about it.
G = 4 is given as an example, and a one-variable polynomial equivalent to “Xn = sin24nθ” is obtained. Here, when "n = 1"
Consider a solution X1 such that "X1 = sin24θ". The range of the logistic map of equation (5) is [0,1]. Therefore, considering the phase θ in which the solution X1 is “0” or “1” while “sin24θ” is between “0 and 1”, that is, the phase 4θ of the trigonometric function sin is between “0 and π / 2”.
(1) When θ = 0π / 8 Since 4θ = 0, X1 = sin24θ = 0.
(2) When θ = 1π / 8 Since 4θ = 4π / 8 = π / 2, X1 = sin24θ = 1
(3) When θ = 2π / 8 Since 4θ = 8π / 8 = π, X1 = sin24θ = 0.
(4) When θ = 3π / 8 Since 4θ = 12π / 8 = 3π / 2, X1 = sin24θ = 1
(5) When θ = 4π / 8 Since 4θ = 16π / 8 = 2π, X1 = sin24θ = 0.
It is found that it is a polynomial with two maximum values and one minimum value, and it is expected that a one-variable polynomial equivalent to "Xn = sin24nθ" is constructed by the following fourth-order equation (15). can.

Next, consider finding the coefficients “a, b, c, d, e” from the above quaternary equations.
From the information in (1) above, when "x = 0", "f (0) = 0", so it can be seen that the coefficient e in the equation (15) is "e = 0".
The remaining coefficients "a, b, c, d" are the simultaneous equations shown in the following (16) having a fourth degree from the information of "(2), (3), (4), (5)" above. It is required by standing up.

得られた４つの連立方程式から係数“ａ，ｂ，ｃ，ｄ”を導出する手法を紹介する。
式（１６）は行列を使って表すと次の行列式（１８）になる。

Substitute the values of sin2θ from (2), (3), (4), and (5) for the terms "x0, x1, x2, x3" of the simultaneous equations in the above equation (16) as follows. As a result, four simultaneous equations consisting of "a, b, c, d" can be obtained.

We will introduce a method for deriving the coefficients "a, b, c, d" from the four simultaneous equations obtained.
The determinant (16) becomes the following determinant (18) when expressed using a matrix.

となり逆行列Ｘ－１を用意して式（１９）の両辺にかけると、

となり、逆行列Ｘ－１より係数Ａを求めることができる。図１３Ａと図１３Ｂは、「ガウスの消去法」を用いて４次の一変数多項式を求める例を示す図である。行列を用いた連立方程式の解法として「クラメルの公式」や「ＬＵ分解」が知られているが、ここでは図１３Ａと図１３Ｂに示すように、「ガウスの消去法」を用いて４次の一変数多項式を求める。式（１８）の変数“ｘ０，ｘ１，ｘ２，ｘ３”に上記の（数２４）を代入したものが図１３Ａの最初の行列式となる。この４×４の行列式の位置を指定できるよう各行にＣ０～Ｃ３を、各列にＲ０～Ｒ３を振ってある。 Here, the matrix part of the variable x of the "4 × 4" in the equation (18) is "X", the coefficients (a, b, c, d) are "A", and (0,1,0,1) is "E". If you say,

When the inverse matrix X-1 is prepared and applied to both sides of equation (19),

Therefore, the coefficient A can be obtained from the inverse matrix X-1. 13A and 13B are diagrams showing an example of finding a fourth-order one-variable polynomial using the "Gauss-Jordan method". "Cramer's rule" and "LU decomposition" are known as methods for solving simultaneous equations using matrices, but here, as shown in FIGS. 13A and 13B, the fourth-order method is used using the "Gauss-Jordan method". Find a one-variable polynomial. Substituting the above (Equation 24) into the variables "x0, x1, x2, x3" in equation (18) is the first determinant in FIG. 13A. C0 to C3 are assigned to each row and R0 to R3 are assigned to each column so that the position of this 4 × 4 determinant can be specified.

The Gauss-Jordan method consists of two processes, "forward elimination" and "backward substitution". In "(1) forward elimination", it is surrounded by a diagonal left diagonal line on C0R0 to C3R3 as shown in the first matrix of FIG. 13A. The diagonal line is set to "1", and the part surrounded by the triangular dotted line at the lower left of the diagonal line is converted to "0".
The details of the calculation process are described in FIG. 13A, but the calculation is performed in units of rows C. At first, in order to set C0R0 to 1, the process of dividing the entire row C0 by C0R0 is started, and the obtained row C0 = 1 is multiplied by the values of the rows C1, C2, and C3 of the column R0 to obtain each row. By performing subtraction at C0, the values in rows C1, C2, and C3 in column R0 are set to 0. After that, by similarly setting the value on the diagonal line to 1 and setting each column R to 0, the formula A in FIG. 13A is finally obtained.

By executing "(2) backward substitution" in FIG. 13B from the formula A, the value of the coefficient (a, b, c, d) is finally derived.
The calculation process in FIG. 13A uses the square root symbol √ (root) and is rationalized to make it easier to see, with the √ term removed from the denominator. Python's "SymPy" library is known as a programming language that can perform algebraic calculations using symbols (Symbol) such as √ and variable x. Since this embodiment uses trigonometric functions and square roots, it is an operation that handles irrational numbers. It is necessary to consider the operation accuracy guarantee in computer implementation, but by utilizing a library that performs operations using such a radical symbol √, infinite operation accuracy implementation can be performed and the influence of calculation error can be removed. can.
The above is an example of finding a one-variable polynomial having a fourth-order degree when the generator G = 4.

の位相θが０からπ／２の間（三角関数sinは０から１の間）を取るとき、必ず解“ｆＧ（ｘ）”が０か１になる個数は“Ｇ＋１”個となることが推定できる。 FIG. 14 shows one having a second or higher order equivalent to “sin2G2θ” when each coefficient is obtained by swinging G from 2 to 9 using the Gauss-Jordan method shown in FIGS. 13A and 13B. A variable polynomial and its map are shown.
G shown in FIG. 14 is a degree of a one-variable polynomial, and the degree G is superscripted and distinguished from G as a function f (x) of each G, such as “fG (x)”. Since Eq. (18) was G = 4 when calculating the coefficients of the polynomial, the number of components in the rows and columns is G × G. In the solution on the right of the determinant (18), when the horizontal axis direction is "x = sin2G2θ" from the map of FIG. 14, the section of sin2G2θ is [0,1], so that the solution fG (x) is in this section. Considering "x = sin2G2θ" that takes 0 or 1, as shown in the example of finding the fourth-order polynomial in FIG.

When the phase θ of is between 0 and π / 2 (trigonometric function sin is between 0 and 1), the number of solutions “fG (x)” that are 0 or 1 is always “G + 1”. Can be estimated.

となり、行列式（１８）の右の解は行Ｇ個とすることができる。
例えばＧ＝５の場合は式（１７）を参考にして“ｘ”は、

の５つを割り当てて５×５の行列を構成し、図１３Ａ、図１３Ｂのようにガウスの消去法で各項の係数を求め、図１４の“ｆ５（ｘ）”となる５次の多項式を得ることができる。 Here, in equation (20), when “n = 0”, the solution “f (x) = f (0) = 0”, so it is shown that “e = 0” in equation (15). As mentioned above, the term (constant term) of the 0th order of "x" is always "0", so except for the case of "k = 0" in the equation (20).

Therefore, the solution on the right of the determinant (18) can be G rows.
For example, in the case of G = 5, "x" is based on the equation (17).

A 5 × 5 matrix is constructed by allocating the five factors, and the coefficients of each term are obtained by the Gauss-Jordan method as shown in FIGS. 13A and 13B. Can be obtained.

のため“ｘ”へ“ｆ２（ｘ）”を代入すると、

から図１４のＧ＝４の場合の式が得られる。 It is also possible to create a one-variable polynomial for each G by synthesizing functions without using the Gauss-Jordan method.
For example, when creating "f4 (x)" of G = 4 in FIG. 14, f2 (x) at G = 2 is substituted for f2 (x) and "f4 (x) = f2 (f2 (x)). ) ”. In the example of FIG. 14, when G = 2.

Therefore, when "f2 (x)" is substituted for "x",

From this, the equation for G = 4 in FIG. 14 can be obtained.

ただし次数Ｇが“２，３，５，７，１１，１３、…”となる素因数分解ができない素数の場合は、式（２２）のように関数を合成して作ることができないため、図１３のようにガウスの消去法を利用して多項式を求める。
なお、合成関数の生成はインタプリタ型言語Ｐｙｔｈｏｎの代数計算ライブラリ“ＳｙｍＰｙ”を利用し代数方程式を作ることができる。 As another example, when creating a composite function in which the degree G consists of 3 and 4, since 12 = 3 × 4, it is possible to create a one-variable polynomial having a degree of 12. When creating a composite map having a degree G = l × m from a degree l and a degree m equivalent to sin2Gnθ, the relationship of the following equation (22) holds.

However, in the case of a prime number whose order G is "2,3,5,7,11,13, ..." and cannot be factored into prime numbers, it cannot be created by synthesizing a function as in Eq. (22), so FIG. 13 The polynomial is obtained by using the Gauss-Jordan method as in.
The synthetic function can be generated by using the algebraic calculation library "SymPy" of the interpreted language Python.

Next, an embodiment in which key sharing is performed using the one-variable polynomial shown in FIG. 14 will be described. FIG. 15 is a flowchart of the key sharing calculation method. FIG. 16 is a diagram showing specific movements of numerical values by executing the flowchart shown in FIG.
15 and 16 are divided into a process performed by the cryptographic side common key generation unit 102 and a process performed by the decryption side common key generation unit 202. The decryption side common key generation unit 202 generates information to be exchanged, the encryption side common key generation unit 102 sends it to the decryption side common key generation unit 202, and the decryption side common key generation unit 202 sends it to the encryption side common key generation unit 102. Send. In the reception process, the information transmitted by each other is received, the information is set, the mapping is performed, and the secret information to be shared is obtained.

The flowchart of FIG. 15 will be described with reference to the specific numerical values of FIG. In FIG. 16, it is possible to perform the calculation using the spreadsheet software Excel (registered trademark).
The cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 mutually agree on a prime number P = 19 and a generation source G = 2 in advance (S30A, S30B). The prime number P = 19 and the generation source G = 2 are notification information, which can be sent from the cryptographic side common key generation unit 102 to the decryption side common key generation unit 202 and held by both. The number Sa, which is secret information known only to the cryptographic side common key generation unit 102, is generated (S31A), and the secret information Sb known only to the decryption side common key generation unit 202 is generated (S31B). A polynomial is generated from the generator G (S32A, S32B). When G = 2, the polynomial is the polynomial of the following logistic map. In the cryptographic side common key generation unit 102, the number Sa, which is secret information, is set to the number of repetitions r, and "sin2 (π / P)" is set to the initial value "x0" (S33A). In the decryption-side common key generation unit 202, the secret information Sb is set to the number of repetitions r, and "sin2 (π / P)" is set to the initial value "x0" (S33B).
A calculation example in which the conventional Diffie-Hellman key sharing is performed becomes the column “DH” in the table in FIG. This is the result of the calculation by substituting the formula "= MOD (POWER (2, i), 19)" into the cell to perform the calculation of ".

に初期値“ｘ０＝ｓｉｎ２（π／１９）”を浮動点小数で与え写像の反復毎の計算結果となる。
送信前の処理では暗号側共通鍵生成部１０２は、暗号側共通鍵生成部１０２のみが知る秘密情報である数Ｓａとして設定した反復回数７回、復号側共通鍵生成部２０２は、復号側共通鍵生成部２０２のみが知る秘密情報Ｓｂとして設定した反復回数４回を設定し、写像の反復をそれぞれ行っている（Ｓ３４Ａ、Ｓ３４Ｂ）。
列“ｉ”が“０”のときに“Ｘ０＝ｓｉｎ２（π／１９）”の初期値を与える計算を行い列“Ｘｉ”セルに数式“＝ＳＩＮ（ＰＩ（）／１９）＊ＳＩＮ（ＰＩ（）／１９）”を代入し、列“ｉ”が１以降のとき列“Ｘｉ”セルに一つ上のセルの数値を参照するようにして数式“＝４＊Ｘｉ－１＊（１－Ｘｉ－１）”を代入し、“Ｘｉ－１”を参照して計算を行っている。これらの計算結果“Ｘｉ”は、小数点以下９まで表示させており結果として暗号側共通鍵生成部１０２は“０．５４１２８９６７３”、復号側共通鍵生成部２０２は“０．２２６５２５９２１”を計算結果として得ておりこれを相手に送信する（Ｓ３４Ａ、Ｓ３４Ｂ）。
列“ＡｒｃＳＩＮ”は列“Ｘｉ”の数値を参照して、“ｓｉｎ２Ｇ（π／１９）”となるＧの値を次の式（２３）の逆三角関数ａｒｃｓｉｎ（ｓｉｎ－１とも表記）を用いて計算した結果となる。

The column “Xi” in the table is the polynomial of the logistic map of equation (12) corresponding to G = 2 in FIG.

The initial value "x0 = sin2 (π / 19)" is given to the floating point decimal number, and the calculation result is obtained for each iteration of the map.
In the processing before transmission, the cryptographic side common key generation unit 102 repeats 7 times set as the number Sa, which is secret information known only to the cryptographic side common key generation unit 102, and the decryption side common key generation unit 202 is common to the decryption side. The number of repetitions set as the secret information Sb known only to the key generation unit 202 is set to 4 times, and the mapping is repeated (S34A, S34B).
When the column "i" is "0", a calculation is performed to give the initial value of "X0 = sin2 (π / 19)", and the formula "= SIN (PI () / 19) * SIN (PI)" is added to the column "Xi" cell. () / 19) ”is substituted, and when the column“ i ”is 1 or later, the formula“ = 4 * Xi-1 * (1- "Xi-1)" is substituted, and the calculation is performed with reference to "Xi-1". These calculation results "Xi" are displayed up to 9 decimal places, and as a result, the encryption side common key generation unit 102 is "0.541289673" and the decryption side common key generation unit 202 is "0.2265252921" as the calculation result. Obtained and transmitted to the other party (S34A, S34B).
The column "ArcSIN" refers to the numerical value of the column "Xi", and the value of G that becomes "sin2G (π / 19)" is used as the inverse trigonometric function arcsin (also referred to as sin-1) of the following equation (23). It is the result of calculation.

The formula "= 19 * ASIN (SQRT (Xi)) / PI ()" is substituted into the cell of the column "ArcSIN", and G is obtained by referring to "Xi".
G will be described in comparison with the column “DH” (Diffie-Hellman key sharing).
The initial value of the phase is "π / 19", the value obtained by substituting "n" in the following equation (24) as 0, 1, 2, 3, ... And the result of "Xi" performed by the polynomial are as described above. From the explanation, the same value is taken in the interval [0,1].

FIG. 17 is a diagram showing the value of “Xi” calculated up to “n = 7” with “P = 19” in the equation (24). The value of the phase molecule in FIG. 17 and the value of the transmission processing column “DH” of the cryptographic side common key generation unit 102 in FIG. 16 are the same numerical value. Further, it can be confirmed that the calculation result performed by the equation (24) and the calculation result of iterating the mapping with the polynomial of the column “Xi” in FIG. 16 are equal. The result of the column "Xi" in FIG. 16 is calculated by a polynomial, but the equation (24) having the same solution is the Diffie-Hellman key sharing modal arithmetic (or Bernoulli shift mapping) in terms of phase. Has arithmetic and equivalence.

By the way, comparing the number G of the column "ArcSIN" and the number of the column "DH" in FIG. 16, the column "ArcSIN" consists of 9 or less numerical values, and when "i = 4", the column "DH" is 16. However, it is 3 in the column "ArcSIN".
About this, the trigonometric function sin has sin (16π / 19) = sin (π-16π / 19) = sin (3π / 19) depending on the complementary angle.
This is because the same value is taken when the phase is "π / 2" or more.
Therefore, in the joint arithmetic, the period is "P-1" according to Fermat's little theorem in Eq. (14), but the period at which the mapping returns to the original when using a polynomial is "(P-1) / 2". It turns out that the period is 9 because "P = 19".

The G of the key sharing by the polynomial takes a value of "(P-1) / 2" or less with respect to the prime number P which is the method of the Diffie-Hellman key sharing. Therefore, in the present embodiment, G used is between 2 and 9, so G = 2 to 9 is shown in FIG.
Further, looking at the column "ArcSIN", a value of 10 or more larger than "(P-1) / 2" has a "19-G" relationship with the value of the column "DH".

As described above, in the transmission process of FIG. 16, the column “DH” (Diffie-Hellman key sharing) has a calculation result of “14” for the cryptographic side common key generation unit 102 and “16” for the decryption side common key generation unit 202. Send to. In the key sharing by the polynomial of the present embodiment, the cryptographic side common key generation unit 102 has "0.541289673" and the decryption side common key generation unit 202 has "0.226525921" as the calculation result of the column "Xi" (polynomial). (S34A, S34B).

Next, the reception process of FIG. 16 will be described with reference to the flowchart of FIG.
The column "DH" is a Diffie-Hellman key sharing calculation, and the encryption side common key generation unit 102 and the decryption side common key generation unit 202 set the prime number P and its own secret information with the received value as the generation source G. , Performs modal arithmetic operations. In the example of FIG. 16, the encryption side common key generation unit 102 sets G = 14 from the received value, and the decryption side common key generation unit 202 sets G = 16 from the received value, and each is set as secret information. The cryptographic side common key generation unit 102 sets 7 and the decryption side common key generation unit 202 sets 4 to the power multiplier "i", and refers to the values in the column "i" from 0 onward in the column "i" to "2i". "Mod 19" is performed, the formula "= MOD (POWER (2, i), 19)" is substituted into the cell for calculation, and finally the secret information "17" to be shared is obtained.
The key sharing by the one-dimensional mapping of the one-variable polynomial according to the present embodiment becomes the column "Xi", and in the processing of the cryptographic side common key generation unit 102, "0.2265252921" is received from the decryption side common key generation unit 202 (S35A). ), G = 3, which is the generation source, is calculated from the received “0.226525921” by the equation (23) (S36A).

Next, in order to generate a polynomial of G = 3 shown in FIG. 14 (S37A) and give an initial value of “X0 = sin2 (π / 19)” when the column “i” is 0, the column Substitute the formula "= SIN (PI () / 19) * SIN (PI () / 19)" in the "Xi" cell, and after the column "i" is 1, the cell above the column "Xi" cell Substitute the mathematical formula "= Xi-1 * (4 * Xi-1-3) * (4 * Xi-1-3)" obtained by factoring the polynomial of G = 3 so as to refer to the numerical value, and "Xi". The calculation is performed with reference to -1 ”(S38A, S39A).
Similarly, in the processing of the decryption-side common key generation unit 202, "0.541289673" is received from the encryption-side common key generation unit 102 (S35B), and the generated "0.541289673" is generated by the equation (23). G = 5 is calculated (S36B).
Next, in order to generate a polynomial of G = 5 shown in FIG. 14 (S37B) and give an initial value of “X0 = sin2 (π / 19)” when the column “i” is 0, “Xi” is performed. Substitute the formula "= SIN (PI () / 19) * SIN (PI () / 19)" in the "cell" and refer to the numerical value of the cell one above the column "Xi" after the column "i" is 1. The formula "= Xi-1 * (16 * Xi-1 * Xi-1-20 * Xi-1 + 5) * (16 * Xi-1 * Xi-1-" 20 * Xi-1 + 5) ”is substituted and the calculation is performed with reference to“ Xi-1 ”(S38B, S39B).

As a result, the calculation result of the cryptographic side common key generation unit 102 and the decryption side common key generation unit 202 has the same value as "0.10542975" and can be used as shared secret information.
Further, paying attention to the fact that the value of the “column Xi” at i = 1 on the receiving side in FIG. 15 is the received value, the received value is set as the initial value X0 as it is in consideration of the calculation accuracy. The number of iterations obtained by subtracting -1 from the secret information set by the encryption side common key generation unit 102 and the decryption side common key generation unit 202 (6 for the encryption side common key generation unit 102 and 3 for the decryption side common key generation unit 202). It is conceivable to generate confidential information to be shared by setting and repeating mapping.
The embodiment of the key sharing method using the one-dimensional mapping of the one-variable polynomial has been shown above.

とすることで、べき乗の項をなくすことができる。
また、インタプリタ型言語Ｐｙｔｈｏｎの代数計算ライブラリ“ＳｙｍＰｙ”で提供される関数“ｆａｃｔｏｒ”を用い、多項式を因数分解して計算式とすることでも演算コストの削減が期待できる。 In the Bernoulli shift mapping program of FIG. 8A, there is a process of storing the boundary value in the memory in advance and searching the corresponding section using the IF branch, and the larger the generation source G, the larger the memory space. This is necessary and the cost of the search process increases, but according to this embodiment, the process of storing the boundary value in the memory and searching for the boundary value becomes unnecessary, and by making it a polynomial, the operation can be performed seamlessly without performing the number division process. You will be able to do it.
In terms of calculation cost, there is a method that uses the following Horner's method to prevent the calculation of exponentiation. Horner's method is a method of performing operation of an nth-order polynomial with the minimum number of addition and multiplication operations. For example, in the case of the equation of G = 4 in FIG.

By doing so, the exponentiation term can be eliminated.
Further, the calculation cost can be expected to be reduced by factoring the polynomial into a calculation formula by using the function "factor" provided by the algebraic calculation library "SymPy" of the interpreted language Python.

上記式である場合、平文と暗号文のペアを入手し、鍵を推定する既知平文攻撃では平文と暗号文の排他的論理和である以下の式によりセッション鍵ＳＫが判り、第三者に既知となる乱数を引き算すれば元となる秘密情報がすぐに判ってしまう。

From the viewpoint of security, if you want to generate a different ciphertext each time you communicate, you can combine it with a random number based on the secret information shared by each other to generate a temporary key, generate a disposable key every time you communicate, and encrypt it. There is a scene to do. This disposable key will be referred to as a session key SK hereafter. In this case, there is a concern that the strength of the session key SK may be weakened depending on the implementation method such as simply adding a random number to the secret information. For example, suppose that the cryptographic algorithm using the session key SK adopts the following equation that takes the exclusive OR of the session key SK and plaintext.

In the case of the above formula, the session key SK is known to a third party by the following formula, which is the exclusive OR of the plaintext and the ciphertext in the known plaintext attack that obtains the pair of plaintext and ciphertext and estimates the key. If you subtract the random number that becomes, the original secret information can be found immediately.

Therefore, in the second embodiment, a session key generation unit is further provided. FIG. 18 is a block of the second embodiment. The encryption generation device 100A is provided with a encryption side session key generation unit 103, and the decryption device 200A is provided with a decryption side session key generation unit 203. The cryptographic side session key generation unit 103 generates the session key SK by performing the operation of the one-dimensional mapping based on the common key generated by the cryptographic side common key generation unit 102. The decoding side session key generation unit 203 generates the session key SK by performing the operation of the one-dimensional mapping based on the common key generated by the decoding side common key generation unit 202. The encryption generation unit 101 in this figure generates a ciphertext using the common key and the session key SK, and the decryption unit 201 generates plaintext by decryption using the common key and the session key SK. .. The encryption generator 100A is provided with a random number generation unit 104.

In the present embodiment, the session key SK is generated by assigning the number of iterations of the mapping as a secret key in the one-dimensional mapping to ensure the security based on the discrete logarithm problem. FIG. 18A is a flowchart showing the session key generation of the present embodiment.
As shown in FIG. 18A, the common key CK is obtained (S41A, S41B), and the random number generation unit 104 of the encryption generator 100A generates a random number RND and transmits it to the decryption device 200A (S42A, S42B). This random number RND is set to the initial value X0 of the one-dimensional map.
The common key CK (Comon Key) and the random number RND are combined in advance as secret information shared by the encryption generation device 100A and the decryption device 200A to determine the inclination coefficient G and the prime number P of the calculation accuracy, and the common key CK is mapped. It is set to the number of repetitions (S45A, S45B).
As shown in FIG. 18A, the slope coefficient G adopts the remainder obtained by dividing the random number RND by the common key CK (when the remainder becomes “0” or “1”, the minimum value G is 2 or more. The slope coefficient G should not be 0 or 1 such as by adding) (S43A, S43B).
As the prime number P, the closest prime number equal to or less than the value obtained by multiplying the random number RND and the common key CK is adopted (S44A, S44B).
These are set in each parameter of the one-dimensional mapping of the process A of FIG. 8A represented by the equation (11), the mapping is repeated CK times with a common key, and the value XCK is obtained (S46A, S46B). The session key SK is obtained by obtaining the remainder obtained by dividing the obtained value XCK by the predetermined key length M (S47A, S47B).

FIG. 19 shows specific numerical values obtained by executing the flowchart of FIG. 18A. The encryption generation device 100A and the decryption device 200A are set as a common key CK that shares the number 36 obtained in FIG. The random number generation unit 104 of the encryption generation device 100A generates the number 141 as a random number and transmits it to the encryption generation device 100A and the decryption device 200A.
Hereinafter, the encryption generation device 100A and the decryption device 200A determine the slope coefficient G of the equation (11), the prime number P of the calculation accuracy, and the session key SK generation by performing the same calculation.
The slope coefficient G sets the remainder 21 obtained by dividing the random number 141 by the common key 36, and the initial value X0 sets the random number 141.
As the prime number P of the calculation accuracy, the nearest prime number 8447 of 8460 or less as a result of multiplying the random number 141 and the common key 36 is adopted.
The numerical value obtained above is set in the process A of the equation (11), and the mapping is repeated for the number of times of the secret information to obtain a value, and the number 3062 is obtained. In the present embodiment, the key length is 8 bits as a protocol, and the number "246" is obtained as the session key SK (Session Key) by obtaining the remainder obtained by dividing the number 3062 by the maximum of 256 of 8 bits.
In this example, the Bernoulli shift map of the equation (11) is used, but it is conceivable that other one-dimensional maps having unidirectionality as shown in FIG. 14, such as a logistic map, can also be used.

In the above, the method of generating the common key (including the session key) used for encryption is shown. For example, a common key cryptographic method based on the discrete logarithm problem can be considered by using the number of iterations of a one-dimensional map as secret information.
FIG. 20 is a flowchart showing an operation when the encryption generation unit 101 and the decryption unit 201 shown in FIG. 18 realize a system by common key cryptography using the common key CK and the session key SK.
It is assumed that the encryption generation unit 101 encrypts the plaintext and transmits it to the decryption unit 201. The encryption generation unit 101 and the decryption unit 201 share the same session key SK (Session Key) and common key CK (Common Key) in advance. Using them, the slope coefficient G of the parameter of the equation (11), the prime number P of the calculation accuracy, and the number of iterations r of the mapping are determined.

The iteration count r of the mapping sets the session key SK (S51A, S51B), and the slope coefficient G sets the remainder obtained by dividing the session key SK by the common key CK. When the remainder becomes 0 or 1, the minimum value G is added so that it becomes 2 or more, and the slope coefficient G does not take 0 or 1. As the prime number P that is the calculation accuracy, the closest prime number equal to or less than the value obtained by multiplying the session key SK and the common key CK is adopted (S52A, S52B).
The above parameters are set in the equation (11), the plaintext is set as the initial value X0, and the result "XSK" is transmitted to the decryption unit 201 as a ciphertext as a result of repeating the mapping by SK (S53A to S53A). S55A).

が成り立ち、“Ｇ”を“Ｐ－１”乗して、”Ｐ”で割り算した余りは“１”になる。
上記で説明したように合同算術の余りと整数演算化したベルヌーイシフト写像の式（１１）は同じ値を取得することができる。つまり、演算精度をＰとする式（１１）のベルヌーイシフト写像の反復を“Ｐ－１”回行うことで、Ｘｉ値が元に戻る周期を持っていることが判る。この機構から暗号生成部１０１は既にＳＫ回の写像の反復を行っているため、復号部２０１は受信した暗号文を初期値Ｘ０に設定して残り回数の“Ｐ－１－ＳＫ”回の写像の反復を行うことで復号部２０１は暗号文を平文に戻す復号が行える（Ｓ５３Ｂ～Ｓ５５Ｂ）。
この暗号方法では秘密情報を写像の反復回数とするだけでなく、傾き係数Ｇと演算精度Ｐも秘密情報から生成するため第三者にとって追跡の手掛かりが小さくなるため安全性を高める効果を得ることができる。 Next, the decryption unit 201 decodes the received ciphertext. In order to use Fermat's little theorem in equation (14), the principle of decoding will be described. When P is a prime number and G is an integer that is not a multiple of P (G and P are relatively prime [the greatest common divisor is 1], that is, P is a prime number), the following Fermat's little theorem

Is established, and the remainder obtained by multiplying "G" by "P-1" and dividing by "P" becomes "1".
As described above, the same value can be obtained from the remainder of the joint arithmetic and the Bernoulli shift mapping equation (11) that has been converted into an integer arithmetic. That is, it can be seen that the Xi value has a period of returning to the original value by repeating the Bernoulli shift mapping of the equation (11) with the calculation accuracy as P "P-1" times. Since the encryption generation unit 101 has already repeated the mapping of SK times from this mechanism, the decryption unit 201 sets the received ciphertext to the initial value X0 and maps the remaining number of "P-1-SK" times. The decryption unit 201 can perform decryption to return the ciphertext to plaintext by repeating the above (S53B to S55B).
In this encryption method, not only the secret information is used as the number of iterations of the mapping, but also the slope coefficient G and the calculation accuracy P are generated from the secret information, which reduces the clues for tracking to a third party and thus obtains the effect of improving security. Can be done.

FIG. 21 is a diagram showing a processing example in which specific numerical values are input to encryption and decryption in the flowchart of FIG. The plaintext to be encrypted is, for example, the four characters "word". In ASCII code 8-bit, when the decimal number and the parentheses are expressed in hexadecimal, each character is "w = 119 (77h), o = 111 (6fh), r = 114 (72h), d = 100 (64h)". Become.
Encryption is performed in block units of 8 bits each, and encryption is performed character by character.
Hereinafter, the operation will be described according to the flowchart of FIG. The cryptographic generator 100A and the decryption device 200A share the common key CK = 36 generated in FIG. 10 and the session key SK = 246 generated in FIG. 19 (B11). Find the prime number P.
The slope coefficient G gives the remainder 30 obtained by dividing the session key SK = 246 by the common key CK = 36. The prime number P is 8849, which is the closest to the value 8856 or less obtained by multiplying the common key CK = 36 and the session key SK = 246 (B12).

From the above, the number of iterations r, the calculation accuracy P, the slope coefficient G, and the initial value X0 are obtained, these values are set in the equation (11), and encryption and decryption are performed (B13). The encryption generation unit 101 sets the first character "w" to the initial value X0 = 119 of the equation (11), repeats the mapping of the session key SK number 246 times, and performs encryption. As a result, the ciphertext is encrypted. As a result, the number 997 is obtained (D11). The encryption generation unit 101 transmits the ciphertext "997" to the decryption unit 201. The decryption unit 201 sets the received ciphertext to the initial value X0 and becomes "P-1-SK = 8849-1-246 = 8602". Therefore, by repeating the mapping 8602 times, it becomes "X8602 = 119". It can be confirmed that the decryption has been performed (M11). It can be confirmed that other encrypted characters are also decrypted (D12 to D14, M12 to M14).
In FIG. 21, the value Xi obtained by repeating the mapping of encryption and decryption displays the value Xi of the first three times and the last three times.

Since the size of the ciphertext is determined by the number of digits of the prime number that is the law, in the computer implementation, if it is handled in byte units in the example of FIG. 21, 8 bits of plaintext is expanded to 16 bits of ciphertext, and the ciphertext is It will be treated as twice the size of plaintext. Therefore, in practice, the prime number is larger than the unit of the plaintext size, so the block length of the plaintext and the ciphertext is adjusted by limiting the maximum digit of the prime number by the protocol.

Also, in this example, the same ciphertext is output if it is the same plaintext, so the slope coefficient G is incremented by +1 for each block, or the initial value X0 of the plaintext is incremented by +1 and the same value is used after decoding. You can do subtraction. As a result, a method of outputting different ciphertexts for the same plaintext for each block is realized. In addition, even if the sender and receiver of the ciphertext generate the same random number from the common key and bias the random number to the tilt coefficient or plaintext for each block (addition, subtraction, exclusive OR) is adopted. good.

In terms of security, this embodiment is divided into 8-bit block units, but the larger the unit of the size of the plaintext to be encrypted, the higher the calculation cost but the higher the security. Therefore, it is desirable to take a larger block size.

FIG. 21A is a block diagram describing the processing contents of each part of the encryption / decryption system shown in FIG. In this encryption / decryption system, the same common key is generated and shared by the encryption generation device 100A and the decryption device 200A by the encryption side common key generation unit 102 of the encryption generation device 100A and the decryption side common key generation unit 202 of the decryption device 200A. ("Common key sharing"). Further, the same session key SK is generated and shared by the encryption generation device 100A and the decryption device 200A by the encryption side session key generation unit 103 of the encryption generation device 100A and the decryption side session key generation unit 203 of the decryption device 200A. "Common key generation"). The encryption generation unit 101 of the encryption generation device 100A uses the common key CK and the session key SK to generate an encrypted text (“encryption processing”), and the common key CK and the session key SK decrypt the decryption device 200A. In the unit 201, a process of decrypting the encrypted text into a plain text (“decryption process”) is performed. This system employs a common key cryptographic method based on the discrete logarithm problem, which eliminates the need for key management and can reduce the calculation load and calculation cost.

The Diffie-Hellman key sharing system is a system that generates secret information to be shared from information exchanged with each other. If the encryption generator 100 (100A (hereinafter omitted)) and the decrypting device 200 (200A (hereinafter omitted)) set the same initial value, prepare an arbitrary one-way function, and the final number of calculation steps match. Focusing on the fact that the same solution can be obtained, it is possible to consider a mechanism for generating confidential information in which the number of each calculation step is shared as confidential information.
For example, the encryption generator 100 selects 5 as the secret information, executes the calculation for 5 steps in the one-way function, and passes the numerical value NA of the result to the decryption device 200, while the decryption device 200 selects 9 as the secret information. It is assumed that the one-way function is selected, the calculation of 9 steps is executed, and the numerical value NB of the result is passed to the encryption generator 100.
The cryptographic generator 100 that has received the NB executes a calculation for 5 steps using the secret information 5 known only to the cryptographic generator 100, so that a total of 14 steps are added to the 9 steps executed by the decryption device 200. Get the numerical results you made. On the other hand, the decryption device 200 that has received the NA executes the calculation for 9 steps by the secret information 9 known only to the decryption device 200, so that 9 steps are added to the 5 steps executed by the encryption generation device 100, for a total of 14 steps. Get the numerical result. From the above, the final number of calculation steps calculated by the encryption generation device 100 and the decryption device 200 is the same, and the encryption generation device 100 and the decryption device 200 can acquire the same value.
In consideration of the above logic, in the embodiment shown below, the encryption / decryption system, the encryption / decryption method, and the encryption / decryption program for updating the common key are disclosed by setting a common key shared by each other as the initial value.

FIG. 22 is a block diagram of the encryption / decryption system according to the third embodiment. In the encryption / decryption system according to the third embodiment, in the configuration of the encryption / decryption system shown in FIG. 2, the encryption generation device 100B is provided with the first encryption side update key generation unit 105, and the decryption device 200B is the first. The decryption side update key generation unit 205 is provided. The first cryptographic side update key generation unit 105 receives a common key from the cryptographic side common key generation unit 102, performs Berneuy shift mapping with this common key, and generates cryptographic side exchange information. The first decryption side update key generation unit 205 receives a common key from the decryption side common key generation unit 202, performs Bernoulli shift mapping with this common key, and generates decryption side exchange information.

Further, the first encryption side update key generation unit 105 receives the decryption side exchange information, performs Bernoulli shift mapping using the decryption side exchange information, and generates the update key. Further, the first decryption side update key generation unit 205 receives the encryption side exchange information, performs Bernoulli shift mapping using the encryption side exchange information, and generates an update key.

As a specific example of the third embodiment, the one-way function prepares a Bernu shift map in which the slope coefficient fluctuates, and the update key is generated using this Bernu shift map. 22A is a flowchart showing the process of generating the update key, and FIG. 23 is a flowchart showing the main part of FIG. 22A. Further, FIG. 24 shows the process shown in FIG. 23 described in a C language program. Further, FIGS. 25A, 25B and 26 are diagrams showing the process of generating the update key using specific calculated values.

共通鍵ＣＫの値を２乗してＧｍａｘの割り算の剰余にＧｍｉｎを足した数を傾き係数Ｇとする（Ｓ６２Ａ、Ｓ６２Ｂ）。
Ｇｍａｘは予めプロトコルで決めておき、Ｇｍｉｎは“ＣＫ×ＣＫ ｍｏｄ Ｇｍａｘ”の剰余がゼロになった場合に、最小の傾き係数Ｇは２以上にするため“Ｇｍｉｎ＝２”を入れておく。次に、求めた傾き係数Ｇと素数Ｐより

を実行してＸ０を求める（Ｓ６３Ａ、Ｓ６３Ｂ）。 In the present embodiment, first, as shown in the flowchart of FIG. 22A, a pattern in which the inclination coefficient is changed is generated from the common key CK (S60A, S60B). Specifically, the encryption generation device 100B and the decryption device 200B calculate the closest prime number P, which is smaller than the squared value of the common key CK shared by each other (S61A, S61B). Next, the slope coefficient G is determined by the following mathematical formula shown in the flowchart of FIG. 22A.

The value obtained by squaring the value of the common key CK and adding Gmin to the remainder of the division of Gmax is defined as the slope coefficient G (S62A, S62B).
Gmax is determined in advance by the protocol, and Gmin is set to "Gmin = 2" so that the minimum slope coefficient G is 2 or more when the remainder of "CK × CK mod Gmax" becomes zero. Next, from the obtained slope coefficient G and the prime number P

Is executed to obtain X0 (S63A, S63B).

The cryptographic generator 100B generates a random number Sa (S64A), and each initial parameter Sa (random number) of the Bernoulli shift map whose slope fluctuates in FIG. 22A ⇒ number of repetitions r, prime number P ⇒ calculation accuracy P, G ⇒ slope coefficient G, X0 ⇒ Initial value X0
Is set (S65A).
Similarly, the decoding device 200B generates a random number Sb (S64B), and each initial parameter Sb (random number) ⇒ number of iterations r, prime number P ⇒ calculation accuracy P, G ⇒ slope coefficient G, X0 ⇒ initial value X0.
Is set (S65B).

Next, the fluctuation pattern of the slope coefficient G shown in FIG. 23 is determined (SAF23).
A variable y is prepared, and the remainder value “y = P mod G” obtained by dividing the slope coefficient G by the calculation accuracy P is set.
From the following modal arithmetic formula, the method is set to the prime number P, and y is updated G times, and the maximum slope coefficient from y is set to G, and the value obtained by taking 20% of G is stored as dG [i] for G pieces. ..

Next, specific calculated values will be described with reference to the numerical values in the uppermost frame of FIG.
Since the value obtained by using the common key 36 obtained in FIG. 10 and squared the common key is "36 × 36 = 1296", when the nearest prime number less than that is searched, the prime number P = 1291. If the value of the common key is too small, for example, a rule that the prime number is at least 1000 or more may be set and the power of the value of the common key may be continued.
Next, it is assumed that the maximum slope coefficient G can be taken up to 99 in the protocol of the present embodiment, and G is a fluctuating value. Therefore, by setting it to at least 10, G can be taken in three types of 8, 9, and 10. Therefore, with "Gmax = 90" and "Gmin = 10", the slope coefficient G = 46 is taken from "46 = (1296 mod 90) +10". The initial value X0 becomes “3 = 1291 mod 46” from X0 = P mod G, and “X0 = 3” is obtained.
As described above, the "slope coefficient G, prime number P, number of repetitions r, initial value X0" is determined, and the setting in the initial process (S71) of FIG. 23 shown by SAF23 of FIG. 22 is made.

FIG. 23 is a flowchart showing an iterative operation of the Bernu shift mapping in which the inclination coefficient is changed, and a specific C language program thereof is shown in FIG. 24. As described above, in step S71, "the slope coefficient G, the prime number P, the number of repetitions r, and the initial value X0" are determined, and subsequently, a fluctuation pattern of the coefficient G is generated. A variable y is prepared, and the value “y = 138” is set by multiplying the input initial value X0 = 3 and the slope coefficient G = 46 (S72).
Next, the fluctuation pattern of the slope coefficient G is determined from y. y is repeated G times by "y = (G × y) mod P" to update the value of y, and G input by “dG [i] = y mod (G × 2/10)” is the maximum slope. Since it is 46 in the present embodiment, it becomes a coefficient, and 46 pieces of values 0 to 8 corresponding to 20% thereof are stored in dG [i] (S73, S74).

により格納しておいたｄＧ［ｉ］を引き算した値が各区間“ｉｎｔｅｒｖａｌ［ｉ］”により選択される（Ｓ７５、Ｓ７６）。
例えば、傾き係数Ｇが最大１００のときは、変動する傾き係数Ｇは８０～１００の間の値を採る。 With the above, the pattern in which the slope coefficient G fluctuates is determined, and the Bernoulli shift mapping is repeatedly calculated while the slope coefficient G fluctuates. The fluctuation of the slope coefficient G is also shown in the flowchart of FIG. 23.

The value obtained by subtracting the dG [i] stored in is selected by each interval “interval [i]” (S75, S76).
For example, when the slope coefficient G is 100 at the maximum, the fluctuating slope coefficient G takes a value between 80 and 100.

In the operation of the Bernoulli shift map shown in FIG. 23, 38 to 46 obtained by subtracting the array dG [i] corresponding to each interval “i” for each G pieces from the input inclination coefficient G is taken. The map image of the Bernoulli shift map of the specific array dG [i] values (46 pieces) of the present embodiment and the inclination coefficient G of each section is shown in the second frame of FIG. 25A.

As described above, the encryption generation device 100B generates a fluctuation pattern of the slope coefficient G, outputs the Xsa as a result of repeating the Bernoulli shift mapping Sa times, and sends this Xsa to the decoding device 200B (S66A). Further, the decoding device 200B generates a fluctuation pattern of the slope coefficient G, outputs Xsb as a result of repeating the Bernoulli shift mapping Sb times, and sends this Xsb to the encryption generator 100B (S66B).

The encryption generator 100B receives Xsb (S67A), sets this Xsb as the initial value X0 (S68A), and outputs the update key Xk in which the Bernoulli shift mapping is repeated Sa times (SAF23). The decoding device 200B receives Xsa (S67B), sets this Xsa as the initial value X0 (S68B), and outputs the update key Xk in which the Bernoulli shift map is repeated Sb times (SAF23).

FIG. 26 shows a specific numerical example in which the key is updated by the program shown in FIG. 24.
Here, the difference between the process A of FIG. 8A and the program of FIG. 24 will be described. In the process A of FIG. 8A, the value “x / G” obtained by dividing x by G is finally returned as the return value, but in FIG. 24, since G is changed, an indivisible value is generated. Since the value of the calculation result is different, as shown in step S77 of FIG. 23, “x” is used as the return value as it is.

The encryption generator 100B generates "7" as secret information, repeats the mapping with a variation of the slope coefficient G seven times, obtains "X7 = 24904", and transmits the "X7 = 24904" to the decryption apparatus 200B. The decryption device 200B generates "10" as confidential information, repeats the mapping with a variation of the slope coefficient G 10 times, obtains "X10 = 6162", and transmits the "X10 = 6162" to the encryption generation device 100B.

In the reception process, the encryption generation device 100B sets the notification information 6162 received from the decryption device 200B to the initial value X0, repeats the mapping with the tilt coefficient varying from the secret information 7 of the encryption generation device 100B seven times, and ". X7 = 49160 ”is obtained as an update key. The decryption device 200B sets the notification information 24904 received from the encryption generation device 100B to the initial value X0, repeats the mapping with the tilt coefficient varying from the secret information 10 of the decryption device 200B 10 times, and sets "X10 = 49160". Get it as an update key. By performing such processing, the encryption generation device 100B and the decryption device 200B can have a common update key. The encryption generation device 100B and the decryption device 200B use the generated update key as a common key. That is, it can be used to generate a ciphertext and decrypt a ciphertext to obtain a plaintext.

暗号生成装置１００Ｂは“ＧＮＡ（ｍｏｄ Ｐ）”を復号装置２００Ｂに送信し、復号装置２００Ｂは“ＧＮＢ（ｍｏｄ Ｐ）”を暗号生成装置１００Ｂに送信して、暗号生成装置１００Ｂと復号装置２００Ｂは共有する“ＧＮＡ ＋ ＮＢ（ｍｏｄ Ｐ）”を得ることになる。ところが、お互い送信した情報ＧＮＡとＧＮＢを掛け算してＰで法をとった“ＧＮＡ×ＧＮＢ（ｍｏｄ Ｐ）”と同じ値になるため、素数Ｐさえ判れば共有する秘密情報Ｓを簡単に求められる。 The above is the key update method in which the slope coefficient G is varied. However, as a caveat, when the slope coefficient G is constant, the secret information S will be known to a third party by multiplying the exchanged information transmitted to each other and taking the method P, as shown in the following joint arithmetic formula. ..

The encryption generation device 100B transmits "GNA (mod P)" to the decryption device 200B, the decryption device 200B transmits "GNB (mod P)" to the encryption generation device 100B, and the encryption generation device 100B and the decryption device 200B You will get the shared "GNA + NB (mod P)". However, since the value is the same as "GNA x GNB (mod P)" obtained by multiplying the information GNA and GNB transmitted to each other by P, the secret information S to be shared can be easily obtained if only the prime number P is known. ..

FIG. 27 is a diagram showing an example in which the process A program of FIG. 8A is executed using specific numerical values when the slope coefficient G is fixed without fluctuation. In the process A of FIG. 8A, “initial value X0 = 1” is obtained. The encryption generator 100B transmits the value 102 mapped 7 times, and the decryption device 200B transmits the value 482 mapped 10 times to each other.
When the method 1291 is applied to 102 × 482 = 49164, the remainder is “106”, and the value calculated and shared by the encryption generator 100B and the decryption device 200B is also “106” as shown at the end of the table in FIG. Therefore, if only the prime number P is known, the secret information shared by the encryption generation device 100B and the decryption device 200B can be easily known. Therefore, it is necessary that the fluctuation pattern of the slope coefficient G always fluctuates to a different value G by at least 2 or more.

An example of another variation pattern of the slope coefficient G is shown in FIG. 25B. The common key is 36 and becomes (001100100) 2 in binary, but considering that 46 values of 0 to 8 G are stored in dG [i] as in the example of FIG. 25A. When extracting from bits, 3 bits of 8 or less 0 to 7 are extracted.
Skip 1 in FIG. 25B means that if 3 bits are taken out and arranged every 1 bit,
{(001) 2, (010) 2, (100) 2, (001) 2, (010) 2, (100) 2, (000) 2, (000) 2, ...}
A total of 8 pieces can be taken out. In the 7th bit, the same bit string (001001100) 2 is connected to the end of the 9th and subsequent bits so that the 9th and subsequent bits can be taken as in (0010010000100100) 2.

"DG [0] = 1, dG [1] = 2, dG [2] = 4, dG [3] = 1, dG [4] = 2, dG [5] = 4, dG [6] = 0, By adopting dG [7] = 0 ”, eight tilt fluctuation patterns can be secured.
Next, as shown in Skip 2 of FIG. 25B, the operation of taking out 3 bits every 2 bits is repeated, and the same bit string is connected to the missing part at the end, and 8 pieces are taken. Although not shown next, skip 3 takes 1 bit every 3 bits, and so on, skip 7 is performed in the same manner, and a total of 8 × 7 = 56 ways can be acquired.
Since the slope coefficient G = 46, 46 numerical values shown in FIG. 25B are acquired and generated as the slope fluctuation pattern 2.
Up to this point, various parameters have been shown as an example of generating from one common key, but it is also possible to configure each parameter as a plurality of common keys in advance, and it is expected that the confidentiality will be further improved.
The example of the key update method for changing the tilt coefficient of the Bernoulli shift map is shown above.

Next, an example will be shown in which encryption is performed by the encryption generation device 100B while generating a plurality of update keys, a ciphertext is transmitted to the decryption device 200B, and decryption is performed by the decryption device 200B.
Since both the cryptographic generator 100B and the decryption device 200B use a one-dimensional mapping function having a pattern that fluctuates the same inclination coefficient G, the cryptographic generation device 100B and the decryption device 200B keep each mapping even after the update key is generated. The output "Xi + 1" of is obtained with the same value.

For this reason, a configuration is conceivable in which a key and plaintext are synthesized and encrypted for an arbitrary amount of data while adding a key. Here, the key is not generated by generating the key for each mapping and encryption, but the mapping is repeated several times and the output "Xi + 1" is additionally generated as the key. Is desirable.

This is because, assuming that "Xi + 1 = 0.3" obtained from the Bernoulli shift mapping equation (9), it is considered that the equation (9) is traced back once. In the case of "Xi <0.5", since "2Xi" in the equation (9) is executed, "Xi =" by substituting "0.3" from "Xi = Xi + 1/2" to "Xi + 1". 0.15 ", on the other hand, in the case of" 0.5≤Xi ", since" 2Xi-1 "is being executed," 0.3 "is substituted from" Xi = (Xi + 1 + 1) / 2 "to" Xi + 1 ". By doing so, "Xi = 0.65" is obtained, and it can be inferred from the information of "Xi + 1 = 0.3" whether the mapping was performed from either "0.15" or "0.65". Therefore, if Xi + 1 is output after one mapping, two candidates can be inferred for the initial value X0. When the result obtained by repeating the mapping three times is "Xi + 1 = 0.3", the following eight candidates are obtained by predicting which value came from three times before the iteration.
(0.0375, 0.1625, 0.2875, 0.4125, 0.5375, 0.6625, 0.7875, 0.9125)

When these values are set to the initial value X0 of the equation (9) and the mapping is repeated three times, "X3 = 0.3" is obtained in all cases.
When "Xi + 1" is acquired by leaving the map three times, 8 = 23 initial value candidates are estimated, so that the safety of 3 bits can be ensured. In other words, if you want to obtain 8-bit strength (256 initial value candidates), you can encrypt by opening the map 8 times because 28 = 256, and repeat the map 8 times to output the key. become. It can be expected that it will be difficult to estimate the key generation series by opening the iterations of the mapping in this way.

をとることで算出する（Ｓ８２Ａ、Ｓ８２Ｂ）。具体的な数値として図２９ではＣＫ＝３６、Ｇ＝４６のため、

としている。
ここで数Ｓが小さすぎる場合は所定の数値以上をとるようにしておく。 Next, a processing example of an encryption / decryption system that outputs a key, encrypts it, and decrypts it will be shown. FIG. 28 is a flowchart showing the operation of an encryption / decryption system that outputs a key, encrypts and decrypts the key, and FIG. 29 is a diagram showing processing when the processing of FIG. 28 is performed using specific numerical values. Is.
In FIG. 29, it is assumed that the encryption generation device 100B encrypts the ASCII code 3 characters “map” as plain text and transmits it to the decryption device 200B. Since "map" is encrypted one character at a time, if the ASCII code for 8 bits of each character is converted into a decimal number, it becomes "m = 109, a = 97, p = 112".
As shown in FIG. 28, the “common key CK”, “slope coefficient G”, “update key X0”, and “prime number P” of FIG. Exclusive OR of G and common key CK

Is calculated by taking (S82A, S82B). As specific numerical values, since CK = 36 and G = 46 in FIG. 29,

It is supposed to be.
Here, if the number S is too small, it should be set to a predetermined value or more.

Next, the total number n of plaintexts to be encrypted is obtained, and the number of times i for generating the update key is set to 0 (S83A, S83B). Further, in the processing unit according to the flowchart of FIG. 23, the number of repetitions S is set to the number of repetitions r, the prime number P is set to the calculation accuracy P, the slope coefficient G is set to the slope coefficient G, and the update key Xi is set to the initial value X0. (S84A, S84B).

The key Xi is output by repeating the mapping with the inclination coefficient G varying S times according to the program of FIG. 24 (S85A, S85B). The update key Xi is output by the following formula (S86A, S86B).

In the present embodiment, the encryption is performed on the finite field GF (P) using the prime number P, and the key K and the plaintext T are targeted at values of the prime number P or less. The exchanged value shown in the program of FIG. 24 is a value multiplied by G, but the value is reduced to the order P or less of the finite field GF (P) by using the value obtained by dividing the generated value by G as a key. The key K is generated so as to be.
For encryption, the key K generated by the following equation (24) is multiplied by the plaintext T, and the remainder divided by the prime number P is the ciphertext C. The ciphertext Ci is generated by this equation (24) and transmitted to the decryption device 200B (S87A). In step S88A, it is detected whether or not the encryption has been performed for the total number of plaintexts.

For decryption, the decryption device 200B that received the ciphertext C calculates the reciprocal K-1 from the key K shared with the ciphertext generator 100B (S87B), and takes the reciprocal (multiplication reverse element) to the ciphertext C to obtain plaintext. Calculate T. That is, decoding is performed by the formula shown in step S88B of FIG. 28 (S88B).
In step S89B, it is detected whether or not the encryption has been performed for the total number of plaintexts. In modal arithmetic, it is known that if the method P is a prime number, the finite field GF (P) consisting of the multiplicative group has the reciprocal K-1 for which the multiplicative element holds. Specifically, the plaintext T is derived using the Euclidean algorithm as shown below.
Equation (24) means that the remainder of the quotient y obtained by dividing the divisions K and T by the divisor P is C, and the following equation holds.

式（２５）からベズーの等式として知られる一次不定方程式の整数解を利用することで、平文Ｔを導出できる。以下に一次不定方程式の解法による例を提示し、平文Ｔの導出について説明する。 Here, by transposing "P · y" on the right side of the above equation to the left side, the following equation (25) is obtained.

The plaintext T can be derived from equation (25) by using an integer solution of a linear indefinite equation known as Bezout's equation. An example of solving a linear indefinite equation is presented below, and the derivation of the plaintext T will be described.

<Theorem> When the integer solutions "a" and "b" of a linear indefinite equation are relatively prime integers, there are integer solutions "x" and "y" that satisfy the following two-dimensional linear equations.

The “x” in the equation (26) corresponds to the plaintext T in the equation (25), and an example of deriving the plaintext T is shown. Here, the right side of the equation (26) is 1, and the right side of the equation (25) is the ciphertext C, but on the finite field GF (P), the reciprocal of K is as shown in the following equation. Derivation of K-1 to be 1.

となり、上記式のように“ｘ＝－３６０，ｙ＝３３１”が得られたが“ｘ”はマイナス、“ｙ”はプラスになっており式（２５）と見比べると“ｙ”はマイナス、つまり“ｙ＝－ｙ”となるため“ｘ”がプラスとなるよう以下の手法を利用する。 The integer solution of the linear indefinite equation "extended Euclidean algorithm" is used to find "x" and "y", which are the reciprocals (inverse elements) K-1. A specific example is shown in FIG. FIG. 30 is a diagram showing a procedure for obtaining an integer solution of a linear indefinite equation with an example numerical value. The value in FIG. 30 is the quotient obtained by setting the update key 49160 obtained in FIG. 26 in FIG. 29 to the initial value X0 and dividing the value 54610 obtained by repeating the mapping S = 10 times by G = 46. The value is obtained with the key K = 1187 and the prime number P = 1219. The result is

As shown in the above equation, "x = -360, y = 331" was obtained, but "x" was negative, "y" was positive, and "y" was negative when compared with equation (25). That is, since “y = −y”, the following method is used so that “x” becomes positive.

式（２７）の“ａ×ｂ”の部分は差し引きで消去できるため、式（２６）と等しい。
求めた値は“ｘ＝－３６０，ｂ＝１２１９”また“ｙ＝３３１，ａ＝１１８７”であるため、これを式（２７）に代入すると

と“ｘ＝９３１，ｙ＝－８５６”になり、式（２５）の形式が得られ逆数Ｋ－１は“９３１”となる。 Equation (26) is transformed into the following.

Since the “a × b” portion of the equation (27) can be eliminated by subtraction, it is equivalent to the equation (26).
Since the obtained values are "x = -360, b = 1219" and "y = 331, a = 1187", substituting this into equation (27)

And "x = 931, y = -856", the form of equation (25) is obtained, and the reciprocal K-1 is "931".

図２９は、“ｍａｐ”３文字分を生成された各鍵の逆数を計算して復号を行い、各平文Ｔを算出した実施形態を示す図である。 Calculate the remainder of P by multiplying the reciprocal K-1 by the multiplicative inverse element (C and K-1) given as the ciphertext of the plaintext "m" (= 109) in FIG. 29 as shown in the following equation. ) To decode to plaintext T.

FIG. 29 is a diagram showing an embodiment in which the reciprocal of each key generated for three “map” characters is calculated and decoded, and each plaintext T is calculated.

In this embodiment, the key is updated using the initial value as the common key, but the common key is reused, each generates a random number for each communication and sets it as the number of repetitions, and the mapping is repeated every time. It can also be used to generate a session key SK by exchanging different values.

As described above, in the present embodiment, the common key cryptosystem using the initial value as the common key is shown, but the step of repeating the mapping in the form of disclosing the initial value to a third party such as Diffie-Hellman key sharing. It may be a cryptographic decryption system using a number as confidential information. In this case, since the initial value is disclosed, the security is low, but the transmission data is masked (scrambled) with the number of steps of iterating the mapping generated by each communicator as confidential information, so that the wireless line or the Internet is used. It is possible to easily prevent leakage against capture by a third party on the line.
While key management is required in a general common key cryptosystem, in this third embodiment, sharing of a common key is not required, so that there is an advantage that key management can be eliminated. Have.

In the first embodiment described above, a Diffie-Hellman type key sharing method using a one-variable polynomial is shown, but even in a one-dimensional mapping using a one-variable polynomial, if the number of iterations of the map is finally the same, the same number is obtained. Is possible.
However, when the generator G is constant, as shown in the third embodiment, when the one-variable polynomial is replaced with the phase of the trigonometric function shown in FIG. When the prime number P is estimated from the setting of "initial value X0 = sin2 (π / P)", the secret information to be shared can be easily known. This is because even in a one-variable polynomial of degree 2 or higher, focusing on the phase θ is equivalent to performing the Bernoulli shift mapping operation on the phase, so the situation is the same as when the generator G is fixed, and the phase. This is because the confidential information can be easily identified as shown in FIG. 27 by following the calculation of.

Therefore, in this fourth embodiment, we focus on the coefficient of the one-variable polynomial in FIG. 14, and provide a cryptographic decryption system, a cryptographic decryption method, and a cryptographic decryption program that perform key update using the coefficient as a common key.
FIG. 31 is a block diagram of the encryption / decryption system according to the fourth embodiment. In FIG. 31, instead of the first encryption side update key generation unit 105 in the block diagram of the encryption / decryption system according to the third embodiment, the encryption generation device 100C has a second encryption side update key generation unit 106. It is the same except that the decoding device 200C is provided with a second decryption side update key generation unit 206 instead of the first decryption side update key generation unit 205.

The second cryptographic side update key generation unit 106 receives the common key from the cryptographic side common key generation unit 102, generates a one-variable polynomial with this common key, performs one-dimensional mapping with this one-variable polynomial, and performs cryptographic side exchange information. To generate. The second decoding side update key generation unit 206 receives the common key from the decoding side common key generation unit 202, generates the one-variable polynomial with this common key, performs one-dimensional mapping with this one-variable polynomial, and exchanges the decoding side. Generate information.

The second cryptographic side update key generator receives the decryption side exchange information, performs one-dimensional mapping by the one-variable polynomial using the decryption side exchange information, and generates an update key.
The second decryption side update key generation unit receives the encryption side exchange information, performs one-dimensional mapping by the one-variable polynomial using the encryption side exchange information, and generates an update key.

を与えて係数“ａ，ｂ，ｃ，ｄ”を求めると次のような式（２８）が得られる。

In the present embodiment, as an example, consider changing the coefficient of the one-variable polynomial of degree G = 4 in FIG. 14 from the common key. In the Gauss-Jordan method shown in FIG. 13 used in the first embodiment, the coefficient “a, b, c, d” is set to (1,0,1,0) as the solution of the fourth-order one-variable polynomial. I was looking for.
In the present embodiment, when the common key is divided in half as 8 bits (001100100) 2 (decimal number 36), it becomes (0010) 2 and (0100) 2, and when it is made into a decimal number, it becomes 2 and 4. Considering that these 2 and 4 are applied as a rule such as subtracting 2% and 4% from "1", "0.98" and "0.96" are calculated, and the fourth-order one-variable polynomial Change the solution to "(0.98,0,0.96,0)" and give it. This is implemented by programming the Gauss-Jordan method shown in FIG. 13 on a computer, and the same next value as when x is obtained by setting G = 4 in the equation (21).

Is given to obtain the coefficients “a, b, c, d”, and the following equation (28) is obtained.

のとき ｆ（ｘ０）＝０．９８、
のとき ｆ（ｘ２）＝０．９６
となっている。
図３２は、式（２８）を用いて鍵を更新するフローチャートであり、図３３は、具体的な数値による本実施形態の動作を説明する図である。
この実施形態では、共通鍵ＣＫを入手し（Ｓ９１Ａ、Ｓ９１Ｂ）、共通鍵ＣＫから多項式を生成し（Ｓ９２Ａ、Ｓ９２Ｂ）、図３２のフローチャートによる処理部に、秘密鍵情報である数Ｓａを反復回数ｒに設定し、共通鍵ＣＫを初期値Ｘ０へ設定する（Ｓ９３Ａ、Ｓ９３Ｂ）。
次に、暗号生成装置１００Ｃでは、多項式一元写像をＳａ回反復して結果Ｘｓａを得て、これを復号装置２００Ｃへ送信する（Ｓ９４Ａ）。復号装置２００Ｃでは、多項式一元写像をＳｂ回反復して結果Ｘｓｂを得て、これを暗号生成装置１００Ｃへ送信する（Ｓ９４Ｂ）。
次に、暗号生成装置１００Ｃでは、結果Ｘｓｂを受信し（Ｓ９５Ａ）、復号装置２００Ｃでは、結果Ｘｓａを受信する（Ｓ９５Ｂ）。暗号生成装置１００Ｃでは、秘密鍵情報Ｓａを反復回数ｒに設定し、結果Ｘｓｂを初期値Ｘ０へ設定し（Ｓ９６Ａ）、復号装置２００Ｃでは、秘密鍵情報Ｓｂを反復回数ｒに設定し、結果Ｘｓａを初期値Ｘ０へ設定する（Ｓ９６Ｂ）。
次に、暗号生成装置１００Ｃでは、多項式一次元写像をＳａ回反復計算し、更新鍵Ｘｋを得る（Ｓ９７Ａ）。暗号生成装置１００Ｃでは、多項式一次元写像をＳｂ回反復計算し、更新鍵Ｘｋを得る（Ｓ９７Ｂ）。 In equation (28), the digits of the coefficient are shown to the sixth decimal place. The graph of FIG. 31A is a plot in which x in the equation (28) is swayed from 0 to 1. In the graph,

When f (x0) = 0.98,
When f (x2) = 0.96
It has become.
FIG. 32 is a flowchart for updating the key using the equation (28), and FIG. 33 is a diagram illustrating the operation of the present embodiment by specific numerical values.
In this embodiment, the common key CK is obtained (S91A, S91B), a polynomial is generated from the common key CK (S92A, S92B), and the number Sa, which is the secret key information, is repeated in the processing unit according to the flowchart of FIG. 32. Set to r and set the common key CK to the initial value X0 (S93A, S93B).
Next, the encryption generation device 100C repeats the polynomial unity mapping Sa times to obtain the result Xsa, which is transmitted to the decryption device 200C (S94A). The decryption device 200C repeats the polynomial unity mapping Sb times to obtain the result Xsb, which is transmitted to the encryption generation device 100C (S94B).
Next, the encryption generator 100C receives the result Xsb (S95A), and the decryption device 200C receives the result Xsa (S95B). In the encryption generator 100C, the secret key information Sa is set to the number of repetitions r, the result Xsb is set to the initial value X0 (S96A), and in the decryption device 200C, the secret key information Sb is set to the number of repetitions r, and the result Xsa. Is set to the initial value X0 (S96B).
Next, in the encryption generator 100C, the polynomial one-dimensional map is iteratively calculated Sa times to obtain the update key Xk (S97A). In the encryption generator 100C, the polynomial one-dimensional map is iteratively calculated Sb times to obtain the update key Xk (S97B).

In this embodiment, considering the affinity with a computer that handles finite digits, the integer arithmetic of the equation (28) is considered.
The polynomial of "f4 (x)" in FIG. 14 is as follows.

上記の記号

は整数を扱い、値Ｎの小数点以下は切り捨てにするという意味である。 The section between the horizontal axis x and the vertical axis f4 (x) in the graph of “f4 (x)” in FIG. 14 is 1, but when this is magnified M times, it is expressed by the following equation. ..

Symbol above

Means that integers are treated and the value N after the decimal point is rounded down.

The one-dimensional mapping by the one-variable polynomial obtained by expanding the equation (28) from M = 1 to M = 10000 as an example so that the maximum interval of the horizontal axis and the vertical axis of FIG. It becomes the recurrence formula (29).

FIG. 33 is a diagram showing an example of calculation in which the key is updated by the equation (29) according to the flowchart of FIG. 32.
In FIG. 33, the equation (29) is generated from the common key value 36, “initial value X0 = 36” and the common key value are set, and the encryption generator 100C sets 7 as secret information and the equation (29). Is repeated 7 times to obtain "X7 = 8086" and transmit it to the decoding device 200C. On the other hand, the decryption device 200C sets 10 as confidential information, repeats the equation (29) 10 times to obtain "X10 = 7284" and transmits it to the encryption generation device 100C.

The encryption generation device 100C that has received "7284" from the decryption device 200C sets the initial value X0 = 7284 from the secret information 7 known only to the encryption generation device 100C, and repeats the equation (29) seven times to obtain "X7 =". 4721 "is obtained as an update key. On the other hand, the decryption device 200C receiving "8086" from the encryption generation device 100C sets the equation (29) to the initial value X0 = 8086 from the secret information 10 known only to the decryption device 200C, and repeats the equation (29) 10 times. By obtaining "X10 = 4721" as the update key, the encryption generation device 100C and the decryption device 200C update the common key.

FIG. 34 is a diagram showing another method for generating a one-variable polynomial. In FIG. 34, a cubic one-variable polynomial “f (x)” and a quadratic one-variable polynomial “g (x)” are prepared. Here, as in the case of generating equation (28), a one-variable polynomial is generated by giving "0.98" to f (x) and "0.96" to g (x) from the common key as maximum values. do. By synthesizing these two functions, the next 6th-order one-variable polynomial number "h (x)" is generated.

These generate a one-variable polynomial with modified coefficients and use the coefficients as a common key, but note that the selection of coefficients does not suddenly fall into the periodic zone (does not converge) by repeating the mapping. It needs to be a parameter band that does not diverge.

In the present embodiment, the encryption generation device 100C and the decryption device 200C generate random numbers to each other, and the values obtained by mapping the number of steps are exchanged to update the common key. On the other hand, as described in the third embodiment, when the common key (initial value) is disclosed, the security is low, but the number of steps of the iteration of the mapping generated by each communicator is used as the key as secret information. You may try to share.

In the previous embodiments, the number of digits in the calculation was reduced for the sake of explanation, but in the Diffie-Hellman key sharing method, the digit width of the calculation is increased as currently recommended for digits of 2048 bits or more. This shall ensure safety.

Focusing on the fact that the logistic map and the tent map are phase-conjugated, it is considered that the Diffie-Hellman type key sharing method can be used even for a one-dimensional map using a one-variable polynomial having a second or higher order as shown in the embodiment of the present invention. In the Bernoulli shift mapping, memory was secured and search processing (IF branching) was performed, but it is no longer necessary and it can be expected that the mapping can be repeated seamlessly. In addition, it was possible to show that one-dimensional mapping is effective in public key cryptography in addition to modal arithmetic.
Focusing on the fact that the Diffie-Hellman key sharing method can output secret information shared by each other if the number of final powers is the same as each secret information as a power multiplier, the initial value is used as a common key in a one-dimensional mapping. A device or system that updates a common key whose secret information is the number of iterations of mapping can be considered. In this configuration, the safety is low when the initial value is set to the public value, but it is possible to prevent information leakage to a third party by masking the transmitted data using the number of iterations of each map of the communicator as confidential information. It is possible to provide a cryptographic system that eliminates the need for key management.
Furthermore, according to the encryption method in which the common key shared by the encryption generation side and the decryption side is the number of iterations of the mapping, the common key encryption method using the one-dimensional mapping based on the discrete logarithmic problem is used. It is possible to provide a robust common key cryptographic compound code system in which "control parameters" including key sharing and session key generation and "number of mapping iterations" are double keys.
Although a plurality of embodiments according to the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other embodiments, and various omissions, replacements, and changes can be made without departing from the gist of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are also included in the scope of the invention described in the claims and the equivalent scope thereof.

10 ... CPU, 11 ... Main memory, 12 ... Bus, 13 ... External storage interface, 14 ... Input interface, 15 ... Display interface, 16 ... Communication interface, 23. External storage device, 24 ... Input device, 25 ... Display device, 26-1 to 26-n ... Port, 100, 100A, 100B, 100C ... Cryptographic generator, 101 ... Cryptographic generation unit, 102 ... Cryptographic side common key generation unit, 103 ... Cryptographic side session key generation unit, 104 ... Randomness generation unit, 105 ... First cryptographic side update key generation unit, 106. Second encryption side update key generation unit, 200, 200A, 200B, 200C ... Decryptor, 201 ... Decryption unit, 202 ... Decryption side common key generation unit, 203 ... Decryption side session Key generation unit, 205 ... First decryption side update key generation unit, 206 ... Second decryption side update key generation unit

Claims (21)

In a cryptographic decryption system including a cryptographic generator having a ciphertext generator that generates a ciphertext by calculation, and a decryption device having a decryption device that receives the ciphertext from the ciphertext generator and decrypts the ciphertext into plain text.
The cryptographic generator and the decryption device are provided with a cryptographic side common key generation unit and a decryption side common key generation unit that exchange notification information generated by each of them by a one-dimensional mapping calculation to generate the same common key. Be,
A encryption / decryption system characterized in that the encryption generation unit performs encryption generation based on the common key, and the decryption unit performs decryption processing based on the common key. The encryption side common key generation unit and the decryption side common key generation unit each hold different unique secret information and hold the same two numerical values, and each holds the secret information and the two numerical values in one dimension. The encryption / decryption system according to claim 1, wherein the notification information is generated by performing a mapping calculation. When the encryption side common key generation unit and the decryption side common key generation unit receive the notification information, the encryption side common key generation unit and the decryption side common key generation unit are characterized in that a common key is generated by a one-dimensional mapping calculation using the notification information and the secret information. The encryption / decryption system according to claim 2. The cryptographic generator is provided with a cryptographic side session key generation unit that generates a session key by performing an operation on the one-dimensional mapping based on the common key generated by the cryptographic side common key generation unit.
The cipher-generating unit generates a ciphertext using the common key and the session key.
The decoding device is provided with a decoding side session key generation unit that generates a session key by performing an operation on the one-dimensional mapping based on the common key generated by the decoding side common key generation unit.
The encryption / decryption system according to any one of claims 1 to 3, wherein the decryption unit generates plaintext by decryption using the common key and the session key. The encryption / decryption according to claim 4, wherein the encryption generation device includes a random number generation unit that generates a random number and sends the random number to the encryption side session key generation unit and the decryption side session key generation unit. system. The encryption / decryption system according to claim 4 or 5, wherein the encryption side session key generation unit and the decryption side session key generation unit generate a session key by a Bernoulli shift mapping or a logistic mapping. The cryptographic generator receives a common key from the cryptographic side common key generation unit, generates a one-variable polynomial with this common key, performs one-dimensional mapping with the one-variable polynomial, and generates cryptographic side exchange information. The cryptographic side update key generator is provided,
The decoding device receives a common key from the decoding side common key generation unit, performs a one-dimensional mapping by the one-variable polynomial with this common key, and generates a decoding side exchange information. Is provided,
The second cryptographic side update key generator receives the decryption side exchange information, performs one-dimensional mapping by the one-variable polynomial using the decryption side exchange information, and generates an update key.
The second decryption-side update key generation unit receives the encryption-side exchange information, performs one-dimensional mapping by the one-variable polynomial using the encryption-side exchange information, and generates an update key. The encryption / decryption system according to any one of 1 to 8. In the cipher generation unit, cipher generation using the generated update key is performed.
The encryption / decryption system according to claim 5 or 7, wherein the decryption unit performs decryption using the generated update key. In a cryptographic decryption method performed by a cryptographic generator having a ciphertext generator that generates a ciphertext by calculation and a decryption device having a decryption unit that receives a ciphertext from the ciphertext generator and decrypts the ciphertext into a plain text. ,
The encryption generator and the decryption device are provided with a cryptographic side common key generation unit and a decryption side common key generation unit.
A cryptographic decryption method comprising a cryptographic generation based on a common key in the cryptographic generation unit and a decryption process based on the common key in the decryption unit. The cryptographic side common key generation unit and the decryption side common key generation unit each hold different unique secret information and hold the same two numerical values, and each holds the same two numerical values in one dimension using the secret information and the two numerical values. The encryption / decryption method according to claim 9, wherein the notification information is generated by performing a mapping calculation. When the notification information is received, the encryption-side common key generation unit and the decryption-side common key generation unit are characterized in that a common key is generated by a one-dimensional mapping calculation using the notification information and the secret information. The encryption / decryption method according to claim 10. The encryption / decryption method according to claim 11, wherein the one-dimensional map is a Bernoulli shift map. The encryption / decryption method according to claim 11, wherein the one-dimensional map is a one-dimensional map of a one-variable polynomial. The encryption generation device is provided with a encryption side session key generation unit, and the encryption side session key generation unit performs an operation of the one-dimensional mapping based on the common key generated by the encryption side common key generation unit. Generate a session key
In the cipher generator, a ciphertext is generated using the common key and the session key.
The decoding device is provided with a decoding side session key generation unit, and the decoding side session key generation unit performs an operation of the one-dimensional mapping based on the common key generated by the decoding side common key generation unit. Generate a session key and
The encryption / decryption method according to any one of claims 11 to 13, wherein the decryption unit generates plaintext by decryption using the common key and the session key. 13. The described encryption / decryption method. The encryption / decryption method according to claim 14, wherein the encryption-side session key generation unit and the decryption-side session key generation unit generate a session key by a Bernoulli shift mapping or a logistic mapping. The encryption generation device is provided with a first encryption side update key generation unit, and the first encryption side update key generation unit receives a common key from the encryption side common key generation unit and uses this common key. Performs Bernoulli shift mapping, generates cryptographic exchange information,
The decryption device is provided with a first decryption side update key generation unit, and the first decoding side update key generation unit receives a common key from the decryption side common key generation unit, and Bernoulli receives the common key from this common key. Shift mapping is performed, decoding side exchange information is generated, and
The first encryption-side update key generation unit receives the decryption-side exchange information, performs Bernoulli shift mapping using the decryption-side exchange information, and generates an update key.
Claims 9 to 16, wherein the first decryption-side update key generation unit receives the encryption-side exchange information, performs Bernoulli shift mapping using the encryption-side exchange information, and generates an update key. The encryption / decryption method according to any one item. The encryption / decryption method according to claim 17, wherein the generated update key is used as a common key or a session key. The encryption generation device is provided with a second encryption side update key generation unit, and the second encryption side update key generation unit receives a common key from the encryption side common key generation unit and uses this common key. A one-variable polynomial is generated, a one-dimensional mapping is performed by this one-variable polymorphism, and cryptographic side exchange information is generated.
The decryption device is provided with a second decryption side update key generation unit, and the second decoding side update key generation unit receives a common key from the decryption side common key generation unit, and the common key is used to receive the common key. A variable polynomial is generated, a one-dimensional mapping is performed by this one-variable polynomial, and the decoding side exchange information is generated.
The second cryptographic side update key generation unit receives the decryption side exchange information, performs one-dimensional mapping by the one-variable polynomial using the decryption side exchange information, and generates an update key.
The second decryption-side update key generation unit receives the encryption-side exchange information, performs one-dimensional mapping by the one-variable polynomial using the encryption-side exchange information, and generates an update key. Item 9. The encryption / decryption method according to any one of Items 9 to 18. In the cipher generation unit, cipher generation using the generated update key is performed.
The encryption / decryption method according to claim 18, wherein the decryption unit performs decryption using the generated update key. A computer equipped with a cryptographic generator of a cryptographic decryption system,
It functions as a ciphertext generator that generates ciphertext by calculation,
A computer provided in the decryption device of the encryption / decryption system is made to function as a decryption unit that receives a ciphertext from the ciphertext generator and decrypts the ciphertext into plaintext.
Further, the cryptographic side common key generator that generates the same common key by exchanging the notification information generated by the computer provided in the cryptographic generator and the decryption device computer by the calculation of one-dimensional mapping. And the decryption side common key generator,
To function as
A computer provided in the encryption generator is made to function as the encryption generation unit to generate encryption based on the common key.
A encryption / decryption program, characterized in that a computer provided in the decryption device functions as the decryption unit to perform a decryption process based on the common key.

Images