JP3302335B2 - Ciphertext verification method, its program recording medium, and its device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a secure communication system in which communication contents are concealed in a telecommunication system and information about a private key of a decryptor is not leaked even when the decrypted contents are made public. More particularly, the present invention relates to a ciphertext verification method in which a decryptor verifies the legitimacy of a ciphertext and a program recording medium thereof.

[0002]

2. Description of the Related Art In an encryption system resistant to selective plaintext attacks,
The decryptor verifies that the sender of the ciphertext knows the original plaintext in some way. The Cramer-Shoup cipher is described in R. Cramer and V. Shoup: "A practical publ.
ic key cryptosystem provablysecure against adaptiv
e chosen chipertext attack ”, Advances in Cryptol
ogy-CRYPTO'98, LNCS 1462, Springer-Verlag, pp.13-2
5, 1998, can be proved to be strong against adaptive choice ciphertext attacks under the widely believed assumption of the existence of a generalized one-way hash function and the difficulty of Diffie-Hellman decision problem This is a key encryption method. Cramer-Sho
Up encryption is an encryption method that assumes one decryption person having one secret key corresponding to one public key.

In the Cramer-Shoup encryption method, which is already known to be resistant to adaptive selective ciphertext attacks in the case of a single decryptor, first, large prime numbers p and q are selected such that q divides p-1. , The element g of the subgroup Gq of order q of the multiplicative group Zp
1, g2, the secret key is (x1, x2, y1, y
2, z) ∈Zq ^5, the public key ^{X = g1 x1 g2 x2 mod p} ,
Let Y = g1 ^y1 g2 ^y2 mod p and Z = g1 ^z mod p. The ciphertext E for the plaintext m∈Gq is (u1, u2, v, e)
A correctly formed ciphertext is such that for a given random number r, u1 = g1 ^r mod p, u2 = g2 ^r mod p, c = H
(U1, u2), v = X ^r Y ^cr mod p, e = mZ ^r mod
satisfies p. Upon receiving this ciphertext, the decryptor first
c = H (u1, u2) is calculated, and the ciphertext is verified by the verification formula u1.
^{x1 + cy1} u2 ^{x2 + cy2 検}証 Verify whether v (mod p) is satisfied, and if not, refuse to decrypt the ciphertext; otherwise, calculate m = e / u1 ^z modp And plaintext m
Get.

[0004] The above verification formula allows the decryptor to confirm that the creator of the ciphertext knows the original plaintext m. The attacker cannot obtain any useful information because it refuses decryption for an illegal ciphertext that does not satisfy the verification formula. However, in this ciphertext verification method, when decryption is rejected as a result of the verification, the verified ciphertext is incorrect for a third party, that is, V ^@ u1 ^{x1 + cy1} u2.
as ^{x2 + cy2} (mod p), that it does not become a V ≠ v (mod p), it is difficult in practice to prove without Las leakage what et al information about the V.

Further, as is often the case with the ElGamal encryption, the secret key corresponding to one public key is divided into a plurality of partial secret keys by secret sharing, and this is held by a plurality of decryptors. In the case of applying the thresholded decryption that enables decryption only when the number of decryptors exceeding the threshold value cooperates, an illegal ciphertext that does not satisfy the verification formula in this decryption method On the other hand, ^since the calculation result V of the left side of the verification formula u1 ^{x1 + cy1} u2 ^{x2 + cy2} is known to a plurality of ^decryptors , information is leaked to the attacker when there is a ^decryptor who ^colludes with the attacker. This makes it impossible to maintain security against selected ciphertext attacks.

For a decoding method with a threshold value, see, for example, the article V. Shoup and R. Gennaro: “Securing thresho
ld cryptosystems against chosen ciphertext attack
”, Advances in Cryptology-EUROCRYPT ^, 98, LNCS 14
The method proposed in 03, Springer-Verlag, pp.1-16,1998 has been shown to be resistant to adaptive selective ciphertext attacks under the assumption that a random oracle exists.

However, the assumption of a random oracle is extremely impractical. If a random oracle is used by replacing it with a hash function or the like which is considered to be difficult to collide, no guarantee can be obtained for its security. Can not.

[0008]

SUMMARY OF THE INVENTION The object of the present invention is
In the amer-Shoup cipher, the validity of ciphertext can be verified without leaking any information about the value in the verification formula,
Also, if the value of the validation expression indicates that it is not valid,
A zero-knowledge proof can be used to prove to a third party that the value has been created correctly, and when multiple decryptors cooperate and verify, if there is an unauthorized person in the decryptors Another object of the present invention is to provide a ciphertext verification method, a program recording medium, and a device thereof, in which a value of a verification formula is not leaked to a decryption person.

[0009]

Means for Solving the Problems The value of the verification formula at the time of decryption in the Cramer-Shoup cipher is raised to the power of a random number that no one of the decryptors can know the value, and the result of the power raised is 1
The validity of the ciphertext is verified by verifying whether or not By performing the calculation of exponentiation with this random number by distributed calculation in cooperation with all the operators, even if the verification expression is not satisfied, the value of the verification expression before exponentiation does not leak to any decoder In other words, if the value is not valid, the calculated value is a value other than 1, and the value is raised to a power by a random number. Therefore, even if the calculated value is not 1 and the calculated value is not 1, that is, it is not valid. The value before the exponentiation is hidden, and there is no risk of information leakage.

It is assumed that n decryptors are P1 to Pn, and each decryptor Pj (j = 1, 2,..., N) has a unique public value wj. (X1, x2, y1, y2, z) ∈Zq ⁵
Is shared by a secret sharing scheme with a threshold value t, and a secret value (x1j, x2j, y1j, y2j, zj) corresponding to the value wj
Is the secret key of the decryptor Pj.

Xj = g1 ^x1j g2 ^x2j mod p, Y
Let (Xj, Yj, Zj) that j = g1 ^y1j g2 ^y2j mod p and Zj = g1 ^zj mod p be the public key of the decryptor Pj. X
= G1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mod p, Z =
Let (X, Y, Z) g1 ^z mod p be the public key used for encryption. Each of the decryption devices is connected by a secure communication path, and each of the decryption devices can use a broadcast-type communication path that guarantees that all other decryption devices receive the same contents. Shall be.

E = (u1, u2, v, e) is calculated by Cramer-Sho
The encrypted text is a plaintext m encrypted by the up encryption method.
The decryptor device cooperates to execute the distributed random number generation procedure, and the device of the decryptor Pj obtains the secret value rj. Here, rj is a secret value corresponding to the value wj when the random number r∈Zq is shared by the secret sharing method with the threshold value t. From any t + 1 secret values, r It is a value that can be recovered. Also, due to the nature of the distributed random number generation procedure, each decryption device cannot know the value of r, and r is 0 or more and q
Will be a random integer less than.

The device of each decryptor Pj that has received E is c =
H (u1, u2) and Vj = (u1 ^{x1j + cy1j} u2
^{x2j + cy2j} v ^-1 ) ^{Calculate rj} mod p. Further, Vj is distributed by a verifiable secret sharing scheme with a threshold value of 2t, and a value wk
Secret value Vj corresponding to (k = 1, 2,..., N, k ≠ j)
k is transmitted to the device of each decryptor Pk via a secure communication path. After receiving Vjk from all other decoder devices, the device of decoder Pk transmits Vk to all other decoder devices via the broadcast communication path. Each decryptor device receives each V
Verify that k is a correct value using Vkj.

[0014] Of the Vk confirmed to be correct, 2t + 1 are selected, and the exponent part, ie, x1k + cy1k, x2k +
The value V restored by the secret restoration procedure for cy2k is 1
Check if it is equal to. If they are not equal, repeat the secret recovery procedure in the other combinations in the same manner, for all 2t + 1
If the restoration value is not equal to 1 for any of the combinations, the decoding is refused and the operation is stopped.

When each ^decryptor calculates according to the above procedure, V = (u1 ^× 1 ^{+ cy1} u2) from a secret key recovery procedure for the exponent part from 2t + 1 or more correct Vk.
^{x2 + cy2v- 1} ) ^r mod V can be restored.
Here, if V is not congruent with 1 modulo p, then Cram
the original validation expression in the er-Shoup method ^{u1 x1 + cy1 u2 x2 + c} y2
Is not congruent with v. On the other hand, when V is congruent with 1, it means that the original verification formula is congruent with v or the random number r is 0. However, the probability that the random number r generated by the distributed random number generation procedure becomes 0 is 1 / q
And is small enough to be ignored. Therefore,
If V is congruent with 1, the original verification equation can be considered congruent with v.

Here, it is assumed that there are a maximum of t decryptors who commit fraud. The t persons (1) make sure that the value V of the verification formula for the illegal ciphertext E is 1 or (2) make sure that the value V of the verification formula for the valid ciphertext E does not become 1; It may be possible to deviate from the above procedure for two purposes. First, in order to achieve the purpose of (1),
The value of V restored from some 2t + 1 Vk must be 1. However, all the decryptor devices including the fraudulent device have Vk output from other decryptor devices.
Before knowing the value of Vc, the value of its own Vk must be shared by a verifiable secret sharing method, and the V
Since it is impossible to change the value of Vk of the own device after knowing the value of k, an unauthorized decoder can achieve the purpose of (1) only when the prediction regarding Vk of another decoder is successful. it can. The probability of hitting the prediction is 1 / q, which is small enough to ignore. Next, with regard to the case (2), no matter what the illegal decryptor device transmits the illegal value Vk, the illegal person is at most t, and the other 2t + 1 devices have the correct value. Since it is transmitting, at least one way can take a set of 2t + 1 Vk of all correct values, and from such a set V =
1 is restored.

Regarding information leakage, if V is not 1, for any value of u1 ^{x1 + cy1} u2 ^{x2 + cy2} ,
V = (u1 ^{x1 + cy1} u2 ^{x2 + cy2} v ⁻¹ ) ^r mod r that satisfies p
Is determined, then (u1 ^{x1 + cy1} u2 ^{x2 + cy2} v ^-1 )
Is randomized by r, and even if this randomized value is indicated, the value before being randomized by r is not leaked. That is, in the above verification method, the information on u1 ^{x1 + cy1} u2 ^{x2 + cy2} is No leakage.

As described above, according to the present invention, if the number of unauthorized decryptors is less than 1/3 of all decryptors, the original Cramer-Shoup can be performed by the cooperation of a plurality of decryptors without leaking any information on the secret key. It is possible to calculate a verification equation equivalent to the verification equation of the encryption method, and therefore, it is possible to configure a multi-decryptor encryption / decryption apparatus that is resistant to adaptive selection ciphertext attacks.

In the above-mentioned method, when there are n decryptors, each decryptor apparatus receives 2t + 1 pieces of verification data (V1,..., Vn) received from all decryptor apparatuses. Take out the data and verify whether it satisfies a certain verification formula. If not, this verification is performed for all 2t + 1 combinations that can be obtained for n. Therefore, when the verification formula is not satisfied, there is a disadvantage that the calculation amount increases exponentially with respect to the number n of the decryptors.

According to another aspect of the present invention, in an encryption / decryption method using a plurality of decryptors, calculations can be efficiently performed even for a large number of decryptors, and more than one-third or more decrypters are illegal. The present invention provides a ciphertext verification method for a ciphertext that is resistant to adaptive selective ciphertext attacks that can be recovered even after performing the method, and a program recording medium therefor. That is, according to another aspect of the present invention, first, as means for reducing the amount of calculation for the number of decryptors, an unauthorized person is specified by having each decryptor device prove the validity of the result by zero-knowledge proof. The ciphertext is verified using only valid data. By doing so, it is possible to perform verification with a calculation amount proportional to the number n of decryptors. However, since the zero-knowledge proof used at this time has a large amount of communication, it is inefficient when fraud hardly occurs. A unique public value of each decoder is determined so that the calculation result of each decoder device becomes a codeword of the BCH code, the receiver device verifies that the calculation result is a codeword, and only when the calculation result is not a codeword, By executing the zero-knowledge proof, when a correct ciphertext is received, it is possible to perform an efficient calculation while suppressing the communication amount.

According to this method, the number of permissible fraudulent persons is up to t persons satisfying 3t + 1> n, which is inappropriate when a more permissive and secure system is desired. In addition, as a means to cope with the case where the fraudulent person is 1/3 or more and less than 1/2, when the fraudulent person is identified, another decryption apparatus cooperates with the decryption secret key possessed by the unauthorized decryption apparatus. The problem is solved by calculating and publishing so that anyone can calculate the correct result on behalf of its unauthorized decryptor.

Specific means are as follows. The n decryptors are P1 to Pn, and a unique public value wj is allocated to each decryptor Pj. A threshold value t that satisfies 3t <n is determined. (X1, x2, y1, y2 , z) the ∈Zq ⁵ was dispersed by a secret sharing scheme threshold t, the secret value corresponding to the value wj (x1j, x2j, y1j, y2j, zj) the decryption person Pj The secret key.

Xj = g1 ^x1j g2 ^x2j mod p, Y
Let (Xj, Yj, Zj) that j = g1 ^y1j g2 ^y2j mod p and Zj = g1 ^zj mod p be the public key of the decryptor Pj. X
= G1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mod p, Z =
Let (X, Y, Z) g1 ^z mod p be the public key used for encryption. Each of the decryption devices is connected by a secure communication path, and each of the decryption devices can use a broadcast-type communication path that guarantees that all other decryption devices receive the same contents. Shall be.

Let E = (u1, u2, v, e) be a Cramer-Sho
The encrypted text is a plaintext m encrypted by the up encryption method.
The decryptor device cooperates to execute the distributed random number generation procedure, and the device of the decryptor Pj obtains the secret value rj. Here, rj is a secret value corresponding to the value wj when the random number r∈Zq is shared by the secret sharing method with the threshold value t. From any t + 1 secret values, r It is a value that can be recovered. Also, due to the nature of the distributed random number generation procedure, each decryptor cannot know the value of r, and r is a random integer from 0 to less than q.

Next, all the decryptor devices cooperate to execute the distributed multiplication means, and the device of each decryptor Pj determines the secret value x1j ', x
2j ', y1j', y2j 'are obtained. Where the secret value x
1j ′ is a value obtained by distributing the product of the random number r and the secret key x1 by the secret sharing method with the threshold value t,
It is possible to decode r · x1 (mod q) from x1j ′ possessed by one decryptor. Secret value x2j ', y1
j ′ and y2j ′ are similarly set at arbitrary t +
From one value, r · x2 (mod q), r · y1 (mod
q), r · y2 (mod q) can be restored.

Each decryptor Pj device receiving E receives c = H
( ^U1 , u2) and Vj = u1 ^{x1 j '+ cy1j'} u2
^{x2j '+ cy2j'} v ^-rj mod p is calculated, and Vj is transmitted to all other decoder devices via the broadcast-type communication channel. Next, each decoder determines that the exponent part of (V1,..., Vn) is a BCH codeword. (V1, ..., V
If it turns out that the exponent part of n) is not a codeword of the BCH code and is incorrect, the device of each decoder Pj
X1j that j is ^{u1 x1j '+ cy1j' u2 x2j} '+ cy2j' v calculation results ^{-rj mod p ', x2j',} y1j ', y2
Without leaking information on j 'and rj, it is proved to other decryptors by the zero knowledge proof.

The decryptor Pj whose certification has failed is regarded as a fraudulent person, and the secret value x1 of the deviator who is the fraudulent person is j1.
j ', x2j', y1j ', y2j', rj are recovered by another decryptor using a secret value recovery procedure, and the correct value of Vj is made public. The correct (V1,..., Vn) is obtained including the published value of the correct Vj. After confirming that the exponent part of (V1,..., Vn) is correct and is a codeword, the value V is restored by a secret restoration procedure for the exponent part. Each decryptor device checks whether V is equal to 1 and if not, rejects decoding and stops.

If equal, the device of each decryptor Pj is Dj
= U1 ^zj mod p and transmit it to all other decoders by broadcast-type channel. Upon receiving Dj, each decryptor performs the same codeword verification on (D1,..., Dn) as performed on (V1,..., Vn). Similarly, an unauthorized person is identified by performing zero knowledge proof, and a correct value of Dj is recovered using a secret value recovery procedure.

Each of the decryption apparatuses is correct (D1,..., D
From n), D = u by the secret recovery procedure for the exponent part
Reconstruct 1 ^z mod p and calculate m = e / D mod p to decode message m. When each decryptor device calculates according to the above procedure, V = (u1) is obtained from 2t + 1 or more arbitrary correct Vk by a secret key restoration procedure for the exponent part.
^{x1 + cy1 u2 x2 + c y2} v -1) can restore the ^r mod p becomes V. Here, if V is not congruent with 1 modulo p, the original verification formula u1 ^{x1 + cy1} in the Cramer-Shoup method
The value of ^{u2x2 + cy2} is also not congruent with v. On the other hand, when V is congruent with 1, it means that the original verification formula is congruent with v or the random number r is 0. However, the probability that the random number r generated in the distributed random number generation procedure becomes 0 is 1 / q, which is sufficiently small and can be ignored. Therefore, when V is congruent with 1, the original verification formula can be regarded as congruent with v.

Here, it is assumed that there are a maximum of t decryptors who commit fraud. The t persons (1) make sure that the value V of the verification formula for the illegal ciphertext E is 1 or (2) make sure that the value V of the verification formula for the valid ciphertext E does not become 1; It may be possible to deviate from the above procedure for two purposes. However, the output of all decryptor devices is B
Because it is verified by the codeword inspection of the CH code,
When an incorrect value exists, if the incorrect value is less than 1/3 of the entire value, the existence can be detected. In such a case, each decryptor proves the correctness of the output value by the zero-knowledge proof, so that a fraudulent person who outputs an incorrect value fails the proof and is eliminated.

Regarding information leakage, when V is not 1, for any value of u1 ^{x1 + cy1} u2 ^{x2 + cy2} ,
V = (u1 ^{x1 + cy1} u2 ^{x2 + cy2} v ⁻¹ ) ^r mod r that satisfies p
Is determined, so in the above verification method, u1 ^{x1 + cy1
No} information about u2 ^{x2 + cy2} is leaked. As described above, according to the present invention, the decryption person who performs fraud is one third of the total decryption person.
If it is less than the above, it is possible to calculate a verification equation equivalent to the original Cramer-Shoup cryptography verification equation with the cooperation of multiple decryptors without leaking any information on the secret key It is possible to configure a multi-decryptor encryption / decryption method that is strong against sentence attacks.

On the other hand, in the above means, the code word check of the BCH code is not performed, the zero-knowledge proof is always executed to identify the unauthorized person, and the other secretaries cooperate with each other to share the secret secret possessed by the unauthorized decryptor. By calculating and publishing the key, anyone can calculate the correct result on behalf of the unauthorized decryptor, so that less than half the unauthorized person can be handled (the zero-knowledge proof is correct). That is decided by majority vote, so at least half of the decoders must be correct).

[0033]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 Hereinafter, a ciphertext verification method according to a first embodiment of the present invention will be described. As shown in FIG. 1, the ciphertext created by the ciphertext creator device 11 is decrypted by the decryptor device 12. In order to prevent the decryption device 12 from arbitrarily rejecting the decryption unless the ciphertext is correct, the verifier device 13 verifies whether the decryption rejection is appropriate.

Now, there are large prime numbers p and q, and q is p−1
Is divisible. Elements g1 and g2 of Gq are randomly selected. X = g1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2
Let ^y2 mod p, Z = g1 ^z mod p be the public key used in the encryption procedure. Here, (x1, x2, y1, y2, z) ∈
And Zq ^5. The public key is p,
It is assumed that it has been released along with q, g1, and g2. It is assumed that the secret key is stored on the memory of the decryption apparatus.

Cramer-Shoup encryption using X, Y, and Z as public keys
Ciphertext E = (u1,
u2, v, e) as shown in FIG.
1), the decryption apparatus generates a random number r (S2), and c = H
(U1, u2) and V = (u1 ^{x1 + cy1}u2
^{x2 + cy2}v^-1)^rThe mod p is calculated (S3). If V is 1
If this is the case, the ciphertext is accepted (S4), and the decryption calculation is performed.
(S5).

If V is not 1, it is rejected. In order to prove the rejection to a third party, BC (r) is made public by using a bit commitment function BC (). This bit commit function includes, for example, Pederse
n. That is, a random number s is generated, and BC
(R, s): = g ^{r hs} mod p is calculated. Where g,
h is Gq such that the discrete logarithm of h with base g is unknown.
Is the source of

Then, r forming BC (r, s)
Using x1, x2, y1, and y2 constituting the public keys X and Y, the result of performing the calculation of (u1 ^{x1 + cy1} u2 ^{x2 + cy2} v ^-1 ) ^r mod p is V, and r, x1 , X2, y1, y
Without divulging the secret about No. 2 to a third party with zero knowledge proof (S6). This zero knowledge proof is performed in the following procedure.

In the following, g and h are elements of Gq such that the discrete logarithm of h whose base is g is unknown. Decoding's device, a random number a, a1, a2, b1, b2 selected from ^{Zq, R = g r h a} mod p RX1 = R x1 h a1 modp RX2 = R x2 h a2 modp RY1 = R y1 h b1 modp RY2 = R ^y2 h ^b2 modp become R, RX1, RX2, RY1, RY2 to the sent to the verifier apparatus.

Further, the decryption apparatus randomly selects a random number w0 from Zq, and sends K = g, L = g ^w0 mod p to the verifier apparatus. The verifier device has e0 and e
1 is randomly selected from Zq to calculate B = K ^e0 L ^e1 modp and send B to the decoder.

The decoder's device selects a random number w1~w18 randomly from ^{_{Zq, T 1 = g 1 w1}} g 2 w2 mod p T 2 = g 1 w3 g 2 w4 mod p T 3 = g w5 g w6 mod p _{^{T 4 = R w1 h w7 mod}} p T 5 = R w2 h w8 mod p T 6 = R w3 h w9 mod p T 7 = R w4 h w10 mod p T 8 = g w11 h w12 mod p T 9 = g w13 to calculate the _{^{h w14 mod p T 10 = g}} w15 h w16 mod p T 11 = g w17 h w18 mod p T 12 = u1 w11 + cw15 u2 w13 + cw17 v -w5 mod p, and sends to the verifier apparatus.

The verifier sends e0 and e1 to the decryptor. The decryption apparatus confirms that B = K ^e0 L ^e1 modp holds, and stops the certification if it does not hold. If this is true, the decryptor apparatus calculates: z1 = w1 + e0 * x1 modq z2 = w2 + e0 * x2 modq z3 = w3 + e0 * y1 modq z4 = w4 + e0 * y2 modq z5 = w5 + e0 * r modq z6 = w6 + e0 * a modq e7 * 7 z8 = w8 + e0 · a2 modq z9 = w9 + e0 · b1 modq z10 = w10 + e0 · b2 modq z11 = w11 + e0 · r · x1 modq z12 = w12 + e0 (a · x1 + a1) modq z13 = w13 + e0 · r · x2 + modxz14 Modq z15 = w15 + e0 · r · y1 modq z16 = w16 + e0 (a · y1 + b1) modq z17 = w17 + e0 · r · y2 modq z18 = w18 + e0 (a · y2 + b2) modq is calculated, and z1 to z18 and w0 are sent to the verifier device. Send it.

The verifier _{^{apparatus, L = g w0 modp g 1}} z1 g 2 z2 = T 1 X e0 mod p g 1 z3 g 2 z4 = T 2 Y e0 mod p g z5 h z6 = T 3 R e0 modp R _{^{z1 h z7 = T 4 (RX1}} ) e0 mod p R z2 h z8 = T 5 (RX2) e0 mod p R z3 h z9 = T 6 (RY1) e0 mod p R z4 h z10 = T 7 (RY2) e0 mod p g ^z11 h ^z12 = T ₈ (RX1) ^e0 mod p g ^z13 h ^z14 = T ₉ (RX2) ^e0 mod p g ^z15 h ^z16 = T ₁₀ (RY1) ^e0 mod p g ^z17 h ^z18 = T ₁₁ (RY2) to verify that ^{the e0 mod p u1 z11 + cz15 u2} z13 + cz17 v -z5 = T 12 V e0 mod p holds.

The principle of the above proof is the same as that of the Schnorr signature, and the decryptor device is V, X, Y, R, RX1, RX2,
Since the verification formula is valid only when RY1 and RY2 are created correctly, the verification fails if even one does not hold. Embodiment 2 Hereinafter, a second embodiment of the present invention will be described. As shown in FIG. 3, the cipher creator device 11 and the decryptors P1 to Pn
And each device 12 ₁ to 12 _n of which is connected to the broadcast channel 14, also decipherer device 12 ₁ to 12 _n are connected by a secure communication channel 15 to each other.

Now, there are large prime numbers p and q, and q is p−1
Is divisible. Elements g1 and g2 of Gq are randomly selected. First, n decryptors are defined as P1 to Pn, and a unique public value wj is allocated to each decryptor Pj (j = 1, 2,..., N). A threshold value t that satisfies 3t <n is determined. All the decryption apparatuses perform a distributed random number generation procedure of the threshold value t.
5 times, and the device of the decryptor Pj determines that the secret value (x1j, x2
j, y1j, y2j, zj), and this is used as the secret key of the decryptor Pj. Xj = g1 ^x1j g2 ^x2j mod p,
Let (Xj, Yj, Zj) such that Yj = g1 ^y1j g2 ^y2j mod p and Zj = g1 ^zj mod p be the public key of the decryptor Pj.
Further, X = g1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mo
Let d p, Z = g1 ^z mod p be the public key used in the encryption procedure. Here, (x1, x2, y1, y2, z) ∈Zq
⁵ is an arbitrary t + 1 set of secret values (x1j, x2j, y1
j, y2j, zj) are random numbers restored by the secret restoration procedure. As a distributed random number generation procedure for generating such random numbers, for example, there is a method by Pedersen. The procedure for generating the distributed random numbers will be described below.

As shown in FIG. 3, between each decryptor device.
It is assumed that there is a secure communication channel 15 and that each decryptor
The device receives the same content from all other decryptor devices
That can use the broadcast type communication path 14 that is guaranteed to be
I do. S-1) The device of Pj has two polynomials f (X) =
a_0j+ A_1jX + ... + a _tjX^tAnd g_j(X) = b_0j+
b_1jX + ... + b_tjX^tRandomly select the Pk
(K = 1, 2,..., N, excluding k = j) fj (w
k) and gj (wk) over a secure channel
You.

S-2) The device of Pj is i = 0, 1,..., T
The _{^{C ij = g1 aij g2 bij mod}} p calculated for, and transmits through the broadcast communication channel to all other decoder's apparatus. S
-3) The apparatus of Pk that received the C _ij from all other decipherer device wki = wk ⁱ mod q as g1 ^{fj (wk)} g2
^{gj (wk)} = C _0j ^wk0 · C _1j ^wk1 ... Verify that C _tj ^wkt mod p holds.

S-4) The device of Pk is x1k = f1 (w
k) + f2 (wk) +... + fn (wk) mod q, x2k
= G1 (wk) + g2 (wk) + ... + gn (wk) mod
The distributed random number values x1k and x2k are obtained as q. S-5) X
= C ₀₁ ... C _0n modp. Similarly, the public keys Y and Z and the corresponding private keys y1j, y2j and zj of each decryptor are created in the same manner.

All the decryptor's devices generate a distributed random number rｑZq by the distributed random number generation procedure, and each decrypter Pj's device holds the secret value rj (FIG. 5, S1). X, Y,
After receiving the ciphertext E = (u1, u2, v, e) of the plaintext m encrypted by the Cramer-Shoup encryption method using Z as a public key (S2), the device of each decryptor Pj sets c = H (u
1, u2) and Vj = (u1 ^{x1j + cy1j} u2 ^{x2j + cy2j} v
^-1 ) ^{Calculate rj} mod p (S3).

Subsequently, the device of Pj distributes Vj by a verifiable secret sharing method with a threshold value of 2t, and transmits a secret value Vjk corresponding to the value wk to the device of each decryptor Pk via a secure communication path. (S4). Pedersen's method can be used for the verifiable secret sharing method used here.
The following is the procedure. P-1) There are large prime numbers P and Q, Q divides P-1 and Q> p, and g and h are elements of G _Q for which the value of log _g h is unknown.

[0050] P-2) two of the polynomial f _j on the device _{Pj Z Q (X) = V} j + a 1j X + ... + a tj X t and g _j
(X) = b _0j + b _1j X +... + B _tj X ^t (where a _0j = V
j) are selected at random except for the portion of Vj, and fj (wk) and gj (wk), that is, Vjk, are transmitted to each Pk device through a secure communication channel. P-3) Pj
Apparatus has C _ij = g ^aij h for i = 0, 1,..., ^T.
Calculate ^bij mod p and transmit it to all other decoder devices via the broadcast channel.

P-4) C_ijThe device of Pk that has received
i = wkⁱg as mod q^{fj (wk)}h ^{gj (wk)}= C_0j ^wk0・
C_1j ^wk1... C_tj ^wktverify that mod p holds,
That is, Vjk is verified (S5). P-5) If this does not hold, the Pk device gives a “fail”
Transmit to all other decryptor devices via broadcast communication channel
You.

P-6) If the number of "fail" notifications is t + 1 or more, Pj is regarded as an unauthorized person and is excluded (Sj).
6), all other decryptor devices discard all information previously transmitted by the device of Pj. Steps P-4, 5, and 6 are procedures for verifying the shared secret value Vjk and removing an unauthorized person. After all decryption apparatuses have finished transmitting data, a reject list is made public. It may be done by doing.

After all the decoders have distributed Vj according to the above procedure, each decoder Pj _transmits Vj and _b0j to all other decoders via the broadcast communication channel (S7). The device of each _decryptor Pj that has received this is C _0j
= ^{G1 Vj hb0j} mod p is verified and Vj is verified (S8). If it does not hold,
"Fail" is notified to all other decryption apparatuses, and an unauthorized person is excluded (S9).

2t + 1 are arbitrarily selected from all Vk confirmed to be correct (S10), and it is checked whether or not the value V restored by the secret restoration procedure for the exponent part is equal to 1 (S11). The secret recovery procedure for the exponent is described in Crame
r, et.al: “A seure and Optimally Efficient Multi-A
uthority Election Scheme ”, Advances in Cryptology
-Eurocrypt'97, LNCS 1233 Springer-Verlag, pp.103-
118, 1997 Below, the selected 2t + 1 V
The restoration procedure for the exponent part when the set of the index k of k is α is shown. The secret value of the exponent is Pederse
Let n be a secret value obtained by the verifiable secret sharing scheme.

R-1) First, the Lagrange interpolation coefficient is

[0056]

(Equation 1) Is calculated as R-2) Next,

[0057]

(Equation 2) Is calculated. If V is not 1, the secret restoration procedure is similarly repeated for another 2t + 1 combinations (S12). If the restoration value is not equal to 1 for all combinations, a failure is notified and the operation is stopped.

If there is at least one combination, the ciphertext is accepted. The device of each decryptor Pj calculates Dj = u1 ^zj mod p as shown in FIG. 4 (S1),
The data is transmitted to all the other decryption apparatuses via the broadcast communication channel (S2). D1,..., D
It is confirmed that the discrete logarithm of n base u1 is the codeword of the BCH code (S4), and if it is a codeword, D = u1 by the secret restoration procedure for the exponent described above.
^z mod p is restored (S5), and m = e / D modp is calculated to decode the message m (S6). If it is not a code word in step S4, the correctness of the calculation is proved by the zero knowledge proof, and those that cannot be proved are discarded as illegal Di (S7). Embodiment 3 Hereinafter, a third embodiment of the present invention will be described.

It is assumed that there is a secure communication path between each of the decryption devices, and each of the decryption devices has a broadcast type in which all other decryption devices are guaranteed to receive the same contents. It is assumed that a communication path can be used. There are large prime numbers p and q, and q is divisible by p-1. The element g1 of Gq
g2 is selected at random. First, n decryptors are P1
To Pn, and a unique public value wj is assigned to each decryptor Pj. A threshold value t that satisfies 3t <n is determined.

First, the secret sharing method by Pedersen
Show the law. First, let g and h be log_gh is unknown
Gq. Distributor P that distributes secret values a0 and b0
Is a t-th order polynomial f (X) = a0 on Zq
+ A1X + ... + atX^t, G (X) = b0 + b1X +...
+ BtX ^tIs randomly selected except for a0, and each recipient
Pass f (wj) and g (wj) to the Pj device via a secure communication channel
Send it through.

Next, the commit value Ei of each coefficient is set as i =
Ei = g for 0, ..., t^aih^bicalculated like mod p
And publish it via a broadcast channel. Received these
The device of each Pj is uji = wjⁱg as mod q^{f (wj)}
h^{g ( wj)}= E0^uj0E1^uj1... Et^ujtmod p holds
Verify that This E0 ^uj0E1^uj1... Et^ujtmo
Let the value of d p be the commitment to the shared secret value of Pj and
Call. If the commit value of each coefficient is published,
And the commitment to the shared secret value of any Pj
Can be calculated.

In the following, this secret sharing method is represented by Ped (a0, b0) [g, h] → (a0j, b0
j) Write as (E0, ..., Et). (A0, b0) is the secret information to be distributed, (a0j, b0j) is the distributed secret value received by the device of each Pj via a secure communication path, and each of them is f (w
j), g (wj). (E0,..., Et) are the commit values of the respective coefficients that are made public through the broadcast communication channel. [G, h] represents a base used when creating a commit. Regarding the above notation, unless otherwise specified, the coefficients of the polynomial except for the constant term are randomly selected.

To recover the original secret from the secret value thus distributed by polynomial interpolation, first,
The holder of each shared secret value publishes that value. For the published (a0j, b0j) value, g ^a0j h ^b0j = E0
^uj0 E1 ^uj1 ... Confirm that ^Etujt modp holds. Any t + 1 (a0
j, b0j), the set created by the index j is α. Lagrange interpolation coefficient

[0064]

(Equation 3) Then

[0065]

(Equation 4) And a0 can be recovered. b0 can be similarly recovered. The above secret sharing method can be executed in exactly the same manner even if only one base is used. In such a case, Ped (a0) [g] → (a0j) (E0,..., E
Write t).

Using this secret sharing method, a plurality of people can cooperatively generate a random number that is shared. First,
The Pi device selects random numbers ai and bi from Zq, and calculates them as Ped (ai, bi) [g, h] → (aij, bij)
(Ei0..., Eit). All of P1 to Pn execute this. Then, the device of Pj is (a1j, b1j),.
(Anj, bnj) is received from the secure communication path, and (E1
0,..., E1t),..., (En0,. At this time, the shared secret value (x1j, x2j) of Pj is represented by x1j = a1j +... + Anj m
odq, x2j = b1j +... + bnj modq. The random number value x1 recovered from the shared secret value is

[0067]

(Equation 5) And no one knows its value until the recovery is performed. Further, the commit value EXk of the k-th coefficient of the polynomial using the secret random value as a constant is expressed as EXk = E1
k · E2k... Enkmod p. In particular, EX0 = g ^x1
Note that h ^x2 mod p. This method is called distributed random number generation, and Rand ([a], [b]) [g, h] → (aj, b
j) Write (E0,..., Et). ([A], [b]) are generated random numbers, and [] means that the value is unknown to any computer. The meanings of [g, h], (aj, bj) and (E0,..., Et) are the same as those of the secret sharing notation described above.

The all-decoder apparatus performs a procedure for generating a distributed random number with a threshold value t by Rand ([x1], [x2]) [g1, g2] → (x
1j, x2j) (EX0,..., EXt) Rand ([y1], [y2]) [g1, g2] → (y
1j, y2j) (EY0,..., EYt) Rand ([z1]) [g1] → (z1j) (EZ0,
..., run three times as EZt), apparatus of the decryption person Pj is a secret value (x1
j, x2j, y1j, y2j, zj), and this is used as the secret key of the device of the decryptor Pj. Xj = g1 ^x1j g
2 ^x2j mod p, Yj = g1 ^y1j g2 ^y2j mod p, Zj =
g1 ^zj mod p (Xj, Yj, Zj) is assigned to the decryptor Pj .
The public key of the device . In addition, X = EX0 = g1 ^x1 g2
^x2 mod p, Y = EY0 = g1 ^y1 g2 ^y2 mod p, Z = EZ
Let 0 = g1 ^z mod p be the public key used in the encryption procedure.
Here (x1, x2, y1, y2 , z) ∈Zq 5 is arbitrary t + 1 set of secret values (x1j, x2j, y1j, y2
j, zj) is a random number restored by the secret restoration procedure.

[0069] All the decryptor apparatuses perform a distributed random number generation procedure Ran.
d ([r], [s]) [g1, g2] → (rj, sj)
(R0,..., Rt) and a distributed random number r∈Zq
Is generated, and the device of each decryptor Pj holds the secret values rj and sj (FIG. 6, S1). Here, R is R = R0 = g1 ^r g
2 ^s mod p.

Next, all the decryption apparatuses obtain secret values x1j ', x2j', y1j ', y2j' by means of distributed multiplication means (S2). Here, the secret value x1j ′ is a value obtained by distributing the product of the random number r and the secret key x1 by the secret sharing method with the threshold value t, and x1 held by any t + 1 decryptors
From j ′, rx1 (mod q) can be decoded. Similarly, for the secret values x2j ', y1j', y2j ', rx2 (mod
q), ry1 (mod q) and ry2 (mod q) can be restored. Such a variance multiplication means is executed as follows.

The device of the decryptor Pj is as follows: Ped (x1j, x2j) [g1, g2] → (x1j
i, x2ji) (EXj0,..., EXjt). The device of each Pj is Rj = g1 ^rj g2 ^sj mod
Calculate p. This value Rj, since uji = wj ⁱ mod q as ^Rj = R0 uj0 R1 uj1 ... may be calculated as ^Rt ujt mod p, note that you can calculate anyone.

Next, the device of Pj is Ped (x1j, x
2d), Ped (x1j, s1j) [Rj, g
2] → (x1ji, s1ji) (ERX1j0,..., E
RX1jt) Ped (x2j, s2j) [Rj, g2] → (x1j
i, s2ji) (ERX2j0,..., ERX2jt). However, s1j and s2j are randomly selected, and a polynomial using these as a constant term is also randomly selected.

Finally, the device of Pj is Ped (x1j · rj, x1j · sj + s1j) [g
1, g2] → (rx1ji, rs1ji) (ERX1j
0,..., ERX1jt) Ped (x2j · rj, x2j · sj + s2j) [g
1, g2] → (rx2ji, rs2ji) (ERX2j
0, ..., ERX2jt).

The above procedure is executed by the devices P1 to Pn. The Pi device receives the set of received shared secret values (rx1
1i,..., Rx1ni), the Lagrange interpolation coefficient

[0075]

(Equation 6) Is calculated. The set of correct x1j 'indices is β
When | β |> = t + 1,

[0076]

(Equation 7) Since the multiplication result r · x1 can be recovered, it can be seen that x1j ′ is a t-th shared secret value of r · x1. Similarly to x1j ', x2j' is calculated. Further, the secret values y1j 'and y2j' are similarly calculated by executing the distributed multiplication procedure.

After receiving the ciphertext E = (u1, u2, v, e) for the plaintext m encrypted by the Cramer-Shoup encryption method (S3), the device of each decryptor Pj sets c = H (u
1, u2) and Vj = u1 ^{x1j '+ cy1j'} u2 ^{x2j '+ cy2j'}
v- ^rj mod p is calculated (S4), and Vj is transmitted to all other decoder devices via the broadcast communication channel (S5). Next, in each decryptor, the exponent part of (V1,..., Vn) is B
Confirm that the code word is a CH code (S
6). For the codeword confirmation procedure, refer to the literature FJ MacWilliam
s: “The Thory of Error Correcting Codes”, Nort
h-Holland Mathematical Library, pp. 201-202 or
M. Ben-Or, S. Goldwasser, A. Wigerson: “Completeness
Theorems for Non-Cryptographic Fault-Tolerant Dist
^{ributed Computation ", 20 th ACM Symposium} on Theo
See ry of Computing, pp. 1-10, 1988. The procedure for checking the codeword is shown below. Let w ≠ 1 be the nth root of 1 in mod q, and ξij = w
^{j (i-1)} modq.・ For all j of j = 1, ..., 2t

[0078]

(Equation 8) Make sure that By the above procedure, (V1, ...,
If the exponent part of Vn) is found to be incorrect, the device of each ^decryptor Pj determines that Vj is u1 ^{x1j '+ cy1j'} u2
^{x2j '+ cy2j'} v- ^rj mod p is the calculation result of x1
Without leaking information on j ', x2j', y1j ', y2j', rj, it is proved to another decryption apparatus by the zero knowledge proof (S7).

This zero-knowledge proof is executed as follows. However, in the following description of the procedure for Pj, a subscript j is added to all variables, so that the description will be omitted. First, the shared secret values x1 ', x2', y held by Pj
1 ', y2', with respect to r, a, a1, a2, b1 as a random number in the ^{R = g1 r g2 s mod p} RX1 = ERX10 = R x1 g2 a1 mod p RX2 = ERX20 = R x2 g2 a2 mod p ^{RY1 = ERY10 = R y1 g2 b1} mod p RY2 = ERY20 = R y2 g2 b2 mod p becomes the value of the commitment R, RX1, RX2, RY1,
RY2 can be obtained by anyone from the commit value of the coefficient published by the distributed random number generation means and the distributed multiplication means.

Pj randomly selects a random number w0 from Zq, and sends K = g, L = g ^w0 mod p to another decryption apparatus. The other decryption apparatuses cooperate to make Rand ([e0], [e1]) [K, L] → (e0
i, e1i) (Ee0, ... , run the Eet), to send the Ee0 = K ^e0 L ^e1 mod p to the device of Pj.

[0081] Pj device selects a random number w1~w18 randomly from ^{_{Zq, T 1 = g 1 w1}} g 2 w2 modp T 2 = g 1 w3 g 2 w4 modp T 3 = g w5 g w6 modp T 4 = _{^{R w1 h w7 modp T 5 =}} R w2 h w8 modp T 6 = R w3 h w9 modp T 7 = R w4 h w10 modp T 8 = g w11 h w12 mod p T 9 = g w13 h w14 mod p T 10 = calculate the _{^{g w15 h w16 mod p T 11}} = g w17 h w18 mod p T 12 = u1 w11 + cw15 u2 w13 + cw17 v -w5 mod p, and sends to other decoding user equipment.

The other decryptor device discloses the shared secret value and sets e
0 and e1 are recovered and sent to the device of Pj. Pj of the device, make sure that the Ee0 = K ^e0 L ^e1 modp is true,
If it does not hold, the certification will be cancelled. If this holds, the device of Pj is: S1 = w1 + e0 · x1mod q S2 = w2 + e0 · x2mod q S3 = w3 + e0 · y1mod q S4 = w4 + e0 · y2mod q S5 = w5 + e0 · rmod qS6 = w6 + e0 · amod a1mod q S8 = w8 + e0 · a2mod q S9 = w9 + e0 · b1mod q S10 = w10 + e0 · b2mod q S11 = w11 + e0 · r · x1mod q S12 = w12 + e0 (a · x1 + a1) mod q S13 = w13 + e0 · r · x2mod q S14 = w14 + e0 ( a * x2 + a2) mod q S15 = w15 + e0 * r * y1 mod q S16 = w16 + e0 (a * y1 + b1) mod q S17 = w17 + e0 * r * y2mod q S18 = w18 + e0 (a * y2 + b2) mod q and calculate S1 to S18 w0 is sent to another decryption apparatus. Other decoding's ^{device, L = g w0 mod p g} 1 s1 g 2 s2 = T 1 X e0 modp g 1 s3 g 2 s4 = T 2 Y e0 modp g s5 h s6 = T 3 R e0 modp R s1 h _{^{s7 = T 4 (RX1) e0}} modp R s2 h s8 = T 5 (RX2) e0 mod p R s3 h s9 = T 6 (RY1) e0 mod p R s4 h s10 = T 7 (RY2) e0 mod p g s11 _{^{h s12 = T 8 (RX1)}} e0 mod p g s13 h s14 = T 9 (RX2) e0 mod p g s15 h s16 = T 10 (RY1) e0 mod p g s17 h s18 = T 11 (RY2) e0 mod p ^{u1 S11 + cS15 u2 S13 + cS17} v -S5 = T 12 V e0 mod p to verify that is true.

The above equation shows that the device of Pj is V, X, Y, R, R
Since it is valid only when X1, RX2, RY1, and RY2 are correctly created, the verification fails if even one does not hold (the explanation above omitting the suffix "j"). The device of the decryption person Pj who has failed to prove is regarded as a deviator, and the secret values x1j ', x2j', y1j ', y of the deviator
2j 'and rj are recovered by another decryption apparatus using a secret value recovery procedure, and the correct value of Vj is disclosed. For the secret value recovery procedure here, for example, see A. Herzberg, et.a
l: “Proactive secret sharing or: How to cope with
perpetual leakage ”, Advances in Cryptology-CRYPT
O'95, LNCS 963, pp.339-352, Springer-Verlag, 1995
Familiar with. The correct (V1,..., Vn) is obtained including the published correct value of Vj.

After confirming that the exponent part of (V1,..., Vn) is correct, the value V is restored by a secret restoration procedure for the exponent part. Each decryptor device checks whether V is equal to 1 and if not, refuses decryption and stops (S
8). If they are equal, then each decryptor P, as in FIG.
The device of j calculates Dj = u1 ^zj modp and transmits it to all other decoder devices via a broadcast-type communication channel. Each decoder device that receives Dj receives (V1,..., Dn) with respect to (D1,..., Dn). ,
.., Vn), the same codeword is verified, and if a fraud is detected, a zero-knowledge proof is similarly performed to identify the deviator, and the correct value of Dj is used as a secret value recovery procedure. Use to recover.

The zero-knowledge proof here is executed as follows. The device of Pj randomly selects the random number d0 from Zq, and sends W = g ₁ and Q = g ₁ ^d0 modp to another decoder device. The other decryption apparatuses cooperate to make Rand ([c2], [c3]) [W, Q] → (c2
i, c3i) (Ec0, ... , run the Ect), to send the Ec0 = W ^c2 Q ^C3 modp to the device of Pj.

The device of Pj randomly selects random numbers d1 and d2 from Zq, calculates T ₁₂ = g ₁ ^d1 modp T ₁₃ = u1 ^d1 modp, and sends it to another decoder device. The other decryption apparatus publishes the shared secret value, recovers c2 and c3, and sends them to the apparatus of Pj.

[0087] Pj of the device to make sure that holds true Ec0 = W ^c2 Q ^C3 modp, if you do not hold to cancel a certificate. If this holds, the device of Pj calculates S0 = d1 + c2 · z1mod q and sends S0 and d0 to another decoder device. Other decoding's device verifies that _{^{Q = g 1 d0 modp g 1}} s0 = T 12 Xj c2 modp u1 s0 = T 13 Dj c2 modp holds.

Since the above equation holds only when the device of Pj has correctly created Dj, the verification fails if even one does not hold. Each decryptor device is correct (D1,
, Dn), D = u1 ^z mod p is restored by a secret restoration procedure for the exponent part, and m = e / Dmod p is calculated to decrypt the message m.

FIG. 7 shows an example of a functional configuration of the decryption apparatus according to the second embodiment. The memory 21 has x1j, x2j, y1
j, y2j, zj private keys are stored, and public values wj, g
1, g2, p, q, etc. are also stored, and the memory 21 is used to temporarily store information to be transmitted to the outside and information to be received from the outside. The shared random number generation unit 22 includes a secret sharing device 23, a shared secret verification device 24, and a shared secret adder 25, and the secret keys x1j, x2j, y1j, y
2j and zj are generated, and a variance rj of the random number r is also generated. With respect to the received ciphertext E by the hasher 26, c
= H (u1, u2), and Vj = (u1 ^{x1j + cy1j} u2)
^{x2j + cy2j} v ^-1 ) The operation of ^rj mod p is performed. The secret sharing unit 31 includes a secret sharing device 32 and a shared secret verification device 33,
The secret value Vj is distributed to Vjk by a verifiable secret sharing method with a threshold value of 2t. The exponent part secret recovery unit 34
A secret restoration procedure for the exponent part of k is executed, and the BCH codeword verifier 35 confirms that the discrete logarithm of D1,... A broadcast-type communication receiver 36, a broadcast-type communication transmitter 37, an individual communication receiver 38, and an individual communication transmitter 39 are provided, and each unit is sequentially operated by a control unit 41.

FIG. 8 shows the functional configuration of the decryption apparatus used in the third embodiment, with parts corresponding to those in FIG. A value x1j 'obtained by distributing the product of the random number r and the secret key x1 by the secret sharing method with the threshold value t by the sharing multiplication means 43,
Similar values x2j ', y1j', y2j 'are obtained.
The proving unit 44 includes a random number generator 45, a power calculator 46, and a modular multiplication / adder 47, and Vj is u1 ^{x1j '+ cy1j'} u2.
^{x2j '+ cy2j'} v- ^rj The result of calculation of modp is proved to another ^decryptor by a zero-knowledge proof. The verification during the zero knowledge proof procedure is performed by the power calculator 49 and the comparator 51 of the verification unit 48.

[0091]

According to the present invention, the value of the verification formula at the time of decryption in the Cramer-Shoup encryption is verified whether or not the value raised to the power of a random number by which no decryptor can know the value is 1. Has verified the validity of the ciphertext,
Even if the raised value is disclosed, no information about the value in the original verification formula is leaked. By proving to a third party that this value has been correctly created by zero-knowledge proof, it is possible to prove to the third party that the received ciphertext does not satisfy the original verification formula.

Further, by performing the calculation of exponentiation with random numbers by distributed calculation in cooperation with all the computers, even if the verification expression is not satisfied, the value of the verification expression before exponentiation is leaked to any decoder. Attackers can not gain any benefit even if there is an unauthorized person among the decryptors, so it is a secure thresholded decryption method against selective ciphertext attacks .

Further, according to another aspect of the present invention, an unauthorized person is specified by making each decryptor prove the validity of the calculation result by zero-knowledge proof, and verification of a ciphertext is performed using only valid data. Therefore, verification can be performed with a calculation amount proportional to the number n of decryptors. Further, a unique public value of each decoder is determined so that the calculation result of each decoder becomes a codeword of the BCH code. First, the receiver verifies that the calculation result is a codeword. By executing the zero-knowledge proof only in the case where a correct ciphertext is received, it is possible to perform an efficient calculation while suppressing the communication amount.

Further, when an unauthorized person is specified, other decryptors cooperate to calculate and publish the shared secret key of the unauthorized decryptor, so that anyone can give the unauthorized decryptor. By being able to calculate the correct result instead, it is possible to obtain the correct verification result and the decryption result even if there is more than one third of the wrongdoer as long as it is less than one half. It is possible.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a system configuration according to a first embodiment of the present invention.

FIG. 2 is a flowchart showing a verification operation procedure of the decryption apparatus according to the first embodiment of the present invention.

FIG. 3 is a diagram illustrating a system configuration according to a second embodiment of the present invention.

FIG. 4 is a flowchart showing a decryption operation procedure of the decryptor Pi's device in Embodiment 2 of the present invention.

FIG. 5 is a flowchart showing a verification operation procedure of an apparatus of a decryptor Pi in Embodiment 2 of the present invention.

FIG. 6 is a flowchart showing a verification operation procedure of an apparatus of a decryptor Pi in Embodiment 3 of the present invention.

FIG. 7 is a diagram illustrating a functional configuration of a decryption apparatus according to the second embodiment.

FIG. 8 is a diagram illustrating a functional configuration of a decryption apparatus according to a third embodiment.

──────────────────────────────────────────────────続 き Continuation of the front page (56) References A Practical Public Key Cryptosystem Provisionally Secure a gain Adaptive Chosen Ciphertext Attack, Lecturer, September 9, 1998 1462, p. 13-25 (58) Field surveyed (Int. Cl. ⁷ , DB name) H04L 9/30 G09C 1/00 620 JICST file (JOIS)

Claims (20)

(57) [Claims] 1. Divide p by a large prime number and q by p-1
A large prime number, Gq is the multiplicative group Zp^*Subgroup of order q
Where g1 and g2 are the values of g2 with g1 as the base.
Let Gq be an element whose discrete logarithm is unknown, and let H be a general-purpose hash
Function, and (x1, x2, y1, y2, z) ∈Zq^FiveIs the secret key, X
= G1^x1g2^x2mod p, Y = g1^y1g2^y2mod p, Z =
g1^zUsing (P, X, Y, Z) mod p as a public key, the ciphertext E for the plaintext m becomes c with H (u1, u2) mod q
U1 = g1^rmod p, u2 = g2^rmod p, v =
X^rY^crmod includes the triplet (u1, u2, v)
Encryption methodCryptographic Verification MethodIn, the decryption apparatus generates a random number r, and c = H (u1, u2)
Calculate mod q, V = (u1^{x1 + cy1}u2^{x2 + cy2}v^-1)^rcalculate mod p,
Verify that V is equal to 1 to correct the ciphertext
Verify the validityAnd  If V is not equal to 1Is verified using the zero-knowledge proof.
Between the user device andV for a random number r (u1^{x1 + cy1}
u2^{x2 + cy2}v^-1)^rmod pToThat the result is calculated
ProveRun the protocolCiphertext characterized by the following:
Method of verification. 2. Divide p by a large prime number and q by p-1
Gq is a large prime number, and Gq is a subgroup of order q of the multiplicative group Zp.
G1 and g2 are elements of Gq, and H is a general-purpose
Function and the neachDecryptorPj (j = 1,2, ..., n)Solid
Have a public value wjGiving, (X1, x2, y1, y2, z) ∈Zq^Five3t <n
The secret sharing method with the threshold value t
Secret value (x1j, x2j, y1) corresponding to the value wj
j, y2j, zj) to the decryptor PjEquipmentXj = g1^x1jg2^x2jmod p, Yj = g1^y1jg2
^y2jmod p, Zj = g1^zjmod p becomes (Xj, Yj, Z
j) is the decryptor PjEquipmentAnd that there is a secure communication path between each decryptor device.
Also, each decryptor device is the same as all other decryptor devices.
Use a broadcast-type communication path that is guaranteed to receive
The random number r∈Zq is shared by a secret sharing method with a threshold value t.
The obtained secret value rj corresponding to the value wj is converted to the decryptor Pj.of
apparatusHolds, E = (u1, u2, v, e) and X = g1^x1g2^x2mod
p, Y = g1^y1g2^y2mod p, Z = g1^zRelease mod p
The ciphertext of the plaintext m used as the key, and the correct ciphertext is u1 = g
1^rmod p, u2 = g2^rmod p, c = H (u1, u
2), v = X^rY^crmod p, e = mZ^rsatisfy mod p
When the device of each decryptor Pj that has received E receives c = H (u1, u
2), and Vj = (u1)^{x1j + cy1j}u2^{x2j + cy2j}v^-1)^rjmod p
Vj can be verified from threshold value t to 2tPolynomialSecret
The value wk obtained by dispersion by the scatter method(K = 1, 2,
..., n, k ≠ j, and so on)Secret value Vjk corresponding to
Transmitting to each decryptor Pk's device via a secure communication channel,After that, g is calculated with each coefficient of the polynomial used for the secret sharing.
Each value C multiplied _ij (I = 0,..., T) are defined as broadcast-type communication paths.
To all other decryptor Pk's devices, C _ij Pk (k = 1, 2,..., N, k}
The device of j) is wk and C _ij , The previously received Vj
Verify that k is the correct value,  The device of the decryptor Pk uses the broadcast-type communication channel toThe wholehand
Decryptor ofPj (j = 1, 2,..., N, j ≠ k, hereinafter the same)
Mr)The device of each decryptor Pj that transmitted to the device and received VkIs eachVk is the correct value
Received thatC _0j , And 2t + 1 of Vk confirmed to be correct are selected.
The value V restored by the secret restoration procedure for several parts is equal to 1
Check if it is correct, and if it is not equal, the other 2t + 1
Repeat the security recovery procedure in the same way for all
If none of the restoration values is equal to 1
If the ciphertext is determined to be invalid, and there is at least one combination
Ciphertext verification method characterized by determining that a sentence is correct
Law. 3. The ciphertext verification method according to claim 2 , wherein when the ciphertext is determined to be correct, w is set to the nth root of 1 in mod q, and each decryptor device is configured to execute wj
Is defined as w ^j−1 mod q, and wj that satisfies wj ≠ 1 in 1 <j <n is defined as a public eigenvalue. The apparatus of each decoder Pj calculates Dj = u1 ^zj mod p, , And the discrete logarithm with the base u1 of (D1,..., Dn) received is B
Confirming that the code word is a CH code word; 4. Divide p by a large prime number and q by p-1
Gq is a large prime number, and Gq is a subgroup of order q of the multiplicative group Zp ^*
And g1 and g2 are the values of g2 with g1 as the base.
Let Gq be an element whose discrete logarithm is unknown, and let H be a general-purpose hash
A function, (x1, x2, y1, y2, z) ∈Zq 5 a secret key, X
= G1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mod p, Z =
The public key is (X, Y, Z) which is g1 ^z mod p, and the ciphertext E for the plaintext m is c (H (u1, u2) mod q
U1 = g1 ^r mod p, u2 = g2 ^r mod p, v =
X ^r Y ^cr mod p, e = mZ ^r mod p
1, u2, v, e)
Then , w is assigned to the device of each of the n decryptors Pj (j = 1,..., N).
Let n be the nth root of mod q, wj be w ^j-1 mod q,
1 <j <shall satisfy wj ≠ 1 in n, assign a value wj to the apparatus of the decryption person Pj, secret key (X1j devices of each decryption person Pj, x2j, y1
j, y2j, zj) is a secret value corresponding to the value wj obtained by distributing (x1, x2, y1, y2, z) by a secret sharing method with a threshold value t satisfying 3t <n, and Xj = ^{G1 x1j} g2 ^x2j mod p, Yj = g1 ^y1j g2
^y2j mod p, Zj = g1 ^Zj mod p (Xj, Yj, Z
j) is the public key of the device of the decryptor Pj , there is a secure communication path between each decryptor device, and each decryptor device has the same contents as all other decryptor devices. The secret value rj corresponding to the value wj, which is obtained by distributing the random number rｑZq by the secret sharing method with the threshold value t, is used as the decrypter Pj of
The device shall be retained, and the device of each decryptor Pj shall be r · x1, r · x2, ry
1, r · y2 obtained by distributing the secret values by a secret sharing method with a threshold value t, respectively.
x2j ', y1j', y2j 'are calculated and held by the distributed multiplication method, and the device of each decryption person Pj that receives the ciphertext obtains c = H (u
1, u2), and Vj = u1 ^{x1j ′ + cy1j ′} u2
^{x2j '+ cy2j'} v ^-rj mod p is calculated, and Vj is transmitted to all other decoder devices via the broadcast communication channel, and each decoder device receives the exponent part of (V1,..., Vn). Is a code word of a BCH code, and verifies the validity of the ciphertext by confirming that the value V restored by the secret restoration procedure for the exponent is equal to 1. Method. 5. The ciphertext verification method according to claim 4 , wherein when (V1,..., Vn) is not a BCH codeword, the apparatus of each decryptor Pj uses the zero-knowledge proof to perform other operations.
Between the decoding's device, Vj is ^u1 x1j ^{'+ cy1j'} u2
^{x2j '+ cy2j'} prove that it is the result of v- ^rj mod p
Are defined as x1j ', x2j', y1j ', y2
It executes without leaking information about j ′ and rj, identifies the device of the decryption person Pj that failed in certification as the device of the deviant person, and sets the secret values x1j ′, x2j ′, y1 of the device of the deviator.
A ciphertext verification method, characterized in that j ', y2j', and rj are restored by another decryption apparatus using a secret value recovery procedure. 6. Divide p by a large prime number and q by p-1
Gq is a large prime number, and Gq is a subgroup of order q of the multiplicative group Zp ^*
And g1 and g2 are the values of g2 with g1 as the base.
Let Gq be an element whose discrete logarithm is unknown, and let H be a general-purpose hash
A function, (x1, x2, y1, y2, z) ∈Zq 5 a secret key, X
= G1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mod p, Z =
The public key is (X, Y, Z) which is g1 ^z mod p, and the ciphertext E for the plaintext m is c (H (u1, u2) mod q
U1 = g1 ^r mod p, u2 = g2 ^r mod p, v =
X ^r Y ^cr mod p, e = mZ ^r mod p
1, u2, v, e)
Then , w is assigned to the device of each of the n decryptors Pj (j = 1,..., N).
Let n be the nth root of mod q, wj be w ^j-1 mod q,
It is assumed that wj ≠ 1 is satisfied when 1 <j <n, and each decoding
The value wj is assigned to the device of the decryption person Pj, and the secret key (x1j, x2j, y1) of the device of each decryption person Pj is assigned.
j, y2j, zj) is a threshold value t satisfying 3t <n.
(X1, x2, y1, y2, z) is divided by the secret sharing method.
Obtained by dispersion, and a secret value corresponding to the value ^{wj, Xj = g1 x1j g2 x2j} mod p, Yj = g1 y1j g2
^y2j mod p, Zj = g1 ^Zj mod p (Xj, Yj, Z
j) is the public key of the decryption device Pj, and there is a secure communication path between each decryption device.
Also, each decryptor device is the same as all other decryptor devices.
Use a broadcast-type communication path that is guaranteed to receive
The random number r 乱 数 Zq is shared by a secret sharing method with a threshold value t.
The obtained secret value rj corresponding to the value wj is given by the decryptor Pj.
It is assumed that the device is held, and the device of each decryptor Pj is r · x1, r · x2, ry.
1, r · y2 are calculated by the secret sharing method with threshold value t.
A secret value x1j ′ corresponding to the value wj, which is obtained by distribution,
x2j ', y1j', y2j 'are calculated by the variance multiplication method.
The device of each decryptor Pj that has calculated and stored the encrypted text has c = H (u
1, u2), and Vj = u1 ^{x1j ′ + cy1j ′} u2
^{x2j '+ cy2j'} v ^-rj mod p
And transmits Vj to all other decryptor devices, and each decryptor device uses the zero-knowledge proof to communicate with the other decryptor devices.
During the period, the received Vj is u1 ^{x1j '+ cy1j'} u2 ^{x2j '+ cy2j'}
It is x1j ', x2 that the calculation result of v- ^rj mod p is obtained.
leak information about j ', y1j', y2j ', rj
Without executing the certifying protocol, the device of the decryption person Pj who failed in the proof is regarded as the deviator device.
Secret values x1j ', x2j', y of the deviator device
1j ', y2j', rj and another decryptor device
And reconstructed using the above order, with respect to the exponent part of (V1,..., Vn)
That the value V restored by the secret restoration procedure is equal to 1.
A ciphertext verification method characterized by verifying the validity of a ciphertext by checking. 7. The ciphertext verification method according to claim 4 , wherein when the restored value V is equal to 1, each decryptor Pj's device calculates Dj = u1 ^zj mod p, and uses the broadcast-type communication channel to ^perform another calculation. A ciphertext verification method, comprising: confirming that a discrete logarithm having a base of u1 of (D1,..., Dn) received is a codeword of a BCH code. 8. The ciphertext verification method according to claim 6 , wherein, when the restored value V is equal to 1, the apparatus of each decryptor Pj calculates Dj = u1 ^zj mod p , and
With other decoding's apparatus, without leaking information about zj that Dj is the correct calculation result, it proved Surupu
Run the protocol, specified in <br/> a departure's device a device failed decryption person Pj zero knowledge proof, a secret value zj of departure's device other decipherer device using a secret value recovery procedure A ciphertext verification method characterized by restoring and restoring. 9. The ciphertext verifying method according to claim 7 or 8 , wherein each of the decryptor apparatuses obtains D = D1 from the correct (D1,.
A ciphertext verification method characterized by restoring u1 ^z mod p, calculating m = e / Dmod p, and decrypting plaintext m. 10. Divide p by a large prime number and q by p-1
Gq is a subgroup of the order p of the multiplicative group Zp
And g1 and g2 are elements of Gp, and H is a general
X = g1 as a hash function^x1g2^x2mod p, Y = g1
^y1g2^y2modp, Z = g1^zuse mod p for the encryption procedure
(X1, x2, y1, y2, z) ∈Zq
^FiveAnd the ciphertext E for the plaintext m changes c to H (u1, u
2) u1 = g1 as modp^rmod p, u2 = g2^rmod
 p, v = X^rY^crmod p triplet (u1, u2,
v), a process of generating a random number r, a process of receiving a ciphertext E, a process of calculating c = H (u1, u2) mod q, and a process of V = (u1^{x1 + cy1}u2^{x2 + cy2}v^-1)^rcalculate mod p
Processing and verifying that V = 1 to verify the validity of the ciphertext
Processing and If V ≠ 1, the bit commitment function (B
C) to publish BC (r), r to form BC (r), and x to form public keys X and Y
1, x2, y1, y2, (u1^{x1 + cy1}u2
^{x2 + cy2}v^-1)^rThe result of calculating mod p is V
ThatBetween the verifier and the zero-knowledge proof,r,
Keep secrets about x1, x2, y1, y2TestimonyLight
DoRun the protocolProcessing andThe decryptor's device
Recorded programs to be executed by the computerrecoding media. 11. Divide p by a large prime number and q by p-1
Gq is a subgroup of the order q of the multiplicative group Zp
Where g1 and g2 are elements of Gq, and H is a general
A hash function and n peopleEach ofDecryptor Pj(J = 1, ...,
device n)Unique public value wjGiven, (X1, x
2, y1, y2, z) ∈Zq^FiveSatisfy 3t <n
The value wj obtained by distributing the threshold value t by the secret sharing method
Corresponding to the secret value (x1j, x2j, y1j, y2j,
zj) of the decryptor PjEquipmentXj = g1 as a secret key
^x1jg2^x2jmod p, Yj = g1^y1jg2^y2jmod p,
Zj = g1^zjmod p to the decryptor PjEquipmentThe public key is used, and a random number r∈Zq is distributed by a secret sharing method with a threshold value t.
Processing for generating secret value rj corresponding to obtained value wj
And X = g1^x1g2^x2mod p, Y = g1^y1g2^y2mod p, Z
= G1^zmod p is a public key, plaintext m is ciphertext, and
The new ciphertext is u1 = g1^rmod p, u2 = g2^rmod
p, c = H (u1, u2), v = X^rY^crmod p, e =
mZ^rsatisfy mod pYouCiphertext E = (u1, u2, v,
e), c = H (u1, u2) is calculated, and Vj = (u1)^{x1j + cy1j}u2^{x2j + cy2j}v^-1)^rjmod p
Calculation, and verification of Vj from threshold t to 2tPolynomialSecret
Secret value corresponding to value wk, obtained by dispersion by the scatter method
A process of transmitting Vjk to the device of each decryptor Pk and a process of receiving Vkj from all other decryptor devices Pk
When,Each value obtained by raising g to the power of each coefficient of the polynomial used for secret sharing
C _ij (I = 0, ..., t) To all other decryptor devices
Processing, All other decryptor devices Pk to C _ik Processing to receive the wk and received C _ik Vkj received earlier using
Processing to verify that the A process of transmitting Vj to all other decryptor devices, a process of receiving Vk from all other decryptor devices,,  Make sure that each Vk is the correct valueC _OK Verification process using
Select 2t + 1 of Vk confirmed to be correct,
The value V restored by the secret restoration procedure for several parts is equal to 1
Check if it is correct, and if it is not equal, the other 2t + 1
Repeat the security recovery procedure in the same way for all
No restoration value is equal to 1 for any combination
The ciphertext is determined to be invalid and any
If there is a match, determine that the ciphertext is correct
Processing and a program that causes the computer of the decryptor device to execute
The recording medium on which it was recorded. 12. Divide p by a large prime number and q by p-1
Gq is a subgroup of the order q of the multiplicative group Zp
Where g1 and g2 are elements of Gq, and H is a general
As a hash function, (x1, x2, y1, y2, z) ∈Zq^FiveIs the secret key, X
= G1^x1g2^x2mod p, Y = g1^y1g2^y2mod p, Z =
g1^zUsing (P, X, Y, Z) mod p as a public key, the ciphertext E for the plaintext m becomes c with H (u1, u2) mod q
U1 = g1^rmod p, u2 = g2^rmod p, v =
X^rY^crmod p, E = mZ ^r mod pBecomeFourTuple (u
1, u2, v, E),  Let w be the nth root of 1 in mod q and wj be w^j-1mod q and
And satisfying wj ≠ 1 when 1 <j <n,n
person'sEach decryptor Pj(J = 1,..., N)To the value wj
Assignment of the decryptor PjEquipmentThe secret key (x1j, x2j, y1j,
y2j, zj) is the secret of the threshold t satisfying 3t <n
Disperse (x1, x2, y1, y2, z) by the dispersion method
Xj = g1 as a secret value corresponding to the value wj obtained by^x1jg2^x2jmod p, Yj = g1^y1jg2
^y2jmod p, Zj = g1^zjmod p becomes (Xj, Yj, Z
j) of the decryptor PjEquipmentThe public key is used, and a random number r∈Zq is distributed by a secret sharing method with a threshold value t.
A process for retaining a secret value rj corresponding to the value wj obtained.
And rx1, rx2, ry1, and ry2 are respectively set to the threshold value t.
Corresponding to the value wj obtained by sharing by the secret sharing method
Secret values x1j ', x2j', y1j ', y2j'
A process of calculating and holding by the scattered multiplication method, and upon receiving the ciphertext, calculate c = H (u1, u2),
Vj = u1^{x1j '+ cy1j'}u2^{x2j '+ cy2j'}v^-rjmod p
And Vj is set to all other decryptor
And the exponent part of (V1,..., Vn) is the code word of the BCH code.
And the value V restored by the secret restoration procedure for the exponent is
The validity of the ciphertext by checking that it is equal to 1
To verify andDecryptor deviceComputerRealDone
ProgramRecordedrecoding media. 13. The recording medium according to claim 12 , wherein the threshold value t satisfies 2t <n, and a process of confirming that the exponent part of (V1,..., Vn) is a code word of a BCH code. Instead, Vj is u1
^{x1j '+ cy1j'} u2 ^{x2j '+ cy2j'} It is x1j ', x2j', y1j ', y2 that the correct calculation result of v- ^rj mod p is obtained.
Zero-knowledge proof without leaking information about j ', rj
Protocol to authenticate with other decryptor devices using
A process of execution to identify a device decryption person Pj that zero-knowledge proof fails as a departure of the apparatus <br/>, secret value x1j of deviation of the apparatus', x2
A recording medium characterized by including a program for causing the computer to execute a process of restoring j ', y1j', y2j ', and rj using a secret value recovery procedure. 14. The recording medium according to claim 12 , wherein when (V1,..., Vn) is not a BCH codeword, Vj is ^{u1x1j '+ cy1j'u2x2j' + cy2j'v- rjmo.}
x1j ', x2j', y1
Without leaking information about j ', y2j', rj,
Using zero-knowledge proof, which proves with other decipherer device
The process of executing the protocol and the device of the decryption person Pj who failed in the above certification are specified as the devices of the deviant person , and the secret values x1j ', x2j', y1j ', y2j', rj of the device of the deviator are specified.
Wherein the program includes a program for causing the computer to execute a process of restoring the program using a secret value recovery procedure. 15. p is a large prime number, q is a large prime number that divides p−1, Gq represents a subgroup of the order q of the multiplicative group Zp, g1 and g2 are elements of Gq, and H is a general and hash function, (x1, x2, y1, y2, z) ∈Zq 5 a secret key, X
= G1 ^x1 g2 ^x2 mod p, Y = g1 ^y1 g2 ^y2 mod p, Z =
The public key is (X, Y, Z) which is g1 ^z mod p.
U1 = g1 ^r mod p, u2 = g2 ^r mod p, v =
^{X r Y cr mod p, e} = mZ r mod p becomes four pairs (u
1, u2, v , e ), means for generating a random number r, means for calculating c = H (u1, u2) mod q, and V = ( ^{u1x1 + cy1).} means for calculating a ^{u2 x2 + cy2 v -1) r} mod p, and means V to verify the validity of the ciphertext by confirming equal to 1, if V is not equal to 1, zero-knowledge using a certificate, decryption
With the user device, V is relative random number r (u1 ^{x1 + cy1} u2
^{x2 + cy2} v ^-1 ) A ciphertext verification device comprising means for executing a protocol for proving that the result is calculated as in ^r mod p. 16. p is a large prime number, q is a large prime number that divides p−1, Gq represents a subgroup of the order q of the multiplicative group Zp, g1 and g2 are elements of Gq, and H is a general-purpose element. and the hash function, the decryption person Pj for the n (j = 1, ..., n ) have unique public values wj to the apparatus of the (x1, x2, y1, y2 , z) ∈Zq 5, 3t <n
Secret value (x1j, x2j, y1) corresponding to the value wj obtained by distribution by the secret sharing method with a threshold value t satisfying
j, y2j, zj) as the secret key of the device of the decryptor Pj, and Xj = g1 ^x1j g2 ^x2j mod p, Yj = g1 ^y1j g2
^y2j mod p, Zj = g1 ^zj mod p (Xj, Yj, Z
j) is the public key of the device of the decryptor Pj, there is a secure communication path between each decryptor device, and each decryptor device has the same contents as all other decryptor devices. The secret value rj corresponding to the value wj, which is obtained by distributing the random number rｑZq by the secret sharing method with the threshold value t, is used as the decrypter Pj It shall held, E = (u1, u2, v, e) a, X = g1 ^x1 g2 ^x2 mod
p, Y = g1 ^y1 g2 ^y2 mod p, and Z = g1 ^z mod p are ciphertexts for the plaintext m using the public key, and the correct ciphertext is u
1 = g1 ^r mod p, u2 = g2 ^r mod p, c = H (u
1, u2), v = X r Y cr mod p, a verification device ciphertext satisfying e = mZ ^r mod p, means for calculating a reception to c = H (u1, u2) and E Vj = (u1 ^{x1j + cy1j} u2 ^{x2j + cy2j} v ^-1 ) means for calculating ^rj mod p, and Vj is distributed by a verifiable polynomial secret sharing method having a threshold value of t or more and 2t or less to correspond to a value wk Means for obtaining a secret value Vjk to be transmitted, means for transmitting Vjk to the device of each decryptor Pk via a secure communication path, and values obtained by raising g to the power of each coefficient of the polynomial used for secret sharing.
C _{i j} (i = 0, 1,..., T) is changed by a broadcast-type communication channel.
Correct is Vkj previously received with means for transmitting to all of the decoding user equipment, means for receiving a C _ik from all other decoder's device Pk, a C _ik and the received wk of
Means for verifying that a have value, to all the other decoder's device Pk, the broadcast channel, V
means for sending a j, receiving that each Vk is the correct value
Means for verifying using the received C _0k , means for selecting 2t + 1 of Vk confirmed to be correct and restoring V by a secret restoration procedure for the exponent part, and whether or not the restored value V is equal to 1. Means for checking whether V is not equal to 1; means for repeating the same secret recovery procedure with another 2t + 1 combinations if V is not equal to 1; and means for checking whether V is equal to 1 and for all 2t + 1 combinations. If the restoration value is not equal to 1, the ciphertext is determined to be invalid,
Means for determining that the ciphertext is correct if there is at least one combination, and a ciphertext verifying device. 17. The ciphertext verifying apparatus according to claim 16 , wherein w is an n-th root of 1 in mod q, and each decryptor device is wj
^Wj-1 mod q, wj that satisfies wj ≠ 1 in 1 <j <n is a public eigenvalue, Dj = u1 ^zj mod p means for calculating, and Dj is another A cipher comprising: means for transmitting to all decryptor devices; and means for confirming that the discrete logarithm of the received (D1,..., Dn) whose base is u1 is a BCH codeword. Statement verification device. 18. Divide p by a large prime number and q by p-1
Gq is a subgroup of the order q of the multiplicative group Zp
Where g1 and g2 are elements of Gq, and H is a general
As a hash function, (x1, x2, y1, y2, z) ∈Zq^FiveIs the secret key, X
= G1^x1g2^x2mod p, Y = g1^y1g2^y2mod p, Z =
g1^zUsing (P, X, Y, Z) mod p as a public key, the ciphertext E for the plaintext m becomes c with H (u1, u2) mod q
U1 = g1^rmod p, u2 = g2^rmod p, v =
X^rY^crmod p, E = mZ ^r mod pBecomeFourTuple (u
1, u2, v, E), The ciphertext verification device comprising:  Let w be the nth root of 1 in mod q and wj be w^j-1mod q and
It is assumed that wj ≠ 1 is satisfied when 1 <j <n.
Decryptor Pj(J = 1,..., N)Is assigned the value wj
hand,  Decryptor PjEquipmentThe secret key (x1j, x2j, y1j,
y2j, zj) is the secret of the threshold t satisfying 3t <n
Disperse (x1, x2, y1, y2, z) by the dispersion method
Xj = g1 as a secret value corresponding to the value wj obtained by^x1jg2^x2jmod p, Yj = g1^y1jg2
^y2jmod p, Zj = g1^Zjmod p becomes (Xj, Yj, Z
j) of the decryptor PjEquipmentA public key, with a secure communication channel between each decryptor device
Also, each decryptor device is the same as all other decryptor devices.
Use a broadcast-type communication path that is guaranteed to receive
The random number r∈Zq is shared by a secret sharing method with a threshold value t.
Means for obtaining a secret value rj corresponding to the value wj;
Secret value corresponding to the value wj distributed by the secret sharing method of
Distributed multiplication method for x1j ', x2j', y1j ', y2j'
Calculates c = H (u1, u2) for the means obtained by calculating
And Vj = u1^{x1j '+ cy1j'}u2^{x2j '+ cy2j'}v
^-rjsending Vj to all other decoders by means of calculating mod p and by means of a broadcast channel
Means for transmitting, and the exponent part of (V1,..., Vn) is a codeword of a BCH code.
Means for confirming that the password is valid, and means for restoring V using a secret restoration procedure for the exponent part.
And confirming that the restored value V is equal to 1
Means for verifying the validity of the ciphertext. 19. The ciphertext verification device according to claim 18 , wherein the threshold value t satisfies 2t <n, and it is confirmed that the exponent part of (V1,..., Vn) is a BCH codeword. Instead of Vj
^{x1j '+ cy1j'} u2 ^{x2j '+ cy2j'} It is x1j ', x2j', y1j ', y2 that the correct calculation result of v- ^rj mod p is obtained.
Zero-knowledge proof without leaking information about j ', rj
Protocol to prove with other decryption devices using
Ciphertext verification device characterized by comprising means for executing. 20. The ciphertext verifying apparatus according to claim 18 , wherein, if (V1,..., Vn) is not a code word of the BCH code, Vj is u1 ^{x1j ′ + cy1j ′} u2 ^{x2j ′ + cy2j ′} v ^-rj mo
x1j ', x2j', y1
Without leaking information about j ', y2j', rj,
Using zero-knowledge proof with another decoder's device, proving
Means for executing the protocol specifies a departure's device a device decipherer Pj has failed its certificate, secret value x1j deviations's apparatus ', x2j', y1
means for restoring j ', y2j', rj using a secret value recovery procedure.