JP3870753B2 - Public Key Cryptography Considering Third Oracle - Google Patents

Description

【０００８】
により与えられる。但し，fは公開された落し戸付き一方向性置換であり，G,Hはハッシュ関数。この公開鍵暗号方法は，G,Hを理想的ランダム関数とするとき，IND-CCA2であることが同文献の中で示されている。
【０００９】
今，ハッシュ関数Gがハッシュ関数G'に対して，G=G'・fとなるように作成されていたと仮定する。但し，(f・g)(x)=f(g(x))。G'を理想的ランダム関数とすると，Gは理想的ランダムになる点に注意する。このとき，攻撃者は（第3番目のオラクルから）関数G'を手に入れることができたとすると，
【００１０】
【数２４】

【００１１】
により，メッセージ文xを計算できてしまう。
【００１２】
このように，従来の定義（IND-CCA2）の範囲内では安全である公開鍵暗号であっても，（従来の定義の範囲外である）第３のオラクルから攻撃者にランダムオラクルに付随する情報を与えてしまうと，簡単に破れてしまう場合が存在する。
【００１３】
本発明は，第１のオラクル，第2のオラクルに加えて，上記の第3のオラクルからランダムオラクルに付随する情報を攻撃者に与えた場合にも，メッセージ文に関するいかなる部分情報も計算できない公開鍵暗号方法を提供する。
【００１４】
さらに、上記方法を用いた暗号通信方法，その応用装置，またはシステムを提供する。
【００１５】
【課題を解決するための手段】
本発明による公開鍵暗号方法では，暗号文から（メッセージ文のみならず）各ハッシュ関数への入力値に関する部分情報を計算することが困難となるように暗号文を作成する。これにより，攻撃者がランダムオラクルに付随するいかなる情報を第3のオラクルから得ても，ハッシュ関数への入力値に関する情報を暗号文から計算できないため，この攻撃を無効とすることが可能になる。
【００１６】
次に，メッセージ文のみならず，ハッシュ関数への入力値に関する部分情報を秘匿にするための具体的な方法について述べる。
［鍵生成]
メッセージの受信者は，
【００１７】
【数２５】

【００１８】
を公開鍵とし，
【００１９】
【数２６】

【００２０】
を秘密鍵とする。但し，Ｇは有限アーベル群を表わし，Ｇの元と{0,1}^kの元の間に１対１対応があるものとする。また，k=k₁+k₂とする。
【００２１】
［暗号化]
メッセージの送信者は，メッセージｍ∈{0,1}^k1に対して，乱数ｒ∈{0,1}^k2を選び，
【００２２】
【数２７】

【００２３】
を計算し，（ｕ，ｖ）を暗号文として，該受信者に送信する。
【００２４】
［復号化]
受信者は，自身の秘密鍵を用いて，
【００２５】
【数２８】

【００２６】
なる（ｍ'，ｒ'）を計算し，さらに，
【００２７】
【数２９】

【００２８】
が成立することを確認した後（確認が失敗した場合，暗号文は不正なものとみなし拒否する），ｍ'を該暗号文（ｕ，ｖ）のメッセージ文とする。
【００２９】
【発明の実施の形態】
以下，図面を用いて，本発明の実施例について説明する。
【００３０】
図１は，本発明の各実施例のシステム構成を示す図である。このシステムは，送信者側装置100と受信者側装置200から構成されている。さらに，送信者側装置100と受信者側装置200は通信回線300で接続されている。
【００３１】
図２は，図１のシステムにおける送信者側装置100の内部構成を示す。送信者側装置100は，乱数生成手段101，べき乗算手段102，演算手段103，剰余演算手段104，メモリ105，通信装置106，入力装置107，を備えている。
【００３２】
図３は，図１のシステムにおける受信者側装置200の内部構成を示す。受信者側装置200は，鍵生成手段201，べき乗算手段202，剰余演算手段203，演算手段204，メモリ205，通信装置206，復号化装置207，を備えている。
【００３３】
（実施例１）
本実施例は，メッセージの送信者であるＡが受信者であるＢに対して，送信データｍを暗号通信によって送信する場合について説明する。図４に，本実施例の概要を示す。
【００３４】
１．鍵生成処理
受信者Ｂは，予め，受信者側装置200内の鍵生成手段201を用いて，
【００３５】
【数３０】

【００３６】
なる秘密鍵，
【００３７】
【数３１】

【００３８】
なる公開鍵を作成する。但し，Ｇは有限アーベル群を表わし，Ｇの元と{0,1}^kの元の間に１対１対応があるものとする。また，k=k₁+k₂とする。また，公開情報を通信回線300などを介して出力し，送信者側装置100へ送付するか，または公開する。公開する方法として，例えば第３者（公開情報管理機関）への登録など，周知の方法を用いることが可能である。その他の情報については，メモリ205に格納する。
【００３９】
２．暗復号化処理
（１）送信者Ａは，メッセージｍ∈{0,1}^k1に対して，送信者側装置100内の乱数生成手段101を用いて乱数ｒ∈{0,1}^k2を選び，演算手段103を用いて，
【００４０】
【数３２】

【００４１】
を計算し，（ｕ，ｖ）を暗号文として通信装置106を用いて通信回線300を介して受信者Ｂの受信者側装置200に送信する。
【００４２】
（２）受信者は，上記秘密情報と受信者側装置200内の演算手段204を用いて暗号文（ｕ，ｖ）から，
【００４３】
【数３３】

【００４４】
なる（ｍ'，ｒ'）を計算し，さらに，
【００４５】
【数３４】

【００４６】
が成立することを確認した後，ｍ'を該暗号文（ｕ，ｖ）のメッセージ文として出力する。確認が失敗した場合，暗号文は不正なものとみなし拒否する。
【００４７】
本実施例による公開鍵暗号方法では，群G上のDiffie-Hellman決定問題の困難性を前提にして，選択暗号文攻撃に対して強秘匿（IND-CCA2）であることが証明できる。証明のアウトラインは以下の通り
本実施例による公開鍵暗号方法を破ろうとする攻撃者（適応的選択暗号文攻撃における強秘匿性の意味において。定義については，例えば，文献14「V.Shoup. : OAEP Reconsidered. Available on the e-print library (2000/060), November 2000」に記載されている）が復号化オラクルから情報を得るためには，質問である暗号文において，元の平文を知る必要がある。すなわち，復号化オラクルから攻撃者は新たな情報を得ることができない。また，文献１２「M.Bellare and P.Rogaway, : Optimal Asymmetric Encryption - How to Encrypt with RSA, Proc. of Eurocrypt'94, LNCS950, Springer Verlag, pp.92-111 (1994)」に記載の方法と同様の方法にて，本実施例の方法がIND-CPAであること容易に示せる。これより，本実施例の公開鍵暗号方法はIND-CCA2であることが証明できる。
【００４８】
さらに，乱数rをメッセージ文とみなすと（この場合，メッセージ文mは秘密），同様の方法により，群G上のDiffie-Hellman決定問題の困難性を前提にして，選択平文攻撃に対して強秘匿（IND-CPA）であることが証明できる。すなわち，暗号文から乱数rに関する部分情報を漏らしていないことが証明できる。
【００４９】
以上のことから，攻撃者は仮に第３のオラクルからハッシュ関数に付随する情報を得ても，暗号文からメッセージに関するいかなる部分情報を計算することが困難であることが示された。
【００５０】
（実施例２）
本実施例は，実施例１において，有限アーベル群Gを体から決定される乗法群として与えた場合について述べる。
【００５１】
１．鍵生成処理
受信者Ｂは，予め，受信者側装置200内の鍵生成手段201を用いて，
【００５２】
【数３５】

【００５３】
なる秘密鍵，
【００５４】
【数３６】

【００５５】
なる公開鍵を作成する。但し，Z^* _pの元と{0,1}^kの元の間に１対１対応があるものとする。また，k=k₁+k₂とする。また，公開情報を通信回線300などを介して出力し，送信者側装置100へ送付するか，または公開する。公開する方法として，例えば第３者（公開情報管理機関）への登録など，周知の方法を用いることが可能である。その他の情報については，メモリ205に格納する。
【００５６】
２．暗復号化処理
（１）送信者Ａは，メッセージｍ∈{0,1}^k1に対して，送信者側装置100内の乱数生成手段101を用いて乱数ｒ∈{0,1}^k2を選び，演算手段103を用いて，
【００５７】
【数３７】

【００５８】
を計算し，（ｕ，ｖ）を暗号文として通信装置106を用いて通信回線300を介して受信者Ｂの受信者側装置200に送信する。
【００５９】
（２）受信者は，上記秘密情報と受信者側装置200内の演算手段204を用いて暗号文（ｕ，ｖ）から，
【００６０】
【数３８】

【００６１】
なる（ｍ'，ｒ'）を計算し，さらに，
【００６２】
【数３９】

【００６３】
が成立することを確認した後，ｍ'を該暗号文（ｕ，ｖ）のメッセージ文として出力する。確認が失敗した場合，暗号文は不正なものとみなし拒否する。
【００６４】
本実施例による公開鍵暗号方法では，実施例１の場合と同様の方法により，群Z^* _p上のDiffie-Hellman決定問題の困難性を前提にして，選択暗号文攻撃に対して強秘匿（IND-CCA2）であることが証明できる。さらに，乱数rをメッセージ文とみなすと（この場合，メッセージ文mは秘密），同様の方法により，群Z^* _p上のDiffie-Hellman決定問題の困難性を前提にして，選択平文攻撃に対して強秘匿（IND-CPA）であることが証明できる。すなわち，暗号文から乱数rに関する部分情報を漏らしていないことが証明できる。
【００６５】
以上のことから，攻撃者は仮に第３のオラクルからハッシュ関数に付随する情報を得ても，暗号文からメッセージに関するいかなる部分情報を計算することが困難であることが示された。
【００６６】
（実施例３）
本実施例は，実施例１の変形例であり，実施例１の公開鍵暗号方法よりも平文空間（メッセージの長さ）を大きく取れるメリットを有する。図５に，本実施例の概要を示す。
【００６７】
１．鍵生成処理
受信者Ｂは，予め，受信者側装置200内の鍵生成手段201を用いて，
【００６８】
【数４０】

【００６９】
なる秘密鍵，
【００７０】
【数４１】

【００７１】
なる公開鍵を作成する。但し，Ｇは有限アーベル群を表わし，Ｇの元と{0,1}^kの元の間に１対１対応があるものとする。また，k=k₁+k₂とする。また，公開情報を通信回線300などを介して出力し，送信者側装置100へ送付するか，または公開する。公開する方法として，例えば第３者（公開情報管理機関）への登録など，周知の方法を用いることが可能である。その他の情報については，メモリ205に格納する。
【００７２】
２．暗復号化処理
（１）送信者Ａは，メッセージｍ∈{0,1}ⁿに対して，送信者側装置100内の乱数生成手段101を用いて乱数ｒ₁∈{0,1}^k1，ｒ₂∈{0,1}^k2を選び，演算手段103を用いて，
【００７３】
【数４２】

【００７４】
を計算し，（ｕ，ｖ，ｗ）を暗号文として通信装置106を用いて通信回線300を介して受信者Ｂの受信者側装置200に送信する。
【００７５】
（２）受信者は，上記秘密情報と受信者側装置200内の演算手段204を用いて暗号文（ｕ，ｖ，ｗ）から，
【００７６】
【数４３】

【００７７】
なる（r'₁，ｒ'₂）を計算し，さらに，
【００７８】
【数４４】

【００７９】
が成立することを確認した後，
【００８０】
【数４５】

【００８１】
により，（ｕ，ｖ，ｗ）のメッセージ文を復号化する。確認が失敗した場合は，暗号文は不正なものとみなし拒否する。
【００８２】
本実施例による公開鍵暗号方法では，メッセージの長さ（ビット長）であるｎは任意に選ぶことが出来るため，実施例１の方法に比べて長いメッセージ文を暗号化することが可能である。公開鍵暗号の利用目的の中では，共通鍵暗号のデータ暗号化鍵の配送に利用することが最も多い。しかし，単にデータ暗号化鍵のみを暗号化するのではなく，ユーザのＩＤ情報等の付加情報を加えて暗号化することが少なくなく，このような場合において本実施例の公開鍵暗号方法は有効である。
【００８３】
（実施例４）
本実施例は，実施例３において，有限アーベル群Gを体から決定される乗法群として与えた場合について述べる。
【００８４】
１．鍵生成処理
受信者Ｂは，予め，受信者側装置200内の鍵生成手段201を用いて，
【００８５】
【数４６】

【００８６】
なる秘密鍵，
【００８７】
【数４７】

【００８８】
なる公開鍵を作成する。但し，Z^* _pの元と{0,1}^kの元の間に１対１対応があるものとする。また，k=k₁+k₂とする。また，公開情報を通信回線300などを介して出力し，送信者側装置100へ送付するか，または公開する。公開する方法として，例えば第３者（公開情報管理機関）への登録など，周知の方法を用いることが可能である。その他の情報については，メモリ205に格納する。
【００８９】
２．暗復号化処理
（１）送信者Ａは，メッセージｍ∈{0,1}ⁿに対して，送信者側装置100内の乱数生成手段101を用いて乱数ｒ₁∈{0,1}^k1，ｒ₂∈{0,1}^k2を選び，演算手段103を用いて，
【００９０】
【数４８】

【００９１】
を計算し，（ｕ，ｖ，ｗ）を暗号文として通信装置106を用いて通信回線300を介して受信者Ｂの受信者側装置200に送信する。
【００９２】
（２）受信者は，上記秘密情報と受信者側装置200内の演算手段204を用いて暗号文（ｕ，ｖ，ｗ）から，
【００９３】
【数４９】

【００９４】
なる（r'₁，ｒ'₂）を計算し，さらに，
【００９５】
【数５０】

【００９６】
が成立することを確認した後，
【００９７】
【数５１】

【００９８】
により，（ｕ，ｖ，ｗ）のメッセージ文を復号化する。確認が失敗した場合は，暗号文は不正なものとみなし拒否する。
【００９９】
以上，実施例では，送信者と受信者が各々の装置を利用して暗号通信を行うという一般形で述べたが，具体的には様々なシステムに適用される。
【０１００】
例えば，電子ショッピングシステムでは，送信者はユーザであり，送信者側装置はパソコンなどの計算機であり，受信者は小売店，受信者側装置はパソコンなどの計算機となる。このとき，ユーザの商品等の注文書は共通鍵暗号で暗号化されることが多く，その際の暗号化鍵を本実施例による方法により暗号化されて小売店側装置に送信される。
【０１０１】
また，電子メールシステムでは，各々の装置はパソコンなどの計算機であり，送信者のメッセージは共通鍵暗号で暗号化されることが多く，その際の暗号化鍵を本実施例による方法により暗号化されて受信者の計算機に送信される。
【０１０２】
その他にも，従来の公開鍵暗号が使われている様々なシステムに適用することが可能である。
【０１０３】
なお，本実施例における各計算は，CPUがメモリ内の各プログラムを実行することにより行われるものとして説明したが，プログラムだけではなく，いずれかがハードウエア化された演算装置であって，他の演算装置や，CPUと，データのやりとりを行うものであっても良い。
【０１０４】
【発明の効果】
本発明によれば，安全な公開鍵暗号方法を提供できる。
【０１０５】
【図面の簡単な説明】
【図１】本発明の実施例のシステム構成を示す図である。
【図２】本発明の実施例における送信者側装置の内部構成を示す図である。
【図３】本発明の実施例における受信者側装置の内部構成を示す図である。
【図４】本発明に実施例１の概要を示す図である。
【図５】本発明の実施例３の概要を示す図である。
【符号の説明】
１００…送信者側装置，１０１…送信者側装置１００内の乱数生成手段，１０２…送信者側装置１００内のべき乗算手段，１０３…送信者側装置１００内の演算手段，１０４…送信者側装置１００内の剰余演算手段，１０５…送信者側装置１００内のメモリ，１０６…送信者側装置１００内の通信装置，１０７…送信者側装置１００内の入力装置，１０８…送信者側装置１００内の暗号化装置，２００…受信者側装置，２０１…受信者側装置２００内の鍵生成手段，２０２…受信者側装置２００内のべき乗算手段，２０３…受信者側装置２００内の剰余演算手段，２０４…受信者側装置２００内の演算手段，２０５…受信者側装置２００内のメモリ，２０６…受信者側装置２００内の通信装置，２０７…受信者側装置２００内の復号化装置，３００…通信回線。[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an encryption communication method using public key cryptography that can be proved to be strong against an enhanced adaptive selection ciphertext attack.
[0002]
[Prior art]
Reference 1 `` M. Bellare, A. Desai, D. Pointcheval and P. Rogaway: Relations Among Notions of Security for Public-Key Encryption Schemes, Proc. Of Crypto'98, LNCS1462, Springer Verlag, pp.26-45 (1998 ) ”, At present, in public key cryptography, it is considered that the most secure (IND-CCA2) is the most secure against adaptive selection ciphertext attacks.
[0003]
As a public key encryption method that can be proved to be IND-CCA2, Reference 2 “D. Dolve, C. Dwork and M. Naor: Non-Malleable Cryptography, In 23 ^rd Annual ACM Symposium on Theory of Computing, pp. 542-552 (1991), Reference 3, “M. Naor and M. Yung: Public-Key Cryptosystems Provably Secure against Chosen Ciphertext Attacks, Proc. Of STOC, ACM Press, pp. 427-437 (1990) ", reference 4," R. Cramer and V. Shoup: A Practical Public Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Attack, Proc. Of Crypto98, LNCS1462, Springer-Verlag, pp.13 -25 (1998) ”, Reference 5,“ M. Bellare and P. Rogaway: Optimal Asymmetric Encryption How to Encrypt with RSA, Proc. Of Eurocrypt'94, LNCS950, Springer Verlag, pp.92- 111 (1994) ”, reference 6“ V. Shoup: OAEP Reconsidered. Available on the e-print library (2000/060), November 2000 ”. Cryptographic method described in Reference 7, “M. Bellare and P. Rogaway: Random Oracles are Practical-A Paradigm for Designing Efficient Protocol, First ACM Conference on Computer and Communications Security, pp. 62--73 (1993)” , Etc. are known.
[0004]
[Problems to be solved by the invention]
In simple terms, it is said that confidentiality against adaptive selected ciphertext attacks (IND-CCA2) on the random oracle model is “the attacker with polynomial time capability is the target ciphertext and the corresponding public key. , It is difficult to compute any information in the message text corresponding to the target ciphertext in an environment where access to the decryption oracle or random oracle is allowed (strict definition) For example, see Document 1.)
[0005]
However, in addition to the target ciphertext, the corresponding public key, the decryption oracle (first oracle), and the random oracle (second oracle), it is attached to the random oracle as the third oracle. When information is given, there are cases where an attacker can calculate partial information of a message sentence.
[0006]
This case will be described below. Reference 7 describes the following public key encryption method: For a message sentence x, the ciphertext is
[0007]
[Expression 23]

[0008]
Given by. Where f is a public one-way replacement with trapdoor, and G and H are hash functions. It is shown in the same document that this public key encryption method is IND-CCA2 when G and H are ideal random functions.
[0009]
Assume that the hash function G is created so that G = G ′ · f with respect to the hash function G ′. However, (f · g) (x) = f (g (x)). Note that if G 'is an ideal random function, G will be ideal random. Then, if the attacker was able to get the function G '(from the third oracle),
[0010]
[Expression 24]

[0011]
Can calculate the message sentence x.
[0012]
Thus, even with public key cryptography that is secure within the scope of the conventional definition (IND-CCA2), the third oracle (outside the scope of the conventional definition) is accompanied by a random oracle from the third oracle. If information is given, it can be easily broken.
[0013]
In the present invention, in addition to the first oracle and the second oracle, even if the information accompanying the random oracle is given to the attacker from the third oracle, any partial information regarding the message text cannot be calculated. Provide a key encryption method.
[0014]
Furthermore, the present invention provides an encryption communication method using the above method, its application apparatus, or system.
[0015]
[Means for Solving the Problems]
In the public key encryption method according to the present invention, a ciphertext is created so that it is difficult to calculate partial information related to an input value to each hash function (not only a message text) from the ciphertext. This makes it possible to invalidate this attack because information about the input value to the hash function cannot be calculated from the ciphertext, even if the attacker obtains any information associated with the random oracle from the third oracle. .
[0016]
Next, a specific method for concealing not only the message text but also the partial information related to the input value to the hash function will be described.
[Key generation]
The recipient of the message
[0017]
[Expression 25]

[0018]
Is the public key,
[0019]
[Equation 26]

[0020]
Is a secret key. Here, G represents a finite abelian group, and there is a one-to-one correspondence between an element of G and an element of {0,1} ^k . In addition, k = k ₁ + k _{2 is} assumed.
[0021]
[encryption]
The message sender selects a random number r∈ {0,1} ^k2 for the message m∈ {0,1} ^k1 ,
[0022]
[Expression 27]

[0023]
And (u, v) is transmitted to the recipient as ciphertext.
[0024]
[Decryption]
The recipient uses his private key to
[0025]
[Expression 28]

[0026]
(M ′, r ′) is calculated, and
[0027]
[Expression 29]

[0028]
(If the confirmation fails, the ciphertext is regarded as invalid and rejected), and m ′ is the message text of the ciphertext (u, v).
[0029]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
[0030]
FIG. 1 is a diagram showing a system configuration of each embodiment of the present invention. This system includes a sender apparatus 100 and a receiver apparatus 200. Further, the sender device 100 and the receiver device 200 are connected by a communication line 300.
[0031]
FIG. 2 shows the internal configuration of the sender apparatus 100 in the system of FIG. The sender apparatus 100 includes random number generation means 101, power multiplication means 102, calculation means 103, remainder calculation means 104, memory 105, communication device 106, and input device 107.
[0032]
FIG. 3 shows the internal configuration of the receiver-side device 200 in the system of FIG. The receiver-side device 200 includes key generation means 201, power multiplication means 202, remainder calculation means 203, calculation means 204, memory 205, communication device 206, and decryption device 207.
[0033]
Example 1
In the present embodiment, a case where transmission data m is transmitted by encrypted communication to B, which is a message sender A, is a receiver. FIG. 4 shows an outline of this embodiment.
[0034]
1. The key generation processing receiver B uses the key generation means 201 in the receiver side device 200 in advance,
[0035]
[30]

[0036]
Secret key,
[0037]
[31]

[0038]
Create a public key. Here, G represents a finite abelian group, and there is a one-to-one correspondence between an element of G and an element of {0,1} ^k . In addition, k = k ₁ + k _{2 is} assumed. Also, public information is output via the communication line 300 or the like and sent to the sender apparatus 100 or disclosed. As a public method, a known method such as registration with a third party (public information management organization) can be used. Other information is stored in the memory 205.
[0039]
2. Encryption / Decryption Processing (1) The sender A selects a random number r∈ {0,1} ^k2 for the message m∈ {0,1} ^k1 using the random number generation means 101 in the sender apparatus 100. , Using the arithmetic means 103,
[0040]
[Expression 32]

[0041]
And (u, v) is transmitted as a ciphertext to the receiver-side apparatus 200 of the receiver B via the communication line 300 using the communication apparatus 106.
[0042]
(2) The receiver uses the secret information and the calculation means 204 in the receiver-side device 200 from the ciphertext (u, v),
[0043]
[Expression 33]

[0044]
(M ′, r ′) is calculated, and
[0045]
[Expression 34]

[0046]
Is confirmed, m ′ is output as the message text of the ciphertext (u, v). If the verification fails, the ciphertext is considered invalid and rejected.
[0047]
In the public key encryption method according to the present embodiment, it is possible to prove that it is confidential (IND-CCA2) against the selected ciphertext attack on the premise of the difficulty of the Diffie-Hellman decision problem on group G. The outline of the proof is as follows: An attacker who tries to break the public key encryption method according to the present embodiment (in the meaning of confidentiality in the adaptive selective ciphertext attack. For definition, see, for example, Reference 14 “V.Shoup. OAEP Reconsidered. Available on the e-print library (2000/060), November 2000 ”), in order to obtain information from the decryption oracle, it is necessary to know the original plaintext in the ciphertext that is the question There is. That is, the attacker cannot obtain new information from the decryption oracle. Further, the method described in Reference 12 “M. Bellare and P. Rogaway,: Optimal Asymmetric Encryption-How to Encrypt with RSA, Proc. Of Eurocrypt '94, LNCS950, Springer Verlag, pp.92-111 (1994)” In the same way, it can be easily shown that the method of this embodiment is IND-CPA. From this, it can be proved that the public key encryption method of this embodiment is IND-CCA2.
[0048]
Furthermore, when the random number r is regarded as a message sentence (in this case, the message sentence m is secret), the same method is applied to the chosen plaintext attack, assuming the difficulty of the Diffie-Hellman decision problem on the group G. It can be proved that it is confidential (IND-CPA). That is, it can be proved that the partial information regarding the random number r is not leaked from the ciphertext.
[0049]
From the above, it was shown that even if the attacker obtains the information associated with the hash function from the third oracle, it is difficult to calculate any partial information about the message from the ciphertext.
[0050]
(Example 2)
In this embodiment, a case where the finite abelian group G is given as a multiplicative group determined from the body in the first embodiment will be described.
[0051]
1. The key generation processing receiver B uses the key generation means 201 in the receiver side device 200 in advance,
[0052]
[Expression 35]

[0053]
Secret key,
[0054]
[Expression 36]

[0055]
Create a public key. However, it is assumed that there is a one-to-one correspondence between the _elements of Z ^* _{p and} the _elements of {0,1} ^k . In addition, k = k ₁ + k _{2 is} assumed. Also, public information is output via the communication line 300 or the like and sent to the sender apparatus 100 or disclosed. As a public method, a known method such as registration with a third party (public information management organization) can be used. Other information is stored in the memory 205.
[0056]
2. Encryption / Decryption Processing (1) The sender A selects a random number r∈ {0,1} ^k2 for the message m∈ {0,1} ^k1 using the random number generation means 101 in the sender apparatus 100. , Using the arithmetic means 103,
[0057]
[Expression 37]

[0058]
And (u, v) is transmitted as a ciphertext to the receiver-side apparatus 200 of the receiver B via the communication line 300 using the communication apparatus 106.
[0059]
(2) The receiver uses the secret information and the calculation means 204 in the receiver-side device 200 from the ciphertext (u, v),
[0060]
[Formula 38]

[0061]
(M ′, r ′) is calculated, and
[0062]
[39]

[0063]
Is confirmed, m ′ is output as the message text of the ciphertext (u, v). If the verification fails, the ciphertext is considered invalid and rejected.
[0064]
In the public key cryptography method according to the present embodiment, confidentiality against the selected ciphertext attack is assumed in the same manner as in the first embodiment, assuming the difficulty of the Diffie-Hellman decision problem on the group Z ^* _p. IND-CCA2). Further, if the random number r is regarded as a message sentence (in this case, the message sentence m is secret), a similar method is used to attack the chosen plaintext attack, assuming the difficulty of the Diffie-Hellman decision problem on the group Z ^* _p. It can be proved that it is strong secrecy (IND-CPA). That is, it can be proved that the partial information regarding the random number r is not leaked from the ciphertext.
[0065]
From the above, it was shown that even if the attacker obtains the information associated with the hash function from the third oracle, it is difficult to calculate any partial information about the message from the ciphertext.
[0066]
(Example 3)
The present embodiment is a modification of the first embodiment, and has an advantage that a plaintext space (message length) can be made larger than the public key encryption method of the first embodiment. FIG. 5 shows an outline of this embodiment.
[0067]
1. The key generation processing receiver B uses the key generation means 201 in the receiver side device 200 in advance,
[0068]
[Formula 40]

[0069]
Secret key,
[0070]
[Expression 41]

[0071]
Create a public key. Here, G represents a finite abelian group, and there is a one-to-one correspondence between an element of G and an element of {0,1} ^k . In addition, k = k ₁ + k _{2 is} assumed. Also, public information is output via the communication line 300 or the like and sent to the sender apparatus 100 or disclosed. As a public method, a known method such as registration with a third party (public information management organization) can be used. Other information is stored in the memory 205.
[0072]
2. Encryption / Decryption Process (1) The sender A uses the random number generation means 101 in the sender apparatus 100 for the message m∈ {0,1} ⁿ and uses the random number r ₁ ∈ {0,1} ^k1 , Choose r ₂ ∈ {0,1} ^k2 and use the arithmetic means 103 to
[0073]
[Expression 42]

[0074]
And (u, v, w) is transmitted as a ciphertext to the receiver apparatus 200 of the receiver B via the communication line 300 using the communication apparatus 106.
[0075]
(2) The receiver uses the above secret information and the ciphertext (u, v, w) using the calculation means 204 in the receiver-side device 200.
[0076]
[Equation 43]

[0077]
(R ′ ₁ , r ′ ₂ )
[0078]
(44)

[0079]
After confirming that
[0080]
[Equation 45]

[0081]
Thus, the message sentence (u, v, w) is decrypted. If the verification fails, the ciphertext is considered invalid and rejected.
[0082]
In the public key encryption method according to the present embodiment, n, which is the message length (bit length), can be arbitrarily selected. Therefore, it is possible to encrypt a longer message sentence as compared with the method of the first embodiment. . Among the uses of public key cryptography, it is most often used for delivery of data encryption keys for common key cryptography. However, it is not easy to encrypt only the data encryption key, but it is often the case that encryption is performed by adding additional information such as user ID information. In such a case, the public key encryption method of this embodiment is effective. It is.
[0083]
Example 4
In this embodiment, the case where the finite abelian group G is given as a multiplicative group determined from the body in the third embodiment will be described.
[0084]
1. The key generation processing receiver B uses the key generation means 201 in the receiver side device 200 in advance,
[0085]
[Equation 46]

[0086]
Secret key,
[0087]
[Equation 47]

[0088]
Create a public key. However, it is assumed that there is a one-to-one correspondence between the _elements of Z ^* _{p and} the _elements of {0,1} ^k . In addition, k = k ₁ + k _{2 is} assumed. Also, public information is output via the communication line 300 or the like and sent to the sender apparatus 100 or disclosed. As a public method, a known method such as registration with a third party (public information management organization) can be used. Other information is stored in the memory 205.
[0089]
2. Encryption / Decryption Process (1) The sender A uses the random number generation means 101 in the sender apparatus 100 for the message m∈ {0,1} ⁿ and uses the random number r ₁ ∈ {0,1} ^k1 , Choose r ₂ ∈ {0,1} ^k2 and use the arithmetic means 103 to
[0090]
[Formula 48]

[0091]
And (u, v, w) is transmitted as a ciphertext to the receiver apparatus 200 of the receiver B via the communication line 300 using the communication apparatus 106.
[0092]
(2) The receiver uses the above secret information and the ciphertext (u, v, w) using the calculation means 204 in the receiver-side device 200.
[0093]
[Formula 49]

[0094]
(R ′ ₁ , r ′ ₂ )
[0095]
[Equation 50]

[0096]
After confirming that
[0097]
[Formula 51]

[0098]
Thus, the message sentence (u, v, w) is decrypted. If the verification fails, the ciphertext is considered invalid and rejected.
[0099]
As described above, the embodiment has been described in a general form in which the sender and the receiver perform encryption communication using each device, but the present invention is specifically applied to various systems.
[0100]
For example, in an electronic shopping system, the sender is a user, the sender device is a computer such as a personal computer, the receiver is a retail store, and the receiver device is a computer such as a personal computer. At this time, the order form for the user's product or the like is often encrypted with the common key encryption, and the encryption key at that time is encrypted by the method according to the present embodiment and transmitted to the retail store side device.
[0101]
In the electronic mail system, each device is a computer such as a personal computer, and the sender's message is often encrypted with a common key encryption. The encryption key at that time is encrypted by the method according to this embodiment. And sent to the recipient's computer.
[0102]
In addition, the present invention can be applied to various systems using conventional public key cryptography.
[0103]
Although each calculation in the present embodiment has been described as being performed by the CPU executing each program in the memory, it is not only a program but one of them is a hardware-equipped arithmetic unit. It is also possible to exchange data with the arithmetic device or CPU.
[0104]
【The invention's effect】
According to the present invention, a secure public key encryption method can be provided.
[0105]
[Brief description of the drawings]
FIG. 1 is a diagram showing a system configuration of an embodiment of the present invention.
FIG. 2 is a diagram illustrating an internal configuration of a sender-side device according to an embodiment of the present invention.
FIG. 3 is a diagram showing an internal configuration of a receiver side device in the embodiment of the present invention.
FIG. 4 is a diagram showing an outline of Embodiment 1 of the present invention.
FIG. 5 is a diagram showing an outline of Embodiment 3 of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 100 ... Sender side apparatus, 101 ... Random number generation means in sender side apparatus 100, 102 ... Power multiplication means in sender side apparatus 100, 103 ... Arithmetic means in sender side apparatus 100, 104 ... Sender side Remainder calculating means in device 100, 105 ... Memory in sender device 100, 106 ... Communication device in sender device 100, 107 ... Input device in sender device 100, 108 ... Sender device 100 , 200 ... receiver side apparatus, 201 ... key generation means in receiver side apparatus 200, 202 ... power multiplication means in receiver side apparatus 200, 203 ... remainder operation in receiver side apparatus 200 Means 204, arithmetic means in the receiver apparatus 200, 205 memory in the receiver apparatus 200, 206 communication apparatus in the receiver apparatus 200, 207 decoding apparatus in the receiver apparatus 200, 00 ... communication line.

Claims (8)

A public key cryptosystem comprising: a sender side device that creates a ciphertext using a public key of a ciphertext recipient; and a receiver side device that decrypts the ciphertext using the recipient's private key Because
The receiver side device comprises key generation means,
The key generation means is a secret key,

Create
As public key,

( However, G Represents a finite abelian group, G With the origin of {0 , 1} ^k During the original 1 versus 1 It is assumed that there is a correspondence. Also, k = k ₁ + k ₂ To )
Create
The sender side device comprises a random number generation means, a cryptographic operation means, and a transmission side communication device,
The random number generation means is a message m ∈ {0 , 1} ^k1 For a random number r ∈ {0 , 1} ^k2 Generates
The cryptographic operation means is the random number r And the public key based on the message m Ciphertext (u , v) ,

Calculated by
The transmitting communication device transmits the ciphertext. (u , v) To the receiver side device,
The receiver side device further includes a decoding operation means and a reception side communication device,
The receiving side communication device transmits the ciphertext. (u , v) Received,
The decryption operation means is the ciphertext (u , v) And the secret key,

Become (m ' , r ') And

Whether or not is true,
If not, the ciphertext (u , v) Is considered to be fraudulent. m ' , The ciphertext (u , v) Is output as the result of decryption
A public key cryptosystem characterized by that. In the public key cryptosystem according to claim 1,
The receiver side device transmits the public key via the receiver side communication device. (g , h , H ₁ , H ₂ ) Is transmitted to the sender device or registered with the public information management organization.
A public key cryptosystem characterized by that. A public key cryptosystem comprising: a sender side device that creates a ciphertext using a public key of a ciphertext recipient; and a receiver side device that decrypts the ciphertext using the recipient's private key Because
The receiver side device comprises key generation means,
The key generation means is a secret key,

Create
As public key,

( However, Z _p With the origin of {0 , 1} ^k During the original 1 versus 1 It is assumed that there is a correspondence. Also, k = k ₁ + k ₂ To )
Create
The sender side device comprises a random number generation means, a cryptographic operation means, and a transmission side communication device,
The random number generation means is a message m ∈ {0 , 1} ^k1 For a random number r ∈ {0 , 1} ^k2 Generates
The cryptographic operation means is the random number r And the public key based on the message m Ciphertext (u , v) ,

Calculated by
The transmitting communication device transmits the ciphertext. (u , v) To the receiver side device,
The receiver side device further includes a decoding operation means and a reception side communication device,
The receiving side communication device transmits the ciphertext. (u , v) Received,
The decryption operation means is the ciphertext (u , v) And the secret key,

Become (m ' , r ') And

Whether or not is true,
If not, the ciphertext (u , v) Is considered to be fraudulent. m ' , The ciphertext (u , v) Is output as the result of decryption
A public key cryptosystem characterized by that. In the public key cryptosystem according to claim 3,
The receiver side device transmits the public key via the receiver side communication device. (p , g , h , H ₁ , H ₂ ) Is transmitted to the sender device or registered with the public information management organization.
A public key cryptosystem characterized by that. A public key cryptosystem comprising: a sender side device that creates a ciphertext using a public key of a ciphertext recipient; and a receiver side device that decrypts the ciphertext using the recipient's private key Because
The receiver side device comprises key generation means,
The key generation means is a secret key,

Create
As public key,

( However, G Represents a finite abelian group, G With the origin of {0 , 1} ^k During the original 1 versus 1 It is assumed that there is a correspondence. Also, k = k ₁ + k ₂ To )
Create
The sender side device comprises a random number generation means, a cryptographic operation means, and a transmission side communication device,
The random number generation means is a message m ∈ {0 , 1} ⁿ For a random number r ₁ ∈ {0 , 1} ^k1 , r ₂ ∈ {0 , 1} ^k2 Generates
The cryptographic operation means is the random number r ₁ , r ₂ And the public key based on the message m Ciphertext (u , v , w) ,

Calculated by
The transmitting communication device transmits the ciphertext. (u , v , w) To the receiver side device,
The receiver side device further includes a decoding operation means and a reception side communication device,
The receiving side communication device transmits the ciphertext. (u , v , w) Received,
The decryption operation means is the ciphertext (u , v , w) And the secret key,

Become (r ' ₁ , r ' ₂ ) And

Whether or not is true,
If not, the ciphertext (u , v , w) Is considered illegal and

Become m ' And
Said m ' The ciphertext (u , v , w) Is output as the result of decryption
A public key cryptosystem characterized by that. In the public key cryptosystem according to claim 5,
The receiver side device transmits the public key via the receiver side communication device. (g , h , H ₁ , H ₂ , G ₁ , G ₂ ) Is transmitted to the sender device or registered with the public information management organization.
A public key cryptosystem characterized by that. A public key cryptosystem comprising: a sender side device that creates a ciphertext using a public key of a ciphertext recipient; and a receiver side device that decrypts the ciphertext using the recipient's private key Because
The receiver side device comprises key generation means,
The key generation means is a secret key,

Create
As public key,

( However, Z _p With the origin of {0 , 1} ^k During the original 1 versus 1 It is assumed that there is a correspondence. Also, k = k ₁ + k ₂ To )
Create
The sender side device comprises a random number generation means, a cryptographic operation means, and a transmission side communication device,
The random number generation means is a message m ∈ {0 , 1} ⁿ For a random number r ₁ ∈ {0 , 1} ^k1 , r ₂ ∈ {0 , 1} ^k2 Generates
The cryptographic operation means is the random number r ₁ , r ₂ And the ciphertext of the message m based on the public key (u , v , w) ,

Calculated by
The transmitting communication device transmits the ciphertext. (u , v , w) To the receiver side device,
The receiver side device further includes a decoding operation means and a reception side communication device,
The receiving side communication device transmits the ciphertext. (u , v , w) Received,
The decryption operation means is the ciphertext (u , v , w) And the secret key,

Become (r ' ₁ , r ' ₂ ) And

Whether or not is true,
If not, the ciphertext (u , v , w) Is considered illegal and

Become m ' And
Said m ' The ciphertext (u , v , w) Is output as the result of decryption
A public key cryptosystem characterized by that. In the public key cryptosystem according to claim 7,
The receiver side device transmits the public key via the receiver side communication device. (p , g , h , H ₁ , H ₂ , G ₁ , G ₂ ) Is sent to the sender's device or registered with the public information management organization
A public key cryptosystem characterized by that.

Images