JP4000900B2 - Cryptographic method with authentication, decryption method with authentication, verification method and device, program, and computer-readable recording medium - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authenticated encryption method, an authenticated decryption method, a verification method and apparatus, a program, and a computer-readable recording medium , and more particularly to a ciphertext recipient of encryption and digital signature technology in a telecommunication system. An encryption method with authentication, a decryption method with authentication, a verification method, an apparatus, a program, and a computer are readable by the system for authenticating the creator of the ciphertext or the corresponding plaintext The present invention relates to a recording medium .
[0002]
[Prior art]
2. Description of the Related Art Conventionally, a method in which a recipient verifies the integrity of a received document by encryption communication between two parties is known. In the so-called common key setting method in which the receiver and the sender share a secret key with others, data authentication is possible by attaching a data authentication code (Message Authentication Code: MAC) to the transmitted ciphertext. It is. In a situation where key sharing in advance is difficult, it is common to perform data authentication by attaching a digital signature to a transmission text based on public key cryptography. However, attaching a digital signature based on public key cryptography also provides evidence to a third party other than the communication party that the sender has transmitted a plaintext. Even if the designated verifier signature is distributed from the designated verifier to the third party, for the third party, is the signature of the original sender or a signature forged by the verifier? It has the characteristic that it cannot be distinguished. Because of its characteristics, it is a signing method that does not have evidence as a sender's signature for a third party.
As a conventional technique, “Disignated Verifier signature method (“ Proofs of Partial Knowledge and Simplified Design of Witncess Hiding Proofs ”Crypto'94, LNCS 839, pp.174-187, Springer Verlag, 1994)” by Cramer et al. Will be described.
Let pi and qi be large prime numbers, respectively, and qi should divide pi. Let gi be the source of the subgroup of order qi of pi.
[0003]
xi ∈ Zqi
The private key,
yi = gi ^xi mod pi
And the public key.
[0004]
Of two public keys (yj, gj, qj, pj) j = 0, 1, a signer who knows the corresponding private key xi with respect to any yi generates a signature for the document m in the following procedure. . In the following example, i = 0 without loss of generality. Let H be a hash function having an output area with the larger number of bits of q0 and q1. The act of randomly selecting one original β from the set α will be written as β ← α.
[0005]
(1) The following is executed.
[0006]
(A) s1 ← Zqi
(B) c1 ← {0, 1} ^L
(C) z1: = g1 ^s1 y1 ^c1 mod p1
▲ 2 ▼ r0 ← Zq0
(3) z0: = gi ^ri mod p0
(4) c: = H (z0‖z1‖m)
(5) c0 = c * c1 (where x is a logical product)
(6) s0: = r0-c0.x0 mod q0
(7) (c0, s0, c1, s1) is output.
[0007]
The signature (c0, s0, c1, s1) for the document m is recognized as a correct signature when the following holds.
[0008]
c0 × c1 = H (g00 ^s0 , y0 ^co mod p0 ‖g1 ^s1 y i ^ci mod p1 ‖m)
(However, x is logical product)
According to the conventional method described above, the recipient of the signature cannot distinguish which public key the signer holds the private key. Therefore, it is a signature method that does not have evidence as a sender's signature for a third party. By signing the ciphertext using the above private verifier signature, the receiver can confirm that the received document is intended by the sender.
[0009]
[Problems to be solved by the invention]
However, the conventional method based on the Designated Verifier signature has evidence for a third party as a signature generated by either the sender or the designated verifier. Therefore, the sender can deny the signature for intentional disclosure of the designated verifier, but the signature of the sender and the designated verifier cannot be obtained by a third party using any means. Both cannot deny the contents of the transmission / reception.
The present invention has been made in view of the above points, and a sender / receiver can deny communication contents to a third party, but a valid receiver can perform message authentication and, if necessary, It is an object of the present invention to provide an authenticated encryption method, authenticated decryption method, verification method, apparatus, program, and computer-readable recording medium that can cancel the sender's repudiation.
[0010]
[Means for Solving the Problems]
FIG. 1 is a diagram for explaining the principle of the present invention.
[0011]
The present invention (Claim 1) is a method of authenticating encryption in which a recipient of a ciphertext authenticates the creator of the ciphertext or a corresponding plaintext.
The sender's signature key sks and encryption key pkr are specified. When the encryption key pkr is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public key cryptosystem. When the ciphertext c is generated with the unique value to be IDb as
A step of redundancy means for making plaintext m redundant to obtain redundant plaintext m ′ (step 1);
A step (Step 2) in which the random number generation means generates a random number r from the random number seed s;
A step (step 3) in which a disturber generating means creates a disturber h from a fixed value IDb specifying a recipient, a random number and a redundant plaintext m ′;
A step of generating a signature σ for the disturbance h by using the signature key sks (step 4 ),
Encrypting means performs encrypted, and to obtain a ciphertext c (Step 5), the using the encryption key pkr the (m, r, sigma).
[0012]
FIG. 2 is a principle configuration diagram of the present invention.
[0013]
The present invention (Claim 2) is a cryptographic apparatus with authentication 10 in which a recipient of a ciphertext authenticates the creator of the ciphertext or the corresponding plaintext,
The sender's signature key sks and encryption key pkr are used, and when the encryption key pkr is disclosed as a public key, the recipient is specified when performing encrypted communication between the two parties using the public encryption method. When generating the ciphertext c using the unique value as IDb,
Redundancy means 11 for making plaintext m redundant and obtaining redundant plaintext m ′;
Random number generation means 12 for generating a random number r from a random number seed s;
A disturbance generator generating means 13 for generating a disturbance h from a fixed value IDb for identifying a receiver, a random number and a redundant plaintext m ′;
Signature generation means 14 for generating a signature σ for the disturbance h using a signature key sks;
Encryption means 15 for encrypting (m, r, σ) using the encryption key pkr to obtain a ciphertext c;
Have
[0014]
The present invention (Claim 3) is a cryptographic program with authentication that causes a computer to execute the function of the cryptographic apparatus with authentication according to claim 2 .
[0015]
The present invention (Claim 4) is a computer-readable recording medium storing the authenticated encryption program according to Claim 3 .
[0016]
The present invention (Claim 5) is a decryption method with authentication executed on an authenticated encryption system in which a recipient of a ciphertext authenticates the creator of the ciphertext or corresponding plaintext,
The recipient's decryption key skr and signature verification key pks are specified. When the signature verification key pks is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public encryption method. When the ciphertext c is decrypted using the unique value IDb as
The decryption means decrypts the ciphertext c using the decryption key skr, and stops processing if it is determined to be an illegal ciphertext during the decryption process, and decryption result (m if it is a valid ciphertext) , R, σ) to obtain a decoding step (step 6);
Redundancy means, and redundant to obtain a redundant plaintext m 'that redundant m of decoding result (step 7),
A disturber generating step (step 8) in which a disturber generating means creates a disturber h from a random number r and a redundant plaintext m ′ as a fixed value IDb that identifies the receiver;
The signature verification means verifies that the signature σ is a correct signature for the disturbance h by using the signature verification key pks. If the verification is successful, m is regarded as a valid message, and if it is unsuccessful , m is invalid. And a signature verification step (step 9) for determining that the message is a correct message .
[0017]
The present invention (Claim 6) is the decryption apparatus with authentication 20 in the authenticated encryption system in which the recipient of the ciphertext authenticates the creator of the ciphertext or the corresponding plaintext,
The recipient's decryption key skr and signature verification key pks are specified. When the signature verification key pks is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public encryption method. When decrypting the ciphertext c with the unique value to be IDb as
The ciphertext c is decrypted using the decryption key skr, and if it is determined as an illegal ciphertext during the decryption process, the processing is stopped, and if it is a valid ciphertext, the decryption result (m, r, σ Decoding means 21 to obtain
Redundancy means 22 for obtaining redundant plaintext m ′ obtained by making m of the decryption result redundant;
A disturbance generator generating means 23 for generating a disturbance h from a random number r and a redundant plaintext m ′ as a fixed value IDb for identifying the receiver;
It is verified that the signature σ is a correct signature for the disturbance h by using the signature verification key pks. If the verification passes, m is regarded as a valid message, and if not, m is determined to be an invalid message. Signature verification means 24.
[0018]
The present invention (Claim 7) is a decryption program with authentication for causing a computer to realize the function of the decryption apparatus with authentication according to Claim 6.
[0019]
The present invention (Claim 8) is a computer-readable recording medium storing the program according to Claim 7.
[0021]
The present invention (Claim 9 ) provides a verification method for a plaintext / signature pair in which the refusal of the ciphertext is canceled.
A step in which a random number generation means generates a random number r from a published random number seed s;
A step of making the plaintext m obtained by decryption redundant to obtain a redundant plaintext m ′;
A step disrupting code generation means, to create a Kakuranko h from a fixed value IDb for identifying the sender, a random number and redundant plaintext m ',
A step of verifying whether or not the signature σ obtained by the decrypting step of claim 5 is a signature for the disturbance h using a verification key pks;
Do.
[0022]
The present invention (Claim 10 ) is a verification apparatus for a pair of plaintext and signature in which the refusal of the ciphertext is canceled,
Random number generating means for generating a random number r from a publicly available random number seed s;
A redundancy means for making plaintext m obtained by decryption redundant to obtain redundant plaintext m ′;
A disturbance value generating means for generating a disturbance value h from a fixed value IDb for identifying a sender, a random number and a redundant plaintext m ′;
Signature verification means for verifying whether or not the signature σ obtained by the decryption means of claim 6 is a signature for the disturbance h using a verification key pks.
[0023]
The present invention (Claim 11 ) is a verification program for causing a computer to realize the function according to Claim 10 .
[0024]
The present invention (Claim 12 ) is a computer-readable recording medium storing the verification program according to Claim 11.
[0025]
As described above, in the present invention, the identifier that identifies the recipient, such as a public key, is IDb. A redundant plain text m ′ obtained by making the plain text m redundant is created. A sufficiently long random number r is generated from a short random number seed s, IDb and redundant plaintext m ′ are perturbed by the random number r to create a disturbance h, and a signature σ is assigned to h (the signature method used here is , A potential non-counterfeitable (EUF-CMA) method against an adaptive choice sentence attack), and a set of m, r, σ is encrypted (the encryption method used here is an adaptive choice ciphertext) Invisible to attack (IND-CCA) method) Send to recipient.
[0026]
Also, at the time of generating a disturbance, a different (r ′, IDb ′, m ″) (where m ″ has the same redundancy) becomes the same h as h created from (r, IDb, m ′). Suppose that it is easy to create.
[0027]
When canceling the refusal of the ciphertext, the random number seed s is disclosed.
[0028]
Furthermore, when the plaintext m and signature σ are verified with respect to the obtained plaintext-signature pair after decrypting the ciphertext whose repudiation has been canceled, the same random number generation method as the sender is used. The random number r is restored from the published random number seed s, the redundant plaintext m ′ is created from the plaintext m, the disturber h is created from (r, IDb, m ′), and the signature σ is correct for the disturber h The signature is verified using the sender's public key pks.
Thus, the sender's signature is given to the perturbator, and the perturbator becomes the same perturbator h with respect to the perturbator h created from (r, IDb, m ′). Since it is easy to create r ′, IDb ′, m ″), the signature does not have evidence for the message m after all.
[0029]
On the other hand, the IND-CCA encryption method has a feature that only those who know plaintext can create the encrypted text. Therefore, as a result of decrypting the received ciphertext, only a legitimate receiver who can decrypt the received ciphertext when the sender A has obtained a signature addressed to the receiver B by the third party and cannot be forged by a third party. Can be convinced that the obtained plaintext is created by the sender A.
[0030]
Furthermore, when the random seed s is made public, it is not possible to create different (r ′, IDb ′, m ″) with the same h for the disturbance h created from (r, IDb, m ′). Although it is easy, when the random numbers r and r ′ are sufficiently long, r ′ must be determined so that the redundant plaintext m ″ has the correct redundancy with respect to an arbitrary m. It is difficult to obtain a random seed s ′ for a particular r ′, and the signature can be regarded as having evidence for (s, IDb, m).
[0031]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0032]
[First Embodiment]
In the following description, it is assumed that the sender's signature key sks, the encryption key pkr, the receiver's decryption key skr, and the signature verification key pks, and the signature verification key pks and the encryption key pkr are disclosed as public keys. . Also, the unique value that identifies the recipient is IDb.
FIG. 3 shows the configuration of the authentication encryption apparatus according to the first embodiment of the present invention.
[0033]
The encryption apparatus 10 shown in FIG. 1 makes a plaintext m redundant and obtains a redundant plaintext m ′, a randomizing unit 11 that generates a random number r from a random seed s, IDb, a random number r, and a redundant plaintext m ′. A disturber generator 13 for generating a disturber h from the signature, a signature generator 14 for generating a signature σ for the disturber h using a signature key sks, and encrypting m‖r‖σ using an encryption key pkr, It comprises an encryption unit 15 that obtains a sentence c.
[0034]
FIG. 4 shows the configuration of the authentication decryption apparatus according to the first embodiment of the present invention.
[0035]
The decryption apparatus 20 shown in the figure includes a decryption unit 21 that receives a ciphertext c and decrypts the ciphertext c using a decryption key skr, a redundancy unit 22 that makes a plaintext m redundant and obtains a redundant plaintext m ′. From a disturber generator 23 that creates a disturber h from IDb, r, m ′, and from a signature verifier 24 that verifies that the signature σ is the correct signature of the sender A for the disturber h using the signature verification key pks. Composed.
[0036]
Next, the operation in the above configuration will be described.
[0037]
The premise of the operation described below will be described.
[0038]
It is assumed that the sender A has a signature key sks and an encryption key pkr, and pkr is made public. It is assumed that the sender B has a decryption key skr and a signature verification key pks, and pks is made public.
[0039]
In the following, the binary operator a + b is an exclusive OR for each bit of a and b, and a‖b represents a combined bit string. | A | represents the number of bits of a. Character string that can specify the recipient (name or public key).
[0040]
The ciphertext for the document m to be transmitted from the sender A to the receiver B is created by the authentication encryption apparatus 10. The operation is as follows.
[0041]
FIG. 5 is a flowchart of the encryption procedure according to the first embodiment of the present invention.
[0042]
Step 101) The redundancy unit 11 makes the plaintext m redundant to obtain a redundant plaintext m ′.
[0043]
Step 102) The random number generator 12 generates a random number r from the random number seed s.
[0044]
Step 103) The disturber generator 13 creates a disturber h from IDb, r, m ′.
[0045]
Step 104) The signature generator 14 generates a signature σ for the disturbance h using the signature key sks.
[0046]
Step 105) The encryption unit 15 encrypts m‖r‖σ using the encryption key pkr to obtain a ciphertext c.
[0047]
Next, the ciphertext received from the sender A is decrypted by the authentication decryption device 20. The decoding operation is as follows.
[0048]
FIG. 6 is a flowchart of the decoding procedure in the first embodiment of the present invention.
[0049]
Step 201) The decryption unit 21 decrypts the input ciphertext c using the decryption key skr.
[0050]
Step 202) If it is an illegal ciphertext during the decryption process, the processing is stopped.
[0051]
Step 203) If it is a valid ciphertext, a decryption result m‖r‖σ is obtained.
[0052]
Step 204) The redundancy unit 22 makes the plaintext m redundant to obtain a redundant plaintext m ′.
[0053]
Step 205) The disturbance generator h generates a disturbance h from the IDb, r, m ′.
[0054]
Step 206) The signature verification unit 24 verifies that the signature σ is the correct signature of the sender A for the disturbance h using the signature verification key pks.
[0055]
Step 207) It is determined whether the verification is passed or failed. If it is passed, the process proceeds to Step 208, and if it is not passed, the process proceeds to Step 209.
[0056]
Step 208) Determine a valid message for m.
[0057]
Step 209) It is determined that m is an illegal message.
[0058]
[Second Embodiment]
In the present embodiment, a case will be described in which signature verification is performed on a plaintext m and a signature σ in which the random seed s is disclosed and ciphertext repudiation is canceled.
[0059]
FIG. 7 shows the configuration of the signature verification apparatus when the repudiation is canceled in the second embodiment of the present invention.
[0060]
When the plaintext m obtained by the decryption unit 21 is input, the signature verification apparatus 30 shown in the figure makes the plaintext m redundant and obtains a redundant plaintext m ′, and the random number s from the public random number s a random number generator 32 for generating r, a disturber generator 33 for generating a disturber h from IDb, r, m ′, and a signature verification key pks that the signature σ is the correct signature of the sender A for the disturber h. The verification unit 34 is used for verification.
[0061]
The operation of signature verification for plaintext m and signature σ with the repudiation canceled in the above configuration will be described.
[0062]
FIG. 8 is a flowchart of a signature verification procedure for plaintext m and signature σ in which repudiation is canceled in the second embodiment of the present invention.
[0063]
Step 301) The redundancy unit 31 makes the plaintext m redundant to obtain a redundant plaintext m ′.
[0064]
Step 302) The random number generator 32 generates a random number r from the published random number seed s.
[0065]
Step 303) The disturber generator 33 generates a disturber h from IDb, r, m ′.
[0066]
Step 304) The signature verification unit 34 verifies that the signature σ is the correct signature of the sender A with respect to the disturbance h using the signature verification key pks.
[0067]
Step 305) If the verification result is acceptable, the process proceeds to step 306. If the result is unacceptable, the process proceeds to step 307.
[0068]
Step 306) It is determined that m is a valid message.
[0069]
Step 307) It is determined that m is an illegal message.
[0070]
【Example】
Embodiments of the present invention will be described below with reference to the drawings.
[0071]
[First embodiment]
The apparatus configuration of the present embodiment is the same as that shown in FIGS. However, in the following embodiments, the redundancy units 11, 22, and 31 use bit combination means, and the disturber generation units 13, 23, and 33 use bit combination means and exclusive OR means.
[0072]
FIG. 9 shows the configuration of the redundancy unit of the first embodiment of the present invention, and FIG. 10 shows the configuration of the disturber generation unit of the first embodiment of the present invention.
[0073]
The operation when the above configuration is used will be described. It is assumed that the sender A has a signature key sks and an encryption key pkr, and pkr is made public. The receiver B has a decryption key skr and a signature verification key pks, and pks is made public.
[0074]
The ciphertext for the document m to be transmitted from the sender A to the receiver B is created by the following authentication encryption apparatus.
[0075]
Hereinafter, the operation of the authentication encryption device 10 will be described.
[0076]
{Circle around (1)} In the bit combining unit 41 which is the redundancy unit 11, 80 bits 0... 0 are combined with the input plaintext m, and the result is set as a redundant plaintext m ′.
[0077]
(2) The random number generator 12 generates | m ′ | + | IDb | bit random number r from the random seed s.
[0078]
(3) The bit combination means 51 and the exclusive OR means 52, which are the disturbance generator 13, calculate h = (m ′ | IDb) × r (where + indicates an exclusive OR). .
[0079]
(4) The signature generator 14 generates a signature σ for the disturbance h using the signature key sks.
[0080]
(5) The encryption unit 15 encrypts m‖r‖σ using the encryption key pkr to obtain a ciphertext c.
[0081]
Next, the decryption process of the ciphertext received from the sender A will be described.
[0082]
(1) The decryption unit 21 decrypts the ciphertext c with the decryption key skr. If it is determined that the ciphertext is invalid during the decryption process, the processing is stopped. If the ciphertext is valid, the decryption result m 結果 r‖σ is obtained.
[0083]
{Circle around (2)} The bit combiner 41 which is the redundancy unit 22 combines 80 bits 0... 0 to the input plaintext m and sets the result as redundant plaintext m ′.
[0084]
(3) The bit combination unit 51 which is the disturbance generator 23 and the exclusive OR unit 52 calculate h = (m′ｍIDb) × r (where x is an exclusive OR).
[0085]
(4) The signature verification unit 24 verifies that the signature σ is the correct signature of the sender A with respect to the disturbance h by using the signature verification key pks. If the verification passes, m is accepted as a valid message, and if it fails, m is determined to be an invalid message.
[0086]
Next, the plaintext m and the signature σ in which the random seed s is disclosed and the repudiation is canceled are verified by the procedure shown in FIG.
[0087]
(1) The bit combination means 41 which is the redundancy unit 31 combines 80 bits 0... 0 to the input plaintext m, and the result is set as a redundant plaintext m ′.
[0088]
(2) The random number generator 32 generates | m ′ | + | IDb | bit random number r from the random seed s.
[0089]
{Circle around (3)} The bit combination means 51 and the exclusive OR means 52, which are the disturbance generator 33, calculate h (m′bIDb) × r (where x is an exclusive OR).
[0090]
(4) The signature verification unit 34 verifies that the signature σ is the correct signature of the sender A with respect to the disturbance h by using the signature verification key pks. If the verification passes, m is accepted as a valid message, and if it fails, m is determined to be an invalid message.
[0091]
[Second Embodiment]
Next, in this embodiment, an example will be described in which a random number generator is used to shorten the bit length of a required random number when the message length is long.
[0092]
FIG. 11 shows the configuration of the disturber generator of the second embodiment of the present invention.
[0093]
The disturber generators 13 and 33 shown in the figure are composed of a bit combination means 61, a hash means 62, and an exclusive OR means 63, and the hash means 62 is added to the structure of FIG.
[0094]
That is, the hash unit 62 having an output bit number of 160 bits is provided, the output of the random number generators 12 and 32 is similarly 160 bits, and the result of combining IDb with the redundant plaintext m ′ is input to the hash unit 62 for shortening. In this method, the exclusive OR of the hash value and the random number r is used as a disturbance.
[0095]
This method is effective when | m ′ | + | IDb | is 160 bits or more.
[0096]
Note that the configurations of the authentication encryption device and the authentication decryption device in the above-described embodiments and examples can be constructed as a program and installed in a computer used as the authentication encryption device and the authentication decryption device.
[0097]
The constructed program is stored in a portable storage medium such as a hard disk, a flexible disk, or a CD-ROM connected to a computer used as an authentication encryption apparatus and authentication decryption apparatus, and the present invention is implemented. By installing at this time, the present invention can be realized.
[0098]
The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.
[0099]
【The invention's effect】
As described above, according to the present invention, both the sender and the receiver can deny the communication content to a third party, but a legitimate receiver can confirm the integrity of the received data. A legitimate sender can arbitrarily authenticate a plaintext corresponding to the transmitted text to a third party as necessary.
[Brief description of the drawings]
FIG. 1 is a diagram for explaining the principle of the present invention.
FIG. 2 is a principle configuration diagram of the present invention.
FIG. 3 is a configuration diagram of an authentication encryption apparatus according to the first embodiment of the present invention.
FIG. 4 is a configuration diagram of an authentication decryption apparatus according to the first embodiment of the present invention.
FIG. 5 is a flowchart of encryption means in the first embodiment of the present invention.
FIG. 6 is a flowchart of a decoding procedure in the first embodiment of the present invention.
FIG. 7 is a configuration diagram of a signature verification apparatus when repudiation is canceled in the second embodiment of the present invention.
FIG. 8 is a flowchart of a signature verification procedure for plaintext and a signature with non-repudiation canceled in the second embodiment of the present invention.
FIG. 9 is a configuration diagram of a redundancy unit according to the first exemplary embodiment of the present invention.
FIG. 10 is a configuration diagram of a disturber generation unit according to the first embodiment of this invention.
FIG. 11 is a configuration diagram of a disturber generating unit according to the second embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 Authentication encryption apparatus 11 Redundancy means, Redundancy part 12 Random number generation means, Random number generation part 13 Disturbant generation means, Disturbant generation part 14 Signature generation means, Signature generation part 15 Encryption means, Encryption part 21 Decryption means , Decoding unit 22 redundancy unit, redundancy unit 23 disturber generation unit, disturbance generator generation unit 24 signature verification unit, signature verification unit 30 signature verification unit 31 redundancy unit 32 random number generation unit 33 disturbance unit generation unit 34 signature verification unit 41 bit combining means 51 bit combining means 52 exclusive OR means 61 bit combining means 62 hash means 63 exclusive OR means

Claims (12)

In the authenticated encryption method in which the recipient of the ciphertext authenticates the creator of the ciphertext or the corresponding plaintext,
The sender's signature key sks and encryption key pkr are specified. When the encryption key pkr is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public key cryptosystem. When the ciphertext c is generated with the unique value to be IDb as
A step of redundancy means for making plaintext m redundant to obtain redundant plaintext m ′;
A step in which a random number generating means generates a random number r from a random number seed s;
Disrupting code generation means, and creating a fixed value IDb and the random number and Kakuranko h from the redundant plaintext m 'for specifying the recipients,
A signature generating means generating a signature σ for the disturber h using the signature key sks;
An encryption unit encrypts (m, r, σ) using the encryption key pkr to obtain a ciphertext c;
A cryptographic method with authentication, characterized in that: The ciphertext recipient is an authenticated encryption device that authenticates the creator of the ciphertext or the corresponding plaintext,
The sender's signature key sks and encryption key pkr are used, and when the encryption key pkr is disclosed as a public key, the recipient is specified when performing encrypted communication between the two parties using the public encryption method. When generating the ciphertext c using the unique value as IDb,
Redundancy means for making plaintext m redundant and obtaining redundant plaintext m ′;
Random number generating means for generating a random number r from a random number seed s;
A disturbance generator generating means for generating a disturbance h from the fixed value IDb for identifying the recipient, the random number and the redundant plaintext m ′;
Signature generating means for generating a signature σ for the disturbance h using the signature key sks;
Encryption means for encrypting (m, r, σ) using the encryption key pkr to obtain a ciphertext c;
And a cryptographic device with authentication. On the computer,
An encryption program with authentication, which causes a function of the encryption device with authentication according to claim 2 to be executed . A computer-readable recording medium storing the authenticated encryption program according to claim 3 . In the authenticated decryption method executed on the authenticated cryptographic system in which the recipient of the ciphertext authenticates the creator of the ciphertext or the corresponding plaintext,
The recipient's decryption key skr and signature verification key pks are specified. When the signature verification key pks is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public encryption method. When the ciphertext c is decrypted using the unique value IDb as
Decryption means decrypts the ciphertext c using the decryption key skr, stops processing if it is determined to be an illegal ciphertext during the decryption process, and decryption results if it is a valid ciphertext A decoding step to obtain (m, r, σ);
Redundancy means, and redundant to obtain a redundant plaintext m 'that redundant m of decoding result,
A disturber generating step for generating a disturber h from the random number r and the redundant plaintext m ′ as a fixed value IDb for identifying the receiver;
The signature verification means verifies that the signature σ is a correct signature for the disturber h by using the signature verification key pks, and if the verification is successful, sets m as a valid message, and if it does not pass , M is a signature verification step that determines that the message is invalid,
A decryption method with authentication, characterized in that: A decryption apparatus with authentication in an authenticated encryption system in which a recipient of ciphertext authenticates the creator of the ciphertext or corresponding plaintext,
The recipient's decryption key skr and signature verification key pks are specified. When the signature verification key pks is made public as a public key, the recipient is specified when performing encryption communication between the two parties using the public encryption method. When the ciphertext c is decrypted using the unique value IDb as
The ciphertext c is decrypted using the decryption key skr, and if it is determined as an illegal ciphertext during the decryption process, the processing is stopped, and if it is a valid ciphertext, the decryption result (m, r , Σ)
Redundancy means for obtaining a redundant plaintext m ′ obtained by making m of the decryption result redundant;
A disturbance generator generating means for generating a disturbance h from the random number r and the redundant plaintext m ′ as a fixed value IDb for identifying the receiver;
The signature σ is verified using the signature verification key pks to verify that the signature σ is a correct signature for the disturbance h, and if the verification passes, the m is a valid message, and if it is not, m is an invalid message. And a signature verification unit that determines that the decryption is performed. On the computer,
The decryption program with authentication which implement | achieves the function of the decryption apparatus with authentication of Claim 6. A computer-readable recording medium storing the program according to claim 7. In the verification method for the plaintext / signature pair in which the refusal of the ciphertext is canceled,
A step in which a random number generation means generates a random number r from a published random number seed s;
A step of making the plaintext m obtained by decryption redundant to obtain a redundant plaintext m ′;
A step disrupting code generation means, to create a fixed value IDb for identifying the sender, the random number and Kakuranko h from the redundant plaintext m ',
A step of verifying whether or not the signature σ obtained by the decrypting step of claim 5 is a signature for the disturber h using a verification key pks;
The verification method characterized by performing . A verification device for a plaintext / signature pair whose ciphertext repudiation has been revoked,
Random number generating means for generating a random number r from a publicly available random number seed s;
A redundancy means for making plaintext m obtained by decryption redundant to obtain redundant plaintext m ′;
A disturbance value generating means for generating a disturbance value h from the fixed value IDb for identifying the sender, the random number and the redundant plaintext m ′;
Signature verification means for verifying whether or not the signature σ obtained by the decryption means of claim 6 is a signature for the disturbance h using a verification key pks;
The verification apparatus characterized by having. On the computer,
A verification program for realizing the function according to claim 10 . A computer-readable recording medium storing the verification program according to claim 11.

Images