JP4450969B2 - Key sharing system, secret key generation device, common key generation system, encryption communication method, encryption communication system, and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a key sharing method by which both entities can easily share a common key without the need for preliminary communication between both the entities and to provide an encryption communication method and system that can build up the secure ID-NIKS (ID-based non-interactive key sharing scheme) by adopting the key sharing method. SOLUTION: A center 1 maps ID information of each entity onto a point on an elliptic curve and generates a private key of each entity by using a public key being a mapped value and private information of the center 1 itself. Each entity generates a common key used for encryption processing/decoding processing by using its own private key received from the center 1 and the public key being the mapped value resulting from the ID information of a communication opposite party mapped on the elliptic curve. In this case, a pairing defined onto the elliptic curve is utilized.

Description

【００４０】
一方、ＩＤ_a ＞ＩＤ_b である場合、エンティティＢは、エンティティＡのＩＤ情報ＩＤ_a を楕円曲線に写像した公開鍵Ｐ_a と自身の秘密鍵Ｓ_b とを用いて、下記（３）に従って共通鍵Ｋ_baを生成する。

よって、エンティティＡが生成する共通鍵Ｋ_abとエンティティＢが生成する共通鍵Ｋ_baとは一致して、両エンティティＡ，Ｂ間で共通鍵を共有できる。
【００４１】
以下に、上記のようなＩＤ情報の大小関係を設定しないで鍵共有を可能とする２つの例について説明する。
【００４２】
（第２例）
ｘ，ｙに関する対称関数ｇ（ｘ，ｙ）（但し、ｇ（ｘ，ｙ）＝ｘｙは除く）を設定する。以下の例では、ｇ（ｘ，ｙ）＝ｘ＋ｙとする。エンティティＡは、ｇ（ｘ，ｙ）＝ｘ＋ｙに従って下記（４）のように、共通鍵Ｋ_ab＝ｋ_ab＋ｋ_baを生成する。

【００４３】
一方、エンティティＢは、ｇ（ｘ，ｙ）＝ｘ＋ｙに従って下記（５）のように、共通鍵Ｋ_ba＝ｋ_ba＋ｋ_abを生成する。

よって、エンティティＡが生成する共通鍵Ｋ_abとエンティティＢが生成する共通鍵Ｋ_baとは一致して、両エンティティＡ，Ｂ間で共通鍵を共有できる。なお、他の種類の対称関数ｇ（ｘ，ｙ）を利用しても、同様に鍵共有が可能である。
【００４４】
（第３例）
エンティティＡは、第２例で示したｋ_abを用いて、下記（６）のように、共通鍵Ｋ_ab＝ｋ_ab＋ｋ_ab ^-1を生成する。

【００４５】
エンティティＢは、第２例で示したｋ_baを用いて、下記（７）のように、共通鍵Ｋ_ba＝ｋ_ba＋ｋ_ba ^-1を生成する。

よって、エンティティＡが生成する共通鍵Ｋ_abとエンティティＢが生成する共通鍵Ｋ_baとは一致して、両エンティティＡ，Ｂ間で共通鍵を共有できる。
【００４６】
（第４例）
エンティティＡは、自身の秘密鍵Ｓ_a とエンティティＢの公開鍵Ｐ_b とを用いて、下記（８）のようにして、中間鍵Ｉ_abを生成する。

【００４７】
エンティティＢは、自身の秘密鍵Ｓ_b とエンティティＡの公開鍵Ｐ_a とを用いて、下記（９）のようにして、中間鍵Ｉ_baを生成する。

【００４８】
ここで、ベイユペアリングにおける前述した（交換則）により、Ｉ_ab×Ｉ_ba＝１の関係が成立することが分かる。このような逆数の関係を利用して、両エンティティＡ，Ｂ間で鍵共有を行うことも可能である。
【００４９】
以上のようにして、ベイユペアリングを利用して、各エンティティ間で等しい共通鍵を容易に生成できる。
【００５０】
なお、上述した例では、エンティティＡのＩＤ情報ＩＤ_a から直接に写像点Ｐ_a を求めるようにしたが、一方向性関数を用いてＩＤ情報ＩＤ_a を変換し、その変換値から写像点Ｐ_a を求めるようにしても良い。この際、一方向性関数の例としてハッシュ関数ｈ（）を用いた場合、公開鍵Ｐ_a ＝ｆ（ｈ（ＩＤ_a ）），秘密鍵Ｓ_a ＝ｒ・ｆ（ｈ（ＩＤ_a ））となる。
【００５１】
エンティティが、センタ１の秘密情報ｒを求めることを困難にするためには、次の２つの条件が必要である。
（条件１）ｑを２¹⁶⁰ 以上に設定すること。
（条件２）＃Ｅ／Ｆ_q ｜ｑ^k −１かつｑ^k ＞２¹⁰²⁴を満たすような整数ｋが存在すること。
【００５２】
（条件１）は、楕円離散対数問題を求めることを困難にするために必要である。（条件２）は、有限体Ｆ_d （但し，ｄ＝ｑ^k ）の離散対数問題を求めることを困難にするために必要である。
【００５３】
次に、上述した鍵共有方式を利用した暗号システムにおけるエンティティ間の情報通信について説明する。図２は、２人のエンティティＡ，Ｂ間における情報の通信状態を示す模式図である。図２の例は、エンティティＡが平文（メッセージ）Ｍを暗号文Ｃに暗号化してそれをエンティティＢへ伝送し、エンティティＢがその暗号文Ｃを元の平文（メッセージ）Ｍに復号する場合を示している。
【００５４】
センタ１には、関数ｆ（）を用いて、各エンティティＡ，ＢのＩＤ情報ＩＤ_a ，ＩＤ_b を楕円曲線に写像した写像位置である公開鍵Ｐ_a ，Ｐ_b を得る公開鍵生成器１ａと、その公開鍵Ｐ_a ，Ｐ_b とセンタ固有の秘密情報ｒとを用いて各エンティティＡ，Ｂの秘密鍵Ｓ_a ，Ｓ_b を求める秘密鍵生成器１ｂとが備えられている。そして、センタ１から各エンティティＡ，Ｂへ、前記（１）に従って生成された秘密鍵Ｓ_a ，Ｓ_b が送付される。
【００５５】
エンティティＡ側には、エンティティＢのＩＤ情報ＩＤ_b を入力し、それを楕円曲線に写像した写像位置である公開鍵Ｐ_b を得る公開鍵生成器１１と、センタ１から送られる秘密鍵Ｓ_a と公開鍵生成器１１からの公開鍵Ｐ_b とに基づいてエンティティＡが求めるエンティティＢとの共通鍵Ｋ_abを生成する共通鍵生成器１２と、共通鍵Ｋ_abを使用して平文（メッセージ）Ｍを暗号文Ｃに暗号化して通信路３０へ出力する暗号化器１３とが備えられている。
【００５６】
また、エンティティＢ側には、エンティティＡのＩＤ情報ＩＤ_a を入力し、それを楕円曲線に写像した写像位置である公開鍵Ｐ_a を得る公開鍵生成器２１と、センタ１から送られる秘密鍵Ｓ_b と公開鍵生成器２１からの公開Ｐ_a とに基づいてエンティティＢが求めるエンティティＡとの共通鍵Ｋ_baを生成する共通鍵生成器２２と、通信路３０から入力した暗号文Ｃを共通鍵Ｋ_baを使用して平文（メッセージ）Ｍに復号して出力する復号器２３とが備えられている。
【００５７】
次に、動作について説明する。エンティティＡからエンティティＢへ情報を伝送しようとする場合、まず、エンティティＢのＩＤ情報ＩＤ_b が公開鍵生成器１１に入力されて公開鍵Ｐ_b が得られ、得られた公開鍵Ｐ_b が共通鍵生成器１２へ送られる。また、センタ１から秘密鍵Ｓ_a が共通鍵生成器１２へ入力される。そして、前記（２），（４）または（６）に従って共通鍵Ｋ_abが求められて、暗号化器１３へ送られる。暗号化器１３において、この共通鍵Ｋ_abを用いて平文（メッセージ）Ｍが暗号文Ｃに暗号化され、暗号文Ｃが通信路３０を介して伝送される。
【００５８】
通信路３０を伝送された暗号文ＣはエンティティＢの復号器２３へ入力される。エンティティＡのＩＤ情報ＩＤ_a が公開鍵生成器２１に入力されて公開鍵Ｐ_a が得られ、得られた公開鍵Ｐ_a が共通鍵生成器２２へ送られる。また、センタ１から秘密鍵Ｓ_b が共通鍵生成器２２へ入力される。そして、前記（３），（５）または（７）に従って共通鍵Ｋ_baが求められて、復号器２３へ送られる。復号器２３において、この共通鍵Ｋ_baを用いて暗号文Ｃが平文（メッセージ）Ｍに復号される。
【００５９】
次に、本発明における安全性について説明する。本発明の安全性は、楕円離散対数問題と後述するようにこれと等価である拡張楕円離散対数問題とに基づいている。
【００６０】
〔楕円離散対数問題と拡張楕円離散対数問題との等価性〕
通常の楕円離散対数問題とは、楕円曲線Ｅ上の任意の点Ｐとそのｒ倍点Ｑ＝ｒＰが与えられている場合に、Ｐ，Ｑからｒを求める問題である。ここで、下記（10）のように、楕円曲線上の任意の点Ｐ_i （１≦ｉ≦ｎ−１）とその点Ｐ_i に基づくＱが与えられている場合に、ある１組のｒ_i （１≦ｉ≦ｎ−１）を求める問題を拡張楕円離散対数問題と定義する。楕円離散対数問題と拡張楕円離散対数問題との等価性について考察する。なお、議論の簡単化のために楕円曲線は素数位数ｐとする。
【００６１】
【数１】

【００６２】
（楕円離散対数問題から拡張楕円離散対数問題への帰着）
楕円離散対数問題がベースポイントＰを基準として解けると仮定する。Ｐ_i （１≦ｉ≦ｎ−１）及びＱは、夫々楕円曲線上のベースポイントＰを基準として係数を、下記（11）のように求めることができる。
【００６３】
【数２】

【００６４】
係数ｒ_i ′，ｒ′をＦ_p の元として、下記（12）の不定方程式を解くことにより、ｒ_i （１≦ｉ≦ｎ−１）を求めることが可能である。よって、拡張楕円離散対数問題を解くことができる。
【００６５】
【数３】

【００６６】
（拡張楕円離散対数問題から楕円離散対数問題への帰着）
任意の拡張楕円離散対数問題が解けると仮定する。ここで、楕円曲線上の点Ｐ_i （１≦ｉ≦ｎ）に対して、下記（13）で示される拡張楕円離散対数問題を解き、これを行列を用いて表すと下記（14）のようになる。
【００６７】
【数４】

【００６８】
上記（14）の行列について係数のみを抜き出すと下記（15）のような関係式が得られ、下記（16）のように変形可能である。
【００６９】
【数５】

【００７０】
上記（16）から分かるように、点Ｐ_i （１≦ｉ≦ｎ−１）はＰ_n の定数倍で表すことが可能である。即ち、拡張楕円離散対数問題を解くことによって、Ｐ_i ＝ｒ_i ′Ｐ_n を満たすｒ_i ′を求めることができる。
以上のことから、楕円離散対数問題と拡張楕円離散対数問題とは等価になる。
【００７１】
〔センタの秘密情報に関する安全性〕
エンティティＣの公開鍵Ｐ_c と秘密鍵Ｓ_c とからセンタの秘密情報ｒを得ることは、楕円離散対数問題を解くことと等価であって、困難である。
エンティティＡの公開鍵Ｐ_a とエンティティＢの公開鍵Ｐ_b とから＜Ｐ_a ，Ｐ_b ＞を計算し、これと共通鍵Ｋ_ab＝＜Ｐ_a ，Ｐ_b ＞^r とからｒを得ることは離散対数問題を解くことと等価であって、困難である。
よって、どのエンティティもセンタの秘密情報ｒを求めることができない。
【００７２】
〔エンティティの秘密鍵に関する安全性〕
ｎ人のエンティティが結託してエンティティＣの秘密鍵Ｓ_c を偽造する攻撃について考察する。エンティティＣの公開鍵Ｐ_c が下記（17）のように他のエンティティの公開鍵の線形結合によって表すことが可能であると仮定すると、前記（１）にこの線形結合を代入すると、下記（18）の関係式が成立するので、エンティティＣの秘密鍵Ｓ_c が露呈する。

【００７３】
しかし、上記（17）での係数ｕ_i を得るには拡張楕円離散対数問題を解く必要があり、このような攻撃は困難であるといえる。よって、安全性は拡張楕円離散対数問題を解くことの難しさに基づいている。
【００７４】
ここで、この秘密鍵の安全性について更に詳述する。拡張楕円離散対数問題は、ＰをＥ／Ｆ_q 上の任意の点、（Ｇ₁ ，Ｇ₂ ）をＥ／Ｆ_q の生成元とした場合に、下記（19）において係数ｕ₁ ，ｕ₂ を求める問題である。
Ｐ＝ｕ₁ Ｇ₁ ＋ｕ₂ Ｇ₂ …（19）
【００７５】
Ｇ₁ ，Ｇ₂ の次数を＃（Ｇ₁ ），＃（Ｇ₂ ）と定義する。但し、＃（Ｇ₁ ）｜＃（Ｇ₂ ）とする。拡張楕円離散対数問題が解けるとすれば、Ｐ＝ｕ₁ Ｇ₁ ＋ｕ₂ Ｇ₂ での係数ｕ₁ ，ｕ₂ 及びＱ＝ｖ₁ Ｇ₁ ＋ｖ₂ Ｇ₂ での係数ｖ₁ ，ｖ₂ は求まり、楕円離散対数問題Ｑ＝ｒＰは、下記（20）のように解ける。
【００７６】
【数６】

【００７７】
上記（17）を解く問題と拡張楕円離散対数問題との等価性について考察する。上記（17）が解けたとすると、下記（21）のｒ_i,j を求めることができる。
【００７８】
【数７】

【００７９】
そして、下記（22）の式において、左辺の（ｎ−２）×（ｎ−２）の行列式が、Ｐ_n-1 ＝Ｇ₁ ，Ｐ_n ＝Ｇ₂ である＃（Ｇ₂ ）に素であるという仮定のもとで、その下記（22）の式を解くことができる。行列式が＃（Ｇ₂ ）に素でない場合には、上記（21）の別の解ｒ_i,j を選択できる。
【００８０】
【数８】

【００８１】
この結果、上記（17）が解けるとすれば、下記（23）に示すＰ_i と（Ｇ₁ ，Ｇ₂ ）との拡張楕円離散対数問題も解ける。
【００８２】
【数９】

【００８３】
これとは逆に、拡張楕円離散対数問題が解ければ、上記（17）が解けることを示す。Ｐ_i と（Ｇ₁ ，Ｇ₂ ）との拡張楕円離散対数問題を下記（24）のように定義し、Ｐ_C と（Ｇ₁ ，Ｇ₂ ）との拡張楕円離散対数問題を下記（25）のように定義すると、下記（26）に示すような関係が成立する。
【００８４】
【数１０】

【００８５】
ｖ_j とｒ_i,j が与えられている場合には、ｕ_i が解けることは明らかである。よって、上記（17）を解く問題と拡張楕円離散対数問題とは等価である。また、楕円曲線の群が周期的である場合、拡張楕円離散対数問題が楕円離散対数問題と等価であることは明らかである。よって、この場合、上記（17）を解く問題は楕円離散対数問題と等価になる。
【００８６】
〔エンティティ間の共通鍵に関する安全性〕
ｎ人のエンティティの結託により、エンティティＡ，エンティティＣ間の共通鍵を偽造する攻撃について考察する。エンティティＣの公開鍵Ｐ_c が上記（17）のように他のエンティティの公開鍵の線形結合によって表すことが可能であると仮定すると、下記（27），（28）のように、両エンティティＡ，Ｃ間の共通鍵Ｋ_ac，Ｋ_caが露呈する。エンティティＣの秘密鍵Ｓ_c が線形結合により書き表せる場合も同様に考えられる。
【００８７】
【数１１】

【００８８】
しかしながら、上記（17）での係数ｕ_i を求めるには拡張楕円離散対数問題を解くことになり、このような攻撃は困難である。
【００８９】
もし、エンティティＡが自身の公開鍵Ｐ_a ，秘密鍵Ｓ_a から他のエンティティ間の共通鍵Ｋ_bcを偽造しようとしても不可能である。なぜなら、秘密鍵Ｓ_b ，Ｓ_c はエンティティＢ，Ｃの秘密情報であり、それらは秘密情報ｒなしでは求められないからである。よって、どのエンティティも共通鍵Ｋ_bcを偽造できない。
【００９０】
秘密鍵Ｓ_b ，Ｓ_c なしに結託エンティティＩの秘密鍵Ｓ_i から共通鍵Ｋ_bcを求める結託攻撃は、秘密鍵Ｓ_i から秘密鍵Ｓ_b ，Ｓ_c を求める場合と同じ問題になる。また、結託エンティティＩ，Ｊ間の共通鍵Ｋ_ijから共通鍵Ｋ_bcを求める結託攻撃は、センタの秘密情報ｒを知らないので、困難な問題となる。共通鍵Ｋ_bcを求める問題は、Diffe-Hellman 型問題に帰着する。
【００９１】
ところで、エンティティＡは共通鍵Ｋ_ab，Ｋ_acを算出することが可能であるので、共通鍵Ｋ_ab，Ｋ_acから共通鍵Ｋ_bcを求めることができるとすれば、エンティティＡは他エンティティ間の共通鍵を偽造可能である。しかし、このような攻撃法は本発明には適用困難である。
【００９２】
以下、本発明の他の実施の形態である、各エンティティのＩＤ情報をベクトルに拡張した鍵共有方式について説明する。
【００９３】
エンティティＡのＩＤ情報であるベクトルＰ_a を下記（29）のように表す。
ベクトルＰ_a ＝（Ｐ_a1，Ｐ_a2，・・・，Ｐ_an） …（29）
また、センタ１の秘密情報としてｎ×ｎの対称行列Ｒを下記（30）のように設定する。
【００９４】
【数１２】

【００９５】
センタ１は、このベクトルＰ_a 及び対称行列Ｒを用い、下記（31）に従って、エンティティＡの秘密鍵（ベクトルＳ_a ）を求め、求めた秘密鍵を秘密裏にエンティティＡへ送付する。
【００９６】
【数１３】

【００９７】
エンティティＡは、エンティティＢとの共通鍵Ｋ_abを下記（32）に従って生成する。但し、点と点との積はベイユペアリングの値とする。
【００９８】
【数１４】

【００９９】
また、エンティティＢは、エンティティＡとの共通鍵Ｋ_baを同様に生成する。そして、前述した実施の形態の第１例のように各エンティティＡ，Ｂ間のＩＤ情報の大小関係を考慮するようにした場合には、Ｋ_ab＝Ｋ_baとなり、同一の共通鍵を共有し合うことができる。
【０１００】
次に、この実施の形態における安全性について考察する。
〔センタの秘密情報に関する安全性〕
エンティティＣの公開鍵ベクトルＰ_c と秘密鍵ベクトルＳ_c とからセンタの秘密行列Ｒを得ることは、拡張楕円離散対数問題を解くことと等価であって、困難である。
エンティティＡの公開鍵ベクトルＰ_a とエンティティＢの公開鍵ベクトルＰ_b とから＜Ｐ_ai，Ｐ_bj＞（１≦ｉ，ｊ≦ｎ）を計算し、これと下記（33）に示す共通鍵Ｋ_abとから行列Ｒの各成分ｒ_ij（１≦ｉ，ｊ≦ｎ）を得ることは、拡張楕円離散対数問題が楕円離散対数問題とが等価であることと同様に、拡張離散対数問題と離散対数問題とで等価である。
【０１０１】
【数１５】

【０１０２】
以上のことから、センタ１の秘密情報（対称行列Ｒ）は露呈しない。
【０１０３】
〔エンティティの秘密鍵に関する安全性〕
ｎ人のエンティティが結託してエンティティＣの秘密鍵ベクトルＳ_c を偽造する攻撃について考察する。エンティティＣの公開鍵ベクトルＰ_c が下記（34）のように他のエンティティの公開鍵ベクトルの線形結合によって表すことが可能であると仮定すると、前記（31）にこの線形結合を代入すると、下記（35）の関係式が成立するので、エンティティＣの秘密鍵ベクトルＳ_c が露呈する。
【０１０４】
【数１６】

【０１０５】
しかし、前記（31）での成分を得るには拡張楕円離散対数問題を解く必要があり、このような攻撃は困難であるといえる。よって、安全性は拡張楕円離散対数問題を解くことの難しさに基づいている。
【０１０６】
〔エンティティ間の共通鍵に関する安全性〕
ｎ人のエンティティの結託により、エンティティＡ，エンティティＣ間の共通鍵を偽造する攻撃について考察する。エンティティＣの公開鍵ベクトルＰ_c が上記（34）のように他のエンティティの公開鍵ベクトルの線形結合によって表すことが可能であると仮定すると、下記（36），（37）のように、両エンティティＡ，Ｃ間の共通鍵Ｋ_ac，Ｋ_caが露呈する。エンティティＣの秘密鍵ベクトルＳ_c が線形結合により書き表せる場合も同様に考えられる。
【０１０７】
【数１７】

【０１０８】
しかしながら、上記（34）での係数ｕ_i を求めるには拡張楕円離散対数問題を解くことになり、このような攻撃は困難である。
【０１０９】
また、この実施の形態にあっても、上述した実施の形態と同様に、あるエンティティが自身の共通鍵から他のエンティティ同士間の共通鍵を生成することは困難である。
【０１１０】
なお、エンティティのＩＤ情報をｎ×ｎの対称行列に拡張することも可能である。この場合、共通鍵行列ｋ_ab＝（ｓ_ij）と共通鍵行列ｋ_ba＝（ｔ_ji）とは、下記（38）の関係を満たす。
ｓ_ij＝ｔ_ji ^-1 …（38）
【０１１１】
なお、上述した例ではベイユペアリングを用いる場合について説明したが、楕円曲線上のペアリングとしてテイト（Ｔａｔｅ）ペアリングを利用する場合にあっても、同様に両エンティティ間で鍵共有を行える。
【０１１２】
また、ベイユペアリング及びテイトペアリングの何れの場合にあっても、鍵共有を行う際のペアリング＜Ｐ，Ｑ＞において、点Ｐの座標と点Ｑの座標とが異なる体に属するようにペアリングの計算を拡張することができる。また、点Ｐの座標を小さな体で定義するとペアリングの計算を高速に行うことができる。
【０１１３】
楕円曲線の定義体を変更する利点は、確実に共通鍵が１とならないようにできるという点、及び、高速に計算できるという点である。楕円曲線の定義体を変更する場合、つまり、２通りの定義体を用いる場合には、２通りの公開鍵への対応のさせ方が必要である。従来のＩＤ−ＮＩＫＳでは、エンティティがＩＤ情報によって決まる１通りの公開鍵と自身の秘密鍵とを用いて鍵共有を行っているが、この方式では、ＩＤ情報に基づいて、定義体が異なる同一の楕円曲線上の点へ、２通りの異なるやり方によって公開鍵を写像し、ＩＤ情報または公開鍵に基づき、一方のエンティティが何れか一方の定義体による公開鍵を使用し、他方のエンティティが他方の定義体による公開鍵を使用して、鍵共有を行う。
【０１１４】
全エンティティを２つのグループＧ₁ ，Ｇ₂ に分ける。グループＧ₁ に属するエンティティはＰを含む群の元を、グループＧ₂ に属するエンティティはＱを含む群の元を夫々ＩＤ情報として用いることにより、グループＧ₁ のエンティティとグループＧ₂ のエンティティとにおいて鍵を共有することが可能である。
各エンティティが２種類のＩＤ情報を有しており、エンティティＡとエンティティＢとの各ＩＤ情報に何らかの大小関係を示すアルゴリズムを設定し、何れのエンティティがどちらのＩＤ情報を使用するかを決定することにより、鍵の共有化を行える。
各エンティティが２種類のＩＤ情報を有しており、両エンティティ間で２種類の値を計算し、その２つの計算値を足し合わせる等、同じ値になる演算を用いて共通鍵を生成する。
Ｐを含む群の元とＱを含む群の元との間の変換を適切に定め、その変換をシステム固有の公開情報として用いることにより、鍵の共有化が可能である。
【０１１５】
なお、上述した例では代数曲線として楕円曲線を用いる場合について説明したが、超楕円曲線を用いる場合にあっても、超楕円離散対数問題及びペアリングを定義できるので、簡単に拡張することができる。
【０１１６】
図３は、本発明の記録媒体の実施の形態の構成を示す図である。ここに例示するプログラムは、各エンティティのＩＤ情報とセンタ固有の秘密情報とに基づき前述した手法にて各エンティティ固有の秘密鍵を生成する処理（エンティティのＩＤ情報に基づき楕円曲線上の点に写像して写像値を得るステップと、その写像値とセンタ固有の秘密情報とを用いて秘密鍵を生成するステップ）を含むか、または、エンティティ自身の秘密鍵と通信相手のエンティティの公開鍵とに基づき前述した手法にて共通鍵を生成する処理（通信相手のエンティティのＩＤ情報に基づき楕円曲線上の点に写像して写像値を得るステップと、その写像値とエンティティ自身の秘密鍵とを用いて共通鍵を生成するステップ）を含んでおり、以下に説明する記録媒体に記録されている。なお、コンピュータ４０は、センタ１側か、または、各エンティティ側に設けられている。
【０１１７】
図３において、コンピュータ４０とオンライン接続する記録媒体４１は、コンピュータ４０の設置場所から隔たって設置される例えばＷＷＷ(World Wide Web)のサーバコンピュータを用いてなり、記録媒体４１には前述の如きプログラム４１ａが記録されている。記録媒体４１から読み出されたプログラム４１ａがコンピュータ４０を制御することにより、各エンティティ固有の秘密鍵を生成するか、または、両エンティティ間の共通鍵を生成する。
【０１１８】
コンピュータ４０の内部に設けられた記録媒体４２は、内蔵設置される例えばハードディスクドライブまたはＲＯＭ等を用いてなり、記録媒体４２には前述の如きプログラム４２ａが記録されている。記録媒体４２から読み出されたプログラム４２ａがコンピュータ４０を制御することにより、各エンティティ固有の秘密鍵を生成するか、または、両エンティティ間の共通鍵を生成する。
【０１１９】
コンピュータ４０に設けられたディスクドライブ４０ａに装填して使用される記録媒体４３は、運搬可能な例えば光磁気ディスク，ＣＤ−ＲＯＭまたはフレキシブルディスク等を用いてなり、記録媒体４３には前述の如きプログラム４３ａが記録されている。記録媒体４３から読み出されたプログラム４３ａがコンピュータ４０を制御することにより、各エンティティ固有の秘密鍵を生成するか、または、両エンティティ間の共通鍵を生成する。
【０１２０】
【発明の効果】
以上詳述したように、本発明では、各エンティティのＩＤ情報から生成する公開鍵を楕円曲線上で写像するようにしたので、予備通信を行うことなく両エンティティ間で容易に共通鍵を共有し合うことができる。また、本発明ではその安全性が代数曲線上の離散対数問題に置かれており、結託攻撃などの攻撃に対して強く、ＩＤ−ＮＩＫＳの発展に本発明は寄与できる。
【図面の簡単な説明】
【図１】本発明の暗号通信システムの構成を示す模式図である。
【図２】２人のエンティティ間における情報の通信状態を示す模式図である。
【図３】記録媒体の実施の形態の構成を示す図である。
【図４】ＩＤ−ＮＩＫＳのシステムの原理構成図である。
【符号の説明】
１ センタ
１１，２１ 公開鍵生成器
１２，２２ 共通鍵生成器
１３ 暗号化器
２３ 復号器
３０ 通信路
４０ コンピュータ
４１，４２，４３ 記録媒体
Ａ，Ｂ，Ｚ エンティティ[0001]
BACKGROUND OF THE INVENTION
  The present invention provides a key sharing system in which a common key is shared between both entities without preliminary communication, a secret key generation device that generates a secret key unique to each entity at the center, and is necessary for encryption processing and decryption processing at each entity Key generation to generate a common keysystemThe present invention relates to an encryption communication method and an encryption communication system for performing communication using ciphertext so that the contents of information cannot be understood by anyone other than the parties, and a recording medium on which a program for realizing these systems or devices is recorded.
[0002]
[Prior art]
In a modern society called an advanced information society, important business documents and image information are transmitted, communicated and processed in the form of electronic information based on a computer network. Such electronic information has the property that it can be easily copied, and it is difficult to distinguish between a copy and the original, and the problem of information maintenance is regarded as important. In particular, the realization of a computer network that satisfies the elements of "computer resource sharing", "multi-access", and "broadening" is essential for establishing an advanced information society. Contains conflicting elements. As an effective technique for resolving such contradiction, attention has been paid to cryptographic techniques that have been used mainly in the military and diplomatic aspects of human history.
[0003]
Cryptography is the exchange of information so that the meaning of the information cannot be understood by anyone other than the parties. In cryptography, encryption is the conversion of an original sentence (plain text) that anyone can understand into a sentence (cipher text) whose meaning is unknown to a third party, and decryption is to convert the cipher text back to plain text. The entire process of encryption and decryption is collectively called an encryption system. In the encryption process and the decryption process, secret information called an encryption key and a decryption key is used, respectively. Since a secret decryption key is required at the time of decryption, only a person who knows the decryption key can decrypt the ciphertext, and the confidentiality of information can be maintained by the encryption.
[0004]
The encryption key and the decryption key may be the same or different. An encryption system in which both keys are equal is called a common key encryption system, and DES (Data Encryption Standards) adopted by the US Bureau of Commerce Standards is a typical example. In addition, as an example of an encryption system in which both keys are different, an encryption system called a public key encryption system has been proposed. In this public key cryptosystem, each user (entity) using the cryptosystem creates a pair of encryption key and decryption key, publishes the encryption key in the public key list, and keeps only the decryption key secret It is a cryptographic system that does. In the public key cryptosystem, the pair of encryption key and decryption key are different, and the decryption key cannot be calculated from the encryption key by using a one-way function.
[0005]
The public key cryptosystem is an epoch-making cryptosystem that publishes an encryption key, and conforms to the above three elements necessary for establishing an advanced information society. In order to make use of the RSA cryptosystem, the research is actively conducted, and the RSA cryptosystem is proposed as a typical public key cryptosystem. This RSA cryptosystem is realized using the difficulty of prime factorization as a one-way function. Various methods have also been proposed for public key cryptosystems that utilize the difficulty of solving discrete logarithm problems (discrete logarithm problem).
[0006]
Also, an encryption system using ID (Identity) information for identifying an individual such as the address, name, and e-mail address of each entity has been proposed. In this encryption system, a common encryption / decryption key is generated between the sender and the receiver based on the ID information. In addition, the encryption technique based on this ID information includes (1) a method that requires preliminary communication between the sender and receiver prior to ciphertext communication, and (2) a backup between the sender and receiver prior to ciphertext communication. There are methods that do not require communication. In particular, since the method (2) does not require preliminary communication, the convenience of the entity is high, and it is considered to be the center of the future encryption system.
[0007]
The encryption system based on the method (2) is called ID-NIKS (ID-based non-interactive key sharing scheme), and the encryption / decryption key is used without performing preliminary communication using the ID information of the communication partner. The method of sharing is adopted. ID-NIKS is a scheme that does not require the exchange of a public key and a secret key between senders and receivers, and does not require a key list or a service by a third party, and allows secure communication between arbitrary entities.
[0008]
FIG. 4 is a diagram showing the principle of the ID-NIKS system. Assuming the existence of a reliable center, a common key generation system is configured around this center. In FIG. 4, ID information such as the name, address, telephone number, and mail address of entity X, which is specific information of entity X, is represented by {ID_X}. The center makes center public information {PC for any entity X_i}, Center secret information {SC_i} And entity X ID information {ID_X}, The secret information S is as follows:_XiAnd secretly distribute to entity X.
S_Xi= F_i({SC_i}, {PC_i}, {ID_X})
[0009]
Entity X is a common key K for encryption and decryption with any other entity Y_XY, Secret information of entity X itself {S_Xi}, Center disclosure information {PC_i} And ID information {ID of the entity Y of the other party_Y} To generate as follows.
K_XY= F ({S_Xi}, {PC_i}, {ID_Y})
Similarly, entity Y also has a common key K to entity X._YXIs generated. If always K_XY= K_YXIf this relationship is established, this key K_XY, K_YXCan be used as an encryption key and a decryption key between entities X and Y.
[0010]
In the public key cryptosystem described above, for example, in the case of the RSA cryptosystem, the length of the public key is a dozen times the current telephone number, which is extremely complicated. On the other hand, in ID-NIKS, if each ID information is registered in the form of a name list, a common key can be generated with any entity by referring to the name list. Therefore, if the ID-NIKS system as shown in FIG. 4 is implemented safely, a convenient cryptosystem can be constructed on a computer network to which many entities join. For these reasons, ID-NIKS is expected to become the center of future cryptographic systems.
[0011]
[Problems to be solved by the invention]
In ID-NIKS that shares a common key that is an encryption key and a decryption key without performing preliminary communication using the ID information of the communication partner, especially against a collusion attack in which multiple entities collide It is desirable to be sufficiently safe. Whether or not a cryptographically secure ID-NIKS can be constructed is an important issue for the highly information-oriented society, and the search for more ideal cryptosystems is being pursued.
[0012]
  The present invention has been made in view of such circumstances, and by mapping to a point on an algebraic curve such as an elliptic curve used in elliptic cryptography based on identification information (ID information) of each entity, A key sharing system that can easily share a common key between both entities without performing preliminary communication, a secret key generation device that can construct a secure ID-NIKS based on this key sharing system, and a common key generationsystemAn object of the present invention is to provide an encryption communication method and an encryption communication system, and a recording medium on which a program for realizing these systems or apparatuses is recorded.
[0013]
[Means for Solving the Problems]
  The key sharing system according to claim 1 is a specific information ID for specifying each of two entities communicably connected to the center._a , ID_b Is disclosed, and is defined on the elliptic curve and a function f () for converting specific information of each entity into a point on the elliptic curveBeA pairing algorithm <,> is disclosed, and a key sharing system that performs key sharing between the entities based on the disclosed specific information, function, and algorithm without preliminary communication. Specific information ID_a , ID_b And the function f () are received, the received specific information is substituted into the function, and the public key P_a = F (ID_a ), P_b = F (ID_b ) And the public key P of each entity generated by the public key generator_a , P_b AcceptGenerate a random number r,Accepted public key P_a , P_b AndLifeThe secret key S as the product of the generated random number r_a = R · f (ID_a ), S_b = R · f (ID_b ) For generating the secret key S_a , S_b Are distributed to corresponding entities, and each of the entities includes a specific information ID of a communication partner entity._a (Or ID_b ) And the function f (), the received specific information is substituted into the function, and the public key P of the communication partner entity_a (Or P_b ) And a public key P generated by the public key generator_a (Or P_b ) And its own private key S distributed from the center_b (Or S_a ) And the algorithm <,>, and substitutes the received public key and secret key into the algorithm to share the common key K_ba= <P_a , S_b > (Or K_ab= <S_a , P_b A common key generator for generating>).
[0017]
  Claim2The key sharing system according to claim1And saidellipseA curve cannot solve the discrete logarithm problem defined on it in polynomial timeellipseIt is a curve.
[0019]
  A key sharing system according to a third aspect is the key sharing system according to the first or second aspect.TamatamaThe public key generator of an entity receives a plurality of specific information of the same entity, and generates a plurality of public keys by substituting each of the received plurality of specific information into the function.
[0020]
  The secret key generation device according to claim 4 is a specific information ID for specifying an entity._a A secret key generation device for generating a secret key of the entity based on a function f () that is disclosed for converting a point into an elliptic curve point, and the entity specific information ID_a And the function f () are received, the received specific information is substituted into the function, and the public key P_a = F (ID_a ) And a public key P generated by the means_a AcceptGenerate a random number r,Accepted public keyLifeThe secret key S as the product of the generated random number r_a = R · f (ID_a And means for generating.
[0021]
  The secret key generation device according to claim 5 is a specific information ID for specifying an entity._a Is a secret key generation device that generates a secret key of the entity based on a function f () that is disclosed for converting a point into a point on an elliptic curve, and the specific information ID of the entity_a , Accepts the function f () and the hash function h (), and receives the public key P_a = F (h (ID_a )) And a public key P generated by the means_a AcceptGenerate a random number r,Accepted public key P_a AndLifeThe secret key S as the product of the generated random number r_a = R · f (h (ID_a )) Generating means.
[0022]
  The common key generation system according to claim 6 is a specific information ID for specifying the first entity._a Based onGenerated at the centerSecret key S_a And a specific information ID for identifying the second entity of the communication partner_b Public key P based on_b And a common key generation system that generates a common key from a function f () for converting specific information for specifying an entity into a point on an elliptic curve,The center isSpecific information ID of the first entity_a And the function f (), the received specific information is substituted into the function, and the public key P of the first entity_a = F (ID_a ) Means to generateWhen,Public key P generated by the means_a AcceptGenerate a random number r,Accepted public key P_a AndLifeThe secret key S of the first entity as the product of the generated random number r_a = R · f (ID_a ) Means to generateWhenWithAnd,The first entity is:Specific information ID of the second entity_b And the function f (), the received specific information is substituted into the function, and the public key P of the second entity_b = F (ID_b And a public key P of the second entity generated by the public key generator._b The abovecenterThe private key S of the first entity generated in step_a And defined on the elliptic curveBeAccepts the public pairing algorithm <,> and accepts the public key P_b , Secret key S_a Is substituted into the algorithm <,> and the common key K_ab= <S_a , P_b And a common key generator for generating>.
[0025]
  In the cryptographic communication method according to claim 7, the secret key of each entity is sent from the center to each of a plurality of entities communicably connected to the center, and one entity has its own secret key sent from the center. The plaintext is encrypted into ciphertext using the common key obtained from the public key of the other entity and transmitted to the other entity, and the ciphertext transmitted by the other entity is sent from the center itself In the encryption communication method for communicating information between entities by decrypting in plaintext using the same common key as the common key obtained from the private key of the one entity and the public key of the one entity, the center , Specific information ID of each entity_a , ID_b And a function f () for converting the specific information into a point on the elliptic curve, and substituting the received specific information into the function to public key P of each entity_a = F (ID_a ), P_b = F (ID_b )Generate a random number r,Public key P of each generated entity_a , P_b AndLifeThe secret key S of each entity as the product of the generated random number r_a = R · f (ID_a ), S_b = R · f (ID_b ) And distribute the generated secret key to each corresponding entity, and each of the entities is a specific information ID of a communication partner entity._a(Or ID_b ) And the function f (), the received specific information is substituted into the function, and the public key P of the communication partner entity_a (Or P_b ) And the generated public key P_a (Or P_b ), Its own private key S sent from the center_b (Or S_a ), And is defined on the elliptic curve as publishedBeAccepts a pairing algorithm <,> and substitutes the received public key and secret key into the algorithm to share the common key K_ba= <P_a , S_b > (Or K_ab= <S_a , P_b >).
[0028]
  An encryption communication system according to claim 8 includes a plurality of entities connected to be communicable with a center, encrypts plain text as information to be transmitted into cipher text, and transmits the cipher text as plain text. And a decryption process to be performed between the plurality of entities, and a secret key for each entity is generated based on the specific information for identifying each entity and sent to each entity. A plurality of entities that generate a common key used for the encryption process and the decryption process using a private key based on the identification information of the communication target entity and a public key based on the identification information of the communication target entity. A function to convert to a point on an elliptic curve and defined on the elliptic curveBeA cryptographic communication system in which an algorithm for public pairing is publicly disclosed, wherein the center includes a specific information ID of each entity._a , ID_b And the function f () are received, the received specific information is substituted into the function, and the public key P_a = F (ID_a ), P_b = F (ID_b ) And the public key P of each entity generated by the public key generator_a , P_b AcceptGenerate a random number r,Accepted public key P_a , P_b AndLifeThe secret key S as the product of the generated random number r_a = R · f (ID_a ), S_b = R · f (ID_b ) For generating the secret key S_a , S_b Are distributed to the corresponding entities, and each entity has a specific information ID of the communication partner entity._a (Or ID_b ) And the function f (), the received specific information is substituted into the function, and the public key P of the communication partner entity_a (Or P_b ) And a public key P generated by the public key generator_a (Or P_b ), Its own private key S sent from the center_b (Or S_a ) And the algorithm <,>, and substitutes the received public key and secret key into the algorithm to share the common key K_ba= <P_a , S_b > (Or K_ab= <S_a , P_b A common key generator for generating>).
[0029]
  Claim9The recording medium according to claim 1 is a computer.4OrTo 5A computer program for functioning as the described secret key generation apparatus is recorded.
[0031]
In the present invention, based on the identification information (ID information) of each entity, it maps to a point on an algebraic curve such as an elliptic curve or a hyperelliptic curve used in elliptic cryptography, and the mapping value is the public key of each entity. And The algorithm of this algebraic curve and mapping is disclosed. The center maps to a point on the algebraic curve based on the identification information (ID information) of each entity, generates a secret key unique to each entity using the mapping value and the center's own secret information, and supports this Secretly sent to the entity. Each entity uses a secret key unique to itself sent from the center and a mapping value mapped to a point on the algebraic curve based on identification information (ID information) of a communication partner, and is used for encryption processing and decryption processing. Generate a key. At this time, using the pairing defined on the elliptic curve (Weil pairing, Tate pairing, etc.), the same common key is shared between both entities without performing preliminary communication. To do. The mapping to the points on the algebraic curve in the present invention can be performed by any entity or center.
[0032]
In the present invention, the basis of safety is based on a discrete logarithm problem on an algebraic curve (for example, a discrete logarithm problem on an elliptic curve, hereinafter referred to simply as an elliptic discrete logarithm problem). Breaking the cryptographic system of the present invention in a collusion attack by a plurality of entities is equivalent to or more difficult than solving an elliptic discrete logarithm problem, for example, and its security is extremely high.
[0033]
DETAILED DESCRIPTION OF THE INVENTION
The embodiment of the present invention will be specifically described.
FIG. 1 is a schematic diagram showing a configuration of a cryptographic communication system according to the present invention. A center 1 that can trust the concealment of information is set, and the center 1 can correspond to, for example, a public organization of society. The center 1 and a plurality of entities A, B,..., Z as users who use this cryptographic communication system are connected by secret communication paths 2a, 2b,. Secret key information (secret key S) from the center 1 via 2a, 2b,._a, S_b, ..., S_z) Is transmitted to each entity A, B,..., Z. Further, communication paths 3ab, 3az, 3bz,... Are provided between the two entities, and ciphertexts obtained by encrypting communication information via the communication paths 3ab, 3az, 3bz,. Are transmitted between each other.
[0034]
Hereinafter, the basic method in the present invention when an elliptic curve is used as the algebraic curve will be described.
First, the basic properties of elliptic curve Baye pairing used in the present invention will be described. Baye pairing is a group E / F formed by points on an elliptic curve._qTo F on a finite field_d(However, d = q^k) To the multiplicative group. A bilinearity and an exchange rule are established in Bayeux pairing as shown below. In addition, <,> represents a Bayeux pairing, and₁, P₂, Q, Q₁, Q₂Indicates a point on the elliptic curve.
[0035]
(Bilinearity)
<P₁+ P₂, Q> = <P₁, Q> <P₂, Q>
<P, Q₁+ Q₂> = <P, Q₁> <P, Q₂>
(Exchange rules)
<P, Q> = <Q, P>^-1
Since it has bilinearity, the following equation holds when m is an integer.
<MP, Q> = <P, Q>^m
<P, mQ> = <P, Q>^m
[0036]
A key sharing method based on Bayeux pairing will be described below.
(Secret key generation at Center 1)
ID of specific information (ID information) such as name, address, telephone number, mail address of any entity A_aAnd The center 1 uses a Baye pairing algorithm <,> and ID information ID of an arbitrary entity A_aTo the point P on the elliptic curve_a∈ E / F_qThe function f () for converting to (mapping) and obtaining the public key is disclosed. Further, the center 1 generates a secret random number r, and the random number r and the public key P of the entity A_aAnd the private key S of entity A as shown in (1) below_aAnd asked for the private key S_aIs secretly distributed to entity A.
S_a= RP_a      ... (1)
[0037]
The above secret information and public information are summarized as follows.
Public information of center 1: <,>, f ()
Secret information of center 1: r (random integer)
Public key of entity A: P_a(= F (ID_a))
Entity A private key: S_a(= R · f (ID_a))
[0038]
(Common key generation in entities A and B)
Each entity generates a common key from its own private key distributed from the center 1 and the public key of the entity that is the communication partner by using Bayer pairing on an elliptic curve.
(First example)
ID information ID of entity A_aAnd ID information of entity B_bAn algorithm that can compare the size of the pair is set, and when pairing is calculated, the pairing order is appropriately set using the size information. This algorithm can be lexicographic or large or small when expressed in binary. As a method for setting the order of pairing, ID information ID_a, ID_bPublic key P after conversion (mapping)_a, P_bIt is also possible to use large and small information.
[0039]
For example, ID_a> ID_b, Entity A has its own private key S_aAnd ID information ID of entity B_bPublic key P that maps to an elliptic curve_bAnd the common key K according to (2) below_abIs generated.

[0040]
On the other hand, ID_a> ID_bThe entity B is the ID information ID of the entity A_aPublic key P that maps to an elliptic curve_aAnd their private key S_bAnd the common key K according to (3) below_baIs generated.

Therefore, the common key K generated by entity A_abAnd the common key K generated by entity B_baAnd a common key can be shared between both entities A and B.
[0041]
In the following, two examples that enable key sharing without setting the magnitude relationship of ID information as described above will be described.
[0042]
(Second example)
A symmetric function g (x, y) with respect to x and y (except for g (x, y) = xy) is set. In the following example, g (x, y) = x + y. The entity A follows the common key K according to g (x, y) = x + y as shown in (4) below._ab= K_ab+ K_baIs generated.

[0043]
On the other hand, the entity B follows the common key K as shown in (5) below according to g (x, y) = x + y._ba= K_ba+ K_abIs generated.

Therefore, the common key K generated by entity A_abAnd the common key K generated by entity B_baAnd a common key can be shared between both entities A and B. Note that key sharing is similarly possible using other types of symmetric functions g (x, y).
[0044]
(Third example)
Entity A is k shown in the second example._abAnd the common key K as shown in (6) below._ab= K_ab+ K_ab ^-1Is generated.

[0045]
Entity B is k shown in the second example._baAnd the common key K as shown in (7) below._ba= K_ba+ K_ba ^-1Is generated.

Therefore, the common key K generated by entity A_abAnd the common key K generated by entity B_baAnd a common key can be shared between both entities A and B.
[0046]
(Fourth example)
Entity A has its own private key S_aAnd entity B's public key P_bAnd the intermediate key I as shown in (8) below._abIs generated.

[0047]
Entity B has its own private key S_bAnd entity A's public key P_aAnd the intermediate key I as shown in (9) below._baIs generated.

[0048]
Here, according to the above-mentioned (exchange rule) in Bayeux pairing, I_ab× I_baIt can be seen that the relationship of = 1 holds. It is also possible to share a key between both entities A and B using such a reciprocal relationship.
[0049]
As described above, it is possible to easily generate an equal common key between the entities using Baye pairing.
[0050]
In the above example, the ID information ID of entity A_aMapping point P directly from_aThe ID information ID is calculated using a one-way function._aAnd the mapping point P is converted from the converted value._aMay be requested. At this time, when the hash function h () is used as an example of the one-way function, the public key P_a= F (h (ID_a)), Private key S_a= R · f (h (ID_a)).
[0051]
In order to make it difficult for the entity to obtain the secret information r of the center 1, the following two conditions are necessary.
(Condition 1) q is 2¹⁶⁰Set it above.
(Condition 2) # E / F_q| Q^k-1 and q^k> 2¹⁰²⁴There must be an integer k that satisfies
[0052]
(Condition 1) is necessary to make it difficult to obtain an elliptic discrete logarithm problem. (Condition 2) is a finite field F_d(However, d = q^k) Is necessary to make it difficult to obtain the discrete logarithm problem.
[0053]
Next, information communication between entities in an encryption system using the above-described key sharing method will be described. FIG. 2 is a schematic diagram showing a communication state of information between two entities A and B. In the example of FIG. 2, entity A encrypts plaintext (message) M into ciphertext C and transmits it to entity B, and entity B decrypts ciphertext C into original plaintext (message) M. Show.
[0054]
The center 1 uses the function f () to identify the ID information IDs of the entities A and B._a, ID_bThe public key P which is the mapping position that maps to an elliptic curve_a, P_bAnd a public key generator 1a for obtaining the public key P_a, P_bAnd the secret key r of each entity A and B using the center-specific secret information r_a, S_bAnd a secret key generator 1b for obtaining Then, the secret key S generated in accordance with the above (1) is sent from the center 1 to the entities A and B._a, S_bWill be sent.
[0055]
On the entity A side, the ID information ID of entity B_b, And the public key P that is the mapping position that maps it to an elliptic curve_bAnd a public key generator 11 for obtaining a secret key S sent from the center 1_aAnd public key P from public key generator 11_bThe common key K with entity B that entity A seeks based on_abA common key generator 12 for generating a common key K_abAnd an encryptor 13 that encrypts a plaintext (message) M into a ciphertext C and outputs it to the communication path 30.
[0056]
Also, on the entity B side, the ID information ID of the entity A_a, And the public key P that is the mapping position that maps it to an elliptic curve_aAnd a secret key S sent from the center 1_bAnd public P from the public key generator 21_aThe common key K with entity A that entity B seeks based on_baAnd the ciphertext C input from the communication path 30 is the common key K_baAnd a decryptor 23 that decrypts and outputs the plaintext (message) M.
[0057]
Next, the operation will be described. When transmitting information from entity A to entity B, first, the ID information ID of entity B_bIs input to the public key generator 11 and the public key P_bAnd the obtained public key P_bIs sent to the common key generator 12. Also, the secret key S from the center 1_aIs input to the common key generator 12. And the common key K according to the above (2), (4) or (6)_abIs sent to the encryptor 13. In the encryptor 13, this common key K_abIs used to encrypt the plaintext (message) M into the ciphertext C, and the ciphertext C is transmitted via the communication path 30.
[0058]
The ciphertext C transmitted through the communication path 30 is input to the decryptor 23 of the entity B. ID information ID of entity A_aIs input to the public key generator 21 and the public key P_aAnd the obtained public key P_aIs sent to the common key generator 22. Also, the secret key S from the center 1_bIs input to the common key generator 22. And the common key K according to the above (3), (5) or (7)_baIs obtained and sent to the decoder 23. In the decryptor 23, this common key K_baIs used to decrypt the ciphertext C into plaintext (message) M.
[0059]
Next, the safety in the present invention will be described. The security of the present invention is based on an elliptic discrete logarithm problem and an extended elliptic discrete logarithm problem which is equivalent to this as will be described later.
[0060]
[Equivalence between elliptic discrete logarithm problem and extended elliptic discrete logarithm problem]
The normal elliptic discrete logarithm problem is a problem of obtaining r from P and Q when an arbitrary point P on the elliptic curve E and its r-fold point Q = rP are given. Here, as shown in (10) below, an arbitrary point P on the elliptic curve_i(1≤i≤n-1) and its point P_iA set of r, given a Q based on_iThe problem of obtaining (1 ≦ i ≦ n−1) is defined as an extended elliptic discrete logarithm problem. We consider the equivalence between the elliptic discrete logarithm problem and the extended elliptic discrete logarithm problem. For simplicity of discussion, the elliptic curve is assumed to have a prime order p.
[0061]
[Expression 1]

[0062]
(Reduction from elliptic discrete logarithm problem to extended elliptic discrete logarithm problem)
Assume that the elliptic discrete logarithm problem can be solved with reference to the base point P. P_iFor (1 ≦ i ≦ n−1) and Q, the coefficients can be obtained as shown in (11) below with reference to the base point P on the elliptic curve.
[0063]
[Expression 2]

[0064]
Coefficient r_i', R' is F_pBy solving the following indefinite equation (12)_i(1 ≦ i ≦ n−1) can be obtained. Therefore, the extended elliptic discrete logarithm problem can be solved.
[0065]
[Equation 3]

[0066]
(Reduction from the extended elliptic discrete logarithm problem to the elliptic discrete logarithm problem)
Suppose that any extended elliptic discrete logarithm problem can be solved. Here, the point P on the elliptic curve_iFor (1 ≦ i ≦ n), the extended elliptic discrete logarithm problem shown in the following (13) is solved and expressed using a matrix as shown in the following (14).
[0067]
[Expression 4]

[0068]
By extracting only the coefficients for the matrix of (14) above, the following relational expression (15) is obtained, which can be modified as shown in (16) below.
[0069]
[Equation 5]

[0070]
As can be seen from (16) above, the point P_i(1≤i≤n-1) is P_nIt can be expressed by a constant multiple of. That is, by solving the extended elliptic discrete logarithm problem, P_i= R_i'P_nSatisfy r_i'Can be obtained.
From the above, the elliptic discrete logarithm problem and the extended elliptic discrete logarithm problem are equivalent.
[0071]
[Safety of confidential information at the center]
Public key P of entity C_cAnd secret key S_cIt is equivalent to solving the elliptic discrete logarithm problem and is difficult to obtain the secret information r of the center from the above.
Public key P of entity A_aAnd entity B's public key P_bAnd <P_a, P_b> And the common key K_ab= <P_a, P_b>^rIt is equivalent to solving the discrete logarithm problem and it is difficult to obtain r from.
Therefore, no entity can obtain the secret information r of the center.
[0072]
[Security of entity private key]
Entity C's private key S collated by n entities_cConsider an attack that counterfeits. Public key P of entity C_cAssuming that can be expressed by a linear combination of public keys of other entities as in (17) below, substituting this linear combination in (1) above yields the following relational expression (18) Therefore, the private key S of entity C_cIs exposed.

[0073]
However, the coefficient u in (17) above_iIt is necessary to solve the extended elliptic discrete logarithm problem to obtain, and such an attack is difficult. Thus, safety is based on the difficulty of solving the extended elliptic discrete logarithm problem.
[0074]
Here, the security of this secret key will be described in further detail. The extended elliptic discrete logarithm problem is expressed as P / E / F_qAny point above (G₁, G₂) E / F_qIn the following (19), the coefficient u₁, U₂It is a problem to seek.
P = u₁G₁+ U₂G₂        … (19)
[0075]
G₁, G₂The order of # (G₁), # (G₂). However, # (G₁) | # (G₂). If the extended elliptic discrete logarithm problem can be solved, then P = u₁G₁+ U₂G₂Coefficient u₁, U₂And Q = v₁G₁+ V₂G₂Coefficient v₁, V₂The elliptic discrete logarithm problem Q = rP can be solved as shown in (20) below.
[0076]
[Formula 6]

[0077]
Consider the equivalence between the problem solving (17) above and the extended elliptic discrete logarithm problem. If the above (17) is solved, r in (21) below_{i, j}Can be requested.
[0078]
[Expression 7]

[0079]
In the following equation (22), the determinant of (n−2) × (n−2) on the left side is P_n-1= G₁, P_n= G₂# (G₂) Can be solved under the assumption that it is prime. The determinant is # (G₂) Is not prime, another solution r in (21) above_{i, j}Can be selected.
[0080]
[Equation 8]

[0081]
As a result, if the above (17) can be solved, P shown in the following (23)_iAnd (G₁, G₂) And the extended elliptic discrete logarithm problem.
[0082]
[Equation 9]

[0083]
On the contrary, if the extended elliptic discrete logarithm problem is solved, the above (17) can be solved. P_iAnd (G₁, G₂) And define an extended elliptic discrete logarithm problem with (24)_CAnd (G₁, G₂If the extended elliptic discrete logarithm problem is defined as shown in (25) below, the relationship shown in (26) below is established.
[0084]
[Expression 10]

[0085]
v_jAnd r_{i, j}Is given, u_iIt is clear that can be solved. Therefore, the problem of solving the above (17) and the extended elliptic discrete logarithm problem are equivalent. It is also clear that the extended elliptic discrete logarithm problem is equivalent to the elliptic discrete logarithm problem when the group of elliptic curves is periodic. Therefore, in this case, the problem of solving the above (17) is equivalent to the elliptic discrete logarithm problem.
[0086]
[Security for common key between entities]
Consider an attack that forges a common key between entity A and entity C by collusion of n entities. Public key P of entity C_cIs represented by a linear combination of the public keys of other entities as in (17) above, the common key K between both entities A and C as in (27) and (28) below._ac, K_caIs exposed. Entity C's private key S_cThe same applies to the case where can be expressed by linear combination.
[0087]
## EQU11 ##

[0088]
However, the coefficient u in (17) above_iTo solve the extended elliptic discrete logarithm problem, and such an attack is difficult.
[0089]
If entity A has its own public key P_a, Secret key S_aTo the common key K between other entities_bcIt is impossible to forge. Because private key S_b, S_cIs the secret information of the entities B and C, which cannot be obtained without the secret information r. Therefore, every entity has a common key K_bcCannot be counterfeited.
[0090]
Secret key S_b, S_cWithout collusion entity I private key S_iTo common key K_bcThe collusion attack seeking the secret key S_iSecret key S_b, S_cIt becomes the same problem as when seeking. Also, a common key K between the collusion entities I and J_ijTo common key K_bcThe collusion attack that seeks is a difficult problem because the secret information r of the center is not known. Common key K_bcThe problem of finding is reduced to a Diffe-Hellman type problem.
[0091]
By the way, entity A has a common key K_ab, K_acSince it is possible to calculate the common key K_ab, K_acTo common key K_bcEntity A can forge a common key between other entities. However, such an attack method is difficult to apply to the present invention.
[0092]
Hereinafter, a key sharing method in which ID information of each entity is extended to a vector, which is another embodiment of the present invention, will be described.
[0093]
Vector P which is ID information of entity A_aIs expressed as (29) below.
Vector P_a= (P_a1, P_a2, ..., P_an... (29)
Further, an nxn symmetric matrix R is set as secret information of the center 1 as shown in (30) below.
[0094]
[Expression 12]

[0095]
The center 1 has this vector P_aAnd the symmetric matrix R and the secret key of the entity A (vector S_a) And secretly send the obtained secret key to entity A.
[0096]
[Formula 13]

[0097]
Entity A has a common key K with entity B_abIs generated according to (32) below. However, the product of points is the value of Baye pairing.
[0098]
[Expression 14]

[0099]
In addition, entity B has a common key K with entity A._baIs generated in the same way. If the magnitude relationship of the ID information between the entities A and B is considered as in the first example of the embodiment described above, K_ab= K_baThus, the same common key can be shared.
[0100]
Next, the safety in this embodiment will be considered.
[Safety of confidential information at the center]
Public key vector P of entity C_cAnd secret key vector S_cIt is equivalent to solving the extended elliptic discrete logarithm problem and it is difficult to obtain the secret matrix R of the center from the above.
Public key vector P of entity A_aAnd the public key vector P of entity B_bAnd <P_ai, P_bj> (1 ≦ i, j ≦ n), and this and the common key K shown in (33) below_abFrom each component r of matrix R_ijObtaining (1 ≦ i, j ≦ n) is equivalent to the extended discrete logarithm problem and the discrete logarithm problem, just as the extended elliptic discrete logarithm problem is equivalent to the elliptic discrete logarithm problem.
[0101]
[Expression 15]

[0102]
From the above, the secret information (symmetric matrix R) of the center 1 is not exposed.
[0103]
[Security of entity private key]
n entities collide and the secret key vector S of entity C_cConsider an attack that counterfeits. Public key vector P of entity C_cAssuming that can be expressed by the linear combination of public key vectors of other entities as shown in (34) below, substituting this linear combination into (31) above yields the following relational expression (35) The secret key vector S of entity C_cIs exposed.
[0104]
[Expression 16]

[0105]
However, in order to obtain the component in (31), it is necessary to solve the extended elliptic discrete logarithm problem, and it can be said that such an attack is difficult. Thus, safety is based on the difficulty of solving the extended elliptic discrete logarithm problem.
[0106]
[Security for common key between entities]
Consider an attack that forges a common key between entity A and entity C by collusion of n entities. Public key vector P of entity C_cIs represented by a linear combination of the public key vectors of other entities as in (34) above, the common key between both entities A and C as in (36) and (37) below K_ac, K_caIs exposed. Entity C's private key vector S_cThe same applies to the case where can be expressed by linear combination.
[0107]
[Expression 17]

[0108]
However, the coefficient u in (34) above_iTo solve the extended elliptic discrete logarithm problem, and such an attack is difficult.
[0109]
Also in this embodiment, it is difficult for an entity to generate a common key between other entities from its own common key, as in the above-described embodiment.
[0110]
It is also possible to extend the entity ID information to an n × n symmetric matrix. In this case, the common key matrix k_ab= (S_ij) And common key matrix k_ba= (T_ji) Satisfies the following relationship (38).
s_ij= T_ji ^-1          ... (38)
[0111]
In the above-described example, the case where Baye pairing is used has been described. However, even when Tate pairing is used as pairing on an elliptic curve, key sharing can be performed between both entities.
[0112]
In either case of Bayeux pairing or Tate pairing, the coordinates of the point P and the coordinates of the point Q belong to different bodies in the pairing <P, Q> when performing key sharing. Pairing calculations can be extended. Further, if the coordinates of the point P are defined by a small body, the pairing calculation can be performed at high speed.
[0113]
The advantage of changing the definition of the elliptic curve is that the common key can be reliably prevented from being 1, and the calculation can be performed at high speed. When changing the definition of the elliptic curve, that is, when using two types of definition, it is necessary to correspond to two types of public keys. In the conventional ID-NIKS, the entity performs key sharing using one public key determined by ID information and its own private key. In this method, the same definition differs based on the ID information. Map the public key to a point on the elliptic curve in two different ways, based on the ID information or public key, one entity uses the public key of either definition, and the other entity Using the public key with the definition of
[0114]
All entities into two groups G₁, G₂Divide into Group G₁Entities belonging to the group G including group P₂Entities belonging to group G use group elements including Q as ID information, respectively.₁Entities and group G₂It is possible to share a key with other entities.
Each entity has two types of ID information, and an algorithm indicating some magnitude relationship is set for each ID information between entity A and entity B, and which ID information is used by which entity is determined. Thus, the key can be shared.
Each entity has two types of ID information, and two types of values are calculated between both entities, and a common key is generated using an operation that has the same value, such as adding the two calculated values.
By appropriately determining the transformation between the group element including P and the group element including Q, and using the conversion as public information unique to the system, the key can be shared.
[0115]
In the above-described example, the case where an elliptic curve is used as an algebraic curve has been described. However, even when a super elliptic curve is used, a super elliptic discrete logarithm problem and pairing can be defined and can be easily extended. .
[0116]
FIG. 3 is a diagram showing the configuration of the embodiment of the recording medium of the present invention. The program illustrated here is a process for generating a secret key unique to each entity based on the ID information of each entity and the secret information unique to the center (mapped to a point on an elliptic curve based on the ID information of the entity). Obtaining a mapping value and generating a secret key using the mapping value and center-specific secret information), or the entity's own secret key and the public key of the communicating entity Based on the above-described method for generating a common key by the above-described method (using a step of obtaining a mapping value by mapping to a point on an elliptic curve based on ID information of a communication partner entity, and using the mapping value and the private key of the entity itself) Generating a common key) and recorded on a recording medium described below. The computer 40 is provided on the center 1 side or on each entity side.
[0117]
In FIG. 3, a recording medium 41 connected online with the computer 40 is a WWW (World Wide Web) server computer installed at a distance from the installation location of the computer 40, and the recording medium 41 includes a program as described above. 41a is recorded. The program 41a read from the recording medium 41 controls the computer 40 to generate a secret key unique to each entity or generate a common key between both entities.
[0118]
The recording medium 42 provided inside the computer 40 is, for example, a hard disk drive or ROM that is installed in the built-in computer, and the recording medium 42 stores the program 42a as described above. The program 42a read from the recording medium 42 controls the computer 40 to generate a secret key unique to each entity, or generate a common key between both entities.
[0119]
A recording medium 43 used by being loaded into a disk drive 40a provided in the computer 40 is a portable medium such as a magneto-optical disk, a CD-ROM, or a flexible disk. 43a is recorded. The program 43a read from the recording medium 43 controls the computer 40 to generate a secret key unique to each entity or generate a common key between both entities.
[0120]
【The invention's effect】
As described in detail above, in the present invention, since the public key generated from the ID information of each entity is mapped on the elliptic curve, a common key can be easily shared between both entities without performing preliminary communication. Can fit. In the present invention, the security is placed on the discrete logarithm problem on the algebraic curve, which is strong against attacks such as collusion attacks, and the present invention can contribute to the development of ID-NIKS.
[Brief description of the drawings]
FIG. 1 is a schematic diagram showing a configuration of a cryptographic communication system according to the present invention.
FIG. 2 is a schematic diagram showing a communication state of information between two entities.
FIG. 3 is a diagram illustrating a configuration of an embodiment of a recording medium.
FIG. 4 is a principle configuration diagram of an ID-NIKS system.
[Explanation of symbols]
1 center
11, 21 Public key generator
12, 22 Common key generator
13 Encryptor
23 Decoder
30 communication channels
40 computers
41, 42, 43 Recording medium
A, B, Z entities

Claims (9)

Specific information ID _a and ID _b that specify two entities that are communicably connected to the center are disclosed, and the function f () for converting the specific information of each entity into a point on an elliptic curve and the above-mentioned algorithm base Iyupearingu defined on an elliptic curve <,> have been published, the specific information that is those published, there a key sharing system that performs key sharing without prior communication between the entities based on the functions and algorithms And
The center is
The specific information ID _a and ID _b and the function f () of each entity are received, and the received specific information is substituted into the function to generate public keys P _a = f (ID _a ) and P _b = f (ID _b ). public key generator and said public key generator generates entity respectively public key P _a of accepts P _b, generates a random number r, the received public key P _a, the P _b及beauty raw form random number r A secret key generator for generating a secret key S _a = r · f (ID _a ) and S _b = r · f (ID _b ) as products,
The generated secret keys S _a and S _b are distributed to the corresponding entities,
Each of the entities is
Receiving specific information ID _a communication partner entity (or ID _b) and the function f (), and generates the received specified information is substituted into the function by public communication partner entity key P _a (or P _b) public key generator and the public key P _a generated by the public key generator (or P _b), the private key itself is distributed from the center S _b (or S _a) and the algorithm <,> accept, accept And a common key generator for generating a common key K _ba = <P _a , S _b > (or K _ab = <S _a , P _b >) by substituting the public key and the secret key into the algorithm. Key sharing system.   The key sharing system according to claim 1, wherein the elliptic curve is an elliptic curve that cannot solve the discrete logarithm problem defined thereon in polynomial time.   The public key generator of the center or the entity receives a plurality of specific information of the same entity, and generates a plurality of public keys by substituting each of the received plurality of specific information into the function. 2. The key sharing system according to 2. A secret key generation device that generates a secret key of an entity based on a function f () that is disclosed for converting specific information ID _a that specifies an entity into a point on an elliptic curve,
Means for receiving the entity specific information ID _a and the function f (), substituting the received specific information into the function, and generating a public key P _a = f (ID _a );
It accepts the public key P _a in which the means to produce, generates a random number r, and means for generating a secret key _{S a = r · f (ID} a) as the product of the random number r that form public Kagi及beauty student accepted A secret key generation apparatus comprising: A secret key generation device that generates a secret key of an entity based on a function f () that is disclosed for converting specific information ID _a that specifies an entity into a point on an elliptic curve,
Means for receiving the entity specific information ID _a , the function f (), and the hash function h (), and generating a public key P _a = f (h (ID _a ));
Accepts the public key P _a in which the means to produce, generates a random number r, the public accepted key P _a及secret key as the product of beauty raw form random number r S _a = r · f a (h (ID _a)) A secret key generation device comprising: means for generating. And the private key S _a generated by the center and based on the specific information ID _a for identifying the first entity, a public key P _b based on the identification information ID _b for identifying the second entity of the communication partner to identify the entity A common key generation system that generates a common key from a function f () for converting specific information into a point on an elliptic curve,
The center is
Means for receiving the specific information ID _a of the first entity and the function f (), and substituting the received specific information into the function to generate the public key P _a = f (ID _a ) of the first entity ;
Receiving a public key P _a which said means is generated, and generates a random number r, the public has accepted key P _a及first entity as a product of beauty raw form random number r secret key _{S a = r · f (ID} a) and a means for generating,
The first entity is:
A public key generator that receives the specific information ID _b and the function f () of the second entity, substitutes the received specific information into the function, and generates a public key P _b = f (ID _b ) of the second entity; ,
The second entity public key P _b of generated by the public key generator, the first entity's private key S _a and defined as base Iyupearingu algorithm on the elliptic curve generated by the center <,> accept, accept A common key generator for generating a common key K _ab = <S _a , P _b > by substituting the public key P _b and the secret key S _a into the algorithm <,>. . A secret key of each entity is sent from the center to each of a plurality of entities communicably connected to the center, and one entity is obtained from its own secret key sent from the center and the public key of the other entity A plaintext is encrypted into a ciphertext using a common key and transmitted to the other entity, and the ciphertext transmitted by the other entity is sent to the private key sent from the center and the disclosure of the one entity. In a cryptographic communication method for communicating information between entities by decrypting in plaintext using the same common key as the common key obtained from the key,
The center is
Accepting entity specific information ID _a , ID _b and a function f () for converting the specific information into a point on an elliptic curve,
Substituting the received specific information into the function to generate public keys P _a = f (ID _a ) and P _b = f (ID _b ) for the entities,
Generate a random number r,
Produce a product entity respectively public key P _a of, P _b及beauty students form an entity as the product of the random number r each secret key of _{S a = r · f (ID} a), S b = r · f (ID b) And
Distribute the generated private key to each corresponding entity,
Each of the entities is
Receiving the identification information ID _a (or ID _b ) of the entity of the communication partner and the function f ();
Substituting the received specific information into the function to generate the public key P _a (or P _b ) of the communication partner entity,
Generated public key P _a (or P _b), the private key itself is sent from the center S _b (or S _a), and has been published, the algorithm of the base Iyupearingu defined on the elliptic curve <, >, And the received public key and secret key are substituted into the algorithm to generate a common key K _ba = <P _a , S _b > (or K _ab = <S _a , P _b >). Encryption communication method. A plurality of entities that are communicably connected to the center, and that perform encryption processing for encrypting plaintext, which is information to be transmitted, into ciphertext, and decryption processing for decrypting the transmitted ciphertext into plaintext. A center that generates each entity's private key based on the specific information that identifies each entity and sends it to each entity, and its own private key sent from the center and the entity to communicate with And a plurality of entities that generate a common key used for the encryption process and the decryption process using a public key based on the specific information of the entity, and for converting the specific information of each entity into a point on the elliptic curve a cryptographic communication system in which the algorithm of base Iyupearingu defined on functions and the elliptic curve has been published,
The center is
The specific information ID _a and ID _b and the function f () of each entity are received, and the received specific information is substituted into the function to generate public keys P _a = f (ID _a ) and P _b = f (ID _b ). public key generator and said public key generator generates entity respectively public key P _a of accepts P _b, generates a random number r, the received public key P _a, the P _b及beauty raw form random number r A secret key generator for generating a secret key S _a = r · f (ID _a ) and S _b = r · f (ID _b ) as products,
The generated secret keys S _a and S _b are distributed to the corresponding entities,
Each entity is
Receiving specific information ID _a communication partner entity (or ID _b) and the function f (), and generates the received specified information is substituted into the function by public communication partner entity key P _a (or P _b) public key generator and the public key P _a generated by the public key generator (or P _b), the private key itself is sent from the center S _b (or S _a) and the algorithm <,> accept, accept And a common key generator for generating a common key K _ba = <P _a , S _b > (or K _ab = <S _a , P _b >) by substituting the public key and the secret key into the algorithm. Cryptographic communication system.   6. A recording medium on which a computer program for causing a computer to function as the secret key generation apparatus according to claim 4 is recorded.

Images