JP5132724B2 - KEY GENERATION DEVICE, KEY GENERATION METHOD, AND KEY GENERATION PROGRAM - Google Patents

Description

  The present invention relates to a digital signature generation apparatus, a digital signature verification apparatus, and a key generation apparatus that use a public key cryptosystem.

  Cryptographic technology is widely used as a means of protecting the confidentiality and authenticity of information in a network society in which people communicate with each other by sending and receiving a large amount of information such as electronic mail.

  Encryption technology can be broadly divided into common key encryption technology and public key encryption technology. Common key encryption is an encryption method based on a data agitation algorithm, and can be encrypted / decrypted at high speed, while a common key is used in advance. Secret communication and authentication communication can only be performed between two parties. Public key cryptography is an encryption method based on a mathematical algorithm, and encryption / decryption is not as fast as common key cryptography, but it does not require prior key sharing, and a public key that is disclosed by the other party during communication. The secret communication is realized by using the secret key, and the digital communication is performed by using the secret key of the sender (to prevent impersonation), thereby enabling the authentication communication.

  For this reason, digital signatures based on common key cryptography have the capability of either a signature generation device or a signature verification device when high speed is required between peers or devices in an environment where a secret key can be shared. It is used as an authentication means for low cases. In addition, digital signatures based on public key cryptography can be used in environments where private keys cannot be shared, such as online shopping established on the Internet, online sites of banks and securities companies, and even in environments where private keys can be shared. It is used when both the signature generation device and the signature verification device have high computing capabilities.

  Typical public key ciphers include RSA cipher and elliptic curve cipher, and digital signature schemes based on them are proposed. RSA cryptography is based on the difficulty of the prime factorization problem, and power-residue calculation is used as signature generation calculation and signature verification calculation. In elliptic curve cryptography, the difficulty of the discrete logarithm problem on the elliptic curve is the basis of security, and point computation on the elliptic curve is used as signature generation computation and signature verification computation. Although these public key ciphers have been proposed for cryptanalysis (signature forgery) with respect to a specific key (public key), general cryptanalysis (signature forgery) is not known. No problem has been found so far, except for the quantum computer cryptanalysis described later.

  Other digital signatures based on public key cryptography include a system called SFLASH based on multi-order multivariate cryptography, which is configured using a field expansion theory and provides a basis for security in solving the simultaneous equations. However, a powerful attack method is known for multi-order multi-variable cryptography, and the key size necessary to avoid the decryption method must be increased, and practicality is beginning to be regarded as a problem.

  On the other hand, even RSA cryptography and elliptic curve cryptography currently widely used for digital signatures are exposed to the risk of being decrypted if a quantum computer appears. A quantum computer is a computer that can perform massively parallel computation (based on a principle different from that of current computers) by utilizing the physical phenomenon known as quantum mechanics called entanglement. However, although it is a virtual computer whose operation has been confirmed only at the experimental level, research and development for its realization is in progress. In 1994, using this quantum computer, Shor showed that an algorithm for efficiently solving prime factorization and discrete logarithm problems can be constructed (see Non-Patent Document 1).

  That is, if a quantum computer is realized, RSA cryptography based on prime factorization and elliptic curve cryptography based on a discrete logarithm problem (on an elliptic curve) can be deciphered.

  Under such circumstances, research on digital signatures based on public key cryptography that is still secure even if a quantum computer is realized has been conducted in recent years. There is a method called SFFLASH based on multi-order multi-variable cryptography as a method that can be realized at present and is difficult to decipher even with a quantum computer using public key cryptography. The key size required for security is enormous, and its practical use is in danger.

  Furthermore, since public key cryptography has a larger circuit scale and takes longer processing time than common key cryptography, there is a problem that it cannot be realized in a low-power environment such as a mobile terminal or even if it is realized. For this reason, public key cryptography that can be realized even in a low-power environment is required.

  In general, a digital signature based on public key cryptography finds a difficult calculation problem (such as a prime factorization problem or a discrete logarithm problem) and tries to generate a digital signature in a message called plaintext (without knowing the secret key). It is configured so that it is computationally equivalent to solving difficult problems. However, even if a problem that is difficult to calculate is found, the digital signature cannot always be configured so that the problem is based on security. This is because the problem of generating a key becomes difficult if a security reason is placed on a problem that is too difficult to calculate, and the configuration becomes difficult. On the other hand, if the problem is made easy to the extent that key generation is possible, forgery of a digital signature becomes easy.

  Therefore, it is difficult to calculate public key cryptography, and it has an exquisite balance that it is easy enough to generate a key, but not easy to decrypt (without knowing the generated private key). The creativity of transforming into a problem is necessary, and because it is difficult, only digital signatures based on public key cryptography have been proposed.

P.W.Shor: “Algorithms for Quantum Computation: Discrete Log and Factoring”, Proceedings of the 35th Annual IEEE Symposium on Foundations of Computer Science, 1994.

  In this way, conventionally, a digital signature system based on public key cryptography that can secure safety even if a quantum computer appears, can be safely realized with a current computer, and can be realized in a low-power environment. (A system for generating keys, generating digital signatures, and verifying) did not exist.

  Therefore, the present invention provides a digital signature system based on public key cryptography that can generate a highly secure and reliable digital signature and can be realized with a small amount of calculation.

The digital signature generation apparatus according to the present invention has a three-dimensional definition defined on the finite field F _q represented by an x coordinate, a y coordinate, a parameter s, and a parameter t as a finite field F _q and a secret key for signature generation. Of the curved surfaces in the manifold A (x, y, s, t), the section D (u _x (s, t), u _y (s, storage means for storing t), s, t), calculates a hash value of the message m, embeds the hash value in a one-variable polynomial h (t) defined on the finite field F _q , and a hash value polynomial And substituting the hash value polynomial into the parameter s of the section stored in the storage means, the digital signature Ds which is a curve on the section in which the x coordinate and the y coordinate are expressed as a function of the parameter t _(U x (t Generates a _{U y (t), t)} .

The digital signature verification apparatus according to the present invention includes a three-dimensional manifold A (defined on the finite field F _q represented by an x coordinate, a y coordinate, a parameter s, and a parameter t as a finite field F _q and a public key. storage means for storing a polynomial of x, y, s, t), a message m is input, and among the curved surfaces in the three-dimensional manifold A (x, y, s, t), the x coordinate and y _X generated using the section D (u _x (s, t), u _y (s, t), s, t) whose coordinates are expressed as a function of parameters s and t as a secret key for signature generation The digital signature Ds: (U _x (t), U _y (t), t) corresponding to the message m, which is a curve on the section whose coordinates and y coordinates are expressed as a function of the parameter t, is input. A hash value of the message m is calculated, and the hash value is embedded in a one-variable polynomial h (t) defined on the finite field F _q having the parameter t, and a hash value polynomial is generated and stored in the storage means The algebraic surface X (x, y, t) corresponding to the hash value is calculated by substituting the hash value polynomial into the parameter s of the generated polynomial, and the coordinates of the algebraic surface X (x, y, t) are calculated. The validity of the message and the digital signature is verified by substituting the function U _x (t) representing the x coordinate of the digital signature and the function U _y (t) representing the y coordinate into x and the coordinate y, respectively. To do.

The key generation device of the present invention is a three-dimensional defined on the finite field F _q represented by an x coordinate, a y coordinate, a parameter s, and a parameter t, which are used as a finite field F _q and a public key for signature verification. Of the manifold A (x, y, s, t) and the curved surface in the three-dimensional manifold A (x, y, s, t) used as a secret key for signature generation, the x coordinate and y coordinate are A key generation device for generating a section represented by a function of parameters s and t, wherein a first two-variable polynomial λ _x (s, t) relating to parameters s and t defined on the finite field F _q is obtained. generated, the first 2-variable polynomial λ _{x (s,} t) is divisible by the second 2-variable polynomial λ _{y (s,} t) that are defined on the finite field F _q generates the finite field F _q on defined parameters s, t for the two 2-variable polynomials _u x (s, t , _V x (s, t) and the difference of the two 2-variable polynomials _{{u x (s, t)} -v x (s, t)} is the first 2-variable polynomial λ _x (s, t) The two two-variable polynomials u _y (s, t) and v _y (s, t) related to the parameters s and t defined on the finite field F _q are generated as the two two-variable polynomials. Is generated so that the difference {u _y (s, t) −v _y (s, t)} becomes the second two-variable polynomial λ _y (s, t), and the two-variable polynomial u _x (s, t) ) the x-coordinate, variable determined _u y (s, sections a t) and y coordinates _{D1: (x, y, s} , t) = (u x (s, t), u y (s, t), s, t) and a section D2 having a two-variable polynomial v _x (s, t) as an x-coordinate and a two-variable function v _y (s, t) as a y-coordinate: (x, y, s, t) = (v _x (s, t) , V _y (s, t), s, t). Further, a polynomial of the three-dimensional manifold A (x, y, s, t) including the section D1 and the section D2 is generated.

The key generation device of the present invention has a finite field F _q and 3 defined on the finite field F _q used as a public key for signature verification represented by x coordinate, y coordinate, parameter s, and parameter t. Among the dimensional manifold A (x, y, s, t) and the curved surface in the three-dimensional manifold A (x, y, s, t), the x coordinate and the y coordinate are expressed by functions of parameters s and t. A key generation device for generating a section used as a secret key for signature generation, wherein the first to nth (n is a positive integer) n (n is a positive integer) parameters s and t (Integer) two-variable polynomials u _{x, i} (s, t) (i: 1 ≦ i ≦ n) defined on the finite field F _q and the first to nth parameters s and t said n finite field _{F q} on defined 2-variable polynomial _{u y, i (s, t} ) (i: 1 ≦ i n) generates i-th (1 ≦ i ≦ n) th two-variable polynomials _{u x,} i (s, t) and _{u y,} i (s, t) and x coordinate respectively, the i to y-coordinate The second section Di: (x, y, s, t) = (u _{x, i} (s, t), u _{y, i} (s, t), s, t) (1 ≦ i ≦ n) is generated Thus, n sections Di (1 ≦ i ≦ n) from the first to the n-th are obtained, and the i-th (1 ≦ i ≦ n) -th two-variable polynomial u _{x, i} (s, t) And u _{y, i} (s, t) are used to calculate the i-th x factor (x−u _{x, i} (s, t)) and y factor (y−u _{y, i} (s, t)). By generating the first to nth x-factor and y-factor, the i-th (1 ≦ i ≦ n) -th x-factor and y-factor are assigned to the left side and the right side, and are assigned to the left side. N x factors And an equation obtained by connecting the product of the y factor and the product of the n x factors and the y factor distributed on the right side with an equal sign, and expanding the generated equation, A polynomial of a three-dimensional manifold A (x, y, s, t) is generated.

  A digital signature based on public key cryptography with high security and reliability can be generated, and can be realized with a small amount of calculation.

The figure for demonstrating fibration of a three-dimensional manifold and an algebraic surface. The figure which showed the structural example of the key generation apparatus. The flowchart for demonstrating the processing operation of the key generation apparatus of FIG. The figure which showed the structural example of the digital signature production | generation apparatus. 5 is a flowchart for explaining a processing operation of the digital signature generation apparatus in FIG. 4. The figure which showed the structural example of the digital signature verification apparatus. 7 is a flowchart for explaining the processing operation of the digital signature verification apparatus of FIG. The figure which showed the other structural example of the key generation apparatus. The flowchart for demonstrating the processing operation of the key generation apparatus of FIG. The figure which showed the other structural example of the key generation apparatus of FIG. The figure which showed the other structural example of the digital signature production | generation apparatus of FIG. The figure which showed the other structural example of the digital signature verification apparatus of FIG. The figure which showed the other structural example of the key generation apparatus of 8. FIG.

  Embodiments of the present invention will be described below with reference to the drawings.

  First, an outline of the present embodiment will be described.

(Overview)
In the present embodiment, a three-dimensional manifold is defined as having a three-dimensional degree of freedom among a set of solutions of simultaneous (algebraic) equations defined on the field K. For example, simultaneous equations on the body K

Since there are three equations that bind them to six variables, it has a three-dimensional degree of freedom and becomes a three-dimensional manifold. Especially the 4-variable K superalgebraic equation

A space defined as a set of solutions of is also a three-dimensional manifold on K. Note that the definition formula of the three-dimensional manifold shown in the formulas (1) and (2) is in the affine space, and in the projective space (in the case of the formula (2)).

It is. In the present embodiment, since the three-dimensional manifold is not handled in the projective space, the definition formula of the three-dimensional manifold is the formula (1) or the formula (2). Is established as is. On the other hand, an algebraic curved surface has a two-dimensional degree of freedom in a set of solutions of simultaneous (algebraic) equations defined on the field K. So for example

Is defined. In the present embodiment, since only a three-dimensional manifold that can be written by one equation as in equation (2) is handled, equation (2) is treated as a three-dimensional manifold definition equation below.

A field is a set that can be freely added, subtracted, divided, and divided, and real numbers, rational numbers, and complex numbers. For example, a set including elements that cannot be divided other than 0, such as integers and matrices, does not correspond. Some fields are composed of a finite number of elements called finite fields. For example, for a prime number p, a remainder class Z / pZ modulo p forms a field. Such a field is called a prime field and is denoted as F _p . In addition to this, the finite field includes a field F _q (q = p ^r ) having a power element of a prime number, but in the present embodiment, only the prime field F _p is mainly handled for simplicity. Generally p of the element body F _p is called the target number of the element body F _p. On the other hand, even in a general finite field, the present embodiment is similarly established by performing obvious deformation.

In public key cryptography, a message is often configured as a finite field because it is necessary to embed the message as digital data. Similarly, in this embodiment, a three-dimensional manifold defined on a finite field (particularly a prime field in this embodiment) F _p is used. Handle.

  In the three-dimensional manifold A: f (x, y, z, u) = 0, there are usually a plurality of algebraic surfaces as shown in FIG. Such an algebraic surface is called a factor on a three-dimensional manifold. In general, the problem of finding a (non-trivial) factor when a definition formula for a three-dimensional manifold is given is an unsolved problem even in modern mathematics, and is common except for a method solved by a multi-order multivariable equation described later. There is no known solution.

  In particular, a three-dimensional manifold defined by a finite field as used in this embodiment has a clue even when compared with a three-dimensional manifold defined by an infinite field (a field consisting of infinite elements) such as a rational number field. It is known to be a less difficult problem. Furthermore, the multi-order multivariable equation that appears to find the factors has a wider variety than the multi-order multivariable equation that appears when solving multi-order multi-variable cryptography, and is proposed for multi-order multi-variable cryptography. The solution is generally not valid.

  In the present embodiment, this problem is referred to as a factor finding problem on a three-dimensional manifold or simply a factor finding problem, and a public key cryptosystem that provides a basis for security in the factor finding problem on the three-dimensional manifold is configured.

In the definition formula f (x, y, z, u) = 0 of the three-dimensional manifold A represented by the x coordinate, the y coordinate, the z coordinate, and the parameter u, the variables z and u are changed to the parameters s and t, respectively. ,
g _{s, t} (x, y): = f (x, y, s, t)
far. This is regarded as a polynomial whose coefficient is an element of a bivariate algebraic function field K (s, t) on the field K, and g _{s, t} (x, y) = 0 is an algebraic curve on K (s, t). Is defined as having a fibrosis on the affine plane P ² with s and t as parameters, and (x, y, s, t) is made to correspond to (s, t). The map A → P ² obtained by is called fibration on the affine plane P ² of the three-dimensional manifold A.

A curve g _{s0, t0} (x) obtained when the point (s, t) on the affine plane P ² is fixed to one point (s ₀ , t ₀ ) (where s ₀ , t ₀ is an element of the body K). , Y) = 0 is called a fiber on the point (s ₀ , t ₀ ) and is denoted as A _{s0, t0} .

A three-dimensional manifold with fibrations on the affine plane P ² is called a section,
(X, y, s, t) = (u _x (s, t), u _y (s, t), s, t)
There are many algebraic surfaces on the three-dimensional manifold A parameterized by s, t, which can be expressed as Although there are fibrations that do not have sections, f (x, y, z, u) that has sections can be easily configured.

On the other hand, as described above, the defining expression f (x, y, z, u) = 0 of the three-dimensional manifold A is not considered on the two-variable algebraic function field K (s, t), but, for example, one variable It can also be considered on the algebraic function field K (t). In that case,
h _t (x, y, s): = f (x, y, s, t)
Then, for each value of _t , h _t (x, y, s) = 0 defines an algebraic surface on a one-variable algebraic function field K (t). At this time, A is said to have a fibration on the affine straight line P ¹ with t as a parameter, and a map A → P ¹ obtained by associating (x, y, s, t) with (t) is 3 This is called fibration on the affine line P ¹ of the dimensional manifold A.

Then, a curved surface obtained when fixing the point t on the affine linear P ¹ to point t ₀
h _t0 (x, y, s) = 0
_Is called a fiber on point t ₀ and is denoted A _t0 .

A section in a three-dimensional manifold with fibrations on the affine straight line P ¹ is
(X, y, s, t) = (u _x (t), u _y (t), u _s (t), t)
And an algebraic curve on the three-dimensional manifold A parameterized by t.

  A section is a factor of a three-dimensional manifold. In general, when a fibration of a three-dimensional manifold is given, the corresponding fiber is obtained immediately (by substituting the element of the field for s and t), but it is extremely difficult to find the corresponding section.

  The digital signature described in the present embodiment is a digital signature based on a safety reason for the problem of finding a section among three-dimensional manifold factor finding problems, particularly when a three-dimensional manifold A fibration is given. It is.

In the present embodiment, mainly because handle fibration on affine plane P ^2, when it is fibration on affine plane P ² for easy clear, simply referred to as a fibration. In this case, the definition expression f (x, y, s, t) = 0 of the three-dimensional manifold having fibration may be simply referred to as fibration.

In order to obtain a section from fibration, the section (u _x (s, t), u _y (s, t), s, t) is also used in modern mathematics.

(Here, deg _s u _x (s, t) is an order when only s is a variable in u _x (s, t).)

And substituting this into A (x, y, s, t) = 0,

And expand the left side to ^calculate the coefficient of s ⁱ t ^j
α0,..., αr _sx r _tx−1 , β0,..., βr _{sy ty−1}
c _{i, j} (α0,..., αr _sx r _tx-1 , β0,..., βr _{sy ty-1} )
Expressed as a system of simultaneous equations

The only way to find out by solving and solving this is known.

  That is, it can be said that the public key cryptography of the present invention results in the solution of simultaneous equations as well as the multi-order multivariable cryptography described in the prior art. However, while multi-order multivariable cryptography has resulted in solving a very limited range of multi-order multivariable equations that depend on finite field expansion theory (which is well understood in modern mathematics) Since the three-dimensional manifold cryptography relies on a factor finding problem that is an unsolved mathematical problem, the level of difficulty of the problem varies greatly.

Hereinafter, a specific configuration of the digital signature based on the factor finding problem on the three-dimensional manifold will be described. In the following we consider a 3-manifolds all defined on F _p. Therefore, all operations performed on F _p.

(First embodiment)
The public key used in the digital signature according to this embodiment is
3-manifolds X of fibration on _{F p: A (x, y} , s, t) = 0.

The secret key is the n sections of the three-dimensional manifold A on F _p
Di: (x, y, s, t) = (ux _{, i} (s, t), u _{y, i} (s, t), s, t).

  These can be easily obtained by a key generation method described later.

(1) Signature generation processing
Next, an outline of the signature generation process will be described. In the signature generation process, first, a message (hereinafter referred to as plain text) for which a signature is to be generated is converted into an integer m. The conversion method is generally a method in which a message is encoded using a code system such as a JIS code and is read as an integer.

Next, the hash value h (m) is calculated by applying the converted integer m to the hash function h (x). Here, since the hash value h (m) is generally 120 bits to 160 bits, for example, h (m) = h ₀ ‖h ₁ ‖... −１h _r−1
Are divided into a plurality of blocks h ₀ , h ₁ ,...
h (t) = h _r−1 t ^r−1 +... + h ₁ t + h ₀
Embed in the coefficient (hash value embedding process). The one-variable polynomial in which the hash value is embedded is called a hash value polynomial h (t). Here, in order to make h (t) a polynomial on F _p ,
Each h _i (0 ≦ i ≦ r−1) needs to be taken to be an element of F _p . That is, the hash value is based on the bit length of p,
0 ≦ h _i ≦ p−1
The hash value is divided so that

Next, one is randomly selected from the n sections Di that are secret keys. Selected section
_{Di: (w x (s,} t), w y (s, t), s, t)
For the variable s, the hash value polynomial h (t) is substituted. That is,
(W _x (h (t), t), w _y (h (t), t), h (t), t)
Organize this,
D _s : (x, y, t) = (W _x (t), W _y (t), t) (3)
This is transmitted to the recipient together with the message m as a digital signature D _s for the message m.

As can be seen from the above description, the digital signature D _s shown in Equation (3) is a curve on the section Di used as a secret key.

Here, from the viewpoint of safety, it is desirable that the orders of W _x (t) and W _y (t) are constant regardless of the selected section. This is for the polynomial u _{x, i} (s, t) appearing in the section

Then, it can be solved by making u _{x, i} (s, t) include a term of s ^hx t ^kx for all i. This is because the maximum degree term of the obtained polynomial Wx (t) becomes h (t) as s ^hx t ^kx , regardless of which section's s is substituted for the hash value polynomial h (t). This is because it arises from the polynomial assigned to the term.

With respect to u _{y, i} (s, t), the order of W _y (t) can be kept constant regardless of i by the same means. A method for generating such a key (section and corresponding three-dimensional manifold) will be described later.

(2) Signature verification processing
The receiver who has received the digital signature D _s (x, y, t) uses the public key A (x, y, s, t) defined on the finite field F _p owned by the receiver as follows. I do.

First, as in the signature generation process described above, a message (hereinafter referred to as plain text) is converted to an integer m. The conversion method is the same as the signature generation process. Next, a hash value h (m) is calculated by applying the converted integer m to the same hash function h (x) as in the signature generation process described above. Further, similarly to the above-described signature generation processing, the hash value is set to h (m) = h ₀ ‖h ₁ ‖ ... ‖h _r−1.
And a plurality of blocks h ₀ , h ₁ ,... H _r−1 , and these are univariate polynomials defined on the finite field F _{p with} respect to the variable t
h (t) = h _r−1 t ^r−1 +... + h ₁ t + h ₀
And a hash value polynomial h (t) in which a hash value is embedded is generated.

Next, the generated hash value polynomial h (t) is substituted into the variable s of the three-dimensional manifold A (x, y, s, t), which is a public key, and an algebraic surface
X (x, y, t) = A (x, y, h (t), t)
Is generated. This X (x, y, t) is also an algebraic surface having fibration.

  Next, the digital signature expressed by Equation (3) (received by the receiving side) is substituted into the obtained algebraic surface X. At this time, if the value is “0”, it means that the digital signature is correct, and if it is not “0”, it means that the digital signature is not correct.

  This is because, in the above-described digital signature generation process, s = h (t) is substituted for a section Di that is randomly selected from the sections given as the secret key. On the other hand, this is an algebraic surface X (x, y, t) obtained by substituting s = h (t) for the three-dimensional manifold A (x, y, s, t) performed in the digital signature verification process described above. ) Section. Therefore, when an assignment operation such as the digital signature verification process described above is performed, the value becomes “0”.

  Further, it is known that it is difficult to obtain the section of an algebraic surface obtained by substituting s = h (t), as in the case of a three-dimensional manifold, resulting in a solution of a multi-order multivariable equation. For this reason, as will be described in detail in the item of the safety signature described later, a third party who does not know the section of the three-dimensional manifold presents the section of the algebraic surface corresponding to the message. To return to. For this reason, it is impossible (in terms of computational complexity). This is the basis for the security of the digital signature of the present invention.

(3) Key generation method
A key generation method will be described. The key generation of this embodiment is performed by randomly selecting sections D1 and D2 and calculating the corresponding fibrations. However, in order for the generated three-dimensional manifold to have two sections at the same time, the following device is required.

Here, for the sake of simplicity, a key generation method will be described by taking a three-dimensional manifold having the following fibration among the three-dimensional manifold as an example.

Here, a (s, t) and b (s, t) are two variable polynomials. First, the characteristic p of the prime field is determined. At this time, even if p is small, there is no problem in safety. Now, section D1, D2

Substituting into the three-dimensional manifold A,

Get. When these are drawn side by side, b (s, t) disappears,

It becomes. To make a (s, t) a two-variable polynomial, for example

If it is enough. Using this fact, it is possible to generate a key with the following algorithm.

Here, k ₁ (s, t) | k ₂ (s, t) is expressed by polynomial k ₁ (s, t),
This means that the polynomial k ₂ (s, t) is divisible.

First, two polynomials _satisfying λ _x (s, t) | λ _y (s, t) are selected at random. Specifically, in order to obtain such a set of polynomials, for example, λ _x (s, t) is given at random, and λ _y (s, t) = c (s , T) λ _x (s, t) can be obtained by calculating λ _y (s, t).

Next, a polynomial v _x (s, t) is selected at random,

To calculate u _x (s, t). Similarly, a polynomial v _y (s, t) is selected at random,

To calculate u _y (s, t). Using u _x (s, t), v _x (s, t), u _y (s, t), and v _y (s, t) calculated in this way,

Is calculated, the polynomial a (s, t) can be calculated. Furthermore, b (s, t) uses the above-mentioned a (s, t),

Obtained by.

Even if the key generation method described above is a three-dimensional manifold other than the above, for example,

Assuming a defining expression of the form is possible in the same way, and is not limited to the above example.

On the other hand, the above key generation method cannot generate an algebraic surface having three or more sections. In addition, digital signatures listed as desirable conditions for security
D _s : (x, y, t) = (W _x (t), W _y (t), t)
It is difficult to generate a public key that makes the order of W _x (t) and W _y (t) appearing in the above constant regardless of the selected section. As a key generation method for solving both of these, the following second key generation method can be considered.

First, a term s ^hx t ^kx of the maximum degree of u _{x, i} (s, t) is determined, and n two-variable polynomials u _{x, x} are set so that the maximum degree of s is hx and the maximum degree of t is kx _{. i} (s, t) is determined. Similarly, the maximum degree term s ^hy t ^ky of u _{y, i} (s, t) is determined, and n two-variable polynomials u are set so that the maximum order of s is hy and the maximum order of t is ky. Define _{y, i} (s, t).

Next, factors (x−u _{x, i} (s, t)) and (y−u _{y, i} (s, t)) are generated from these polynomials, and for each i (1 ≦ i ≦ n), Two factors (x- _{x, i} (s, t)) and (y- _{y, i} (s, t)) having the same value of i are distributed to the left side and the right side, respectively. Then, by connecting the product of the n factors distributed to the left side and the product of the n factors distributed to the right side with an equal sign, an equation as shown in the following equation (6) is obtained.

Equation (6) is an equation that satisfies the above conditions. Here, for example,
Di: (u _{x, i} (s, t), u _{y, i} (s, t), s, t) is a section.

Furthermore, even if h (t) is substituted for these sections, digital signatures Ds: (W _x (t), W _y (t), t) of the same order are generated. In practice, since the section is immediately known if it remains as in equation (6), a three-dimensional manifold that is a public key is obtained by expansion.

On the other hand, in the equation (6), the factor of x is divided on the right side and the factor of y is divided on the left side, so that it may be easy to obtain a section by factorization. So, for example

As described above, it is desirable to generate a three-dimensional manifold which is a public key cryptography by randomly dividing the factor of x and the factor of y on both sides. By generating the public key and the secret key in this way, a highly secure three-dimensional manifold having generally n or more sections can be generated. Except for the safety viewpoint, it is possible to give a degree of freedom to the method of creating _{ux, i} (s, t), ui _{, i} (s, t).

(4) Proof of safety
The above-mentioned digital signature security certification will be described. The security of digital signatures can be obtained in polynomial time if the problem of creating a pair of message (plaintext) and digital signature is solved in polynomial time. If the problem of finding a section of a field can be determined in polynomial time, it can be proved by proving that it is possible in polynomial time to create a message (plaintext) and digital signature pair. That is, by theoretically proving the above facts, it is possible to create a pair of a message (plain text) and a digital signature (can exist forgery) and solve the problem of finding a section of a three-dimensional manifold. If the problem of obtaining the section of the three-dimensional manifold that is the basis of security is difficult, it is indicated that the digital signature cannot be existently counterfeited. The safety proof according to the above policy is shown below.

Here, when the two-dimensional section D is written as D = (d _x (s, t), _dy (s, t), s, t), the order of the two-dimensional section is represented by d _x (s, t). , D _y (s, t) order maximum value,
max {deg (d _x (s, t)), deg (d _y (s, t))}.

[Theorem 1] and that section finding problem of 3D manifold defined on the finite field F _p is a difficult calculation n with the following sections, the digital signature of the present invention is secure in existentially unforgeable meaning of Being equivalent is equivalent.

  [Proof 1] Assume that there is an algorithm α that can calculate a specific pair of plaintext and signature by a digital signature in the present embodiment within a polynomial time. At this time, it is shown that there exists a polynomial time algorithm for obtaining a two-dimensional section of a three-dimensional manifold using this algorithm α.

First, let A (x, y, s, t) be a three-dimensional manifold for which a two-dimensional section is desired. Next, considering a digital signature scheme using A (x, y, s, t) as a public key, a polynomial plaintext / signature pair is generated using an algorithm α. Here, the hash value polynomial for the plaintext _{m i} and _h i (t), the signature

And Here, f _i (s, t) and g _i (s, t) correspond to the x and y coordinates of the section of the three-dimensional manifold A, and there are at most a finite number. Therefore, if a certain number or more of signatures are collected, f _i (s, t) and g _i (s, t) are not all different, and some of them are the same. Which of these is the same can be determined by the following method.

Consider a three-dimensional manifold B (x, y, s, t) (= A (x, y, t, s)). This B (x, y, s, t) is obtained by exchanging s and t of the three-dimensional manifold A (x, y, s, t), and has an n-th order section from the definition of the section order. Yes. Therefore, one plaintext / signature pair is generated using the algorithm α. At that time, in particular, the hash value polynomial h _i (s) is selected such that the constant h _i (s) = h _0, and the generated signature is

Then,

Gives one one-dimensional cycle of A (x, y, s, t) parameterized with s. Here, the cycle means a partial manifold, and in particular, the one-dimensional cycle is a one-dimensional partial manifold. Using this cycle D, one-dimensional cycle

Among them, those existing on the same X section as D are found by the following polynomial algorithm.

First, when (s, t) = (h _i (h ₀ ), h ₀ ) is set, a point on D (ζ (h _i (h ₀ ), h ₀ ), η (h _i (h ₀ ), h ₀ ), h _i (h ₀ ), h ₀ ) and a point on D _s ⁽ⁱ⁾ (f _i (h _i (h ₀ ), h ₀ ), g _i (h _i (h ₀ ), h ₀ ) ), H _i (h ₀ ), h ₀ ) are determined. And note that the section of X is isomorphic to the plane with coordinates (s, t):

Then D _s ⁽ⁱ⁾ and D are on the same section. If not equal, D _s ⁽ⁱ⁾ and D are not on the same section. Here, the one-dimensional cycle group included in the same section,

And Well, here 3D manifold A (x, y, s, t) section of _{(w x (s, t)} , w y (s, t), s, t) a

By substituting the one-dimensional section of equation (8),

Get. A simultaneous linear equation of a _ij can be obtained by comparing the coefficients of both sides for every power of t. Since simultaneous linear equations have polynomial time solutions,
a _ij is obtained. Similarly, since b _ij can be obtained in polynomial time, it has been shown that the section of the three-dimensional manifold A (x, y, s, t) can be obtained in polynomial time.

  Conversely, it is assumed that there exists a polynomial time algorithm β for obtaining a two-dimensional section of a three-dimensional manifold. At this time, it is shown that a specific pair of plaintext and signature by the digital signature of the present embodiment can be calculated within the polynomial time by using this algorithm β.

When a three-dimensional manifold A (x, y, s, t), which is a public key of the digital signature of the present embodiment, is given, the two-dimensional section is obtained using the algorithm β.
_{D: (w x (s,} t), w y (s, t), s, t)
Ask for. Here, when plaintext m is appropriately determined and its hash value polynomial is h (t),
Signature by putting s = h (t)
D _s : (w _x (h (t), t), w _y (h (t), t), t)
Get. As a result, a specific pair of plaintext and signature can be calculated in polynomial time.

  This proves the theorem.

(5) Variation
Variations in this embodiment will be described. The first variation is a variation in which the hash value polynomial is replaced with the hash value itself. In the digital signature generation process in the present embodiment, a hash value h (m) is calculated from the plaintext m, the hash value h (m) is expanded into a hash value polynomial h (t), and the section D _i selected at random is selected. S = h (t).

However, an embodiment in which the hash value is not embedded in the hash value polynomial also holds. That is, the digital signature is obtained by substituting the hash value h (m) itself into section D _i as s = h (m).
_{D s: (w x (h} (m), t), w y (h (m), t), t)
Can be generated. In this case, also in the digital signature verification process, the signature is obtained by the same means by assigning to the three-dimensional manifold A (x, y, s, t), which is a public key, by s = h (m). Verification is possible.

The fact that this variation is actually realized can be understood by considering the hash value polynomial h (t) in the present embodiment as a polynomial consisting of only a constant term. That is, this variation can be said to be a special case of the present embodiment. By using this variation, it is possible to reduce polynomial operations in digital signature generation processing and digital signature verification processing, and it is possible to reduce the amount of calculation memory and calculation processing time. However, the hash value in contrary must be increased to about 120 bits the size of p of F _p is a definition for also 120 bits at a minimum, also ready weakness that multiple length arithmetic is needed And
The scope of application is limited.

  The second variation is a variation related to a change of a variable into which a hash value polynomial is substituted in the digital signature generation device and the digital signature verification device of the present embodiment. In the digital signature generation apparatus and digital signature verification apparatus of the present embodiment, a one-variable polynomial with a variable t called h (t) is taken as a hash value polynomial, and a variable of a section that is a secret key or a three-dimensional manifold that is a public key Although it is substituted for s, the present invention is similarly established including safety even if it is changed as follows.

  That is, a one-variable polynomial with a variable s called h (s) is taken as a hash value polynomial and substituted into a variable t of a section that is a secret key or a three-dimensional manifold that is a public key. Since the variables s and t are both parameters, the effect is not changed by this variation.

(6) Configuration
Next, a configuration example of a key generation device, a digital signature generation device, and a digital signature verification device according to the digital signature method of the present embodiment and processing operations thereof will be described.

  FIG. 2 shows a configuration example of the key generation apparatus, and FIG. 3 is a flowchart for explaining the processing operation of the key generation apparatus of FIG. Hereinafter, the configuration and processing operation of the key generation device of FIG. 2 will be described with reference to the flowchart shown in FIG. Although specific numerical values and formulas are shown as an aid to understanding, this is only an example to help understanding, and a digital signature with sufficient security that is actually used (especially the degree of a polynomial) Do not necessarily match).

Here, the above-described three-dimensional manifold having a fibration of y ² = x ³ + a (s, t) x + b (s, t) will be described as an example.

  A command for starting the key generation process is transmitted from the external device or the like to the control unit 1, and the key generation apparatus starts the key generation process (step S1). When the command is transmitted to the control unit 1, the control unit 1 requests the prime number generation unit 2 to generate a prime number. Prime numbers may be generated randomly, but it is not necessary to use a large prime number here, so it is random from a prime number of about 6 bits at most (by means such as predetermining the output order). Alternatively, a prime number that is predetermined by the key generation device may be used. Here, it is assumed that a prime number p = 17 is generated (step S2).

The control unit 1 outputs the prime number p to the section generation unit 5, and the section generation unit 5 starts generating the section. First, the section generation unit 5 outputs the prime number p to the two-variable polynomial generation unit 3, and the two-variable polynomial generation unit 3 outputs the two-variable polynomial λ _x (s, t) (= −s (t−1)). Generate (step S3). The two-variable polynomial generator 3 randomly selects the order within a predetermined range, and uses the coefficients of the two-variable polynomial having the order in the range from 0 to p−1 using the finite field F _p as an element. Generate.

After generating λ _x (s, t), the two-variable polynomial generator 3 outputs this to the controller 1. When λ _x (s, t) is obtained, the control unit 1 generates a random two-variable polynomial c (s, t) as described above, and obtains c (s, t) (= s + t) ( Step S4).

The control unit 1 outputs c (s, t) and λ _x (s, t) to the two-variable polynomial arithmetic unit 4.

The two-variable polynomial arithmetic unit 4 calculates λ _y (s, t) = c (s, t) λ _x (s, t) (step S5), and sends the control unit 1 to λ _y (s, t) (= -(S + t) s (t-1)) is output.

Upon receiving λ _y (s, t), the control unit 1 then randomly generates a two-variable polynomial v _x (s, t) (= 2st) by a method similar to the generation of λ _x (s, t). (Step S 6), λ _x (s, t) (= −s (t−1)) and v _x (s, t) (= 2st) are output to the two-variable polynomial arithmetic unit 4.

The two-variable polynomial arithmetic unit 4 calculates u _x (s, t) (= λ _x (s, t) + v _x (s, t) = s (t + 1)), and outputs this to the control unit 1 ( Step S7).

Control unit 1, similarly to step ^{_{S6, v y (s, t}} ) (= 2st 2 + s + s 2 t-s 2 -st) generates (step S8), and further,
u _y (= λ _y (s, t) + v _y (s, t) = s (t ² +1)) is calculated (step S9).

The control unit 1 outputs u _x (s, t), u _y (s, t), v _x (s, t), and v _y (s, t) to the three-dimensional manifold generation unit 6.

The three-dimensional manifold generation unit 6 uses the two-variable polynomial calculation unit 4 repeatedly to use the three-dimensional manifold A (x, y, s, t): y ² = x ³ + a using Equation (4). A two-variable polynomial a (s, t) relating to parameters s and t of (s, t) x + b (s, t) is calculated (step S10).

In this example

It is obtained. Furthermore, using equation (5), from a (s, t) and u _x (s, t), u _y (s, t), v _x (s, t), v _y (s, t), By repeatedly using the two-variable polynomial arithmetic unit 4, a two-variable polynomial b (s, t) relating to the parameters s and t is calculated (step S11).

In this example,

Get.

  The three-dimensional manifold generation unit 6 outputs the obtained a (s, t) and b (s, t) to the control unit 1.

The control unit 1 obtains the polynomial representing the three-dimensional manifold A (x, y, s, t): y ² = x ³ + a (s, t) x + b (s, t) in steps S10 and S11. By substituting a (s, t) and b (s, t), fibration A (x, y, s, A polynomial of t) is generated.

Further, as shown in the following equation (10), a section D1: (x, y, s) having a two-variable polynomial u _x (s, t) as an x coordinate and a two-variable polynomial u _y (s, t) as a y coordinate. , T) and a section D2: (x, y, s, t) having the two variable polynomial v _x (s, t) as the x coordinate and the two variable polynomial v _y (s, t) as the y coordinate ( Step S12).

  The control unit 1 outputs the generated public key and secret key to the key output unit 7, and the key output unit 7 outputs the public key and the secret key.

  2 (control unit 1, prime number generating unit 2, two variable polynomial 3, two variable polynomial calculating unit 4, section generating unit 5, three-dimensional manifold generating unit 6, key output unit 7, etc.) As shown in FIG. 10, a storage unit 101 that stores various programs, a calculation unit 100 such as a CPU, an output unit 102, an input unit 103, a communication unit 104, and the like are connected to a computer. This can be realized by executing each program stored in the.

  In FIG. 10, the storage unit 101 includes a control unit 1, a prime number generation unit 2, a two-variable polynomial generation unit 3, a two-variable polynomial calculation unit 4, a section generation unit 5, a three-dimensional manifold generation unit 6, and a key output unit 7. A key generation control program, a prime number generation program, a two-variable polynomial generation program, a two-variable polynomial calculation program, a section generation program, a three-dimensional manifold generation program, and a key output program are stored.

  The secret key and public key output from the key output unit 7 in FIG. 2 are transmitted to the request source via the communication unit 104, or passed to a digital signature generation device and a digital signature verification device described later, for example.

  FIG. 4 shows an example of the configuration of the digital signature generation apparatus, and FIG. 5 is a flowchart for explaining the processing operation of the digital signature generation apparatus of FIG. Hereinafter, the configuration and processing operation of the digital signature generation apparatus of FIG. 4 will be described with reference to the flowchart shown in FIG.

The digital signature generation apparatus of FIG. 4 acquires plaintext m from the plaintext input unit 11 and from the secret key input unit 14 a section group Di (u _x (s, t), u _y (s, y), s, t) (0 ≦ i ≦ n) is acquired.

Here, the secret key was generated by the above key generation process
1. Element characteristic p = 17
2. Two sections of the three-dimensional manifold A defined on the finite field F _p shown in Expression (10) are used. All calculations are performed on the finite field F ₁₇ determined by the key generation process.

First, a digital signature generation process is started by inputting plaintext m from the plaintext input unit 11 (step S101). The input plaintext m is output to the hash value calculation unit 12, and a hash value h (m) is calculated using a hash function such as SHA1 or MD5. Here, for the sake of simplicity, the hash value is set to “0x151”, but it should originally be 120 bits or more. The calculated hash value is sent to the hash value polynomial generation unit 13 and divided into a plurality of predetermined blocks. Here, since p = 17, it is divided every 4 bits, and each block is embedded in the coefficient of the hash value polynomial h (t) (step S103). The resulting hash value polynomial h (t) is h (t) = t ² + 5t + 1.

  The secret key storage unit 18 stores at least one section that is a secret key generated by the key generation apparatus having the configuration shown in FIG. 2 or FIG.

  The secret key input unit 14 reads out a section group that is a secret key from the secret key storage unit 18 and outputs the section group to the signature generation unit 15 (step S104). The secret key storage unit 18 preferably stores a plurality of sections. Here, the two sections D1 and D2 shown in Expression (10) are stored in the secret key storage unit 18, and the secret key input unit 14 reads the two sections D1 and D2 from the secret key storage unit 18. And output to the signature generation unit 15. These section groups are output from the signature generation unit 15 to the section selection unit 16. The section selection unit 16 randomly selects one section from the input group of sections (step S105). Here, it is assumed that D1 is selected. The selected section D1 is output to the signature generation unit 15. If only one secret key is stored in the secret key storage unit 18, the above processing of the section selection unit 16 is omitted.

  The signature generation unit 15 that has received the selected section D1 acquires the hash value polynomial h (t) generated in step S103 from the hash value polynomial generation unit 13, and sets the s coordinate of the selected section D1 to h. Substituting (t) (s = h (t)), section Ds is generated (step S106).

Here, a section Ds as shown in the following equation (11) is generated.

  This section Ds is output from the signature output unit 17 as a digital signature (step S107).

  The first and second variations described above are established by the same processing in this embodiment. When the first variation is used, p needs to be 120 bits or more at present (considering the size of the hash value).

  Each function shown in FIG. 4 (plaintext input unit 11, hash value calculation unit 12, hash value polynomial generation unit 13, secret key input unit 14, signature generation unit 15, section selection unit 16, signature output unit 17, etc.) As shown in FIG. 11, a storage unit 101 that stores various programs, a calculation unit 100 such as a CPU, an output unit 102, an input unit 103, a communication unit 104, and the like are connected to a computer. This can be realized by executing each program stored in the.

  In FIG. 11, the storage unit 101 includes a plaintext input unit 11, a hash value calculation unit 12, a hash value polynomial generation unit 13, a secret key input unit 14, a signature generation unit 15, a section selection unit 16, and a signature output unit 17. A plaintext input program, a hash value calculation program, a hash value polynomial generation program, a secret key input program, a signature generation program, a section selection program, and a signature output program for realizing the above functions are stored. The storage unit 101 also functions as a secret key storage unit 18 that stores a secret key.

  The message m input by the plaintext input unit 11 and the digital signature output by the signature output unit 17 are transmitted to the counterpart terminal via the communication unit 104, for example.

  FIG. 6 shows a configuration example of the digital signature verification apparatus, and FIG. 7 is a flowchart for explaining the processing operation of the digital signature verification apparatus of FIG. The configuration and processing operation of the digital signature verification apparatus shown in FIG. 6 will be described below with reference to the flowchart shown in FIG.

Digital signature generation apparatus of FIG. 6 acquires plaintext m from the plaintext input unit 21, a public key from the public key input unit 24 finite F _p on the defined 3D manifold A (x, y, s, t).

  First, the digital signature verification process is started by inputting plaintext m from the plaintext input unit 21 (step S201).

  The input plaintext m is output to the hash value calculation unit 22, and a hash value is calculated using the same hash function as that used in the signature generation device (step S202). Here, the hash value is “0x151”, which is the same as the hash value output by the signature generation apparatus. This hash value is output to the hash value polynomial generator 23.

The hash value polynomial generator 23 calculates a hash value polynomial h (t) using the same algorithm as that of the digital signature verification device (step S203). Therefore, the hash value polynomial h (t) obtained here is h (t) = t ² + 5t + 1.

  The obtained hash value polynomial h (t) is output to the signature verification unit 26.

The public key storage unit 29 is a three-dimensional manifold A (x, y, s, defined on the finite field F _p that is a public key generated by the key generation device having the configuration shown in FIG. 2 or FIG. Store the polynomial of t).

  The public key input unit 24 reads the polynomial of the three-dimensional manifold that is the public key from the public key storage unit 29, and outputs it to the signature generation unit 15 (step S204). Here, the three-dimensional manifold shown in Expression (9), that is, the public key is input to the signature verification unit 26. The signature verification unit 26 outputs the input public key to the algebraic surface generation unit 27.

  The signature verification unit 26 outputs the hash value polynomial h (t) generated in step S203 to the algebraic surface generation unit 27.

The algebraic surface generation unit 27 generates the algebraic surface X (x, y, t) by substituting the hash value polynomial h (t) output from the signature verification unit 26 for the variable s of the three-dimensional manifold ( Step S205). Here, an algebraic surface X (x, y, t) as shown in the following equation (12) is obtained.

Next, the signature verification unit 26 reads the signature Ds: (U _x (t), U _y (t), t) shown in Expression (11) input to the signature input unit 25 (step S206). The x-coordinate U _x (t) = t ³ + 6t ² + 6t + 1 and the y-coordinate U _y (t) = t ⁴ + 5t ³ + 2t ² + 5t + 1 of the signature Ds are respectively represented by x and a Substituting into the y-coordinate, developing and organizing (step S207). As described above, since the digital signature Ds is a factor of the algebraic surface X, if it is substituted and arranged, it should be “0”. Therefore, if it becomes “0” (step S208), “signature verification success” is output to the determination result output unit 28 (step S209). If it is not “0”, it means that the digital signature is wrong (step S208), and “signature verification failure” is output to the determination result output unit 28 (step S210).

  The determination result output unit 28 outputs the determination result to the outside and ends all the processes.

  In the example shown here, since it is a valid digital signature, the result obtained by substituting the digital signature Ds into the algebraic surface X in step S207 is certainly “0”, and the signature verification unit 26 determines that the determination result output unit 28 "Signature verification success" is output to the determination result output unit 28, which outputs it to the outside and ends.

  The first and second variations are established by the same processing in this embodiment.

  6 (plaintext input unit 21, hash value calculation unit 22, hash value polynomial generation unit 23, public key input unit 24, signature input unit 25, signature verification unit 26, algebraic surface generation unit 27, determination As shown in FIG. 12, the result output unit 28 and the like connect a storage unit 101 for storing various programs, a calculation unit 100 such as a CPU, an output unit 102, an input unit 103, a communication unit 104, and the like to a bus. This can be realized by causing the computer to execute each program stored in the storage unit 101.

  In FIG. 12, the storage unit 101 includes a plaintext input unit 21, a hash value calculation unit 22, a hash value polynomial generation unit 23, a public key input unit 24, a signature input unit 25, a signature verification unit 26, an algebraic curved surface generation unit 27, Plain text input program, hash value calculation program, hash value polynomial generation program, public key input program, signature input program, signature verification program, algebraic surface generation program, determination result output for realizing the respective functions of the determination result output unit 28 The program is stored. The storage unit 101 also functions as a public key storage unit 29 that stores a public key.

  A digital signature corresponding to the message m generated by the digital signature generation device is input to the signature input unit 25.

  Next, the second key generation method will be described. FIG. 8 shows a configuration example of a key generation apparatus using the second key generation method, and FIG. 9 is a flowchart for explaining the processing operation of the key generation apparatus of FIG. Hereinafter, the configuration and processing operation of the key generation device of FIG. 8 will be described with reference to the flowchart shown in FIG.

  A command for starting the key generation process is transmitted from the external device or the like to the control unit 1, and the key generation apparatus starts the key generation process (step S301). When the command is transmitted to the control unit 1, the control unit 1 requests the prime number generation unit 2 to generate a prime number. Prime numbers may be generated randomly, but it is not necessary to use a large prime number here, so it is random from a prime number of about 6 bits at most (by means such as predetermining the output order). Alternatively, a prime number that is predetermined by the key generation device may be used. Here, it is assumed that a prime number p = 17 is generated (step S302).

The control unit 1 transmits the prime number p to the section generation unit 5, and the section generation unit 5 starts generating the section. In the section generator 5, n sections
Di: (x, y, s, t) = (ux _{, i} (s, t), u _{y, i} (s, t), s, t)
(1 ≦ i ≦ n)
X coordinate u _{x, i} (s, t) and y coordinate u _{y, i} (s, t) are determined by the following method.

First, the dimension maximum value h _x related to s of the x coordinate and the dimension maximum value k _x related to t are determined (step S303). That is,

Here, for simplification, it is assumed that h _x = k _x = 2.

Next, the two-variable polynomial generator 3 is requested to generate the x-coordinates u _{x, i} (s, t) of the section Di within the range of the order including the term of s ^hx t ^kx . Here, since n = 3, the two-variable polynomial generating unit 3 randomly selects _{ux, 1} (s, t), ux _{, 2} (s, t), ux _{, 3} (s, t). Are sequentially determined (step S304). That is,

Is obtained.

Next, similarly to step S303, the maximum dimension value h _y for s of the y coordinate and the maximum dimension value k _y for t are determined (step S305). That is,

Here, for simplification, it is assumed that h _y = k _y = 2.

Next, the two-variable polynomial generator 3 is requested to generate the y-coordinates u _{y, i} (s, t) of the section Di within the range of the order including the term s ^hy t ^ky . Here, since n = 3, the two-variable polynomial generation unit 3 randomly converts u _{y, 1} (s, t), u _{y, 2} (s, t), u _{y, 3} (s, t). Are sequentially determined (step S306). That is,

Is obtained.

  Thus, section Di is generated.

  These sections are output to the control unit 1. The control unit 1 outputs these sections to the three-dimensional manifold generation unit 6 to generate a three-dimensional manifold.

In the three-dimensional manifold generation unit 6, the input ux _{, i} (s, t) and uy _{, i} (s, t) are respectively
Factorize with x factor (x-u _{x, i} (s, t)) and y factor (y-u _{, i} (s, t)) (step S307).

Then, the factor x (x−u _{x, i} (s, t)) and the y factor (y−u _{y, i} (s, t)) having the same value of i are randomly distributed to the left side and the right side. Then, by connecting the product of the n factors distributed on the left side and the product of the n factors distributed on the right side with equal signs, four variables (x, y shown in the following equation (13)) are obtained. , S, t) generate a polynomial.

  The three-dimensional manifold generation unit 6 requests the 4-variable polynomial arithmetic unit 8 to develop the above expression (13) via the control unit 1 (or directly).

The 4-variable polynomial calculation unit 8 expands the above equation (13), collects the terms included in the 4-variable polynomial into one of the left side and the right side, and shows the following equation (14): A three-dimensional manifold A (x, y, s, t) is obtained (step S308).

  The 4-variable polynomial arithmetic unit 8 outputs the obtained three-dimensional manifold A (x, y, s, t) to the control unit 1. The control unit 1 outputs the three sections and the three-dimensional manifold A (x, y, s, t) as keys to the key output unit 7, and the key output unit 7 outputs these keys.

  8 (control unit 1, prime number generating unit 2, two variable polynomial generating unit 3, four variable polynomial calculating unit 8, section generating unit 5, three-dimensional manifold generating unit 6, key output unit 7, etc. ) Is stored in a computer in which a storage unit 101 for storing various programs, an arithmetic unit 100 such as a CPU, an output unit 102, an input unit 103, a communication unit 104, and the like are connected to a bus as shown in FIG. This can be realized by executing each program stored in the unit 101.

  In FIG. 13, the storage unit 101 includes a control unit 1, a prime number generation unit 2, a two variable polynomial generation unit 3, a four variable polynomial calculation unit 8, a section generation unit 5, a three-dimensional manifold generation unit 6, and a key output unit 7. A key generation control program, a prime number generation program, a two-variable polynomial generation program, a four-variable polynomial calculation program, a section generation program, a three-dimensional manifold generation program, and a key output program for realizing these functions are stored.

  The secret key and public key output from the key output unit 7 in FIG. 8 are transmitted to the request source via the communication unit 104, or passed to a digital signature generation device and a digital signature verification device described later, for example.

When the two-variable polynomial generating unit 3 of the key generating device shown in FIG. 8 generates a two-variable polynomial corresponding to the x-coordinate and y-coordinate of the section in order to increase security, the maximum number of characters for the variables s and t (The maximum degree hx of the x coordinate variable s, the maximum order kx of the x coordinate variable t, the maximum order hy of the y coordinate variable s, and the maximum polynomial number ky of the y coordinate variable t) are defined respectively. , S ^hx t ^kx is always generated, and for the y-coordinate, a two-variable polynomial is always generated that includes s ^hy t ^ky .

However, the present invention is not limited to this, and a two-variable polynomial u _x including a variable s whose degree is equal to or less than the maximum value hx and a plurality of mononomials having at least one of a variable t whose degree is equal to or less than the maximum value kx as a factor. _{, I} (s, t) (i: 1 ≦ i ≦ n), a plurality of variables having at least one of a variable s whose order is the maximum value hy or less and a variable t whose order is the maximum value ky or less as a factor By generating a two-variable polynomial u _{y, i} (s, t) (i: 1 ≦ i ≦ n) including the monomial, a three-dimensional manifold having n sections can be generated.

As described above, according to the above embodiment, the digital signature generation device of the message sender finite field F _p and, x coordinate, y coordinate, the parameter s, and the on the finite field F _p which is represented by a parameter t Of the curved surfaces in the defined three-dimensional manifold A (x, y, s, t), the section D (u _x (s, t), where the x and y coordinates are expressed by functions of parameters s and t. u _y (s, y), s, t) is stored in the storage means as a secret key for signature generation. Operation means such as a CPU calculates the hash value of the message m, embedding the hash value to the coefficients of the finite field F _p on the defined one-variable polynomial h (t), and generates a hash value polynomial. Then, the calculation means reads one section from the storage means, and generates a digital signature using it as a secret key for signature generation. That is, by substituting the hash value polynomial into the s coordinate of the section, the digital signature Ds (U _x (t), U _y ) is a curve on the section in which the x coordinate and the y coordinate are expressed as a function of the parameter t. (T), t) are generated. The digital signature generated in this way is transmitted to the message receiving side together with the message m by the transmitting means on the message transmitting side.

The storage means stores a plurality of different sections D _i (ux _{, i} (s, t), u _{y, i} (s, t), s, t) (i is an arbitrary positive integer _satisfying 0 ≦ i ≦ n. ) And a digital signature is generated, and by selecting any one of a plurality of sections Di stored in the storage means and generating a digital signature, security is further increased. .

Also, the digital signature verification device on the message receiving side is defined on the finite field F _p represented by the x-coordinate, y-coordinate, parameter s, and parameter t as the finite field F _p and the public key in the storage means. A polynomial of a three-dimensional manifold A (x, y, s, t) is stored. When a message m and a digital signature Ds: (U _x (t), U _y (t), t) corresponding to the message m are input, a calculation means such as a CPU calculates a hash value of the message m. The hash value is embedded in a one-variable polynomial h (t) defined on the finite field F _p to generate a hash value polynomial. Then, the calculation means substitutes the hash value polynomial from the storage means to the s coordinate of the polynomial of the three-dimensional manifold A (x, y, s, t) that is the public key corresponding to the message transmission side, An algebraic surface X (x, y, t) corresponding to the hash value is calculated. Further, the arithmetic means substitutes the digital signature for the algebraic surface X (x, y, t), and verifies the validity of the message and the digital signature. That is, the x coordinate of the digital signature (represented by the polynomial of variable t) U _x (t) is substituted for the x coordinate of the algebraic surface X (x, y, t), and the algebraic surface X (x, y, t) Substituting the y-coordinate of the digital signature (represented by the polynomial of the variable t) U _y (t) into the y-coordinate of (), then expanding the formula (representing the product of the polynomial in the form of a monomial sum) To do. When this result (the result of substituting the x coordinate and y coordinate of the digital signature for the algebraic surface X (x, y, t)) is “0”, the message m is not falsified, and the message m is It is verified that the message is transmitted from a legitimate message sender corresponding to the public key (signature verification success).

In the key generation device, a calculation means such as a CPU includes a first two-variable polynomial λ _x (s, t) relating to parameters s and t defined on the finite field F _p and the first two-variable polynomial λ. Generate a second two-variable polynomial λ _y (s, t) defined on the finite field F _p that is divisible by _x (s, t), and then the variable x defined on the finite field F _p Are expressed by parameters s and t, and two differential variables u _x (s, t) and v _x (s, t) are converted into the difference {u _x (s, t) −v _x of the two variable variables. (S, t)} is generated to be λ _x (s, t), and further, two two-variable polynomials u defined on the finite field F _p are represented by the parameters y and s. _{y (s, t), v} y (s, t) and the difference of the two 2-variable polynomials _{{u y (s, t)} -v y (s, t)} is lambda _y ( , To produce in such a way that t). The computing means then has a section D1: (x, y, s, t) = (u) in which the two-variable polynomial u _x (s, t) is the x coordinate and the two variable function u _y (s, t) is the y coordinate. _x (s, t), u _y (s, t), s, t) and the two-variable polynomial v _x (s, t) are the x-coordinate and the two-variable function v _y (s, t) is the y-coordinate. section _{D2: (x, y, s} , t) = (v x (s, t), v y (s, t), s, t) to generate a. These two sections D1 and D2 are secret keys. Also, a three-dimensional manifold A (x, y, s, t) having these two sections D1 and D2 is generated. This three-dimensional manifold A is a public key.

In another key generation device, the arithmetic means such as a CPU has n (n is a positive integer) number of the finite fields F _p from the first to the n-th (n is a positive integer) regarding the parameters s and t. On the above-defined two-variable polynomials u _{x, i} (s, t) (i: 1 ≦ i ≦ n) and the first to nth finite fields F _{p with} respect to the parameters s and t A defined two-variable polynomial u _{y, i} (s, t) (i: 1 ≦ i ≦ n) is generated. The calculation means uses the generated i-th (1 ≦ i ≦ n) -th two-variable polynomials u _{x, i} (s, t) and u _{y, i} (s, t) as x-coordinate and y-coordinate respectively. Generate i-th section Di: (x, y, s, t) = (ux _{, i} (s, t), u _{y, i} (s, t), s, t) (1 ≦ i ≦ n) Thus, n sections Di (1 ≦ i ≦ n) from the first to the n-th are obtained. These n sections are secret keys. Further, the computing means uses the generated i-th (1 ≦ i ≦ n) -th two-variable polynomials u _{x, i} (s, t) and u _{y, i} (s, t) to generate the i-th By generating x-factor (x-u _{x, i} (s, t)) and y-factor (y-u _{y, i} (s, t)), the first to n-th x-factor and y Find the factor. The computing means distributes the generated i-th (1 ≦ i ≦ n) -th x factor and y factor to the left side and the right side, and the product of n number of x factors and y factor distributed to the left side and the right side When an equality obtained by connecting the product of the distributed n x factors and y factors with an equal sign is generated, by expanding the generated equality, a three-dimensional manifold that is a public key A polynomial of A (x, y, s, t) is generated.

  As described above, the digital signature system based on the public key cryptography according to the above-described embodiment can generate a robust digital signature with high security and reliability, and can be realized with a small amount of calculation. .

  DESCRIPTION OF SYMBOLS 1 ... Control part, 2 ... Prime number generation part, 3 ... Two variable polynomial generation part, 4 ... Two variable polynomial calculation part, 5 ... Section generation part, 6 ... Three-dimensional manifold generation part, 7 ... Key output part, 11 ... Plain text input unit, 12 ... Hash value calculation unit, 13 ... Hash value polynomial generation unit, 14 ... Secret key input unit, 15 ... Signature generation unit, 16 ... Section selection unit, 17 ... Signature output unit, 21 ... Plain text input unit, DESCRIPTION OF SYMBOLS 22 ... Hash value calculation part, 23 ... Hash value polynomial generation part, 24 ... Public key input part, 25 ... Signature input part, 26 ... Signature verification part, 27 ... Algebraic curved surface generation part, 28 ... Judgment result output part, 8 ... 4-variable polynomial arithmetic unit.

Claims (9)

A finite field F _q and a three-dimensional manifold A (x, y, defined on the finite field F _q represented by an x coordinate, a y coordinate, a parameter s, and a parameter t, which are used as a public key for signature verification. s, t) and among the curved surfaces in the three-dimensional manifold A (x, y, s, t) used as a secret key for signature generation, the x coordinate and the y coordinate are expressed by functions of parameters s and t. A key generation device for generating a generated section,
First generating means for generating a first two-variable polynomial λ _x (s, t) defined on the finite field F _{q with} respect to parameters s and t;
Second generating means for generating a second two-variable polynomial λ _y (s, t) defined on the finite field F _q that is divisible by the first two-variable polynomial λ _x (s, t);
Two two-variable polynomials u _x (s, t) and v _x (s, t) defined on the finite field F _{q with} respect to the parameters s and t are expressed by the difference {u _x (s , T) −v _x (s, t)} to be the first two-variable polynomial λ _x (s, t),
The two two-variable polynomials u _y (s, t) and v _y (s, t) defined on the finite field F _{q with} respect to the parameters s and t are expressed by the difference {u _y (s , T) −v _y (s, t)} to be the second two-variable polynomial λ _y (s, t),
A section in which the two-variable polynomial u _x (s, t) generated by the third generating means is an x coordinate and the two variable function u _y (s, t) generated by the fourth generating means is a y coordinate. D1: (x, y, s, t) = (u _x (s, t), u _y (s, t), s, t), and the two-variable polynomial v _x generated by the third generating means Section D2 where (s, t) is an x coordinate and the two variable function v _y (s, t) generated by the fourth generation means is a y coordinate: (x, y, s, t) = (v _x Section generating means for generating (s, t), v _y (s, t), s, t);
Three-dimensional manifold generating means for generating a polynomial of the three-dimensional manifold A (x, y, s, t) including the section D1 and the section D2.
A key generation apparatus comprising: A finite field F _q and a three-dimensional manifold A (x, y, defined on the finite field F _q used as a public key for signature verification represented by an x coordinate, a y coordinate, a parameter s, and a parameter t. s, t) and a secret key for signature generation in which the x-coordinate and y-coordinate of the curved surface in the three-dimensional manifold A (x, y, s, t) are represented by functions of parameters s and t A key generation device for generating a section used as:
Two variable polynomials ux _{, i} (s, s, t) defined on the first to nth (n is a positive integer) number n (n is a positive integer) of the finite fields F _{q with} respect to the parameters s, t. t) (i: 1 ≦ i ≦ n) and the two-variable polynomials u _{y, i} (s, t) defined on the first to nth finite fields F _{q with} respect to the parameters s and t. ) (I: 1 ≦ i ≦ n)
The i-th (1 ≦ i ≦ n) -th two-variable polynomials u _{x, i} (s, t) and u _{y, i} (s, t) generated by the first generation unit are respectively expressed as x-coordinate and y-coordinate. I-th section Di: (x, y, s, t) = (u _{x, i} (s, t), u _{y, i} (s, t), s, t) (1 ≦ i ≦ n) ) To generate n sections Di (1 ≦ i ≦ n) from the first to the nth,
Using the i-th (1 ≦ i ≦ n) -th two-variable polynomials u _{x, i} (s, t) and u _{y, i} (s, t) generated by the first generation means, the i-th X-factor (x-u _{x, i} (s, t)) and y-factor (y-u _{, i} (s, t)) of the first to n-th and a third generating means for obtaining a y factor;
The i-th (1 ≦ i ≦ n) -th x factor and y factor generated by the third generation unit is distributed to the left side and the right side, and the product of n x factors and y factor distributed to the left side A fourth generating means for generating an equation obtained by connecting the product of n x-factors and y-factors distributed to the right side with an equal sign;
Fifth generation means for generating a polynomial of the three-dimensional manifold A (x, y, s, t) by expanding the equation generated by the fourth generation means;
A key generation apparatus comprising: The first generation means includes:
Means for determining a maximum order value hx for the parameter s of the bivariate polynomial u _{x, i} (s, t) and a maximum order value kx for the parameter t;
The i-th two variables including a plurality of mononomials having at least one of a variable s whose degree is equal to or smaller than the maximum value hx and a variable t whose degree is equal to or smaller than the maximum value kx as a factor, and a term of s ^hx t ^kx Means for generating a polynomial u _{x, i} (s, t) (i: 1 ≦ i ≦ n);
Means for determining a maximum order value hy for the variable s of the bivariate polynomial u _{y, i} (s, t) and a maximum order value ky for the variable t;
The i-th 2nd item including a plurality of unary expressions having at least one of a variable s whose degree is equal to or less than the maximum value hy and a variable t whose order is equal to or less than the maximum value ky, and a term of s ^hy t ^ky Means for generating a variable polynomial u _{y, i} (s, t) (i: 1 ≦ i ≦ n);
The key generation device according to claim 2, comprising: A first generation unit, a second generation unit, a third generation unit, a fourth generation unit, a section generation unit, and a three-dimensional manifold generation unit; and a finite field F _q and a public key for signature verification The three-dimensional manifold A (x, y, s, t) defined on the finite field F _q represented by the x-coordinate, y-coordinate, parameter s, and parameter t, and the secret key for signature generation Key generation of a key generation device that generates a section in which the x coordinate and the y coordinate are expressed by functions of parameters s and t among the curved surfaces in the three-dimensional manifold A (x, y, s, t) used as A method,
A first step in which the first generation means generates a first two-variable polynomial λ _x (s, t) with respect to parameters s and t defined on the finite field F _q ;
The second generation means generates a second two-variable polynomial λ _y (s, t) defined on the finite field F _q that is divisible by the first two-variable polynomial λ _x (s, t). A second step;
The third generation means generates two two-variable polynomials u _x (s, t) and v _x (s, t) with respect to parameters s and t defined on the finite field F _q as the two two variables. A third step of generating a polynomial difference {u _x (s, t) −v _x (s, t)} to be the first two-variable polynomial λ _x (s, t);
The fourth generation means _converts the two two-variable polynomials u _y (s, t) and v _y (s, t) related to the parameters s and t defined on the finite field F _q into the two two variables. A fourth step of generating a polynomial difference {u _y (s, t) −v _y (s, t)} to be the second two-variable polynomial λ _y (s, t);
The section generation means uses the _x variable of the two-variable polynomial u _x (s, t) generated by the third generation means in the third step, and the fourth generation means in the fourth step. Section D1: (x, y, s, t) = (u _x (s, t), u _y (s, t), s, with the generated two-variable function u _y (s, t) as the y coordinate t), and the two-variable polynomial v _x (s, t) generated by the third generation means in the third step is an x-coordinate, and is generated by the fourth generation means in the fourth step. two-variable function _v y (s, t) section and a y-coordinate _{D2: (x, y, s} , t) = (v x (s, t), v y (s, t), s, t) A fifth step of generating
A sixth step in which the three-dimensional manifold generating means generates a polynomial of the three-dimensional manifold A (x, y, s, t) including the section D1 and the section D2.
A key generation method characterized by comprising: A first generation unit, a second generation unit, a third generation unit, a fourth generation unit, and a fifth generation unit; a finite field _{Fq, an} x coordinate, a y coordinate, a parameter s, and a parameter t. And the three-dimensional manifold A (x, y, s, t) defined on the finite field F _q used as a public key for signature verification, and the three-dimensional manifold A (x, y, A key generation method of a key generation device that generates a section used as a secret key for signature generation, in which x coordinate and y coordinate are represented by functions of parameters s and t among curved surfaces in s, t). ,
The first generation means includes two variables defined on n (n is a positive integer) number of the finite field F _q from the first to the n-th (n is a positive integer) regarding the parameters s and t. Polynomial u _{x, i} (s, t) (i: 1 ≦ i ≦ n) and two variable polynomials defined on the first to nth finite fields F _{q with} respect to parameters s and t a first step of generating u _{y, i} (s, t) (i: 1 ≦ i ≦ n);
The second generation means is the i-th (1 ≦ i ≦ n) -th two-variable polynomial u _{x, i} (s, t) and u _y generated by the first generation means in the first step. _{, I} (s, t) are the i-th section Di: (x, y, s, t) = (u _{x, i} (s, t), u _{y, i} (s , T), s, t) (1 ≦ i ≦ n) to generate n sections Di (1 ≦ i ≦ n) from the first to the nth,
The third generating means is the i-th (1 ≦ i ≦ n) -th two-variable polynomial u _{x, i} (s, t) and u _y generated by the first generating means in the first step. _{, I} (s, t) to generate the i-th x-factor (x-u _{x, i} (s, t)) and y-factor (y- _{y, i} (s, t)) A third step for obtaining the first to nth x-factor and y-factor;
The fourth generation unit distributes the i-th (1 ≦ i ≦ n) -th x factor and y factor generated by the third generation unit in the third step into a left side and a right side, and A fourth step of generating an equation obtained by connecting the product of the distributed n x-factors and y-factors and the product of the n-numbered x-factors and y-factors distributed on the right side with an equal sign; ,
The fifth generation means expands the equation generated by the fourth generation means in the fourth step, thereby generating the polynomial of the three-dimensional manifold A (x, y, s, t). A fifth step of generating,
A key generation method characterized by comprising: The first step includes
Determining a maximum degree hx for the parameter s of the bivariate polynomial u _{x, i} (s, t) and a maximum order kx for the parameter t;
The i-th two variables including a plurality of mononomials having at least one of a variable s whose degree is equal to or smaller than the maximum value hx and a variable t whose degree is equal to or smaller than the maximum value kx as a factor, and a term of s ^hx t ^kx Generating a polynomial u _{x, i} (s, t) (i: 1 ≦ i ≦ n);
Determining a maximum degree hy for the variable s of the bivariate polynomial u _{y, i} (s, t) and a maximum degree ky for the variable t;
The i-th item including a plurality of mononomials having at least one of a variable s of which the order is the maximum value hy or less and a variable t of which the order is the maximum value ky as a factor, and a term of s ^hy t ^ky Generating a bivariate polynomial u _{y, i} (s, t) (i: 1 ≦ i ≦ n);
The key generation device according to claim 5, comprising: A first generation unit, a second generation unit, a third generation unit, a fourth generation unit, a section generation unit, and a three-dimensional manifold generation unit; and a finite field F _q and a public key for signature verification The three-dimensional manifold A (x, y, s, t) defined on the finite field F _q represented by the x-coordinate, y-coordinate, parameter s, and parameter t, and the secret key for signature generation A computer as a key generation device that generates a section in which the x-coordinate and y-coordinate are expressed by functions of parameters s and t among the curved surfaces in the three-dimensional manifold A (x, y, s, t) used as A key generation program for functioning,
A first step in which the first generation means generates a first two-variable polynomial λ _x (s, t) with respect to parameters s and t defined on the finite field F _q ;
The second generation means generates a second two-variable polynomial λ _y (s, t) defined on the finite field F _q that is divisible by the first two-variable polynomial λ _x (s, t). A second step;
The third generation means generates two two-variable polynomials u _x (s, t) and v _x (s, t) with respect to parameters s and t defined on the finite field F _q as the two two variables. A third step of generating a polynomial difference {u _x (s, t) −v _x (s, t)} to be the first two-variable polynomial λ _x (s, t);
The fourth generation means _converts the two two-variable polynomials u _y (s, t) and v _y (s, t) related to the parameters s and t defined on the finite field F _q into the two two variables. A fourth step of generating a polynomial difference {u _y (s, t) −v _y (s, t)} to be the second two-variable polynomial λ _y (s, t);
The section generation means uses the _x variable of the two-variable polynomial u _x (s, t) generated by the third generation means in the third step, and the fourth generation means in the fourth step. Section D1: (x, y, s, t) = (u _x (s, t), u _y (s, t), s, with the generated two-variable function u _y (s, t) as the y coordinate t), and the two-variable polynomial v _x (s, t) generated by the third generation means in the third step is an x-coordinate, and is generated by the fourth generation means in the fourth step. two-variable function _v y (s, t) section and a y-coordinate _{D2: (x, y, s} , t) = (v x (s, t), v y (s, t), s, t) A fifth step of generating
A sixth step in which the three-dimensional manifold generating means generates a polynomial of the three-dimensional manifold A (x, y, s, t) including the section D1 and the section D2.
Key generation program for causing a computer to execute A first generation unit, a second generation unit, a third generation unit, a fourth generation unit, and a fifth generation unit; a finite field _{Fq, an} x coordinate, a y coordinate, a parameter s, and a parameter t. And the three-dimensional manifold A (x, y, s, t) defined on the finite field F _q used as a public key for signature verification, and the three-dimensional manifold A (x, y, s, t) for causing a computer to function as a key generation device for generating a section used as a secret key for signature generation in which x and y coordinates are represented by functions of parameters s and t A key generation program,
The first generation means includes two variables defined on n (n is a positive integer) number of the finite field F _q from the first to the n-th (n is a positive integer) regarding the parameters s and t. Polynomial u _{x, i} (s, t) (i: 1 ≦ i ≦ n) and two variable polynomials defined on the first to nth finite fields F _{q with} respect to parameters s and t a first step of generating u _{y, i} (s, t) (i: 1 ≦ i ≦ n);
The second generation means is the i-th (1 ≦ i ≦ n) -th two-variable polynomial u _{x, i} (s, t) and u _y generated by the first generation means in the first step. _{, I} (s, t) are the i-th section Di: (x, y, s, t) = (u _{x, i} (s, t), u _{y, i} (s , T), s, t) (1 ≦ i ≦ n) to generate n sections Di (1 ≦ i ≦ n) from the first to the nth,
The third generating means is the i-th (1 ≦ i ≦ n) -th two-variable polynomial u _{x, i} (s, t) and u _y generated by the first generating means in the first step. _{, I} (s, t) to generate the i-th x-factor (x-u _{x, i} (s, t)) and y-factor (y- _{y, i} (s, t)) A third step for obtaining the first to nth x-factor and y-factor;
The fourth generation unit distributes the i-th (1 ≦ i ≦ n) -th x factor and y factor generated by the third generation unit in the third step into a left side and a right side, and A fourth step of generating an equation obtained by connecting the product of the distributed n x-factors and y-factors and the product of the n-numbered x-factors and y-factors distributed on the right side with an equal sign; ,
The fifth generation means expands the equation generated by the fourth generation means in the fourth step, thereby generating the polynomial of the three-dimensional manifold A (x, y, s, t). A fifth step of generating,
Key generation program for causing a computer to execute The first step includes
Determining a maximum degree hx for the parameter s of the bivariate polynomial u _{x, i} (s, t) and a maximum order kx for the parameter t;
The i-th two variables including a plurality of mononomials having at least one of a variable s whose degree is equal to or smaller than the maximum value hx and a variable t whose degree is equal to or smaller than the maximum value kx as a factor, and a term of s ^hx t ^kx Generating a polynomial u _{x, i} (s, t) (i: 1 ≦ i ≦ n);
Determining a maximum degree hy for the variable s of the bivariate polynomial u _{y, i} (s, t) and a maximum degree ky for the variable t;
The i-th 2nd item including a plurality of unary expressions having at least one of a variable s whose degree is equal to or less than the maximum value hy and a variable t whose order is equal to or less than the maximum value ky, and a term of s ^hy t ^ky Generating a variable polynomial u _{y, i} (s, t) (i: 1 ≦ i ≦ n);
The key generation program according to claim 8, comprising:

Images