JP5355263B2 - Key sharing apparatus, key sharing method and program - Google Patents

Description

  The present invention relates to an application of information security technology, and more particularly to a key exchange technology for sharing a key between devices.

  One of the conventional techniques for exchanging keys between devices is the following system (see, for example, Non-Patent Document 1).

[Public parameters]
Let G be a cyclic group of order q (q is a prime number) of L bits (L ≧ 1), and g be a generator of G. H: {0, 1} ^* → {0, 1} Let ^L be a hash function that copies a bit string of arbitrary length to a bit string of L bits. Also, ID (algo) is an algorithm identifier that describes how to use the shared key K (authentication key, encryption key, etc.).

[Key exchange]
A device PA (1) having an identifier ID (1), a secret key a (1) εZ _q and a public key A (1) = ga ⁽¹⁾ εG, an identifier ID (2) and a secret key a (2 ) ΕZ _q and public key A (2) = ga ^{(2) The} device PA (2) having εG shares the key K as follows.

1. The device PA (1) generates a random number r (1) εZ _q and sends the identifier ID (1) and X (1) = gr ⁽¹⁾ εG to the device PA (2).

2. The device PA (2) generates a random number r (2) εZ _q and sends the identifier ID (2) and X (2) = gr ⁽²⁾ εG to PA (1).

3. The device PA (1) calculates φ (1) = X (2) ^{r (1)} εG and φ (2) = A (2) ^{a (1)} εG, and calculates the key K = H (φ (1 ), Φ (2), ID (1), ID (2), ID (algo)).

4). The device PA (2) calculates φ (1) = X (1) ^{r (2)} εG and φ (2) = A (1) ^{a (2)} εG, and calculates the key K = H (φ (1 ), Φ (2), ID (1), ID (2), ID (algo)).

Here, since operations in the cyclic group G are commutative, both φ (1) and φ (2) generated by the devices PA (1) and PA (2)
φ (1) = g ^{r (1) ・ r (2)} ∈G… (1)
φ (2) = g ^{a (1) ・ a (2)} ∈G… (2)
Thus, the same key K is shared by the devices PA (1) and PA (2).

Elaine Barker, Don Johnson, and Miles Smid, "NIST Special Publication 800-56A: Recommendation for Pair-WiseKey Establishment Schemes Using Discrete Logarithm Cryptography", Section 6.1.1.2

  However, the method of Non-Patent Document 1 has a problem that it is vulnerable to a KCI attack (Key-Compromise Impersonation attack).

  The attacker M can perform a KCI attack as follows.

0. The attacker M obtains the secret key a (1) εZ _q of the device PA (1).

1. The device PA (1) generates a random number r (1) εZ _q and sends the identifier ID (1) and X (1) = gr ⁽¹⁾ εG to the device PA (2).

2. The attacker M generates a random number r (2) εZ _q and sends the identifier ID (2) and X (2) = gr ⁽²⁾ εG to PA (1).

3. The device PA (1) calculates φ (1) = X (2) ^{r (1)} εG and φ (2) = A (2) ^{a (1)} εG, and calculates the key K = H (φ (1 ), Φ (2), ID (1), ID (2), ID (algo)).

4). The attacker M calculates φ (1) = X (1) ^{r (2)} εG and φ (2) = A (2) ^{a (1)} εG, and calculates the key K = H (φ (1), φ (2), ID (1), ID (2), ID (algo)) is calculated.

As described above, the attacker M who obtained the secret key a (1) εZ _q of the device PA (1) does not know the secret key a (2) εZ _q of the device PA (2). The device PA (2) can be impersonated and the device PA (1) can share the key K.

  The present invention has been made in view of such a point, and an object thereof is to provide a key sharing technique that is resistant to KCI attacks.

In the present invention, a key sharing device that shares a key with another device includes at least an integer secret value a (i) or an element Z (i) = ga ^{(i) · MSK} εG of ^a cyclic group G, and the like. The public value A (j) = ga ^(j) εG, which is an element of the cyclic group G corresponding to the device in FIG. Note that i, jε {1,. . . , P}, j ≠ i, P is an integer constant of 2 or more, g is a generator that can represent all elements of the cyclic group G by g ^m , and MSK, m, and a (j) are integers . This key sharing apparatus executes the following processing.

First, the key sharing device generates an integer arbitrary value r (i), generates a first arbitrary element X (i) = g ^{r (i)} εG, and outputs the first arbitrary element X (i). . This first arbitrary element X (i) is input to another device.

Further, the second arbitrary element X (j) = gr ^(j) εG output from another device is input to the key sharing device. R (j) is an integer.

The key sharing device has at least a secret value a (i) or an element Z (i) = ga (i) · MSK εG, a public value A (j) = ga (j) εG, and an arbitrary value r Using (i) and the second arbitrary element X (j) = g r (j) ∈ G and generating the element g W (u) ∈ G of the cyclic group G as a shared element σ (u), or further using the function e that maps original cyclic group G to the original cyclic group G T, it generates the original g T W (u) ∈G T of the cyclic group G T as the Pool sigma (u). Note that W (u) is an integer w (u, 1),. . . , W (u, P) is a product of P or more integers, and the integer w (u, p) is a linear sum of a plurality of integers including a (p) and r (p), p ∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer of 1 or more constants, g T is a generator that can represent all of the original cyclic group G T by g T m.

  Then, the key sharing device generates a key K whose value is determined based on at least the sharing source σ (u), and outputs the key K.

Here, W (u) is an integer w (u, 1),. . . , W (u, P) and a product of P or more integers, and the integer w (u, p) is a (p) and r (p) (pε {1,..., P}). Is a linear sum of multiple integers. In this case, the key sharing apparatus knows both the arbitrary value r (i) generated by itself and the corresponding secret value a (i) or element Z (i) = ga ^{(i) · MSK} εG. Otherwise, the sharing source σ (u) cannot be generated. Therefore, even if an attacker who knows the integer a (j) of another device generates an arbitrary value r (i) and impersonates a key sharing device, the attacker corresponds to the arbitrary value r (i). Since the secret value a (i) is not known, correct σ (u) cannot be generated. Therefore, the KCI attack is not successful.

  As described above, the key sharing technique of the present invention is strong against KCI attacks.

FIG. 1A is a diagram for illustrating the overall configuration of the key sharing system of this embodiment. FIG. 1B is a diagram for explaining the basic configuration of the key sharing apparatus of the present embodiment. FIG. 2 is a block diagram for explaining the configuration of the key sharing system according to the first embodiment. FIG. 3A is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 3B is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 4A is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 4B is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 5 is a block diagram for explaining the configuration of the key sharing system of the second embodiment. FIG. 6 is a block diagram for explaining the configuration of the key sharing system according to the second embodiment. FIG. 7 is a block diagram for explaining the configuration of the key sharing system according to the second embodiment. FIG. 8A is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 8B is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 9 is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 10A is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 10B is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 11 is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 12 is a block diagram for explaining the configuration of the key sharing system according to the third embodiment. FIG. 13 is a block diagram for explaining the configuration of the key sharing system according to the third embodiment. FIG. 14A is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 14B is a block diagram for explaining the configuration of the sharing source generation unit. FIG. 15A is a flowchart for explaining the key sharing process of the key sharing apparatus. FIG. 15B is a flowchart for explaining the key sharing process of the key sharing apparatus.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

〔Overview〕
First, the outline of this embodiment will be described.

  FIG. 1A is a diagram for illustrating the overall configuration of the key sharing system 1 of the present embodiment, and FIG. 1B is a diagram for explaining the basic configuration of the key sharing device of the present embodiment. .

  As illustrated in FIG. 1A, the key sharing system 1 according to the present embodiment includes a plurality of key sharing apparatuses 10-p (pε {1,..., P}, P is an integer constant equal to or greater than 2). For example, it is configured to be able to exchange information through the network 20. Note that the exchange of information between the plurality of key sharing apparatuses 10-p is not limited to that performed via a network, and may be performed by, for example, reading / writing information from / to a portable recording medium such as a USB memory. .

The storage unit 11-i (FIG. 1B) of the key sharing device 10-i stores at least an integer secret value a (i) or an element Z (i) of the cyclic group G = ga ^{(i) · MSK.} ΕG and the public value A (j) = ga ^(j) εG, which is an element of the cyclic group G corresponding to the other key sharing apparatus 10-j, are stored. Note that i, jε {1,. . . , P}, j ≠ i, g is a generator capable of expressing all elements of the cyclic group G by g ^m , and MSK, m and a (j) are integers.

When the key sharing device 10-i shares a key with another key sharing device 10-j, first, the arbitrary value generation unit 12-i (FIG. 1B) of the key sharing device 10-i is an integer arbitrary value. r (i) is generated and an arbitrary value r (i) is output. Next, the arbitrary element generation unit 13-i receives the arbitrary value r (i) as an input, generates the first arbitrary element X (i) = gr ⁽ⁱ⁾ ∈ G, and the first arbitrary element X (i) = g ^{r (i)} ∈G is output. The output unit 14-i receives the first arbitrary element X (i) = g ^{r (i)} εG and outputs the first arbitrary element X (i) = g ^{r (i)} εG. The first arbitrary element X (i) = gr ⁽ⁱ⁾ εG is input to another key sharing apparatus 10-j.

Further, the second arbitrary element X (j) = gr (j) εG output from the other key sharing apparatus 10-j is input to the input unit 15-i of the key sharing apparatus 10-i. R (j) is an integer. The shared element generation unit 16-i has at least the secret value a (i) or the element Z (i) = ga (i) · MSK εG and the public value A (j) = ga (j) εG. , An arbitrary value r (i) and a second arbitrary element X (j) = g r (j) ∈ G, and an element g W (u) ∈ G of the cyclic group G is generated as a shared element σ (u) either, or, using function e for further mapping the original cyclic group G to the original cyclic group G T, generates the original g T W (u) ∈G T of the cyclic group G T as the Pool sigma (u) To do. Note that W (u) is an integer w (u, 1),. . . , W (u, P) is a product of P or more integers, and the integer w (u, p) is a linear sum of a plurality of integers including a (p) and r (p), p ∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer of 1 or more constants, g T is a generator that can represent all of the original cyclic group G T by g T m. The sharing source generation unit 16-i outputs the generated sharing source σ (u).

  The key generation unit 17-i receives the sharing element σ (u) as an input and receives a key K whose value is determined based on at least the sharing element σ (u) (at least a key K whose value depends on the sharing element σ (u)). Generate and output the key K.

The key sharing device 10-i knows both the arbitrary value r (i) generated by itself and the corresponding secret value a (i) or element Z (i) = ga ^{(i) · MSK} εG. Otherwise, the sharing source σ (u) cannot be generated. Therefore, even if an attacker who knows the integer a (j) of the key sharing device 10-j generates an arbitrary value r (i) and tries to impersonate the key sharing device 10-i, the attacker has the arbitrary value r. Since the secret value a (i) corresponding to (i) is not known, correct σ (u) cannot be generated. Therefore, the KCI attack is not successful.

  In addition, at least a part of the integers w (u, p) is a linear sum of a plurality of integers including a (p) and r (p) at least one of which is weighted by the integer d (p), and the integer d (P) may be an integer whose value is determined according to the first arbitrary element X (i) and / or the second arbitrary element X (j). For example, when the integer d (p) is an integer whose value is determined according to the first arbitrary element X (i), the value of the integer d (p) is specified until the first arbitrary element X (i) is determined. Therefore, the key sharing device 10-i or an attacker who has impersonated the first arbitrary element X (() that is canceled when the key sharing device 10-j that is the key sharing partner generates the sharing source σ (u). i) cannot be generated intentionally. For example, when the integer d (p) is an integer whose value is determined according to the second arbitrary element X (j), the value of the integer d (p) is determined as the second arbitrary element X (j). Since the key sharing device 10-j or an attacker who has impersonated the key sharing device 10-i is the second arbitrary element that is canceled when the sharing source σ (u) is generated by the key sharing device 10-i X (j) cannot be generated intentionally. As a result, safety is further improved.

  Further, the sharing source generation unit 16-i has a plurality of types of sharing sources σ (1),. . . .sigma. (U) (U.gtoreq.2) is generated, and the key generation unit 17-i generates a plurality of types of sharing sources .sigma. . . A key K whose value is determined based on σ (U) may be generated. In this case, safety is further improved.

[First Embodiment]
Next, a first embodiment of the present invention will be described. In the first embodiment, P = 2, W (u) = w (u, 1) · w (u, 2), and w (u, p) is a (p), r (p) and Is the linear sum of Further, the storage unit of the first key sharing device stores at least the secret value a (i) and the public value A (j) = ga ^(j) εG, and the sharing source generation unit of the first key sharing device Are at least a secret value a (i), a public value A (j) = g ^{a (j)} εG, an arbitrary value r (i), and a second arbitrary element X (j) = g ^{r (j)} Using ∈G, the element g ^{W (u)} ∈G of the cyclic group G is generated as the sharing element σ (u). The storage unit of the second key sharing device stores at least the secret value a (j) and the public value A (i) = ga ⁽ⁱ⁾ εG, and the sharing source generation unit of the second key sharing device Are at least a secret value a (j), a public value A (i) = g ^{a (i)} εG, an arbitrary value r (j), and a first arbitrary element X (i) = g ^{r (i)} Using ∈G, the element g ^{W (u)} ∈G of the cyclic group G is generated as the sharing element σ (u).

<Configuration>
FIG. 2 is a block diagram for explaining the configuration of the key sharing system 100 of the first embodiment. In FIG. 2, description of a network and a portable recording medium which are means for exchanging information between key sharing apparatuses is omitted (the same applies to other drawings).

  As illustrated in FIG. 2, the key sharing system 100 according to the first embodiment includes a key sharing device 110-1 (first key sharing device) and a key sharing device 110-2 (second key sharing device).

  The key sharing device 110-1 includes a storage unit 111-1, an arbitrary value generation unit 112-1, an arbitrary element generation unit 113-1, an output unit 114-1, an input unit 115-1, and a shared source generation. Unit 116-1, key generation unit 117-1, temporary memory 118-1, and control unit 119-1. FIG. 3A is a block diagram for explaining the configuration of the sharing source generation unit 116-1. 3A, the sharing source generation unit 116-1 includes hash calculation units 116b-1 and 116c-1, and sharing source calculation units 116a-u-1 (uε {1,. , U}, U is an integer constant equal to or greater than 1.

  As illustrated in FIG. 2, the key sharing device 110-2 includes a storage unit 111-2, an arbitrary value generation unit 112-2, an arbitrary element generation unit 113-2, an output unit 114-2, and an input unit. 11-2, a sharing source generation unit 116-2, a key generation unit 117-2, a temporary memory 118-2, and a control unit 119-2. FIG. 3B is a block diagram for explaining the configuration of the sharing source generation unit 116-2. 3B, the sharing source generation unit 116-2 includes the hash calculation units 116b-2 and 116c-2, and the sharing source calculation units 116a-u-2 (uε {1,. , U}).

  The key sharing devices 110-1 and 110-2 are executed by reading a predetermined program into a known computer including, for example, a CPU (Central Processing Unit), a RAM (Random Access Memory), a ROM (Read-Only Memory), and the like. That is, the arbitrary value generators 112-1 and 112, the arbitrary element generators 113-1 and 113, the share source generators 116-1 and 116, the key generators 117-1 and 112, and the control unit. Reference numerals 119-1 and 119-2 are processing units configured by, for example, the CPU executing a predetermined program, and the arbitrary value generation units 112-1 and 112-2 are known random number generation ICs (integrated circuits). For example, the storage units 111-1 and 111-2 and the temporary memories 118-1 and 118-may include, for example, a RAM, a register, a cache memory, and an integrated circuit. Inside This is an auxiliary storage device such as an element or a hard disk, or a storage area composed of a combination of at least a part of them. A communication device such as a local area network) card or a reader / writer that reads and writes information from and on a recording medium.

  In addition, the key sharing apparatuses 110-1 and 110-2 execute the respective processes under the control of the control units 119-1 and 119-2. Although the description is simplified below, the data output from each processing unit is stored in the temporary memories 118-1 and 118-1 or the storage units 111-1 and 111-1 one by one. Data stored in the temporary memories 118-1 and 118-2 or the storage units 111-1 and 111-2 are read out as necessary, input to each processing unit, and used for the processing.

<Public parameters>
In the first embodiment, the following are the public parameters.

  G: Cyclic group of order q (q is a prime number) of L bits (L ≧ 1). Operations in the cyclic group G are commutative. Specific examples of the cyclic group G include a multiplicative group of remainder classes modulo q, a subgroup composed of points on an elliptic curve, and the like.

g: A generator of the cyclic group G. All elements of the cyclic group G can be expressed by g ^m (m is an integer). Note that g ^α ∈G means that the operation defined on the cyclic group G is executed α times (α is an integer) for the generation source g. For example, when the cyclic group G is a multiplicative group of residue classes modulo p, the operation defined on the cyclic group G is a residue multiplication modulo p, and g ^α ∈G is g ^α mod p. . When the cyclic group G is a subgroup on the elliptic curve, the operation defined on the cyclic group G is an elliptic addition on the elliptic curve, and g ^α ∈G is a generator g that is a point on the elliptic curve. Α multiplication on the elliptic curve for.

F: G → [0, q ^1/2 ]. A hash function that maps an element of the cyclic group G to an integer between 0 and q ^1/2 .

H: {0, 1} ^* → {0, 1} ^L. A hash function that copies an arbitrary-length bit string into an L-bit bit string.

  ID (prot): identifier of the name of the key exchange method.

<Pre-processing>
The following process is executed as a pre-process of the key sharing process.

In the storage unit 111-1 of the key sharing device 110-1, the secret value (secret key) a (1) εZ _q of the key sharing device 110-1 and the element of the cyclic group G corresponding to the key sharing device 110-1 are stored. The public value (public key) A (1) = g ^{a (1)} ∈ G and the public value (public key) A (2) = g that is the element of the cyclic group G corresponding to the key sharing device 110-2 ^{a (2)} εG, the identifier ID (1) of the key sharing device 110-1, and the identifier ID (prot) are stored. In addition, in the storage unit 111-2 of the key sharing device 110-2, the secret value (secret key) a (2) εZ _q of the key sharing device 110-2 and the cyclic group G corresponding to the key sharing device 110-1 are stored. Public value (public key) A (1) = ga ⁽¹⁾ εG and the public value (public key) A (2) that is the element of the cyclic group G corresponding to the key sharing device 110-2 = Ga ⁽²⁾ εG, the identifier ID (2) of the key sharing device 110-2, and the identifier ID (prot) are stored. Z _q means an integer remainder ring with respect to the modulus q, and an example thereof is a finite set composed of integers of 0 or more and q−1 or less. The identifiers ID (1) and ID (2) are e-mail addresses, telephone numbers, etc., for example.

<Key sharing process>
FIG. 4A is a flowchart for explaining the key sharing process of the key sharing apparatus 110-1, and FIG. 4B is a flowchart for explaining the key sharing process of the key sharing apparatus 110-2. is there.

The arbitrary value generator 112-1 of the key sharing device 110-1 (FIG. 2) generates and outputs an arbitrary value r (1) εZ _q (FIG. 4A / step S112-1). The arbitrary value r (1) εZ _q is, for example, a pseudo random number generated using a known pseudo random number generation algorithm, or a value selected from Z _q in a predetermined order. Arbitrary element generation unit 113-1 receives arbitrary value r (1) εZ _q , and arbitrary element generation unit 113-1 uses arbitrary value r (1) and arbitrary element X (1) = g ^{r (1)} Generate and output εG (step S113-1). Arbitrary element X (1) = gr ⁽¹⁾ ∈ G and identifier ID (1) read from the storage unit 111-1 are input to the output unit 114-1, and the output unit 114-1 X (1) = g ^{r (1)} εG and identifier ID (1) are output (such as transmission to a network or storage on a portable recording medium) (step S114-1). Arbitrary element X (1) = gr ⁽¹⁾ εG and identifier ID (1) are sent to key sharing apparatus 110-2.

On the other hand, the arbitrary value generation unit 112-2 of the key sharing device 110-2 (FIG. 2) generates and outputs an arbitrary value r (2) εZ _q (FIG. 4B / step S112-2). The arbitrary value r (2) εZ _q is, for example, a pseudo random number generated using a known pseudo random number generation algorithm, or a value selected from Z _q in a predetermined order. The arbitrary element generation unit 113-2 receives an arbitrary value r (2) εZ _q , and the arbitrary element generation unit 113-2 uses the arbitrary value r (2), and the arbitrary element X (2) = g ^{r (2)} Generate and output εG (step S113-2). Arbitrary element X (2) = gr ⁽²⁾ ∈ G and identifier ID (2) read from the storage unit 111-2 are input to the output unit 114-2, and the output unit 114-2 X (2) = g ^{r (2)} εG and identifier ID (2) are output (such as transmission to a network or storage on a portable recording medium) (step S114-2). Arbitrary element X (2) = gr ⁽²⁾ εG and identifier ID (2) are sent to key sharing apparatus 110-1.

Arbitrary element X (2) = gr ⁽²⁾ εG and identifier ID (2) are input to input section 115-1 of key sharing apparatus 110-1 (FIG. 4A / step S115-). 1). Arbitrary element X (2) = gr ⁽²⁾ εG is sent to sharing element generation section 116-1, and identifier ID (2) is stored in storage section 111-1.

In the sharing source generation unit 116-1, the arbitrary element X (2) = gr ⁽²⁾ εG sent from the input unit 115-1, and the secret value a (1 ⁾ read from the storage unit 111-1. ) And public value A (2) = ga ⁽²⁾ εG, the arbitrary value r (1) εZ _q generated by the arbitrary value generation unit 112-1 (step S112-1), and the arbitrary element generation unit The arbitrary element X (1) = gr ⁽¹⁾ εG generated in step 113-1 (step S113-1) is input. The shared element generation unit 116-1 uses these to convert the element g ^{W (u)} ∈ G ^(u ∈ {1,..., U}, U is an integer constant of 1 or more ^{) of} the cyclic group G into the shared element σ. (U) is generated and output (step S116-1). In this form,
W (u) = w (u, 1) ・ w (u, 2) ∈Z _q … (3)
w (u, 1) = (r (1) ・ s (u, 1) + a (1) ・ t (u, 1)) ∈Z _q … (4)
w (u, 2) = (r (2) ・ s (u, 2) + a (2) ・ t (u, 2)) ∈Z _q … (5)
G ^{W (u)} εG that satisfies the above is generated as a sharing element σ (u). s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q is a constant or variable determined for each u. s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q and U can be set arbitrarily, but s (u, 1) for all u And t (u, 1) and s (u, 2) and t (u, 2) are not necessarily set to 0. Hereinafter, setting examples of s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q and U, and the process of step S116-1 at that time will be described. Is illustrated.

[Example of Step S116-1]
In this form,
U = 2 (6)
s (1,1) = 1, t (1,1) = 1, s (1,2) = 1, t (1,2) = d (2)… (7)
s (2,1) = 1, t (2,1) = d (1), s (2,2) = 1, t (2,2) = 1… (8)
The process of step S116-1 is exemplified. That is,
σ (1) = g ^{(r (1) + a (1)) (r (2) + a (2) · d (2))} (9)
σ (2) = g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2))} … (10)
An example is shown.

In step S116-1 in this case, the hash calculator 116b-1 (FIG. 3A) receives the arbitrary element X (1) as an input, and the value is set according to the hash value (first arbitrary element X (i)). Fixed integer)
d (1) = F (X (1))… (11)
Is generated and output. Further, the hash calculation unit 116c-1 receives the arbitrary element X (2) as an input and takes a hash value (an integer whose value is determined according to the second arbitrary element X (j)).
d (2) = F (X (2))… (12)
Is generated and output.

The sharing element calculation unit 116a-1-1 (FIG. 3A) includes a hash value d (2), an arbitrary element X (2) = gr ⁽²⁾ εG, a secret value a (1), The public value A (2) = ga ⁽²⁾ ∈ G and the arbitrary value r (1) ∈ Z _q are input, and the sharing element σ (1) = (X (2) · A (2) ^{d (2 )} ) ^{r (1) + a (1)} ∈G… (13)
= (g ^{r (2)}・ g ^{a (2) ・ d (2)} ) ^{r (1) + a (1)}
= g ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2))}
Is generated and output. The sharing element calculation unit 116a-2-1 has the hash value d (1), the arbitrary element X (2) = gr ⁽²⁾ εG, the secret value a (1), and the public value A (2) = g ^{a (2)} ∈ G and arbitrary value r (1) ∈ Z _q are input, and sharing element σ (2) = (X (2) · A (2)) ^{r (1) + a (1)・ D (1)} ∈ G… (14)
= (g ^{r (2)}・ g ^{a (2)} ) ^{r (1) + a (1) ・ d (1)}
= g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2))}
Is generated and output (end of description of [example of step S116-1]).

The key generation unit 117-1 (FIG. 2) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 116-1 (FIG. 4A). ) / Step S117-1). In the example of this embodiment, the key generation unit 117-1 includes the sharing source σ (u) generated by the sharing source generation unit 116-1, and the arbitrary element X (1) generated by the arbitrary element generation unit 113-1. (Step S113-1), the arbitrary element X (2) (Step S115-1) input to the input unit 115-1, and the public values A (1) and A (2) read from the storage unit 111-1. , Identifiers ID (1), ID (2), and ID (prot) are input. The key generation unit 117-1 uses the hash value of these bit combinations as a key.
K = H (σ (1), σ (2), X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot))… (14')
And the generated key K is output.

On the other hand, the arbitrary element X (1) = gr ⁽¹⁾ ∈ G and the identifier ID (1) are input to the input unit 115-2 of the key sharing apparatus 110-2 (FIG. 4B / step). S115-2). Arbitrary element X (1) = gr ⁽¹⁾ εG is sent to sharing element generation section 116-2, and identifier ID (1) is stored in storage section 111-2.

The sharing element generation unit 116-2 includes an arbitrary element X (1) = gr ⁽¹⁾ εG sent from the input unit 115-2 and a secret value a (2 ⁾ read from the storage unit 111-2. ) And public value A (1) = ga ⁽¹⁾ εG and the arbitrary value r (2) εZ _q generated by the arbitrary value generation unit 112-2 (FIG. 4B / step S112-2) Then, the arbitrary element X (2) = gr ⁽²⁾ εG generated by the arbitrary element generation unit 113-2 (step S113-2) is input. The shared element generation unit 116-2 uses these elements to generate the element g ^{W (u)} ∈ G ^(u ∈ {1,..., U}, U is an integer constant equal to or greater than 1 ^{) of} the cyclic group G. (U) is generated and output (step S116-2). In this embodiment, g ^{W (u)} ∈G that satisfies the above-described equations (3) to (5), which is the same as the key sharing apparatus 110-1, is generated as the sharing element σ (u). In the following, an example of setting s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q and U, and the process of step S116-2 at that time, Is illustrated.

[Example of Step S116-2]
In this embodiment, the same sharing element σ (u) that satisfies the above-described equations (6) to (10) is generated, which is the same as the key sharing device 110-1.

In step S116-2 in this case, the hash calculation unit 116b-2 (FIG. 3B) receives the arbitrary element X (1) as an input, and the value is determined according to the hash value (first arbitrary element X (i)). Fixed integer)
d (1) = F (X (1))… (15)
Is generated and output. Further, the hash calculation unit 116c-2 receives the arbitrary element X (2) as an input and takes a hash value (an integer whose value is determined according to the second arbitrary element X (j)).
d (2) = F (X (2))… (16)
Is generated and output.

The sharing element calculation unit 116a-1-2 (FIG. 3B) includes a hash value d (2), an arbitrary element X (1) = gr ⁽¹⁾ εG, a secret value a (2), The public value A (1) = ga ⁽¹⁾ ∈ G and the arbitrary value r (2) ∈ Z _q are input, and the sharing element σ (1) = (X (1) · A (1)) ^{r ( 2) + a (2) ・ d (2)} ∈G (17)
= (gr ⁽¹⁾ · ga ⁽¹⁾ ) ^{r (2) + a (2) · d (2)}
= g ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2))}
Is generated and output. Further, the sharing element calculation unit 116a-2-2 has the hash value d (1), the arbitrary element X (1) = gr ⁽¹⁾ ∈ G, the secret value a (2), and the public value A (1 ) = Ga ⁽¹⁾ ∈ G and an arbitrary value r (2) ∈ Z _q are input, and the sharing element σ (2) = (X (1) · A (1) ^{d (1)} ) ^{r (2 ) + a (2)} ∈G… (18)
= (g ^{r (1)}・ g ^{a (1) ・ d (1)} ) ^{r (2) + a (2)}
= g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2))}
Is generated and output (end of description of [example of step S116-2]).

The key generation unit 117-2 (FIG. 2) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 116-2 (Step FIG. 4 (FIG. 4). B) / S117-2). In the example of this embodiment, the key generation unit 117-2 includes the sharing source σ (u) generated by the sharing source generation unit 116-2 and the arbitrary element X (2) generated by the arbitrary element generation unit 113-2. (Step S113-2), the arbitrary element X (1) (Step S115-2) input to the input unit 115-2, and the public values A (1) and A (2) read from the storage unit 211-2. , Identifiers ID (1), ID (2), and ID (prot) are input. The key generation unit 117-2 uses the hash value of these bit combinations as the key.
K = H (σ (1), σ (2), X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot))… (19)
And the generated key K is output.

<Features of this embodiment>
As can be seen from the transformation results of the equations (13), (14), (17), and (18), the sharing sources σ (1) generated by the key sharing apparatuses 116-1 and 116-2 are the same, and the key sharing is performed. The sharing source σ (2) generated by each of the devices 116-1 and 116-2 is the same. As can be seen from the comparison between the equations (14 ′) and (19), the keys K generated by the key sharing apparatuses 116-1 and 116-2 are the same.

  Here, the key sharing device 116-1 can calculate the sharing sources σ (1) and σ (2) of the equations (13) and (14) because the key sharing device 116-1 has its own secret value a (1). And the arbitrary value r (1). An attacker who knows the secret value a (2) of the key sharing device 116-2 can impersonate the key sharing device 116-1 and generate the arbitrary value r (1) and the arbitrary element X (1). However, since the secret value a (1) is not known, the sharing elements σ (1) and σ (2) of the equations (13) and (14) cannot be calculated.

  Also, the key sharing device 116-2 can calculate the sharing sources σ (1) and σ (2) of the equations (17) and (18) because the key sharing device 116-2 and its secret value a (2) This is because the arbitrary value r (2) is known. An attacker who knows the secret value a (1) of the key sharing device 116-1 can impersonate the key sharing device 116-2 and generate the arbitrary value r (2) and the arbitrary element X (2). However, since the secret value a (2) is not known, the sharing elements σ (1) and σ (2) of the equations (17) and (18) cannot be calculated. Therefore, it is difficult for an attacker to perform a KCI attack on the system of this embodiment.

  In this embodiment, integers d (1) and d (2) whose values are determined according to the arbitrary element X (1) or the arbitrary element X (2) by the equations (11), (12), (15), and (16). Using these, the sharing elements σ (1) and σ (2) are generated as in the equations (13), (14), (17), and (18). Therefore, in this embodiment, high safety can be ensured.

  That is, since the integer d (1) is an integer whose value is determined according to the arbitrary element X (1), the value of the integer d (1) cannot be specified until the arbitrary element X (1) is determined. Therefore, the key sharing device 110-1 or an attacker impersonating it intentionally generates an arbitrary element X (1) that is canceled when the key sharing device 110-2 generates the sharing source σ (u). Can not. For example, when the integer d (1) = 1 is fixed, X (1) = 1 / A (1) is set as an arbitrary element by the key sharing device 110-1 or an attacker who has become the key sharing device 110-. 2, the sharing sources σ (1) and σ (2) generated by the key sharing device 110-2 are both 1εG. In contrast, when an integer d (1) whose value is determined according to the arbitrary element X (1) is used, such an attack cannot be performed. If it is difficult to estimate the value of the integer d (1) until the arbitrary element X (1) is obtained, higher safety can be ensured. Similarly, since the integer d (2) is an integer whose value is determined according to the arbitrary element X (2), the value of the integer d (2) cannot be specified until the arbitrary element X (2) is determined. Therefore, the key sharing device 110-2 or an attacker impersonating it intentionally generates an arbitrary element X (2) that is canceled when the key sharing device 110-1 generates the sharing source σ (u). Can not. If it is difficult to estimate the value of the integer d (2) until the arbitrary element X (2) is obtained, higher safety can be ensured.

  In the present embodiment, since a plurality of sharing sources σ (1) and σ (2) are generated, high security can be ensured.

[Variation 1 of the first embodiment]
The first modification of the first embodiment is a modification of the generation process of the sharing source σ (u) in steps S116-1 and S116-2. In the first modification of the first embodiment, instead of the equations (7) to (10),
s (1,1) = 1, t (1,1) = 1, s (1,2) = 1, t (1,2) = 1… (19 ')
s (2,1) = 1, t (2,1) = d (1), s (2,2) = 1, t (2,2) = d (2)… (20)
And That is,
σ (1) = g ^{(r (1) + a (1)) (r (2) + a (2))} … (21)
σ (2) = g ^{(r (1) + a (1) · d (1)) (r (2) + a (2) · d (2))} (22)
A sharing element σ (u) that satisfies is generated.

In this case, the sharing element calculation units 116a-1-1 and 116a-2-1 (FIG. 3A) replace the expressions (13) and (14) with the sharing element σ (1) = (X (2)・ A (2)) ^{r (1) + a (1)} ∈G… (23)
= g ^{(r (1) + a (1)) (r (2) + a (2))}
σ (2) = (X (2) ・ A (2) ^{d (2)} ) ^{r (1) + a (1) ・ d (1)} ∈G… (24)
= g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2))}
Is generated and output.

Further, the sharing element calculation units 116a-1-2 and 116a-2-2 (FIG. 3B) replace the expressions (17) and (18) with the sharing element σ (1) = (X (1) · A (1)) ^{r (2) + a (2)} ∈G… (25)
= g ^{(r (1) + a (1)) (r (2) + a (2))}
σ (2) = (X (1) · A (1) ^{d (1)} ) ^{r (2) + a (2) · d (2)} ∈ G (26)
= g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2))}
Is generated and output. Others are the same as in the first embodiment.

In addition, assuming that U = 1, instead of formulas (7) to (10),
s (1,1) = 1, t (1,1) = d (1), s (1,2) = 1, t (1,2) = d (2)
That is,
σ (1) = g ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2))}
It may be configured to generate a sharing element σ (u) that satisfies the above. In addition, the configuration of U ≧ 3, the configuration of generating the sharing element σ (u) using only one of the hash values d (1) or d (2), the arbitrary element X (1) and the arbitrary element X (2) A configuration for generating the sharing source σ (u) using the hash value d (3) depending on both, a configuration for generating the sharing source σ (u) without using the hash values d (1) and d (2), etc. Is also possible. Further, d (p) is not limited to a hash value, and may be an integer whose value is determined according to the arbitrary element X (1) and / or the arbitrary element X (2). For example, some bits of the arbitrary element X (1) or the arbitrary element X (2) may be d (p), or a bit combination value of the arbitrary element X (1) and the arbitrary element X (2). The part may be d (p). Also,
r (i) = F ′ (r ′ (i), a (i))
It is good. Note that F ′ is a hash function F ′: {0, 1} ^* → Z _q , and r ′ (i) is a random number. A similar modification may be performed for r (j). Accordingly, high safety can be ensured even when U = 1. In addition, the method for generating the sharing source σ (u) can be modified without departing from the spirit of the present invention.

[Modification 2 of the first embodiment]
The second modification of the first embodiment is a modification of the key generation process in steps S117-1, 2. That is, in the first embodiment, the key K is generated by the equations (14 ′) and (19), but the value of the key K may be determined based on the sharing element σ (u). For example, σ (u), X (1), X (2), A (1), A (2), ID (1), which are input values to the hash function H of the equations (14 ′) (19), There is no restriction on the order of bit combination of ID (2) and ID (prot). In addition, at least part of X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot) may be omitted, and an algorithm identifier ID Other information such as (algo) and session identifier ID (sess) may be added to the bit combination target. For example,
K = H (σ (1), σ (2), X (1), X (2), A (1), A (2), ID (1), ID (2))
K = H (σ (1), σ (2))
K = H (σ (1), σ (2), X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot), ID (algo))
K = H (σ (1), σ (2), X (1), X (2), ID (sess))
It is good also as a key which shares etc. For example, when the identifiers ID (1) and ID (2) are not used for generating the key K, the key sharing apparatuses 110-1 and 110-2 are identified by the identifiers ID (1) and ID (2) in steps S114-1 and S114-2. Is not output, and the identifiers ID (1) and ID (2) may not be input to the key sharing apparatuses 110-1 and 110-2 in steps S115-1 and S115-2. Further, another function may be used instead of the hash function H, or the bit combination value of the value including the sharing element σ (u) may be used as the key K without using the hash function. However, the operations for key generation in steps S117-1, 2 must be the same.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In the second embodiment, P = 3, i = 1, jε {2,3}, and W (u) = w (u, 1) · w (u, 2) · w (u, 3) Yes, w (u, p) is the linear sum of a (p) and r (p). In the second embodiment, a key is shared by three key sharing devices. The storage unit of the key sharing device stores at least the secret value a (i) and A (j) = ga ^(j) εG, and the sharing source generation unit of the key sharing device at least stores the secret value a ( i), two public values A (j) = g ^{a (j)} εG, an arbitrary value r (i), and two second arbitrary elements X (j) = g ^{r (j)} εG, using the function e is bilinear function that maps two original cyclic group G with one of the original cyclic group _{G T,} based on ^{_{g T W (u) = e}} (g, g) of _the cyclic group _{G T} ^{W (u)} generating a ∈G _T as Pool sigma (u).

<Configuration>
5 to 7 are block diagrams for explaining the configuration of the key sharing system 200 according to the second embodiment. In addition, about the part which is common in 1st Embodiment, description is simplified using the same code | symbol as 1st Embodiment.

  As illustrated in FIG. 5, the key sharing system 200 according to the second embodiment includes a key sharing device 210-1 (first key sharing device), a key sharing device 210-2 (second key sharing device), and a key sharing device. 210-3 (third key sharing apparatus).

  As illustrated in FIG. 6, the key sharing apparatus 210-1 includes a storage unit 211-1, an arbitrary value generation unit 112-1, an arbitrary element generation unit 113-1, an output unit 214-1, and an input unit. 215-1, a sharing source generation unit 216-1, a key generation unit 217-1, a temporary memory 118-1, and a control unit 119-1. FIG. 8A is a block diagram for explaining the configuration of the sharing source generation unit 216-1. As illustrated in FIG. 8A, the sharing source generation unit 216-1 includes the hash calculation units 116b-1, 116c-1, and 216d-1, and the sharing source calculation units 216a-u-1 (uε {1 ,..., U}, U is an integer constant equal to or greater than 1.

  The key sharing device 210-2 includes a storage unit 211-2, an arbitrary value generation unit 112-2, an arbitrary element generation unit 113-2, an output unit 214-2, an input unit 215-2, and a shared source generation. Unit 216-2, key generation unit 217-2, temporary memory 118-2, and control unit 119-2. FIG. 8B is a block diagram for explaining the configuration of the sharing source generation unit 216-2. As illustrated in FIG. 8B, the sharing source generation unit 216-2 includes the hash calculation units 116b-2, 116c-2, and 216d-2, and the sharing source calculation units 216a-u-2 (uε {1 ,..., U}).

  As illustrated in FIG. 7, the key sharing apparatus 210-3 includes a storage unit 211-3, an arbitrary value generation unit 212-3, an arbitrary element generation unit 213-3, an output unit 214-3, and an input unit. 215-3, a sharing source generation unit 216-3, a key generation unit 217-3, a temporary memory 218-3, and a control unit 219-3. FIG. 9 is a block diagram for explaining the configuration of the sharing source generation unit 216-3. As illustrated in FIG. 9, the sharing source generation unit 216-3 includes the hash calculation units 216b-3, 216c-3, and 216d-3, and the sharing source calculation units 216a-u-3 (uε {1,. , U}).

  As in the first embodiment, the key sharing apparatuses 210-1, 2, 3 are configured by, for example, reading a predetermined program into a known computer and executing it. Further, the key sharing apparatuses 210-1, 2, 3 execute the respective processes under the control of the control units 119-1, 29-1 and 219-3, respectively. In addition, although the explanation will be simplified below, the data output from each processing unit is the temporary memory 118-1, 2, the temporary memory 218-3 or the storage unit 111-1, 2, the storage unit 211-3. Stored in The data stored in the temporary memory 118-1, 2 and the temporary memory 218-3 or the storage unit 111-1, 2 and the storage unit 211-3 are read out as necessary and input to each processing unit. Used for processing.

<Public parameters>
In the second embodiment, the following are public parameters.

  G: Cyclic group of L-bit order q (q is a prime number).

G _T : Cyclic group of L-bit order q.

  g: A generator of the cyclic group G.

g _T: generator of the cyclic group _{G T.} g _T ^m (m is an integer) can represent all of the original cyclic group _{G T} by. g _T = e (g, g).

e: e (α, β) → γ (α, βεG, γεG _T ). Bilinear function that maps two original cyclic group G with one of the original cyclic group G _T. The bilinear function e satisfies the following properties.

[Bilinearity] The following relationship is satisfied for all α, β∈G and ν, κ∈Z _q .

e (α ^ν , β ^κ ) = e (α, β) ^{ν ・ κ} (27)
Non degenerative] All alpha, not a function View daylight β∈G the unity of the cyclic group G _T.

  [Computability] There is an algorithm for efficiently calculating e (α, β) for every α, β∈G.

  A specific example of the bilinear function e is a function for performing pairing operations such as Weil pairing and Tate pairing (for example, “Alfred. J. Menezes, ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS, KLUWER ACADEMIC PUBLISHERS, ISBN0-7923-9368-6, pp. 61-81 ").

F: G → [0, q ^1/2 ]. A hash function that maps an element of the cyclic group G to an integer between 0 and q ^1/2 .

H: {0, 1} ^* → {0, 1} ^L. A hash function that copies an arbitrary-length bit string into an L-bit bit string.

  ID (prot): identifier of the name of the key exchange method.

<Pre-processing>
The following process is executed as a pre-process of the key sharing process.

In the storage unit 211-1 of the key sharing apparatus 210-1, the secret value (secret key) a (1) ∈Z _q of the key sharing apparatus 210-1 and the element of the cyclic group G corresponding to the key sharing apparatus 210-1 are stored. Public value (public key) A (1) = g ^{a (1)} ∈ G and the public value (public key) A (2) = g that is an element of the cyclic group G corresponding to the key sharing apparatus 210-2 ^{a (2)} and ∈G, based in a public value of the cyclic group G corresponding to the key sharing device 210-3 (public ^{key) a (3) = g a} (3) and ∈G, key sharing device 210-1 Identifier ID (1) and identifier ID (prot) are stored. In the storage unit 211-2 of the key sharing apparatus 210-2, the secret value (secret key) a (2) εZ _q of the key sharing apparatus 210-2 and the element of the cyclic group G corresponding to the key sharing apparatus 210-1 are stored. Public value (public key) A (1) = g ^{a (1)} ∈ G and the public value (public key) A (2) = g that is an element of the cyclic group G corresponding to the key sharing apparatus 210-2 ^{a (2)} ∈G and, based on the a public value of the cyclic group G corresponding to the key sharing device 210-3 (public ^{key) a (3) = g a} (3) and ∈G, key sharing device 210-2 Identifier ID (2) and identifier ID (prot) are stored. The storage unit 211-3 of the key sharing apparatus 210-3 stores the secret value (secret key) a (3) εZ _q of the key sharing apparatus 210-3 and the element of the cyclic group G corresponding to the key sharing apparatus 210-1. Public value (public key) A (1) = g ^{a (1)} ∈ G and the public value (public key) A (2) = g that is an element of the cyclic group G corresponding to the key sharing apparatus 210-2 ^{a (2)} ∈G and, based on the a public value of the cyclic group G corresponding to the key sharing device 210-3 (public ^{key) a (3) = g a} (3) and ∈G, key sharing device 210-2 Identifier ID (2) and identifier ID (prot) are stored.

<Key sharing process>
10A is a flowchart for explaining the key sharing process of the key sharing apparatus 210-1, and FIG. 10B is a flowchart for explaining the key sharing process of the key sharing apparatus 210-2. is there. FIG. 11 is a flowchart for explaining the key sharing process of the key sharing apparatus 210-3.

First, the key sharing apparatus 210-1 (FIG. 6) performs the processing of steps S112-1 and S113-1 of the first embodiment. The arbitrary element X (1) = g ^{r (1)} εG obtained by this and the identifier ID (1) read from the storage unit 111-1 are input to the output unit 214-1, and the output unit 214 −1 outputs an arbitrary element X (1) = g ^{r (1)} εG and an identifier ID (1) (transmission to a network, storage in a portable recording medium, etc.) (FIG. 10A / Step S214-1). Arbitrary element X (1) = gr ⁽¹⁾ εG and identifier ID (1) are sent to key sharing apparatuses 210-2 and 210-3.

Further, the key sharing apparatus 210-2 (FIG. 6) executes the processes of steps S112-2 and S113-2 of the first embodiment. The arbitrary element X (2) = g ^{r (2)} εG obtained in this way and the identifier ID (2) read from the storage unit 111-2 are input to the output unit 214-2, and the output unit 214 -2 outputs an arbitrary element X (2) = g ^{r (2)} εG and an identifier ID (2) (transmission to a network, storage in a portable recording medium, etc.) (FIG. 10B / Step S214-2). Arbitrary element X (2) = gr ⁽²⁾ εG and identifier ID (2) are sent to key sharing apparatuses 210-1 and 210-3.

The arbitrary value generator 212-2 of the key sharing device 210-3 (FIG. 7) generates and outputs an arbitrary value r (3) εZ _q (FIG. 11 / step S212-3). The arbitrary value r (3) εZ _q is, for example, a pseudo random number generated using a known pseudo random number generation algorithm or a value selected from Z _q in a predetermined order. The arbitrary element generation unit 213-3 is input with the arbitrary value r (3) εZ _q , and the arbitrary element generation unit 213-3 uses the arbitrary value r (3), and the arbitrary element X (3) = g ^{r (3)} Generate εG and output it (step S213-3). Arbitrary element X (3) = gr ⁽³⁾ εG and identifier ID (3) read from the storage unit 211-3 are input to the output unit 214-3, and the output unit 214-3 X (3) = g ^{r (3)} εG and identifier ID (3) are output (transmitted to a network, stored in a portable recording medium, etc.) (step S214-3). Arbitrary element X (3) = gr ⁽³⁾ εG and identifier ID (3) are sent to key sharing apparatuses 210-1 and 210-2.

Arbitrary element X (2) = gr ⁽²⁾ εG and identifier ID (2) are input to input unit 215-1 of key sharing apparatus 210-1 (FIG. 6) (FIG. 10 (A) / In step S115-1, the arbitrary element X (3) = gr ⁽³⁾ εG and the identifier ID (3) are input (step S215-1). Arbitrary element X (2) = g ^{r (2)} ∈ G and arbitrary element X (3) = gr ⁽³⁾ ∈ G are sent to sharing element generation unit 216-1, and identifiers ID (2), ID (3 ) Is stored in the storage unit 211-1.

The sharing element generation unit 216-1 includes an arbitrary element X (2) = gr (2) εG, X (3) = gr (3) εG sent from the input unit 215-1, and a storage unit The secret value a (1) and the public value A (2) = ga (2) εG, A (3) = ga (3) εG read out from 211-1 and the arbitrary value generator 112- generating at 1 (step S112-1) have been any value r (1) ∈ Z q and, generated in any element generation unit 113-1 (step S113-1) have been arbitrarily based X (1) = g r (1 ) ΕG is input. Shared source generation unit 216-1 using the aforementioned function e mapping the original of the cyclic group G to the original cyclic group G T, based on g T W (u) ∈G T (u of the cyclic group G T .Epsilon. {1,..., U}, U is an integer constant equal to or greater than 1) is generated and output as a sharing element σ (u) (step S216-1). In this form,
W (u) = w (u, 1) ・ w (u, 2) ・ w (u, 3) ∈Z q … (28)
w (u, 1) = (r (1) ・ s (u, 1) + a (1) ・ t (u, 1)) ∈Z q (29)
w (u, 2) = (r (2) ・ s (u, 2) + a (2) ・ t (u, 2)) ∈Z q … (30)
w (u, 3) = (r (3) ・ s (u, 3) + a (3) ・ t (u, 3)) ∈Z q … (31)
G T W (u) ∈G T satisfying is generated as a Pool sigma (u). s (u, 1), s (u, 2), s (u, 3), t (u, 1), t (u, 2), t (u, 3) εZ q is a constant determined for each u. Or it is a variable. s (u, 1), s (u, 2), s (u, 3), t (u, 1), t (u, 2), t (u, 3) εZ q and U are arbitrarily set However, for all u, s (u, 1) and t (u, 1), s (u, 2) and t (u, 2), s (u, 3) and t ( A setting in which u, 3) is always 0 is not preferable. Below, s (u, 1), s (u, 2), s (u, 3), t (u, 1), t (u, 2), t (u, 3) ∈Z q and U A setting example and the process of step S216-1 at that time will be exemplified.

[Example of Step S216-1]
In this form,
U = 4 ... (32)
s (1,1) = 1, t (1,1) = d (1), s (1,2) = 1, t (1,2) = 1, s (1,3) = 1, t ( 1,3) = 1… (33)
s (2,1) = 1, t (2,1) = 1, s (2,2) = 1, t (2,2) = d (2), s (2,3) = 1, t ( 2,3) = 1… (34)
s (3,1) = 1, t (3,1) = 1, s (3,2) = 1, t (3,2) = 1, s (3,3) = 1, t (3,3 ) = d (3)… (35)
s (4,1) = 1, t (4,1) = d (1), s (4,2) = 1, t (4,2) = d (2), s (4,3) = 1 , t (4,3) = d (3)… (36)
The process of step S216-1 is exemplified. That is,
σ (1) = g ^{(r (1) + a (1) · d (1)) (r (2) + a (2)) (r (3) + a (3))} … (37)
σ (2) = g ^{(r (1) + a (1)) (r (2) + a (2) · d (2)) (r (3) + a (3))} … (38)
σ (3) = g ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3) · d (3))} (39)
σ (4) = g ^{(r (1) + a (1) · d (1)) (r (2) + a (2) · d (2)) (r (3) + a (3) · d (3))} … (40)
An example is shown.

In step S216-1 in this case, the hash calculators 116b-1 and 116c-1 (FIG. 8A) perform the hash value as in the first embodiment.
d (1) = F (X (1))… (41)
d (2) = F (X (2))… (42)
Is generated and output. Further, the hash calculation unit 216d-1 receives the arbitrary element X (3) as an input, and a hash value (an integer whose value is determined according to the second arbitrary element X (j))
d (3) = F (X (3))… (43)
Is generated and output.

Shared element operation unit 216a-1-1 (to FIG. 8 (A)) is a hash value d (1), any source ^{X (2) = g r (} 2) ∈G, X (3) = g r (3 ⁾ ∈ G, secret value a (1), public value A (2) = ga ⁽²⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G, and arbitrary value r (1) ∈ Z _q as an input and share element σ (1) = e (X (2) ・ A (2), X (3) ・ A (3)) ^{r (1) + a (1) ・ d (1)} ∈ G… (44)
= e (g ^{r (2)}・ g ^{a (2)} , g ^{r (3)}・ g ^{a (3)} ) ^{r (1) + a (1) ・ d (1)}
= e (g, g) ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3))} (Formula (27) Than)
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3))} (g _T = e (g, g )Than)
Is generated and output.

The sharing element calculation unit 216a-2-1 uses the hash value d (2), the arbitrary element X (2) = gr ⁽²⁾ ∈ G, X (3) = gr ⁽³⁾ ∈ G, and the secret value a (1), public value A (2) = ga ⁽²⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G, and arbitrary value r (1) ∈ Z _q Element σ (2) = e (X (2) ・ A (2) ^{d (2)} , X (3) ・ A (3)) ^{r (1) + a (1)} ∈G… (45)
= e (g ^{r (2)}・ g ^{a (2) ・ d (2)} , g ^{r (3)}・ g ^{a (3)} ) ^{r (1) + a (1)}
= e (g, g) ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))} (Formula (27) Than)
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))} (g _T = e (g, g )Than)
Is generated and output.

The sharing element calculation unit 216a-3-1 includes a hash value d (3), an arbitrary element X (2) = gr ⁽²⁾ ∈ G, X (3) = gr ⁽³⁾ ∈ G, and a secret value a (1), public value A (2) = ga ⁽²⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G, and arbitrary value r (1) ∈ Z _q Element σ (3) = e (X (2) ・ A (2), X (3) ・ A (3) ^{d (3)} ) ^{r (1) + a (1)} ∈G… (46)
= e (g ^{r (2)}・ g ^{a (2)} , g ^{r (3)}・ ga ^{(3) ・ d (3)} ) ^{r (1) + a (1)}
= e (g, g) ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))} (Formula (27) Than)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))} (g _T = e (g, g )Than)
Is generated and output.

The sharing element calculation unit 216a-4-1 has the hash values d (1), d (2), d (3) and the arbitrary element X (2) = g ^{r (2)} εG, X (3) = g ^{r (3)} εG, secret value a (1), public value A (2) = ga ⁽²⁾ εG, A (3) = ga ⁽³⁾ εG, and arbitrary value r (1 ) ∈Z _q as input, and share element σ (4) = e (X (2) ・ A (2) ^{d (2)} , X (3) ・ A (3) ^{d (3)} ) ^{r (1) + a (1) ・ d (1)} ∈G… (47)
= e (g ^{r (2)}・ g ^{a (2) ・ d (2)} , g ^{r (3)}・ g ^{a (3) ・ d (3)} ) ^{r (1) + a (1) ・ d (1 )}
= e (g, g) ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・d (3))} (From equation (27))
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3) )} (From g _T = e (g, g))
Is generated and output (end of description of [Example of step S216-1]).

The key generation unit 217-1 (FIG. 6) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 216-1 (Step FIG. 10 (FIG. 10). A) / S217-1). In the example of this embodiment, the key generation unit 217-1 includes the sharing source σ (u) generated by the sharing source generation unit 216-1 and the arbitrary element X (1) generated by the arbitrary element generation unit 113-1. (Step S113-1), arbitrary elements X (2) and X (3) (Steps S115-1 and S215-1) input to the input unit 215-1, and the public value read from the storage unit 211-1 A (1), A (2), A (3), identifier ID (1), ID (2), ID (3), and ID (prot) are input. The key generation unit 217-1 uses these bit combined hash values as keys.
K = H (σ (1), σ (2), σ (3), σ (4), X (1), X (2), X (3), A (1), A (2), A (3), ID (1), ID (2), ID (3), ID (prot))… (48)
And the generated key K is output.

Arbitrary element X (1) = gr ⁽¹⁾ εG and identifier ID (1) are input to the input unit 215-2 of the key sharing apparatus 210-2 (FIG. 6) (FIG. 10B / In step S115-2, the arbitrary element X (3) = gr ⁽³⁾ εG and the identifier ID (3) are input (step S215-2). Arbitrary element X (1) = g ^{r (2)} ∈ G and arbitrary element X (3) = gr ⁽³⁾ ∈ G are sent to sharing element generation unit 216-2, and identifiers ID (1), ID (3 ) Is stored in the storage unit 211-2.

The sharing element generation unit 216-2 includes an arbitrary element X (1) = gr ⁽¹⁾ εG, X (3) = gr ⁽³⁾ εG sent from the input unit 215-2, and a storage unit The secret value a (2) and the public value A (1) = ga ⁽²⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G read out from 211-2, and the arbitrary value generator 112- The arbitrary value r (2) εZ _q generated in step 2 (step S112-2) and the arbitrary element X (1) generated in the arbitrary element generation unit 113-1 (step S113-2) = g ^{r (1)} ΕG is input. Shared source generation unit 216-2 uses the aforementioned function e mapping the original of the cyclic group G to the original cyclic group _{G T,} based on _{^{g T W (u) ∈G T}} (u of the cyclic group _{G T} .Epsilon. {1,..., U}) is generated and output as a sharing element σ (u) (step S216-2). In this ^{_{embodiment, g T W (u) ∈G}} T satisfying the formula (28) - (31) is generated as a Pool sigma (u). Below, s (u, 1), s (u, 2), s (u, 3), t (u, 1), t (u, 2), t (u, 3) ∈Z _q and U A setting example and the process of step S216-2 at that time will be exemplified.

[Example of Step S216-2]
In this embodiment, a sharing element σ (u) that satisfies the above-described equations (32) to (40) is generated.

In step S216-2 in this case, the hash calculation units 116b-2, 116c-2, 216d-2 (FIG. 8B) are similar to the hash calculation units 116b-1, 116c-1, and 216d-1, respectively. Hash value
d (1) = F (X (1))… (49)
d (2) = F (X (2))… (50)
d (3) = F (X (3))… (51)
Is generated and output.

Shared element operation unit 216a-1-1 (FIG. 8 (B)) is a hash value d (1), any source ^{X (1) = g r (} 2) ∈G, X (3) = g r (3 ⁾ ΕG, secret value a (2), public value A (1) = ga ⁽¹⁾ εG, A (3) = ga ⁽³⁾ εG, and arbitrary value r (2) εZ _q as input and share source σ (1) = e (X (3) ・ A (3), X (1) ・ A (1) ^{d (1)} ) ^{r (2) + a (2)} ∈G … (52)
= e (g ^{r (3)}・ g ^{a (3)} , g ^{r (1)}・ g ^{a (1) ・ d (1)} ) ^{r (2) + a (2)}
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3))}
Is generated and output.

The sharing element calculation unit 216a-2-2 uses the hash value d (2), the arbitrary element X (1) = gr ⁽²⁾ ∈ G, X (3) = gr ⁽³⁾ ∈ G, and the secret value a (2), public value A (1) = ga ⁽¹⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G, and arbitrary value r (2) ∈ Z _q Element σ (2) = e (X (3) ・ A (3), X (1) ・ A (1)) ^{r (2) + a (2) ・ d (2)} ∈G… (53)
= e (g ^{r (3)}・ g ^{a (3)} , g ^{r (1)}・ g ^{a (1)} ) ^{r (2) + a (2) ・ d (2)}
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))}
Is generated and output.

The sharing element calculation unit 216a-3-2 includes a hash value d (3), an arbitrary element X (1) = gr ⁽²⁾ ∈ G, X (3) = gr ⁽³⁾ ∈ G, and a secret value a (2), public value A (1) = ga ⁽¹⁾ ∈ G, A (3) = ga ⁽³⁾ ∈ G, and arbitrary value r (2) ∈ Z _q Element σ (3) = e (X (3) ・ A (3) ^{d (3)} , X (1) ・ A (1)) ^{r (2) + a (2)} ∈G… (54)
= e (g ^{r (3)}・ g ^{a (3) ・ d (3)} , g ^{r (1)}・ g ^{a (1)} ) ^{r (2) + a (2)}
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))}
Is generated and output.

The sharing element calculation unit 216a-4-2 has the hash values d (1), d (2), d (3) and the arbitrary element X (1) = g ^{r (2)} εG, X (3) = g ^{r (3)} εG, secret value a (2), public value A (1) = ga ⁽¹⁾ εG, A (3) = ga ⁽³⁾ εG, and arbitrary value r (2 ) ∈Z _q as input, and share element σ (4) = e (X (3) ・ A (3) ^{d (3)} , X (1) ・ A (1) ^{d (1)} ) ^{r (2) + a (2) ・ d (2)} ∈G… (55)
= e (g ^{r (3)}・ g ^{a (3) ・ d (3)} , g ^{r (1)}・ g ^{a (1) ・ d (1)} ) ^{r (2) + a (2) ・ d (2 )}
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3) )}
Is generated and output (end of description of [Example of step S216-2]).

The key generation unit 217-2 (FIG. 6) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 216-2 (Step FIG. 10 (FIG. 10). B) / S217-2). In the example of this embodiment, the key generation unit 217-2 includes the sharing source σ (u) generated by the sharing source generation unit 216-2 and the arbitrary element X (2) generated by the arbitrary element generation unit 113-2. (Step S113-2), arbitrary elements X (1) and X (3) (Steps S115-2 and S215-2) input to the input unit 215-2, and the public value read from the storage unit 211-2 A (1), A (2), A (3), identifier ID (1), ID (2), ID (3), and ID (prot) are input. The key generation unit 217-2 uses the hash value of these bit combinations as the key.
K = H (σ (1), σ (2), σ (3), σ (4), X (1), X (2), X (3), A (1), A (2), A (3), ID (1), ID (2), ID (3), ID (prot))… (56)
And the generated key K is output.

Arbitrary element X (1) = gr ⁽¹⁾ εG and identifier ID (1) are input to the input unit 215-3 of the key sharing apparatus 210-2 (FIG. 7) (FIG. 11 / step S215a−). 3) Arbitrary element X (2) = gr ⁽²⁾ εG and identifier ID (2) are input (step S215b-3). Arbitrary element X (1) = gr ⁽²⁾ ∈ G and arbitrary element X (2) = gr ⁽²⁾ ∈ G are sent to sharing element generation unit 216-3, and identifiers ID (1), ID (2 ) Is stored in the storage unit 211-3.

The sharing element generation unit 216-3 includes an arbitrary element X (1) = gr ⁽¹⁾ εG, X (2) = gr ⁽²⁾ εG sent from the input unit 215-3, and a storage unit The secret value a (3) read from 211-3 and the public value A (1) = ga ⁽²⁾ εG, A (2) = ga ⁽²⁾ εG, and the arbitrary value generator 212− The arbitrary value r (3) εZ _q generated in step 3 (step S212-3) and the arbitrary element X (3) generated in step S213-3 (step S213-3) = g ^{r (3 )} ΕG is input. Shared source generation unit 216-3 uses the aforementioned function e mapping the original of the cyclic group G to the original cyclic group _{G T,} based on _{^{g T W (u) ∈G T}} (u of the cyclic group _{G T} Ε {1,..., U}) is generated and output as a sharing element σ (u) (step S216-3). In this ^{_{embodiment, g T W (u) ∈G}} T satisfying the formula (28) - (31) is generated as a Pool sigma (u). Below, s (u, 1), s (u, 2), s (u, 3), t (u, 1), t (u, 2), t (u, 3) ∈Z _q and U A setting example and the process of step S216-3 at that time will be exemplified.

[Example of Step S216-3]
In this embodiment, a sharing element σ (u) that satisfies the above-described equations (32) to (40) is generated.

In step S216-3 in this case, the hash calculation units 216b-3, 216c-3, and 216d-3 (FIG. 9) perform the hash value similarly to the hash calculation units 116b-1, 116c-1, and 216d-1.
d (1) = F (X (1))… (57)
d (2) = F (X (2))… (58)
d (3) = F (X (3))… (59)
Is generated and output.

The sharing element calculation unit 216a-1-3 (FIG. 9) uses the hash value d (1) and the arbitrary element X (1) = gr ⁽²⁾ εG, X (2) = gr ⁽²⁾ εG. And a secret value a (3), a public value A (1) = ga ⁽¹⁾ εG, A (2) = ga ⁽²⁾ εG, and an arbitrary value r (3) εZ _q Input σ (1) = e (X (1) ・ A (1) ^{d (1)} , X (2) ・ A (2)) ^{r (3) + a (3)} ∈G… (60 )
= e (g ^{r (1)}・ g ^{a (1) ・ d (1)} , g ^{r (2)}・ g ^{a (2)} ) ^{r (3) + a (3)}
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3))}
Is generated and output.

The sharing element calculation unit 216a-2-3 uses the hash value d (2), the arbitrary element X (1) = gr ⁽²⁾ ∈ G, X (2) = gr ⁽²⁾ ∈ G, and the secret value a (3), public value A (1) = ga ⁽¹⁾ ∈ G, A (2) = ga ⁽²⁾ ∈ G, and arbitrary value r (3) ∈ Z _q Element σ (2) = e (X (1) ・ A (1), X (2) ・ A (2) ^{d (2)} ) ^{r (3) + a (3)} ∈G… (61)
= e (g ^{r (1)}・ g ^{a (1)} , g ^{r (2)}・ g ^{a (2) ・ d (2)} ) ^{r (3) + a (3)}
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))}
Is generated and output.

The sharing element calculation unit 216a-3-3 includes the hash value d (3), the arbitrary element X (1) = gr ⁽²⁾ ∈ G, X (2) = gr ⁽²⁾ ∈ G, and the secret value a (3), public value A (1) = ga ⁽¹⁾ ∈ G, A (2) = ga ⁽²⁾ ∈ G, and arbitrary value r (3) ∈ Z _q Element σ (3) = e (X (1) ・ A (1), X (2) ・ A (2)) ^{r (3) + a (3) ・ d (3)} ∈G… (62)
= e (g ^{r (1)}・ g ^{a (1)} , g ^{r (2)}・ g ^{a (2)} ) ^{r (3) + a (3) ・ d (3)}
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))}
Is generated and output.

The sharing element calculation unit 216a-4-3 has the hash values d (1), d (2), d (3) and the arbitrary element X (1) = g ^{r (2)} εG, X (2) = g ^{r (2)} ∈ G, secret value a (3), public value A (1) = ga ⁽¹⁾ ∈ G, A (2) = ga ⁽²⁾ ∈ G, and arbitrary value r (3 ) ∈Z _q as input and share element σ (4) = e (X (1) ・ A (1) ^{d (1)} , X (2) ・ A (2) ^{d (2)} ) ^{r (3) + a (3) ・ d (3)} ∈G… (63)
= e (g ^{r (1)}・ g ^{a (1) ・ d (1)} , g ^{r (2)}・ g ^{a (2) ・ d (2)} ) ^{r (3) + a (3) ・ d (3 )}
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3) )}
Is generated and output (end of description of [Example of step S216-3]).

  The key generation unit 217-3 (FIG. 7) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 216-3 (Step FIG. 11 / S217-3).

In the example of this embodiment, the key generation unit 217-3 includes the sharing element σ (u) generated by the sharing element generation unit 216-3 and the arbitrary element X (3) generated by the arbitrary element generation unit 213-3. (Step S213-3), arbitrary elements X (1) and X (2) (steps S215a-3 and S215b-3) input to the input unit 215-3, and the public value read from the storage unit 211-3 A (1), A (2), A (3), identifier ID (1), ID (2), ID (3), and ID (prot) are input. The key generation unit 217-3 uses the hash value of these bit combinations as the key.
K = H (σ (1), σ (2), σ (3), σ (4), X (1), X (2), X (3), A (1), A (2), A (3), ID (1), ID (2), ID (3), ID (prot))… (64)
And the generated key K is output.

<Features of this embodiment>
As can be seen from the transformation results of the equations (44) to (47) (52) to (55) (60) to (63), the sharing elements σ generated by the key sharing devices 216-1, 2, and 3, respectively. (1) is the same, and the sharing source σ (2) generated by the key sharing devices 216-1, 2, 3 is the same, and the sharing source σ generated by the key sharing devices 216-1, 2, 3, respectively. (3) is the same, and the sharing source σ (4) generated by each of the key sharing apparatuses 216-1, 2, 3 is the same. As can be seen by comparing the equations (48), (56), and (64), the keys K generated by the key sharing devices 216-1, 2, and 3 are the same.

  Here, the key sharing apparatus 216-1 can calculate the sharing elements σ (1), σ (2), σ (3), and σ (4) of the equations (44) to (47), respectively. This is because the device 216-1 knows its own secret value a (1) and arbitrary value r (1). An attacker who knows the secret value a (2) of the key sharing device 216-2 can impersonate the key sharing device 216-1 and generate the arbitrary value r (1) and the arbitrary element X (1). However, since the secret value a (1) is not known, the sharing elements σ (1), σ (2), σ (3), and σ (4) in the equations (44) to (47) cannot be calculated. The same is true for the key sharing devices 216-2 and 216. Therefore, it is difficult for an attacker to perform a KCI attack on the system of this embodiment.

  In this embodiment, integers d (1), d (2), and d (3) whose values are determined according to arbitrary elements X (1), X (2), and X (3) are generated and used. The sharing elements σ (1), σ (2), σ (3), and σ (4) are generated. Therefore, in this embodiment, high safety can be ensured.

  In this embodiment, since a plurality of sharing sources σ (1), σ (2), σ (3), and σ (4) are generated, high safety can be ensured.

[Modification 1 of Second Embodiment]
Modification 1 of the second embodiment is a modification of the generation process of the sharing source σ (u) in Steps S216-1, 2, and 3. In the modification 1 of 2nd Embodiment, instead of Formula (33)-(40),
s (1,1) = 1, t (1,1) = 1, s (1,2) = 1, t (1,2) = d (2), s (1,3) = 1, t ( 1,3) = d (3)… (64 ')
s (2,1) = 1, t (2,1) = d (1), s (2,2) = 1, t (2,2) = 1, s (2,3) = 1, t ( 2,3) = d (3)… (65)
s (3,1) = 1, t (3,1) = d (1), s (3,2) = 1, t (3,2) = d (2), s (3,3) = 1 , t (3,3) = 1… (66)
s (4,1) = 1, t (4,1) = 1, s (4,2) = 1, t (4,2) = 1, s (4,3) = 1, t (4,3 ) = 1… (67)
That is,
σ (1) = g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3))} … (68)
σ (2) = g _T ^{(r (1) + a (1) · d (1)) (r (2) + a (2)) (r (3) + a (3) · d (3))} … (69)
σ (3) = g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))} … (70)
σ (4) = g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3))} … (71)
A sharing element σ (u) that satisfies is generated.

In this case, the sharing element computing units 216a-1-1 to 216a-4-1 (FIG. 8A) replace the expressions (44) to (47) with the sharing element σ (1) = e (X ( 2) ・ A (2) ^{d (2)} , X (3) ・ A (3) ^{d (3)} ) ^{r (1) + a (1)} ∈G… (72)
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3))}
σ (2) = e (X (2) ・ A (2), X (3) ・ A (3) ^{d (3)} ) ^{r (1) + a (1) ・ d (1)} ∈G… (73 )
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))}
σ (3) = e (X (2) ・ A (2) ^{d (2)} , X (3) ・ A (3)) ^{r (1) + a (1) ・ d (1)} ∈G… (74 )
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))}
σ (4) = e (X (2) ・ A (2), X (3) ・ A (3)) ^{r (1) + a (1)} ∈G… (75)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3))}
Is generated and output.

Further, the sharing element calculation units 216a-1-2 to 216a-4-2 (FIG. 8B) replace the expressions (52) to (55) with the sharing element σ (1) = e (X (3 ) ・ A (3) ^{d (3)} , X (1) ・ A (1)) ^{r (2) + a (2) ・ d (2)} ∈G… (76)
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3))}
σ (2) = e _T (X (3) ・ A (3) ^{d (3)} , X (1) ・ A (1) ^{d (1)} ) ^{r (2) + a (2)} ∈G… (77 )
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))}
σ (3) = e (X (3) ・ A (3), X (1) ・ A (1) ^{・ d (1)} ) ^{r (2) + a (2) ・ d (2)} ∈G… ( 78)
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))}
σ (4) = e (X (3) ・ A (3), X (1) ・ A (1)) ^{r (2) + a (2)} ∈G… (79)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3))}
Is generated and output.

In addition, the sharing element calculation units 216a-1-3 to 216a-4-3 (FIG. 9) replace the expressions (60) to (63) with the sharing element σ (1) = e (X (1) · A (1), X (2) ・ A (2) ^{d (2)} ) ^{r (3) + a (3) ・ d (3)} ∈G… (80)
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・ d (3))}
σ (2) = e (X (1) ・ A (1) ^{d (1)} , X (2) ・ A (2)) ^{r (3) + a (3) ・ d (3)} ∈G… (81 )
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) (r (3) + a (3) ・ d (3))}
σ (3) = e (X (1) ・ A (1) ^{・ d (1)} , X (2) ・ A (2) ^{d (2)} ) ^{r (3) + a (3)} ∈G… (82 )
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3))}
σ (4) = e (X (1) ・ A (1), X (2) ・ A (2)) ^{r (3) + a (3)} ∈G… (83)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) (r (3) + a (3))}
Is generated and output.

Also, for example, assuming U = 1, instead of formulas (33) to (40),
σ (1) = g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) (r (3) + a (3) ・d (3))}
It is good. In addition, a configuration in which U = 2, 3 and U ≧ 5, a configuration in which the sharing element σ (u) is generated using only a part of the hash values d (1) to d (3), and a plurality of arbitrary elements X (1 ), X (2), X (3) is used to generate the sharing element σ (u) using a hash value that depends on the sharing value σ (u) without using the hash values d (1) to d (3). ) Is also possible. Further, d (p) is not limited to the hash value, and may be an integer whose value is determined according to the arbitrary element X (1) and / or the arbitrary element X (2) and / or the arbitrary element X (3). . For example, some bits of the arbitrary element X (1), arbitrary element X (2), or arbitrary element X (3) may be d (p), or a bit string obtained by bit-combining a part of these arbitrary elements. A part may be d (p). Also,
r (i) = F ′ (r ′ (i), a (i))
It is good. Note that F ′ is a hash function F ′: {0, 1} ^* → Z _q , and r ′ (i) is a random number. A similar modification may be performed for r (j). Accordingly, high safety can be ensured even when U = 1. In addition, the method for generating the sharing source σ (u) can be modified without departing from the spirit of the present invention.

[Modification 2 of the second embodiment]
Similar to the second modification of the first embodiment, in the second embodiment, the key K only needs to be determined based on the sharing element σ (u). As described in the second modification of the first embodiment, the key K The method for generating K may be modified.

[Third Embodiment]
Next, a third embodiment of the present invention will be described. In the third embodiment, an ID-based encryption scheme is applied, P = 2, W (u) = w (u, 1) · w (u, 2) · MSK, and w (u, p) is a linear sum of a (p) and r (p). The storage unit of the first key sharing apparatus includes at least an element Z (i) = ga ^{(i) · MSK} ∈G, a public value A (j) = ga ^(j) ∈G, and an element of the cyclic group G MPK = g ^MSK εG is stored, and the sharing source generation unit of the first key sharing device at least generates the element Z (i) = ga ^{(i) · MSK} εG and the public value A (j) = g. ^{a (j)} ∈ G, arbitrary value r (i), arbitrary element X (j) = g ^{r (j)} ∈ G, MPK = g ^MSK ∈ G, and two elements of cyclic group G are cyclic groups using the function e is bilinear function that maps one original G _T, based on _g ^T W of the cyclic group _{G T (u) = e (} g, g) W (u) ∈G T shared source σ It is generated as (u). In addition, the storage unit of the second key sharing apparatus includes at least an element Z (j) = ga ^{(j) · MSK} εG, a public value A (i) = ga ⁽ⁱ⁾ εG, and a cyclic group G. Element MPK = g ^MSK εG, and the shared key generation unit of the second key sharing device at least provides the element Z (j) = ga ^{(j) · MSK} εG and the public value A (i). = G ^{a (i)} ∈ G, arbitrary value r (j), arbitrary element X (i) = g ^{r (i)} ∈ G, MPK = g ^MSK ∈ G, and two elements of cyclic group G using the function e is bilinear function that maps one original cyclic group _{G T,} sharing the original ^{_{g T W (u) = e}} (g, g) W (u) ∈G T of the cyclic group _{G T} Generated as element σ (u).

<Configuration>
12 and 13 are block diagrams for explaining the configuration of the key sharing system 300 according to the third embodiment. In addition, about the part which is common in 1st Embodiment, description is simplified using the same code | symbol as 1st Embodiment.

  As illustrated in FIG. 12, the key sharing system 300 according to the third embodiment includes a key sharing device 310-1 (first key sharing device) and a key sharing device 310-2 (second key sharing device). The key sharing device 310-1 and the key sharing device 310-2 are configured to be able to exchange information with the key generation device 330. Note that this exchange of information is not limited to being performed via a network, and may be performed by, for example, reading / writing information from / to a portable recording medium such as a USB memory.

  As illustrated in FIG. 13, the key sharing apparatus 310-1 includes a storage unit 111-1, an arbitrary value generation unit 112-1, an arbitrary element generation unit 113-1, an output unit 114-1, and an input unit. 115-1, a sharing source generation unit 316-1, a key generation unit 317-1, a temporary memory 118-1, and a control unit 119-1. FIG. 14A is a block diagram for explaining the configuration of the sharing source generation unit 316-1. 14A, the sharing source generation unit 316-1 includes the hash calculation units 116b-1 and 116c-1, and the sharing source calculation units 316a-u-1 (uε {1,. , U}), 316b-1.

  As illustrated in FIG. 13, the key sharing apparatus 310-2 includes a storage unit 111-2, an arbitrary value generation unit 112-2, an arbitrary element generation unit 113-2, an output unit 114-2, and an input unit. 11-2, a sharing source generation unit 316-2, a key generation unit 317-2, a temporary memory 118-2, and a control unit 119-2. FIG. 14B is a block diagram for explaining the configuration of the sharing source generation unit 316-2. As illustrated in FIG. 14B, the sharing source generation unit 316-2 includes hash calculation units 116b-2 and 116c-2, and sharing source calculation units 316a-u-2 (uε {1,. , U}), 316b-2.

  As in the first embodiment, the key sharing apparatuses 310-1 and 310-2 are configured, for example, by reading a predetermined program into a known computer and executing it. Further, the key sharing apparatuses 310-1 and 310-2 execute each process under the control of the control units 119-1 and 119-2, respectively. Although the description is simplified below, the data output from each processing unit is stored in the temporary memories 118-1 and 118-1 or the storage units 111-1 and 111-1 one by one. Data stored in the temporary memories 118-1 and 118-2 or the storage units 111-1 and 111-2 are read out as necessary, input to each processing unit, and used for the processing.

<Public parameters>
In the third embodiment, the following are public parameters.

  G: Cyclic group of L-bit order q (q is a prime number).

G _T : Cyclic group of L-bit order q.

  g: A generator of the cyclic group G.

g _T: generator of the cyclic group _{G T.}

e: e (α, β) → γ (α, βεG, γεG _T ). Bilinear function that maps two original cyclic group G with one of the original cyclic group G _T.

F: G → [0, q ^1/2 ]. A hash function that maps an element of the cyclic group G to an integer between 0 and q ^1/2 .

H: {0, 1} ^* → {0, 1} ^L. A hash function that copies an arbitrary-length bit string into an L-bit bit string.

Y: {0, 1} ^* → G. A hash function that copies a bit string of arbitrary length to a cyclic group G.

  ID (prot): identifier of the name of the key exchange method.

MPK: Master public key of ID-based encryption method. Note that MPK = g ^MSK ∈ G ( ^MSK ∈ Z _q is a master secret key of the ID-based encryption method) is satisfied.

<Pre-processing>
A master secret key MSKεZ _q is securely stored in the storage unit of the key generation device 330. The key generation device 330 uses the identifier ID (1) of the key sharing device 310-1, and uses the secret key of the key sharing device 310-1.
Z (1) = Y (ID (1)) ^MSK ∈G… (84)
Is generated. here,
A (1) = Y (ID (1)) = g ^{a (1)} ∈G… (85)
Then, equation (84) becomes
Z (1) = ga ^{(1) ・ MSK} ∈G… (86)
It becomes. The secret key Z (1) is sent to the key sharing device 310-1, and is securely stored in the storage unit 311-1.

Further, the key generation device 330 uses the identifier ID (2) of the key sharing device 310-2 and uses the secret key of the key sharing device 310-2.
Z (2) = Y (ID (2)) ^MSK ∈G… (87)
Is generated. here,
A (2) = Y (ID (2)) = g ^{a (2)} ∈G… (88)
Then, equation (87) becomes
Z (2) = ga ^{(2) ・ MSK} ∈G… (89)
It becomes. The secret key Z (2) is sent to the key sharing device 310-2 and securely stored in the storage unit 311-2.

Further, in the storage unit 211-1 of the key sharing apparatus 210-1, the master public key MPK = g ^MSK εG and the public value A (1) = the source of the cyclic group G corresponding to the key sharing apparatus 210-1 ^{Y (ID (1)) =} g a (1) ∈G and public value a (2) which is the original cyclic group G corresponding to the key sharing device 210-2 = Y (ID (2) ) = g a ⁽²⁾ εG, the identifier ID (1) of the key sharing device 210-1, and the identifier ID (prot) are stored. In the storage unit 211-2 of the key sharing device 210-2, the master public key MPK = g ^MSK εG and the public value A (1) = Y () that is the source of the cyclic group G corresponding to the key sharing device 210-1. ^{ID (1)) = g a} (1) ∈G and public value a (2 which is the original cyclic group G corresponding to the key sharing device 210-2) = Y (ID (2 )) = g a (2 ⁾ ΕG, the identifier ID (2) of the key sharing device 210-2, and the identifier ID (prot) are stored.

<Key sharing process>
FIG. 15A is a flowchart for explaining the key sharing process of the key sharing apparatus 310-1, and FIG. 15B is a flowchart for explaining the key sharing process of the key sharing apparatus 310-2. is there.

  As shown in FIG. 15A, the key sharing apparatus 310-1 (FIG. 13) executes the processing of steps S112-1 to S115-1 of the first embodiment.

The sharing element generation unit 316-1 of the sharing apparatus 310-1 reads the arbitrary element X (2) = gr (2) εG input to the input unit 115-1 from the storage unit 211-1. Private key Z (1) = ga (1) · MSK ∈ G, master public key MPK = g MSK ∈ G, public value A (2) = ga (2) ∈ G, and arbitrary value generator 112- The arbitrary value r (1) εZ q generated at 1 (step S112-1) is input. Shared source generation unit 316-1 uses the aforementioned function e mapping the original of the cyclic group G to the original cyclic group G T, based on g T W (u) ∈G T (u of the cyclic group G T .Epsilon. {1,..., U}, U is an integer constant equal to or greater than 1) is generated and output as a sharing element σ (u) (step S316a-1). In this form
W (u) = w (u, 1) ・ w (u, 2) ・ MSK∈Z q … (90)
w (u, 1) = (r (1) ・ s (u, 1) + a (1) ・ t (u, 1)) ∈Z q … (91)
w (u, 2) = (r (2) ・ s (u, 2) + a (2) ・ t (u, 2)) ∈Z q … (92)
G T W (u) ∈G T satisfying is generated as a Pool sigma (u). s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ q is a constant or variable determined for each u, and is set in the same manner as in the first embodiment. That's fine.

Hereinafter, setting examples of s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q and U, and the process of step S316a-1 at that time will be described. Is illustrated.

[Example of Step S316a-1]
In this embodiment, first, a sharing element σ (u) that satisfies the expressions (6) to (10) of the first embodiment is generated. In this case, first, as in the first embodiment, the hash calculators 116b-1 and 116c-1 (FIG. 14A) perform the hash values d (1) and d (2) of the expressions (11) and (12). ) Is generated and output.

The sharing element calculation unit 316a-1-1 (FIG. 14A) has a hash value d (2), an arbitrary element X (2) = g ^{r (2)} εG, and a secret key Z (1) = g. ^{a (1) · MSK} ∈ G, master public key MPK = g ^MSK ∈ G, public value A (2) = g ^{a (2)} ∈ G, and arbitrary value r (1) ∈ Z _q Shared element σ (1) = e (MPK ^{r (1)}・ Z (1), X (2) ・ A (2) ^{d (2)} ) ∈G _T … (93)
= e (g ^{MSK ・ r (1)}・ g ^{a (1) ・ MSK} , g ^{r (2)}・ ga ^{(2) ・ d (2)} ) (from MPK = g ^MSK ∈G)
= e (g, g) ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) MSK} (from equation (27))
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) MSK} (From g _T = e (g, g))
Is generated and output. The shared element calculation unit 316a-2-1 has the hash value d (1), the arbitrary element X (2) = g ^{r (2)} ∈ G, and the secret key Z (1) = ga ^{(1) · MSK} ∈ G, master public key MPK = g ^MSK εG, public value A (2) = ga ⁽²⁾ εG, and arbitrary value r (1) εZ _q are input and shared element σ (2) = e (MPK ^{r (1)}・ Z (1) ^{d (1)} , X (2) ・ A (2)) ∈G _T … (94)
= e (g ^{MSK ・ r (1)}・ g ^{a (1) ・ MSK ・ d (1)} , g ^{r (2)}・ ga ⁽²⁾ ) (from MPK = g ^MSK ∈G)
= e (g, g) ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) MSK} (From Equation (27))
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) MSK} (From g _T = e (g, g))
Is generated and output (end of description of [Example of step S316a-1]).

Further, the sharing source calculation unit 316b-1 of the sharing source generation unit 316-1 receives the arbitrary element X (2) = g ^{r (2)} εG and the arbitrary value r (1) εZ _q as inputs. Element σ (3) = X (2) ^{r (1)} ∈G… (95)
= g ^{r (2) ・ r (1)}
Is generated (step S316b-1). This embodiment is an example of U = 2.

The key generation unit 317-1 (FIG. 13) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 316-1 (Step FIG. 15 (FIG. 15). A) / S217-1). In the example of this embodiment, the key generation unit 317-1 includes the sharing sources σ (1), σ (2), σ (3) generated by the sharing source generation unit 316-1 and the arbitrary element generation unit 113-1. Arbitrary element X (1) generated in step (S113-1), arbitrary element X (2) (step S115-1) input to the input unit 115-1, and disclosure read from the storage unit 311-1. Values A (1), A (2), identifier ID (1), ID (2), and ID (prot) are input. The key generation unit 317-1 uses the hash value of these bit combinations as a key.
K = H (σ (1), σ (2), σ (3), X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot)) ... (96)
And the generated key K is output.

  On the other hand, as shown in FIG. 15B, the key sharing apparatus 310-2 executes the processes of steps S112-2 to S115-2 of the first embodiment.

The sharing source generation unit 316-2 of the sharing apparatus 310-2 reads the arbitrary element X (1) = gr ⁽¹⁾ εG input to the input unit 115-2 from the storage unit 211-2. Private key Z (2) = ga ⁽²⁾ .MSK ∈ G, master public key MPK = g ^MSK ∈ G, public value A (1) = ga ⁽¹⁾ ∈ G, and arbitrary value generator 112- The arbitrary value r (2) εZ _q generated in step 2 (step S112-2) is input. Shared source generation unit 316-2 uses the aforementioned function e mapping the original of the cyclic group G to the original cyclic group _{G T,} based on _{^{g T W (u) ∈G T}} (u of the cyclic group _{G T} .Epsilon. {1,..., U}) is generated and output as a sharing element σ (u) (step S316a-2). In this ^{_{embodiment, g T W (u) ∈G}} T satisfying the formula (90) - (92) is generated as a Pool sigma (u).

Hereinafter, setting examples of s (u, 1), s (u, 2), t (u, 1), t (u, 2) εZ _q and U, and the processing of step S316-2 at that time will be described. Is illustrated.

[Example of Step S316a-2]
In this embodiment, first, a sharing element σ (u) that satisfies the expressions (6) to (10) of the first embodiment is generated. In this case, first, as in the first embodiment, the hash calculation units 116b-2 and 116c-2 (FIG. 14B) perform the hash values d (1) and d (2) of the equations (15) and (16). ) Is generated and output.

The sharing element calculation unit 316a-1-2 (FIG. 14B) uses the hash value d (2), the arbitrary element X (1) = g ^{r (1)} εG, and the secret key Z (2) = g. ^{a (2) · MSK} ∈ G, master public key MPK = g ^MSK ∈ G, public value A (1) = g ^{a (1)} ∈ G, and arbitrary value r (2) ∈ Z _q Shared element σ (1) = e (X (1) ・ A (1), MPK ^{r (2)}・ Z (2) ^{d (2)} ) ∈G _T … (97)
= e (g ^{r (1)}・ g ^{a (1)} , g ^{MSK ・ r (2)}・ ga ^{(2) ・ MSK ・ d (2)} ) (from MPK = g ^MSK ∈G)
= e (g, g) ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) MSK} (from equation (27))
= g _T ^{(r (1) + a (1)) (r (2) + a (2) ・ d (2)) MSK} (From g _T = e (g, g))
Is generated and output. The shared element calculation unit 316a-2-2 has the hash value d (1), the arbitrary element X (1) = g ^{r (1)} ∈ G, and the secret key Z (2) = ga ^{(2) · MSK} ∈ G, master public key MPK = g ^MSK εG, public value A (1) = ga ⁽¹⁾ εG, and arbitrary value r (2) εZ _q are input, and shared element σ (2) = e (X (1) ・ A (1) ^{d (1)} , MPK ^{r (2)}・ Z (2)) ∈G _T … (98)
= e (g ^{r (1)}・ g ^{a (1) ・ d (1)} , g ^{MSK ・ r (2)}・ ga ^{(2) ・ MSK} ) (from MPK = g ^MSK ∈G)
= e (g, g) ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) MSK} (From Equation (27))
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2)) MSK} (From g _T = e (g, g))
Is generated and output (end of description of [Example of step S316a-2]).

Further, the sharing source calculation unit 316b-2 of the sharing source generation unit 316-2 receives the arbitrary element X (1) = g ^{r (1)} εG and the arbitrary value r (2) εZ _q as inputs, and shares Element σ (3) = X (1) ^{r (2)} ∈G… (99)
= g ^{r (1) ・ r (2)}
Is generated (step S316b-2). This embodiment is an example of U = 2.

The key generation unit 317-2 (FIG. 13) generates and outputs a key K whose value is determined based on at least the sharing source σ (u) output from the sharing source generation unit 316-2 (Step FIG. 15 (FIG. 15). B) / S217-2). In the example of this embodiment, the key generation unit 317-2 includes the sharing sources σ (1), σ (2), σ (3) generated by the sharing source generation unit 316-2, and the arbitrary element generation unit 113-2. Arbitrary element X (2) generated in step (Step S113-2), Arbitrary element X (1) (step S115-2) input to the input unit 115-2, and disclosure read from the storage unit 311-2 Values A (1), A (2), identifier ID (1), ID (2), and ID (prot) are input. The key generation unit 317-2 uses the hash value of these bit combinations as the key.
K = H (σ (1), σ (2), σ (3), X (1), X (2), A (1), A (2), ID (1), ID (2), ID (prot)) ... (100)
And the generated key K is output.

<Features of this embodiment>
As can be seen from the transformation results of the equations (93) to (95) (97) to (99), the sharing sources σ (1) generated by the key sharing devices 316-1 and 316-2 are the same, and key sharing The sharing source σ (2) generated by each of the devices 316-1 and 316-2 is the same, and the sharing source σ (3) generated by each of the key sharing devices 316-1 and 316-2 is the same. As can be seen from the comparison of equations (96) and (100), the keys K generated by the key sharing apparatuses 316-1 and 316-2 are the same.

  Here, the key sharing device 316-1 can calculate the sharing sources σ (1) and σ (2) of the equations (93) and (94), respectively, because the key sharing device 316-1 has its own private key Z ( This is because 1) and the arbitrary value r (1) are known. An attacker who knows the secret key Z (2) of the key sharing device 316-2 can impersonate the key sharing device 316-1 and generate the arbitrary value r (1) and the arbitrary element X (1). However, since the secret key Z (1) is not known, the sharing sources σ (1) and σ (2) in the equations (93) and (94) cannot be calculated. The same applies to the key sharing device 216-2. Therefore, it is difficult for an attacker to perform a KCI attack on the system of this embodiment.

  In this embodiment, integers d (1) and d (2) whose values are determined according to the arbitrary elements X (1) and X (2) are generated, and the shared elements σ (1) and σ ( 2) was produced. Therefore, in this embodiment, high safety can be ensured.

  In the present embodiment, since a plurality of sharing sources σ (1) and σ (2) are generated, high security can be ensured.

[Modification 1 of Third Embodiment]
Modification 1 of the third embodiment is a modification of the generation process of the sharing source σ (u) in steps S316a-1, 2 and S316b-1, 2. In Modification 1 of the third embodiment, a sharing element σ (u) that satisfies Expressions (19 ′) to (22) is generated instead of Expressions (7) to (10), and the sharing element σ (3) is Do not generate.

In this case, the sharing element calculation units 316a-1-1 and 316a-2-1 (FIG. 14A) replace the expressions (93) and (94) with the sharing element σ (1) = e (MPK ^{r ( 1)}・ Z (1), X (2) ・ A (2)) ∈G _T … (101)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) MSK}
σ (2) = e (MPK ^{r (1)}・ Z (1) ^{d (1)} , X (2) ・ A (2) ^{d (1)} ) ∈G _T … (102)
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) MSK}
Is generated and output.

Also, the sharing element calculation units 316a-1-2 and 316a-2-2 (FIG. 14B) replace the expressions (98) and (98) with the sharing element σ (1) = e (X (1)・ A (1), MPK ^{r (2)}・ Z (2)) ∈G _T (103)
= g _T ^{(r (1) + a (1)) (r (2) + a (2)) MSK}
σ (2) = e (X (1) ・ A (1) ^{d (1)} , MPK ^{r (2)}・ Z (2) ^{d (2)} ) ∈G _T … (104)
= g _T ^{(r (1) + a (1) ・ d (1)) (r (2) + a (2) ・ d (2)) MSK}
Is generated and output. In this modification, the sharing source σ (3) is not generated. Others are the same as in the third embodiment.

In addition, for example, when U = 1, the sharing source σ (1) = g _T ^{(r (1) + a (1) · d (1)) (r (2) + a (2) · d (2)) MSK}
May be generated. Further, for example, s (1,1), t (1,1), s (1,2), t (1,2), s (2,1) as described in the first modification of the first embodiment. ), T (2,1), s (2,2), t (2,2), and U and d (p) may be modified. Also,
r (i) = F ′ (r ′ (i), a (i))
It is good. Note that F ′ is a hash function F ′: {0, 1} ^* → Z _q , and r ′ (i) is a random number. A similar modification may be performed for r (j). Accordingly, high safety can be ensured even when U = 1. In addition, the method for generating the sharing source σ (u) can be modified without departing from the spirit of the present invention.

[Modification 2 of the third embodiment]
Similar to the second modification of the first embodiment, in the third embodiment, the key K only needs to be determined based on the sharing element σ (u). As described in the second modification of the first embodiment, the key K The method for generating K may be modified.

[Other variations, etc.]
The present invention is not limited to the embodiment described above. For example, in each of the above-described embodiments, the order q is a prime number, but the order q may be a composite number instead of a prime number. In each of the above-described embodiments, the arbitrary values r (i), r (j), etc. are used as the elements of the integer remainder ring Z _q for the modulus _q . However, in each embodiment, the integer remainder ring for the modulus q is used. Each value treated as an element of Z _q may be an element of an integer set.

  In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good.

  In each embodiment, the apparatus is configured by executing a predetermined program on a computer. However, at least a part of the processing contents may be realized by hardware.

  Fields of application of the present invention include, for example, common key sharing in common key cryptography and common key sharing in authentication processing using common key cryptography.

DESCRIPTION OF SYMBOLS 1,100-300 Key sharing system 10-10-P, 110-110-P, 210-210-P, 310-310-P Key sharing apparatus

Claims (9)

A key sharing device that shares a key with another device,
The public value of the other device is an element of the cyclic group ^{G A (2) = g a} (2) is ∈G, g is a generator of the cyclic group G, MSK 及 Beauty a (2) is an integer Or an element of Z _q of order _q ,
An arbitrary value generation unit that generates an arbitrary value r ( 1 ) that is an integer or an element of Z _q ;
An arbitrary element generation unit that generates the first arbitrary element X ( 1 ) = g ^{r ( 1 )} εG using the arbitrary value r ( 1 );
An output unit for outputting the first arbitrary element X ( 1 );
The second optional original ^{X (2) = g r (} 2) ∈G [r (2) the original integer or _{Z q]} an input unit is input,
At least an element Z ( 1 ) = ga ^{( 1 ) · MSK} εG of the cyclic group G, the public value A ( 2 ) , the arbitrary value r ( 1 ), and the second arbitrary element X ( 2 ) When the original MPK ^{= g MSK} ∈G of the cyclic group G, using the bilinear function e for mapping two original the cyclic group G based on the cyclic group _{G T,} based on g _T ^W of a cyclic group G ^{( u) = e (g, g} ) W (u) ∈G T [a (1) is the original integer or _{Z q, W (u) =} w (u, 1) · w (u, 2) · a MSK, w (u, p) is the linear sum of a (p) and r (p), p∈ {1 , 2}, u∈ {1 ,. . . , U}, U is an integer constant equal to or greater than 1 , g _T is a generator of the cyclic group G _T ] as a share element σ (u),
A key generation unit that generates a key K whose value is determined based on at least the sharing source σ (u), and outputs the key K;
A key sharing device. The key sharing device according to claim 1,
U ≧ 2,
The sharing source generation unit includes a plurality of types of the sharing sources σ (1),. . . generate σ (U),
A key sharing device.   A key sharing device that shares a key with another device,
  The public value of the other device is an element of the cyclic group G A (j) = g ^{a (j)} .Epsilon.G and i, j.epsilon. {1,. . . , P}, j ≠ i, P is an integer constant of 2 or more, g is a generator of the cyclic group G, MSK and a (j) are integers or Z of order q _q The origin of
  Integer or Z _q An arbitrary value generation unit that generates an arbitrary value r (i) that is an element of
  Using the arbitrary value r (i), the first arbitrary element X (i) = g ^{r (i)} An arbitrary element generator for generating ∈G;
  An output unit for outputting the first arbitrary element X (i);
  Second arbitrary element X (j) = g ^{r (j)} ∈ G [r (j) is an integer or Z _q The input section to which is input,
  At least an integer or Z _q Secret value a (i) that is an element of Z or element Z (i) of cyclic group G = g ^{a (i) ・ MSK} An element g of a cyclic group G using εG, the public value A (j), the arbitrary value r (i), and the second arbitrary element X (j) ^{W (u)} ∈ G [W (u) is w (u, 1),. . . , W (u, P), a product of P or more integers, where w (u, p) is a plurality of integers including a (p) and r (p) or Z _q Original linear sum of p∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer constant greater than or equal to 1] as a shared element σ (u), or further, an element of the cyclic group G is a cyclic group G _T A function e that maps to the cyclic group G _T Original g _T ^{W (u)} ∈G _T [G _T Is the traveling group G _T Generating source] as a sharing source σ (u),
  A key generation unit that generates a key K whose value is determined based on at least the sharing source σ (u), and outputs the key K;
  r (i) = F ′ (r ′ (i), a (i)), r (j) = F ″ (r ′ (j), a (j)), and F ′ and F ″ are hash functions. And r ′ (i) and r ′ (j) are random numbers.   A key sharing device that shares a key with another device,
  The public value of the other device is an element of the cyclic group G A (j) = g ^{a (j)} .Epsilon.G and i, j.epsilon. {1,. . . , P}, j ≠ i, P is an integer constant of 2 or more, g is a generator of the cyclic group G, MSK and a (j) are integers or Z of order q _q The origin of
  Integer or Z _q An arbitrary value generation unit that generates an arbitrary value r (i) that is an element of
  Using the arbitrary value r (i), the first arbitrary element X (i) = g ^{r (i)} An arbitrary element generator for generating ∈G;
  An output unit for outputting the first arbitrary element X (i);
  Second arbitrary element X (j) = g ^{r (j)} ∈ G [r (j) is an integer or Z _q The input section to which is input,
  At least an integer or Z _q Secret value a (i) that is an element of Z or element Z (i) of cyclic group G = g ^{a (i) ・ MSK} An element g of a cyclic group G using εG, the public value A (j), the arbitrary value r (i), and the second arbitrary element X (j) ^{W (u)} ∈ G [W (u) is w (u, 1),. . . , W (u, P), a product of P or more integers, where w (u, p) is a plurality of integers including a (p) and r (p) or Z _q Original linear sum of p∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer constant greater than or equal to 3] as a shared element σ (u), or further, an element of the cyclic group G is a cyclic group G _T A function e that maps to the cyclic group G _T Original g _T ^{W (u)} ∈G _T [G _T Is the traveling group G _T Generating source] as a sharing source σ (u),
  At least a plurality of types of the sharing sources σ (1),. . . a key generation unit that generates a key K whose value is determined based on σ (U) and outputs the key K;
  A key sharing device.   A key sharing method for a key sharing apparatus that shares a key with another apparatus,
  The public value of the other device is an element of the cyclic group G A (2) = g ^{a (2)} ΕG, g is the generator of the cyclic group G, MSK and a (2) are integers or Z of order q _q The origin of
  Arbitrary value generator, integer or Z _q An arbitrary value generation step for generating an arbitrary value r (1) that is an element of
  The arbitrary element generation unit uses the arbitrary value r (1) and the first arbitrary element X (1) = g ^{r (1)} An arbitrary element generation step for generating ∈G;
  An output step of outputting the first arbitrary element X (1) from an output unit;
  Second arbitrary element X (2) = g ^{r (2)} ∈ G [r (2) is an integer or Z _q An input step in which the source of
  In the sharing source generation unit, at least element Z (1) = g of cyclic group G ^{a (1) ・ MSK} ΕG, the public value A (2), the arbitrary value r (1), the second arbitrary element X (2), and the element MPK of the cyclic group G = g ^MSK ∈ G and the two elements of the cyclic group G are the cyclic group G _T And a bilinear function e that maps to the element of _T ^{W (u)} = E (g, g) ^{W (u)} ∈G _T [A (1) is an integer or Z _q W (u) = w (u, 1) · w (u, 2) · MSK, w (u, p) is a linear sum of a (p) and r (p), p ∈ {1,2}, u∈ {1,. . . , U}, U is an integer constant greater than or equal to 1, g _T Is the traveling group G _T Generating source] as a sharing source σ (u),
  A key generation step of generating a key K whose value is determined based on at least the sharing source σ (u) in the key generation unit, and outputting the key K;
  A key sharing method.   The key sharing method according to claim 5, comprising:
  U ≧ 2,
  The sharing source generation step includes a plurality of types of the sharing sources σ (1),. . . generating σ (U),
  A key sharing method characterized by the above.   A key sharing method for a key sharing apparatus that shares a key with another apparatus,
  The public value of the other device is an element of the cyclic group G A (j) = g ^{a (j)} .Epsilon.G and i, j.epsilon. {1,. . . , P}, j ≠ i, P is an integer constant of 2 or more, g is a generator of the cyclic group G, MSK and a (j) are integers or Z of order q _q The origin of
  Arbitrary value generator, integer or Z _q An arbitrary value generation step for generating an arbitrary value r (i) that is an element of
  The arbitrary element generation unit uses the arbitrary value r (i) and the first arbitrary element X (i) = g ^{r (i)} An arbitrary element generation step for generating ∈G;
  An output step of outputting the first arbitrary element X (i) from an output unit;
  Second arbitrary element X (j) = g ^{r (j)} ∈ G [r (j) is an integer or Z _q An input step in which the source of
  At least an integer or Z in the sharing source generation unit _q Secret value a (i) that is an element of Z or element Z (i) of cyclic group G = g ^{a (i) ・ MSK} An element g of a cyclic group G using εG, the public value A (j), the arbitrary value r (i), and the second arbitrary element X (j) ^{W (u)} ∈ G [W (u) is w (u, 1),. . . , W (u, P), a product of P or more integers, where w (u, p) is a plurality of integers including a (p) and r (p) or Z _q Original linear sum of p∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer constant greater than or equal to 1] as a shared element σ (u), or further, an element of the cyclic group G is a cyclic group G _T A function e that maps to the cyclic group G _T Original g _T ^{W (u)} ∈G _T [G _T Is the traveling group G _T Generating source] as a sharing source σ (u),
  A key generation unit for generating a key K whose value is determined based on at least the sharing source σ (u) and outputting the key K;
  r (i) = F ′ (r ′ (i), a (i)), r (j) = F ″ (r ′ (j), a (j)), and F ′ and F ″ are hash functions. And r ′ (i) and r ′ (j) are random numbers.   A key sharing method for a key sharing apparatus that shares a key with another apparatus,
  The public value of the other device is an element of the cyclic group G A (j) = g ^{a (j)} .Epsilon.G and i, j.epsilon. {1,. . . , P}, j ≠ i, P is an integer constant of 2 or more, g is a generator of the cyclic group G, MSK and a (j) are integers or Z of order q _q The origin of
  Arbitrary value generator, integer or Z _q An arbitrary value generation step for generating an arbitrary value r (i) that is an element of
  The arbitrary element generation unit uses the arbitrary value r (i) and the first arbitrary element X (i) = g ^{r (i)} An arbitrary element generation step for generating ∈G;
  An output step of outputting the first arbitrary element X (i) from an output unit;
  Second arbitrary element X (j) = g ^{r (j)} ∈ G [r (j) is an integer or Z _q An input step in which the source of
  At least an integer or Z in the sharing source generation unit _q Secret value a (i) that is an element of Z or element Z (i) of cyclic group G = g ^{a (i) ・ MSK} An element g of a cyclic group G using εG, the public value A (j), the arbitrary value r (i), and the second arbitrary element X (j) ^{W (u)} ∈ G [W (u) is w (u, 1),. . . , W (u, P), a product of P or more integers, where w (u, p) is a plurality of integers including a (p) and r (p) or Z _q Original linear sum of p∈ {1,. . . , P}, u∈ {1,. . . , U}, U is an integer constant greater than or equal to 3] as a shared element σ (u), or further, an element of the cyclic group G is a cyclic group G _T A function e that maps to the cyclic group G _T Original g _T ^{W (u)} ∈G _T [G _T Is the traveling group G _T Generating source] as a sharing source σ (u),
  In the key generation unit, at least a plurality of types of the sharing sources σ (1),. . . a key generation step of generating a key K whose value is determined based on σ (U) and outputting the key K;
  A key sharing method. Program for causing a computer to function claims 1 as one of the key sharing device 4.

Images