JP5414558B2 - Key exchange system, key exchange method, and key exchange program - Google Patents

Description

  The present invention relates to a key exchange system, a key exchange method, and a key exchange program for sharing a key in common key cryptography.

  Conventionally, encryption communication is used in order to securely communicate secret information between communication devices (terminals). There are two types of encryption methods: a common key encryption method and a public key encryption method. The common key encryption method is a method using a common key among terminals that perform encrypted communication, and for example, AES (Advanced Encryption Standard) is known. The public key cryptosystem is a scheme using two keys, a secret key and a public key. For example, a RSA (Rivest Shamir Adleman) cipher is known.

  By the way, the public key cryptosystem has an advantage that it is not necessary to exchange keys between terminals for encryption. However, the public key cryptosystem has a performance disadvantage that the processing speed is slower than the common key cryptosystem or the load is heavy, so all communications are encrypted using only the public key cryptosystem. Is not efficient.

  On the other hand, in the common key encryption method, it is necessary to share a common key between terminals performing encrypted communication. Primarily, as a method that is difficult to intercept by a third party, the common key is exchanged face-to-face by the administrator of each terminal, or exchanged using a route such as mail that is different from the communication line. Was. However, this primitive common key exchange method is inefficient and impractical for realizing network communication.

  Therefore, various methods for distributing a common key via a communication line have been proposed. For example, a Diffie-Hellman key sharing method (see Non-Patent Document 1) and an application example thereof (see Patent Document 1) have been proposed.

JP 2000-278258 A JP 2006-140743 A

W. Diffie and M.M. E. Hellman, “New Directions in Cryptography,” IEEE Trans. on Information Theory, Vol. 22, no. 6, pp. 644-654, 1976 H. Kraczzyk, “HMQV: A High-Performance Secure Diffie-Hellman Protocol,” Advances in Cryptology-CRYPTO 2005, Springer-Verlag, LNCp 3621. 546-566, 2005

  The Diffie-Hellman key sharing described above is a method that allows secure key exchange using a communication line. However, since there is no guarantee for a random value that is shared for key exchange, there is no guarantee that the intermediary intervenes in communication. There is a possibility of being attacked. In other words, when transmitting information such as a public key from one terminal to another for exchanging a common key, a third party on the transmission path obtains this information, and substitutes forgery information to transmit the key. The exchange can be interrupted and the common key can be obtained illegally. Therefore, there has been a problem that the content of the encrypted communication is wiretapped or tampered by a third party.

  Therefore, in order to prevent this man-in-the-middle attack, a method called authentication key exchange (AKE: Authenticated Key Exchange) that performs mutual authentication using an electronic signature or an authentication function and confirms that the shared random number value is authentic is also available. (For example, see Non-Patent Document 2 and Patent Document 2).

  However, since AKE performs mutual authentication, there is a problem that the amount of communication and the number of communication increases, and further, the calculation load becomes heavy until a key is generated.

  It is an object of the present invention to provide a key exchange system, a key exchange method, and a key exchange program that can perform authentication key exchange with a reduced number of communications and computations.

  The present invention provides the following solutions.

  (1) A key exchange system in which a first terminal and a second terminal share a common key, and the first terminal and the second terminal include a unique signature key made up of natural numbers that do not overlap in advance. , The unique signature key and a unique verification key generated based on a public element belonging to a GDH (GAP-Diffie-Hellman) group, respectively, are allocated, and the first terminal receives from the GDH group A selection unit that selects one element, a signature generation unit that performs operation on the one element using the unique signature key of the first terminal, and generates signature information; and a unique verification key of the first terminal And the first transmission unit that transmits the signature information to the second terminal, the first reception unit that receives the unique verification key of the second terminal from the second terminal, and the one Element, unique of the second terminal A first key generation unit that generates the common key based on a certificate key and a unique signature key of the first terminal, and the second terminal receives the first key from the first terminal. A second reception unit that receives the unique verification key of the terminal and the signature information, a second transmission unit that transmits the unique verification key of the second terminal to the first terminal, the signature information, A key exchange system comprising: a second key generation unit that generates the common key based on the unique verification key of the first terminal and the unique signature key of the second terminal.

  According to such a configuration, the key exchange system uses, at each terminal, a legitimate unique verification key of the counterpart terminal with the issued certificate and a unique signature key that is difficult to obtain by other terminals. Generate a common key. The information necessary for generating the common key is acquired from the number of times of communication from the first terminal to the second terminal and from the second terminal to the first terminal, and each terminal performs one calculation. Generates a common key. Therefore, the key exchange system can perform authentication key exchange while reducing the number of communication times and the number of computations while enabling authentication with the unique verification key.

  (2) The first terminal further transmits the one element to the second terminal by the first transmitter, and the second terminal transmits the one element by the second receiver. The one element is further received from the first terminal, the predetermined calculation result based on the disclosed element and the signature information, the specific verification key of the first terminal and the predetermined element based on the one element And a verification unit that verifies the validity of the signature information, and the second transmission unit is configured to verify the validity of the signature information by the verification unit. The key exchange system according to (1), wherein the unique verification key of the second terminal is transmitted to the first terminal.

  According to such a configuration, the key exchange system further transmits the one element selected from the GDH group to the second terminal, whereby the signature information used for generating the common key in the second terminal. Can be verified. At this time, in order to verify the validity, the predetermined calculation is only executed twice. Therefore, the key exchange system can reduce the number of computations while enabling mutual authentication.

  (3) The key exchange system according to (1) or (2), wherein the selection unit randomly selects the one element from the GDH group.

  According to such a configuration, since the key exchange system randomly selects one element from the GDH group, the possibility that the data used for generating the common key is acquired by a third party is reduced. Can do.

  (4) The key exchange system according to (3), wherein the selection unit obtains the one element from random number data by a one-way hash function calculation that maps numerical data into elements of the GDH group.

  According to such a configuration, the key exchange system obtains one element by a one-way hash function calculation that maps numerical data to an element of the GDH group. Therefore, the key exchange system can easily calculate random elements belonging to the GDH group from the random number data.

  (5) The selection unit determines the one element based on a numerical value calculated from random number data by a one-way hash function calculation that maps and converts numerical data to fixed-length numerical data, and an element of the GDH group. The key exchange system as set forth in (3).

  According to such a configuration, the key exchange system can easily calculate a random element belonging to the GDH group from the random number data using a simple one-way hash function operation for numerical data. it can.

  (6) A key exchange method in which a first terminal and a second terminal share a common key, and the first terminal and the second terminal include a unique signature key made up of natural numbers that do not overlap in advance. , The unique signature key and a unique verification key generated based on a public element belonging to a GDH (GAP-Diffie-Hellman) group, respectively, are allocated, and the first terminal receives from the GDH group A selection step of selecting one element, a signature generation step of performing operation on the one element with the unique signature key of the first terminal to generate signature information, and a unique verification key of the first terminal And a first transmission step of transmitting the signature information to the second terminal, a first reception step of receiving a unique verification key of the second terminal from the second terminal, element, A first key generation step of generating the common key based on the unique verification key of the second terminal and the unique signature key of the first terminal, wherein the second terminal A second receiving step for receiving the unique verification key of the first terminal and the signature information from one terminal, and a second receiving step for transmitting the unique verification key of the second terminal to the first terminal. Key exchange for performing a transmission step and a second key generation step for generating the common key based on the signature information, the unique verification key of the first terminal, and the unique signature key of the second terminal Method.

  According to such a configuration, the same effect as in (1) can be expected by executing the key exchange method between the first terminal and the second terminal.

  (7) A key exchange program for causing a first terminal and a second terminal to share a common key, wherein the first terminal and the second terminal include a unique signature key composed of natural numbers that do not overlap in advance. , The unique signature key and a unique verification key generated based on a public element belonging to a GDH (GAP-Diffie-Hellman) group are respectively assigned to the first terminal from the GDH group. A selection step of selecting one element, a signature generation step of performing operation on the one element with the unique signature key of the first terminal to generate signature information, and a unique verification key of the first terminal And a first transmission step of transmitting the signature information to the second terminal, a first reception step of receiving a unique verification key of the second terminal from the second terminal, and the one An element, a first key generation step of generating the common key based on the unique verification key of the second terminal and the unique signature key of the first terminal, and causing the second terminal to A second receiving step for receiving the unique verification key of the first terminal and the signature information from the first terminal; and a second reception step of transmitting the unique verification key of the second terminal to the first terminal. And a second key generation step of generating the common key based on the signature information, the unique verification key of the first terminal, and the unique signature key of the second terminal. Key exchange program.

  According to such a configuration, the same effect as in (1) can be expected by causing the first terminal and the second terminal to execute the key exchange program.

  According to the present invention, authentication key exchange can be performed with a reduced number of communications and computations.

It is a block diagram which shows the function structure of the key exchange system which concerns on embodiment of this invention. It is a schematic diagram which shows the key exchange method in the key exchange system which concerns on embodiment of this invention. It is a flowchart which shows the process sequence of the key exchange method in the key exchange system which concerns on embodiment of this invention.

  Hereinafter, an example of an embodiment of the present invention will be described. The key exchange system according to the present embodiment shares a common key while performing mutual authentication between two terminals by predetermined communication and calculation.

  By the way, a unique signature key and a unique verification key that are not duplicated in advance are assigned to each terminal by a certificate authority (CA). The unique signature key is composed of a predetermined natural number (x), and the unique verification key is a point (g) on an elliptic curve that is an element of a GDH (GAP-Diffie-Hellman) group (G) and a unique signature key (x). It is preferable to consist of points (v = xg) on an elliptic curve generated based on the above. Such a configuration makes it difficult for a third party who does not know the unique signature key (x) to obtain the unique signature key (x) from the values of “v” and “g”.

  Here, a specific signature scheme employed in the present embodiment will be described. In the key exchange system, a GAP-Diffie-Hellman (GDH) signature is adopted as a basic signature scheme. The GDH signature is a signature that utilizes the fact that the Decision-Diffie-Hellman (DDH) problem can be solved by using a certain black box function e (P, Q) called pairing.

  Next, the GDH signature using the pairing operation will be described. A GDH group has been defined in connection with the Diffie-Hellman problem on an elliptic curve. The GDH group will be briefly described. Let G be a set of points on an elliptic curve. When “g” is an element of the set G, the Decision Diffie-Hellman (DDH) problem and the Computational Diffie-Hellman (CDH) problem on the elliptic curve in the set G are defined as follows.

DDH problem: A problem of determining whether c = ab when there is a, b, cεZ _p ^* (natural number less than p) and g, ag, bg, cg are given.
CDH problem: The problem of calculating abg when there is a, b, cεZ _p ^* and g, ag, bg are given.

  At this time, the DDH problem is simple in terms of calculation amount, but if the CDH problem is difficult in terms of calculation amount, this set G is defined as a GDH group.

On the other hand, points on an elliptic curve are P and Q, and depending on the P and Q, a black box function e (P, Q) called pairing that can have the following properties can be defined. Exists.
e (P, Q ₁ + Q ₂ ) = e (P, Q ₁ ) e (P, Q ₂ ) (1)
e (P ₁ + P ₂ , Q) = e (P ₁ , Q) e (P ₂ , Q) (2)
e (aP, bQ) = e (bP, aQ) = e (abP, Q) = e (P, abQ) = e (P, Q) ^ab (3)

Therefore, when g is a point on an elliptic curve that can be paired, if g, ag, bg, and cg are input to the equation (3) from the above property,
e (ag, bg) = e (g, g) ^ab (4)
e (g, cg) = e (g, g) ^c (5)
Thus, whether or not “ab = c” can be determined depending on whether or not both values match, and g can be an element of the GDH group G.

A GDH signature is constructed using this property. The set G is a GDH group, and g is a point that is an element of the set G. In addition, unlike the method in which the one-way hash function H is mapped and converted into numerical data having an arbitrary bit length size that is normally used, the numerical data having a fixed bit length size,
H: {0,1} ^* → G
As described above, it is defined that the numerical data having an arbitrary bit length size is mapped to the elements of the GDH group G expressed as points on the elliptic curve.

At this time, the GDH signature is defined as follows.
Key generation: A natural number xεZ _p ^* is selected, and v = xg is calculated from g. Let x be the signature key and point v on the elliptic curve be the verification key.
Signature: The signer calculates h = H (m) for the message “mε {0,1} ^* ”, and further calculates σ = xh using his signature key. Publish σ as a signature for m.
Verification: The verifier calculates h = H (m) from the message m, and prepares g, v, h, and σ. e (g, σ) and e (v, h) are calculated, and if both values match, the signature σ is determined to be a correct signature.

At this time, since the value of h becomes an element of the set G, it can be expressed as h = yg using a certain y∈Z _p ^* . As a result, if the signature is correctly performed, (g, v, h, σ) = (g, xg, yg, xyg). Therefore, if the signature is valid, the pairing operation in the above verification is e (g, σ) = e (g, xyg) = e (g, g) ^xy = e (xg, yg) = e ( v, h) and the values match, so that verification is possible. Note that due to the difficulty of the CDH problem that is a condition of the GDH group, it is impossible for a third party who does not know the signature key x to derive the signature σ from the values of g, v, and h.

  FIG. 1 is a block diagram showing a functional configuration of a key exchange system 1 according to the present embodiment. The terminal 10 (first terminal) and the terminal 20 (second terminal) are connected via a network. In addition, although this embodiment demonstrates as starting communication from the terminal 10, you may start from the terminal 20. FIG. In this case, the configuration (each unit) included in the terminal 10 and the terminal 20 is reversed.

  The terminal 10 includes a control unit 11, a storage unit 12, an input unit 13, a display unit 14, and a communication unit 15. Similarly, the terminal 20 includes a control unit 21, a storage unit 22, an input unit 23, a display unit 24, and a communication unit 25.

  The control unit 11 is a part that controls the entire terminal 10, and the control unit 21 is a part that controls the entire terminal 20, and appropriately reads and executes various programs stored in the storage unit 12 or the storage unit 22, respectively. In cooperation with the hardware described above, various functions in the present embodiment are realized. The control unit 11 and the control unit 21 may be a CPU (Central Processing Unit). In addition, the function of each part with which the control part 11 and the control part 21 are provided is mentioned later.

  The storage unit 12 and the storage unit 22 are storage areas for various programs and various data for causing the hardware group to function as the terminal 10 or the terminal 20, and may be a hard disk (HDD). Specifically, the storage unit 12 and the storage unit 22 include a program for causing the control unit 11 and the control unit 21 to execute various functions of the present embodiment, a unique signature key and a unique verification key issued by a public certificate authority. Is memorized.

Note that an element g of a GDH group (elliptic curve) G, which is a generation source of the unique signature key and the unique verification key, is given, and for the terminal 10, x ₁ ∈Z _p ^* is the unique signature key, x ₁ g Is a unique verification key. Further, for the terminal 20, x ₂ εZ _p ^* is a unique signature key and x ₂ g is a unique verification key. Each unique verification key is accompanied by a certificate issued by a public certificate authority, and g and the unique verification keys (v ₁ = x ₁ g and v ₂ = x ₂ g) are made public.

  The input unit 13 and the input unit 23 are interface devices that accept an instruction input from the user to the terminal 10 or the terminal 20. The input unit 13 and the input unit 23 are configured by, for example, a keyboard, a mouse, a touch panel, and the like.

  The display unit 14 and the display unit 24 display a screen for accepting data input to the user, or display a screen of a processing result by the terminal 10 or the terminal 20. The display unit 14 and the display unit 24 may be a display device such as a cathode ray tube display device (CRT) or a liquid crystal display device (LCD).

  The communication unit 15 and the communication unit 25 are network adapters that communicate with an external device via a network. The communication unit 15 and the communication unit 25 establish communication between the terminal 10 and the terminal 20, and transmit and receive various data to and from each other. Specifically, in this embodiment, data used for generating a common key and mutual authentication is transmitted and received.

  The control unit 11 of the terminal 10 includes a selection unit 111, a signature generation unit 112, a transmission unit 113 (first transmission unit), a reception unit 114 (first reception unit), and a key generation unit 115 (first Key generation unit). The control unit 21 of the terminal 20 includes a reception unit 211 (second reception unit), a verification unit 212, a transmission unit 213 (second transmission unit), and a key generation unit 214 (second key generation unit). ).

  The selection unit 111 randomly selects one element (point) h from the GDH group (elliptic curve) G.

The signature generation unit 112 performs an operation on h selected by the selection unit 111 using the unique signature key (x ₁ ) of the terminal 10 to generate signature information (x ₁ h).

The transmission unit 113 transmits the unique verification key with issued certificate (v ₁ ), one element (h), and signature information (x ₁ h) of the terminal 10 to the terminal 20 via the communication unit 15.

The receiving unit 114 receives the unique verification key (v ₂ ) with the issued certificate of the terminal 20 from the terminal 20 via the communication unit 15.

Based on the element (h), the unique verification key (v ₂ ) of the terminal 20, and the unique signature key of the terminal 10, the key generation unit 115 uses the equation (6) or (7) to obtain a common key (Key). Is generated.

The receiving unit 211 receives the unique verification key (v ₁ ) with the issued certificate of the terminal 10, one element (h), and signature information (x ₁ h) from the terminal 10 via the communication unit 25.

The verification unit 212 obtains the result of the pairing operation “e (g, x ₁ h)” based on the disclosed element (g) and the signature information (x ₁ h), and the unique verification key (v ₁ ) of the terminal 10. And the pairing operation “e (v ₁ , h)” based on the one element (h) is confirmed to be equal, and the validity of the signature information (x ₁ h) is verified.

When the validity of the signature information (x ₁ h) is verified by the verification unit 212, the transmission unit 213 uses the unique verification key (v ₂ ) with the issued certificate of the terminal 20 to continue the key exchange procedure. And transmitted to the terminal 10 via the communication unit 25.

Based on the signature information (x ₁ h), the unique verification key (v ₁ ) of the terminal 10, and the unique signature key of the terminal 20, the key generation unit 214 generates a common key (Key) using Equation (8).

と変形できるので、端末１０の鍵生成部１１５により生成された共通鍵と、端末２０の鍵生成部２１４により生成された共通鍵とは同一の値となる。 Here, using “v ₁ = x ₁ g” and “v ₂ = x ₂ g”, the equations (6) to (8) are all

Therefore, the common key generated by the key generation unit 115 of the terminal 10 and the common key generated by the key generation unit 214 of the terminal 20 have the same value.

FIG. 2 is a schematic diagram showing a key exchange method in the key exchange system 1 according to the present embodiment.
The terminal 10 stores a unique signature key (x ₁ ) and a unique verification key (v ₁ = x ₁ g). Further, the terminal 20 stores a unique signature key (x ₂ ) and a unique verification key (v ₂ = x ₂ g).

When the signature information (x ₁ h) is generated from one element (h) selected at random in the terminal 10, the unique verification key (v ₁ ) and one element (h) are transmitted from the terminal 10 to the terminal 20. And signature information (x ₁ h) is transmitted.

The terminal 20 confirms that “e (g, x ₁ h)” and “e (v ₁ , h)” are equal by the pairing calculation. When the two match, the unique verification key (v ₂ ) is transmitted from the terminal 20 to the terminal 10.

  As described above, each of the terminal 10 and the terminal 20 generates a common key by pairing calculation and shares it between the terminals.

  FIG. 3 is a flowchart showing a processing procedure of a key exchange method in the key exchange system 1 according to the present embodiment. This process is performed by the programs stored in the storage unit 12 and the storage unit 22 being executed by the control unit 11 and the control unit 21, respectively.

  In step S1 (selection step), the control unit 11 (selection unit 111) selects one element (h) from the GDH group.

In step S2 (signature generation step), the control unit 11 (signature generation unit 112), based on its own unique signature key (x ₁ ) and the one element (h) selected in step S1, sign information ( x ₁ h) is generated.

In step S3 (first transmission step), the control unit 11 (transmission unit 113) determines the unique verification key (v ₁ ), one element (h), and the signature information (x ₁ h) generated in step S2. Is transmitted to the terminal 20.

In step S4 (second receiving step), the control unit 21 (receiving unit 211) receives the unique verification key (v ₁ ), one element (h), and signature information (x ₁ h) transmitted in step S3. Receive.

In step S5, the control unit 21 (verification unit 212) verifies the validity of the signature information (x ₁ h) received in step S4 using pairing calculation.

In step S6, the control unit 21 determines whether or not the signature information (x ₁ h) verified in step S5 is valid. If this determination is YES, the control unit 21 moves the process to step S7. If the determination is NO, the control unit 21 ends the process and stops key exchange.

In step S7 (second transmission step), since it is confirmed that the signature information (x ₁ h) is valid, the control unit 21 (transmission unit 213) uses its own unique verification key (v ₂ ) as a terminal. 10 to send.

In step S8 (first reception step), the control unit 11 (reception unit 114) receives the unique verification key (v ₂ ) transmitted in step S7.

In step S9 (first key generation step), the control unit 11 (key generation unit 115) transmits one element (h) or signature information (x ₁ h), the unique verification key (v ₂ ) of the terminal 20, and A common key is generated by the above-described pairing operation using the unique signature key (x ₁ ) of the terminal 10.

In step S10 (second key generation step), the control unit 21 (key generation unit 214) performs signature information (x ₁ h), a unique verification key (v ₁ ) of the terminal 10, and a unique signature key ( A common key is generated by the above pairing operation using x ₂ ).

  As described above, according to the present embodiment, the key generation unit 115 and the key generation unit 214 generate a common key by using a publicly-verified unique verification key with an issued certificate. 10 and the terminal 20 can be mutually authenticated. Therefore, the key exchange system 1 can eliminate the man-in-the-middle attack.

Further, in the key exchange system 1, the common key is shared only by one round-trip (two times) communication between the terminals, and necessary information other than the public information includes a random element h and signature information for this h. Only x ₁ h and the amount of information is small. In addition, since the number of calculations is three pairing calculations at the time of signature verification and key generation in the terminal 20, and one pairing calculation at the time of key generation in the terminal 10, it is calculated in comparison with the conventional authentication key exchange. Less often. Therefore, according to the present embodiment, it is possible to perform authentication key exchange with reduced communication, memory, and computation load while enabling mutual authentication.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

In the above-described embodiment, the selection unit 111 directly obtains one element (h) from the GDH group, but is not limited thereto. For example, the selection unit 111 calculates one from random number data (rεZ _p ^* ) by an operation of a one-way hash function (H: {0, 1} ^* → G) that maps and converts numerical data into elements of the GDH group. (H = H (r)) may be obtained.

In addition, for example, the selection unit 111 performs random number data (H ′: {0, 1} ^* → {0, 1} ^l ) by calculating a one-way hash function (M ′) that maps and converts numeric data into fixed-length numeric data. One element (h = H ′ (r) g ′) may be obtained based on the numerical value calculated from r) and the element (g ′) of the GDH group. Here, l indicates the size of the hash value. For example, 160 is SHA-1. Note that when the random number data (r) is acquired by a third party, the element (g ′) is obtained, and the one element (h) may be rewritten. Therefore, the random number data (r) is not disclosed.

  By using the one-way hash function in this way, the selection unit 111 can easily calculate the random element (h) belonging to the GDH group from the random number data.

1 Key exchange system 10 Terminal (first terminal)
20 terminals (second terminal)
111 Selection Unit 112 Signature Generation Unit 113 Transmission Unit (First Transmission Unit)
114 Receiving unit (first receiving unit)
115 Key generation unit (first key generation unit)
211 Receiving unit (second receiving unit)
212 verification unit 213 transmission unit (second transmission unit)
214 Key generation unit (second key generation unit)

Claims (7)

A key exchange system in which a first terminal and a second terminal share a common key,
The first terminal and the second terminal are generated in advance based on a unique signature key consisting of a natural number that does not overlap in advance, and the unique signature key and a public element belonging to a GDH (GAP-Diffie-Hellman) group. And a unique verification key
The first terminal is
A selection unit for selecting one element from the GDH group;
A signature generating unit that performs an operation on the one element using the unique signature key of the first terminal and generates signature information;
A first transmitter that transmits the unique verification key of the first terminal and the signature information to the second terminal;
A first receiving unit that receives a unique verification key of the second terminal from the second terminal;
A first key generation unit that generates the common key based on the one element, the unique verification key of the second terminal, and the unique signature key of the first terminal;
The second terminal is
A second receiving unit for receiving the unique verification key of the first terminal and the signature information from the first terminal;
A second transmitter that transmits the unique verification key of the second terminal to the first terminal;
A key exchange system comprising: a second key generation unit that generates the common key based on the signature information, the unique verification key of the first terminal, and the unique signature key of the second terminal. The first terminal is
The first transmission unit further transmits the one element to the second terminal,
The second terminal is
The second receiving unit further receives the one element from the first terminal,
Confirm that the predetermined calculation result based on the disclosed element and the signature information is equal to the predetermined verification result based on the unique verification key of the first terminal and the one element, and the signature information A verification unit for verifying the correctness;
The said 2nd transmission part transmits the specific verification key of the said 2nd terminal to the said 1st terminal, when the validity of the said signature information is verified by the said verification part. Key exchange system.   The key exchange system according to claim 1 or 2, wherein the selection unit randomly selects the one element from the GDH group.   4. The key exchange system according to claim 3, wherein the selection unit obtains the one element from random number data by performing a one-way hash function calculation for mapping and converting numerical data into elements of the GDH group.   The selection unit obtains the one element based on a numerical value calculated from random number data by a one-way hash function calculation for mapping and converting numerical data to fixed-length numerical data, and an element of the GDH group. 3. The key exchange system according to 3. A key exchange method in which a first terminal and a second terminal share a common key,
The first terminal and the second terminal are generated in advance based on a unique signature key consisting of a natural number that does not overlap in advance, and the unique signature key and a public element belonging to a GDH (GAP-Diffie-Hellman) group. And a unique verification key
The first terminal is
A selection step of selecting one element from the GDH group;
A signature generation step of performing calculation on the one element using the unique signature key of the first terminal and generating signature information;
A first transmission step of transmitting the unique verification key of the first terminal and the signature information to the second terminal;
A first receiving step of receiving a unique verification key of the second terminal from the second terminal;
Performing a first key generation step of generating the common key based on the one element, the unique verification key of the second terminal and the unique signature key of the first terminal;
The second terminal is
A second receiving step of receiving the unique verification key of the first terminal and the signature information from the first terminal;
A second transmission step of transmitting the unique verification key of the second terminal to the first terminal;
And a second key generation step of generating the common key based on the signature information, the unique verification key of the first terminal, and the unique signature key of the second terminal. A key exchange program for causing a first terminal and a second terminal to share a common key,
The first terminal and the second terminal are generated based on a unique signature key composed of natural numbers that do not overlap in advance, and the unique signature key and a public element belonging to a GDH (GAP-Diffie-Hellman) group. And a unique verification key
In the first terminal,
A selection step of selecting one element from the GDH group;
A signature generation step of performing calculation on the one element using the unique signature key of the first terminal and generating signature information;
A first transmission step of transmitting the unique verification key of the first terminal and the signature information to the second terminal;
A first receiving step of receiving a unique verification key of the second terminal from the second terminal;
A first key generation step of generating the common key based on the one element, the unique verification key of the second terminal and the unique signature key of the first terminal;
In the second terminal,
A second receiving step of receiving the unique verification key of the first terminal and the signature information from the first terminal;
A second transmission step of transmitting the unique verification key of the second terminal to the first terminal;
A key exchange program for executing a second key generation step of generating the common key based on the signature information, the unique verification key of the first terminal, and the unique signature key of the second terminal.

Images