JP5562284B2 - Re-encryption system, re-encryption device, capability providing device, re-encryption method, capability provision method, and program - Google Patents

Description

  The present invention relates to a ciphertext re-encryption technique, and more particularly to a technique for providing a ciphertext re-encryption capability to another apparatus.

  Usually, in order to generate a second ciphertext obtained by re-encrypting a first ciphertext encrypted with a certain first encryption key with another second encryption key, it corresponds to the first encryption key. It is necessary to decrypt the first ciphertext using the first decryption key and encrypt the decryption result using the second encryption key (see, for example, Patent Document 1).

  One of the conventional methods for performing re-encryption by a re-encryption device that does not hold the first decryption key is that the first device that holds the first decryption key sends the first decryption to the re-encryption device. In this method, a key is provided, and the re-encryption device performs re-encryption using the first decryption key. In another conventional method, the re-encryption device provides the first ciphertext to the first device, the first device re-encrypts the first ciphertext using the first decryption key, and the obtained second ciphertext Is provided to the re-encryption device.

Japanese Patent No. 3868218

  However, in the method in which the first device provides the first decryption key to the re-encryption device, the first decryption key has to be taken out of the first device, which is a safety problem. On the other hand, in the method in which the re-encryption device provides the first ciphertext to the first device and the first device re-encrypts the first ciphertext using the first decryption key, the re-encryption device is the first device. The correctness of the re-encryption process cannot be verified.

  The present invention has been made in view of these points, and an object of the present invention is to provide a technique that provides the ability to re-encrypt a ciphertext with another encryption key without providing a decryption key.

In the present invention, G, and H as a finite-friendly換群first ciphertext C1 plaintext m in accordance with the first encryption system is the first encryption key y ₁ in encrypted-obtained group H of the original when given, the first ciphertext C1, the second encryption method the plaintext m in accordance with the a second encryption key y ₂ encryption to the group G obtained based on the second ciphertext f Let (C1) = f be a function for converting to C2. It is assumed that a and b are natural numbers that are relatively prime, X ₁ and X ₂ are random variables having values in group G, x ₁ is an actual value of random variable X ₁ , and x ₂ is an actual value of random variable X _2. . Furthermore, a set including ciphertexts that may be obtained by encrypting plaintext with the second encryption key y ₂ in accordance with the second encryption method is referred to as a ciphertext class to which the ciphertext belongs. To.

The re-encryption apparatus outputs first input information τ ₁ and second input information τ ₂ that are elements of the group H corresponding to the first ciphertext C1. The capability providing apparatus correctly calculates f (τ ₁ ) with a probability larger than a certain probability using the first input information τ ₁ , and obtains the obtained calculation result as first output information z ₁ , and second input information τ ₂ , f (τ ₂ ) is correctly calculated with a probability larger than a certain probability, and the obtained calculation result is set as second output information z ₂ . The re-encryption unit, the operation result u = f ^(C1) from the first output information _{z 1} generates a b _{x 1,} generates an operation result _{^{v = f (C1) a x}} 2 from the second output information _{z 2,} When the value u ^a for the operation result u and the value v ^b for the operation result v belong to the same ciphertext class, the values u ^{b ′} for integers a ′ and b ′ satisfying a′a + b′b = 1. Outputs v ^{a ′} .

In the present invention, the capability providing device provides the first output information z ₁ and the second output information z ₂ to the re-encrypting device without providing the decryption key, and the re-encrypting device sets u ^{b ′} v ^{a ′} . Output. u ^{b ′} v ^{a ′} becomes the second ciphertext f (C1) with high probability. As described above, according to the present invention, it is possible to provide the re-encryption device with the capability of re-encrypting the ciphertext with another encryption key without providing the decryption key.

The block diagram for demonstrating the structure of the re-encryption system of embodiment. The block diagram for demonstrating the structure of the re-encryption apparatus of embodiment. The block diagram for demonstrating the structure of the capability provision apparatus of embodiment. The block diagram for demonstrating the structure of the reciphertext acquisition apparatus of embodiment. The block diagram for demonstrating the structure of the input information provision part of embodiment. The block diagram for demonstrating the structure of the input information provision part of embodiment. The flowchart for demonstrating the process of the re-encryption apparatus of embodiment. The flowchart for demonstrating the process of the capability provision apparatus of embodiment. The flowchart for demonstrating the process of step S2103 (S3103). The flowchart for demonstrating the process of step S4103. The block diagram for demonstrating the structure of the re-encryption apparatus of embodiment. The flowchart for demonstrating the process of the re-encryption apparatus of embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First embodiment]
First, a first embodiment of the present invention will be described.

<Configuration>
As illustrated in FIG. 1, the re-encryption system 1 according to the first embodiment includes, for example, an encryption device 10, a re-encryption device 11, a capability providing device 12, and a re-ciphertext acquisition device 13. Each device is configured to be able to exchange information. For example, each device can exchange information via a transmission line, a network, a portable recording medium, or the like.

In this embodiment, the encryption device 10, and outputs the first ciphertext C1 by encrypting the plaintext m in the first encryption key y ₁ in accordance with the first encryption method. The re-encrypting device 11 that has acquired the first ciphertext C1 requests the capability providing device 12 to provide the capability of re-encrypting the first ciphertext C1 into the second ciphertext C2. The capability providing device 12 of this embodiment provides this capability to the re-encryption device 11, and the re-encryption device 11 re-encrypts the first ciphertext C1 into the second ciphertext C2 using the provided capability. The re-encryption device 11 provides the second ciphertext C2 to the re-ciphertext acquisition device 13, and the re-ciphertext acquisition device 13 decrypts the second ciphertext C2 to obtain a decryption result m ′. Further, the re-encryption device 11 and / or the capability provision provides the capability of the re-ciphertext acquisition device 13 to acquire the first ciphertext C1 and re-encrypt the first ciphertext C1 into the second ciphertext C2. You may make a request to the device 12. In this case, this capability is provided to the re-ciphertext acquisition device 13, and the re-ciphertext acquisition device 13 re-encrypts the first ciphertext C1 into the second ciphertext C2 using the provided capability.

  As illustrated in FIG. 2, the re-encryption apparatus 11 according to the first embodiment includes, for example, a natural number storage unit 1101, a natural number selection unit 1102, an integer calculation unit 1103, an input information provision unit 1104, a first calculation unit 1105, It has a first power calculation unit 1106, a first list storage unit 1107, a second calculation unit 1108, a second power calculation unit 1109, a second list storage unit 1110, a determination unit 1111, a final output unit 1112, and a control unit 1113. The re-encryption device 11 executes each process under the control of the control unit 1113. Examples of the re-encryption device 11 include a known or dedicated computer, a server device, a gateway device, or a card reader / writer device having a CPU (central processing unit) and a RAM (random-access memory) loaded with a special program. And a device having a calculation function and a storage function such as a mobile phone.

  As illustrated in FIG. 3, the capability providing apparatus 12 according to the first embodiment includes, for example, a first output information calculation unit 1201, a second output information calculation unit 1202, a key storage unit 1204, and a control unit 1205. The capability providing apparatus 12 executes each process under the control of the control unit 1205. Examples of the capability providing device 12 include a known or dedicated computer having a CPU and RAM loaded with a special program, a device having a calculation function and a storage function such as a mobile phone, an IC card, an IC chip, etc. Tamper resistant module.

  As illustrated in FIG. 4, the re-ciphertext acquisition device 13 of the first embodiment includes, for example, a re-encryption device 1311, a decryption unit 1312, a control unit 1313, and a key storage unit 1314. The configuration of the re-encryption device 1311 is the same as that of the re-encryption device 11 of FIG. The reciphertext acquisition device 13 executes each process under the control of the control unit 1313. An example of the re-ciphertext acquisition device 13 is a known or dedicated computer having a CPU or RAM loaded with a special program, a device having a calculation function and a storage function, such as a mobile phone.

Although the detailed configuration is omitted, the encryption device 10 of the first embodiment is a device having the ability to encrypt the plaintext m with the first encryption key y ₁ in accordance with the first encryption method. An example of the encryption device 10 is a known or dedicated computer including a CPU or RAM into which a special program is read, or a device having a calculation function and a storage function such as a mobile phone.

<Processing premise>
G and H are finite commutative groups (for example, cyclic groups), X ₁ and X ₂ are random variables having values in the group G, x ₁ is an actual value of the random variable X ₁ , and x ₂ is a probability a realization value of the variable X _2, is a function for converting a first ciphertext C1 is the original group H which f is applied to the second ciphertext f (C1) = C2 is the original group G And Wherein the first ciphertext C1 is a ciphertext obtained by encrypting plaintext m in the first encryption key y ₁ in accordance with the first encryption method, the second ciphertext C2 to the second encryption scheme a ciphertext obtained by encrypting plaintext m in the second encryption key y ₂ in accordance. The first encryption method and the second encryption method may be a public key encryption method or a common key encryption method. Further, the first encryption method and the second encryption method may be a stochastic encryption method or a definite encryption method. Furthermore, the first encryption method and the second encryption method may be the same encryption method, or they may be different encryption methods. Examples of the first encryption method and the second encryption method are encryption methods using a homomorphic function as an encryption function and a decryption function. An example of this is the ElGamal cryptosystem (reference 1: Taher Elgamal, “A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” IEEE Transactions on Information Theory, v. IT-31, n. 4, 1985. , 469-472 or CRYPTO 84, pp. 10-18, Springer-Verlag.) and RSA cryptosystem (Reference 2: RLRivest, A. Shamir, and L. Adelman, "A Method for Obtaining Digital Signature and Public-key Cryptsystems, "MIT Laboratory for Computer Science, Thechnical Memo LCS / TM82, April 4,1977 (Revised December 12,1977)). Moreover, G = H may be sufficient and G <> H may be sufficient. In the following, operations on the groups G and H are expressed in a multiplicative manner.

The first decryption key s ₁ corresponds to the first encryption key y ₁ , and the second decryption key s ₂ corresponds to the second encryption key y ₂ . When the first encryption method is a public key encryption method, the first encryption key y ₁ is a public key and the first decryption key s ₁ is a secret key. On the other hand, when the first encryption method is a common key encryption method, the first encryption key y ₁ and the first decryption key s ₁ are common keys. When the second encryption method is a public key encryption method, the second encryption key y ₂ is a public key, and the second decryption key s ₂ is a secret key. On the other hand, when the second encryption method is a common key encryption method, the second encryption key y ₂ and the second decryption key s ₂ are common keys.

Further, the cipher text C2 obtained by the plaintext in accordance with the second encryption system encrypts the second encryption key y _2, by the second encryption scheme using the same encryption key and the same plaintext and C2 A set of ciphertexts that may be obtained is referred to as “ciphertext class” to which the ciphertext C2 belongs. For example, when the second encryption method is a stochastic encryption method such as the ElGamal encryption method, a plurality of ciphertexts correspond to the same plaintext and encryption key pair. A plurality of elements belong to the ciphertext class to which C belongs. On the other hand, for example, when the second encryption method is a definite encryption method such as the RSA encryption method, the ciphertext is uniquely determined for the same plaintext and encryption key pair. Only one element belongs to a class. When only one element belongs to the same ciphertext class, it is equivalent that two values belong to the same ciphertext class and the two values are equal. That is, when the second encryption method is a definite encryption method, it can be determined whether the two values belong to the same ciphertext class by determining whether the two values are equal.

Also, it is assumed that a plurality of types (a, b) of two prime numbers a and b that are relatively prime are stored in the natural number storage unit 1101 of the re-encryption device 11 (FIG. 2). Assuming that I is a set of two natural numbers less than the order of the group G and prime to each other, the natural number storage unit 1101 stores a set (a, b) of natural numbers a and b corresponding to the subset S of I. Can be considered. a and b are relatively prime natural numbers, and “natural number” represents an integer of 0 or more. The first encryption key y ₁ is stored in a key storage unit (not shown) of the encryption device 10, and the first decryption key s ₁ and the second encryption key y ₂ are stored in the capability providing device 12 (FIG. 3). stored in the key storage unit 1204, it is assumed that the second decryption key s ₂ is stored in the key storage unit 1314 of the re-encrypted sentence obtaining unit 13 (FIG. 4).

<Processing>
First, the encryption device 10, key storage unit using the first encryption key y ₁ read from the (not shown), a first ciphertext by encrypting in accordance with the input plaintext m to the first encryption method C1εH is generated and the first ciphertext C1 is output.

  The first ciphertext C1 is input to the input information providing unit 1104 of the re-encryption device 11 (FIG. 2). The natural number selection unit 1102 of the re-encryption device 11 to which the first ciphertext C1 is input, as illustrated in FIG. 7, selects one from a plurality of natural number pairs (a, b) stored in the natural number storage unit 1101. A natural number pair (a, b) is read at random. At least part of the read natural number set (a, b) is sent to the integer calculation unit 1103, the input information providing unit 1104, the first power calculation unit 1106, and the second power calculation unit 1109 (step S1100).

  The integer calculation unit 1103 calculates integers a ′ and b ′ that satisfy the relationship of a′a + b′b = 1 by using the transmitted pair (a, b) of natural numbers. Since the natural numbers a and b are relatively prime, there are always integers a ′ and b ′ that satisfy the relationship of a′a + b′b = 1, and the calculation method is well known. For example, integers a ′ and b ′ are calculated by a well-known algorithm such as the extended mutual division method, and information on a set of natural numbers (a ′ and b ′) is sent to the final output unit 1112 (step S1101).

  The control unit 1113 sets t = 1 (step S1102).

The input information providing unit 1104 generates and outputs first input information τ ₁ and second input information τ ₂ that are elements of the group H corresponding to the input first ciphertext C1. Preferably, the first input information τ ₁ and the second input information τ ₂ are information that disturbs the relationship with the first ciphertext C1. Thereby, the re-encryption device 11 can conceal the first ciphertext C1 from the capability providing device 12. Preferably, the first input information τ ₁ of this embodiment further corresponds to the natural number b selected by the natural number selection unit 1102, and the second input information τ ₂ further corresponds to the natural number a selected by the natural number selection unit 1102. To do. Thereby, the re-encryption device 11 can evaluate the re-encryption capability provided from the capability providing device 12 with high accuracy (step S1103).

As illustrated in FIG. 8, the first input information τ ₁ is input to the first output information calculation unit 1201 of the capability providing apparatus 12 (FIG. 3), and the second input information τ ₂ is input to the second output information calculation unit 1202. Input (step S1200).

The first output information calculation unit 1201 uses the first input information τ ₁ and the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and f with a probability larger than a certain probability. (Τ ₁ ) is correctly calculated, and the obtained calculation result is set as the first output information z ₁ (step S1201). The second output information calculation unit 1202 uses the second input information τ ₂ , the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and f ( (τ ₂ ) is correctly calculated, and the obtained calculation result is set as the second output information z ₂ (step S1202). The example of the function f is a value obtained by decrypting the ciphertext with the first decryption key s ₁ according to the first encryption method, and with the second encryption key y ₂ according to the second encryption method. This is a homomorphic function for encryption. The “certain probability” is a probability of less than 100%. The example of “certain probability” is a probability that cannot be ignored, and the example of “probability that cannot be ignored” is a case where a polynomial ψ (k) is a polynomial that is a broad monotone increasing function for the security parameter k. Of 1 / ψ (k) or more. That is, the first output information calculation unit 1201 and the second output information calculation unit 1202 can output a calculation result including an intentional or unintentional error. In other words, also when the calculation result in the first output information calculation section 1201 is not f Some cases of _{(τ 1) f (τ 1} ), the calculation result of the second output information calculation unit 1202 f (tau ₂ ) or not f (τ ₂ ). The first output information calculation unit 1201 outputs the first output information _{z 1,} the second output information calculation unit 1202 outputs the second output information _{z 2} (step S1203).

Returning to FIG. 7, the first output information z ₁ is input to the first calculation unit 1105 of the re-encryption device 11 (FIG. 2), and the second output information z ₂ is input to the second calculation unit 1108. The first output information z ₁ and the second output information z ₂ correspond to the re-encryption capability given from the capability providing device 12 to the re-encryption device 11 (step S1104).

The first calculation unit 1105 generates a calculation result u = f (C1) ^b x ₁ from the first output information z ₁ . Here, f ^(C1) generates a b _{x 1} to (calculated) is to calculate the value of expression that is defined as f ^(C1) b _{x 1.} If the value of the formula f (C1) ^b x ₁ can be finally calculated, the calculation method in the middle is not limited. The same applies to the calculation of other equations appearing in this application. The calculation result u is sent to the first power calculation unit 1106 (step S1105).

The first power calculation unit 1106 calculates u ′ = u ^a . A set (u, u ′) of the calculation result u and u ′ calculated based on the calculation result is stored in the first list storage unit 1107 (step S1106).

  The determination unit 1111 includes u ′ and v ′ in the pair (u, u ′) stored in the first list storage unit 1107 and the pair (v, v ′) stored in the second list storage unit 1110. Are included in the same ciphertext class. In other words, the determination unit 1111 determines whether there is a set of u ′ and v ′ belonging to a ciphertext class for the same plaintext. For example, when the second encryption method is the definite encryption method, the determination unit 1111 determines whether u ′ = v ′ (step S1107). If the set (v, v ′) is not stored in the second list storage unit 1110, the process of the next step S1108 is performed without performing the process of step S1107. If there is a pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1114. If there is no pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1108.

In step S1108, the second calculation unit 1108 generates an operation result _{^{v = f (C1) a x}} 2 from the second output information _{z 2.} The calculation result v is sent to the second power calculation unit 1109 (step S1108).

The second power calculation unit 1109 calculates v ′ = v ^b . A set (v, v ′) of the calculation result v and v ′ calculated based on the calculation result is stored in the second list storage unit 1110 (step S1109).

  The determination unit 1111 includes u ′ and v ′ in the pair (u, u ′) stored in the first list storage unit 1107 and the pair (v, v ′) stored in the second list storage unit 1110. Are included in the ciphertext class for the same plaintext. For example, when the second encryption method is the definite encryption method, the determination unit 1111 determines whether u ′ = v ′ (step S1110). If there is a pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1114. If there is no pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1111.

  In step S1111, the control unit 1113 determines whether t = T (step S1111). T is a predetermined natural number. If t = T, the final output unit 1112 outputs information indicating that the calculation could not be performed, for example, the symbol “⊥” (step S1113), and the process ends. If not t = T, the control unit 1113 increments t by 1, that is, sets t = t + 1 (t + 1 is a new t) (step S1112), and returns to step S1103.

  Information indicating that the calculation could not be performed (in this example, the symbol “⊥”) means that the reliability with which the capability providing apparatus 12 performs the calculation correctly is below the standard defined by T. In other words, it means that a correct operation could not be performed by repeating T times.

In step S1114, the final output unit 1112 calculates u ^{b ′} v ^{a ′} using u and v corresponding to the set of u ′ and v ′ determined to belong to the ciphertext class for the same plaintext. Is output (step S1114). The reason why u ^{b ′} v ^{a ′} calculated in this way is the second ciphertext f (C1) = C2εG with a high probability (the reason why u ^{b ′} v ^{a ′} = f (C1) with ^a high probability). Will be described later). Therefore, the above-described processing is repeated a plurality of times, and the most frequently used value among the values obtained in step S1114 may be set as the second ciphertext C2. As will be described later, u ^{b ′} v ^{a ′} = f (C1) with an overwhelming probability depending on the setting. In that case, the value obtained in step S1114 may be used as it is as the second ciphertext C2.

The second ciphertext C (y ₂ , m) is input to the decryption unit 1312 of the re-ciphertext acquisition device 13 (FIG. 4). Decoding unit 1312 decodes the second cipher text C2 by using the second decryption key s ₂ read from the key storage unit 1314, and outputs the decryption result m 'obtained thereby.

  It can also be assumed that the re-ciphertext acquisition device 13 cannot trust the second ciphertext given from the re-encryption device 11. For example, there is a case where the process of the re-encryption device 11 is illegal or a case where the second ciphertext output from the re-encryption device 11 may be falsified. In such a case, the first ciphertext C1 is input to the re-encryption device 1311 included locally in the re-ciphertext acquisition device 13, and the above-described diagram is transmitted between the re-encryption device 1311 and the capability providing device 12. The processing described in FIG. 7 and FIG. 8 may be executed. This processing is, for example, processing in which the re-encrypting device 11 is replaced with the re-encrypting device 1311. Alternatively, at the time of this process, at least a part of the process of the capability providing apparatus 12 described above may be executed by the re-encryption apparatus 11. Further, the re-encryption device 1311 does not need to know what processing each of the re-encryption device 11 and the capability providing device 12 performs. The processing described in FIG. 8 only needs to be executed as a system including at least the re-encryption device 11 and the capability providing device 12.

Second ciphertext C2 obtained in this manner is input to the decoding unit 1312 is decoded similarly using the second decryption key s _2. Thereby, even if the first ciphertext C1 is a stochastic cipher, it can be confirmed that the first ciphertext C1 and the second ciphertext C2 correspond to the same plaintext m. Similarly, when the first ciphertext C1 is a definite cipher, it can be confirmed that the first ciphertext C1 and the second ciphertext C2 correspond to the same plaintext m.

<< Reason why u ^{b '} v ^a' = f (C1) with High Probability >>
Let X be a random variable whose value is in group G. For wεG, the one that returns wx ′ corresponding to the sample x ′ according to the random variable X every time a request is received is called a sampler having an error X for w.

For w∈G, each time a natural number a is given, the one that returns w ^a x ′ corresponding to the sample x ′ according to the random variable X is called a randomizable sampler having an error X with respect to w. . A randomizable sampler functions as a sampler if a = 1 is used.

The combination of the input information providing unit 1104 of the present embodiment and the first output information calculation unit 1201 and the first calculation unit 1105, f (C1) randomization can sampler with an error X ₁ for ( "first randomization can a is called a sampler "), the combination of the input information providing unit 1104 and the second output information calculation unit 1202 and the second calculation unit 1108, f (C1) randomization can sampler with an error X ₂ for (" This is called a “second randomizable sampler”.

The reason why u ′ and v ′ belong to the ciphertext class for the same plaintext is that the first randomizable sampler correctly calculates u = f (C1) ^b , and the second randomizable sampler There v = f ^(C1) is correctly calculate ^a _{(x 1} and _{x 2} are the identity _{e g} in the group G) potential inventor that is high found. From the viewpoint of simplifying the explanation, this proof is performed in the fifth embodiment.

When the first randomizable sampler correctly calculates u = f (C1) ^b and the second randomizable sampler correctly calculates v = f (C1) ^a (x ₁ and x ₂ when is a unit based on _{e g} in the group ^{G), u b '= (} f (C1) b x 1) b' = (f (C1) b e g) b '= f (C1) bb' becomes, v ^a a _{^{'= (f (C1) a}} x 2) a' = (f (C1) a e g) a '= f (C1) aa'. For this reason, if the second encryption method is a definite encryption method, u ^{b ′} v ^{a ′} = f (C1) ^{(bb ′ + aa ′)} = f (C1). On the other hand, even if the second encryption method is a stochastic encryption method, if f (C1) is a homomorphic function, u ^{b ′} v ^{a ′} = f (C1 ^{(bb ′ + aa ′)} ) = f (C1) It becomes.

For (q ₁ , q ₂ ) ∈I, a function π _i is defined as π _i (q ₁ , q ₂ ) = q _i for each of i = ₁ and ₂ . Further, L = min (# π ₁ (S), # π ₂ (S)). # · Is the order of the set. When the group G is a cyclic group or a group whose order is difficult to calculate, the probability that the output when the re-encryption device 11 outputs something other than “⊥” is not f (C1) is an error that can be ignored. It can be expected that it is at most about T ² L / # S in the range. If L / # S is a negligible amount and T is an amount on the order of polynomials, the re-encrypting device 11 outputs correct f (C1) with an overwhelming probability. For example, S = {(1, d) | dε [2, | G | −1]} is an example of S in which L / # S becomes a negligible amount.

[Second Embodiment]
The re-encryption system of the second embodiment is an example in which the first randomizable sampler and the second randomizable sampler described above are embodied. Hereinafter, the description will focus on the parts that are different from the first embodiment, and overlapping description will be omitted for common parts. In the following description, parts denoted by the same reference numbers have the same function, and steps denoted by the same reference numbers represent the same processing.

<Configuration>
As illustrated in FIG. 1, in the re-encryption system 2 of the second embodiment, the re-encryption device 11 is replaced with a re-encryption device 21, the capability providing device 12 is replaced with a capability providing device 22, and re-encryption is performed. The text acquisition device 13 is replaced with the re-ciphertext acquisition device 23.

  As illustrated in FIG. 2, the re-encryption apparatus 21 according to the second embodiment includes, for example, a natural number storage unit 1101, a natural number selection unit 1102, an integer calculation unit 1103, an input information provision unit 2104, a first calculation unit 2105, It has a first power calculation unit 1106, a first list storage unit 1107, a second calculation unit 2108, a second power calculation unit 1109, a second list storage unit 1110, a determination unit 1111, a final output unit 1112, and a control unit 1113. As illustrated in FIG. 5, the input information providing unit 2104 of this embodiment includes, for example, a first random number generation unit 2104 a, a first input information calculation unit 2104 b, a second random number generation unit 2104 c, and a second input information calculation unit 2104 d. Have

  As illustrated in FIG. 3, the capability providing apparatus 22 according to the second embodiment includes, for example, a first output information calculation unit 2201, a second output information calculation unit 2202, a key storage unit 1204, and a control unit 1205.

  As illustrated in FIG. 4, the re-ciphertext acquisition device 23 according to the second embodiment includes, for example, a re-encryption device 2321, a decryption unit 1312, a control unit 1313, and a key storage unit 1314. The configuration and processing of the re-encryption device 2321 are the same as those of the re-encryption device 21 in FIG.

<Processing premise>
In the second embodiment, the function f is a homomorphic function, the generation source of the group H is μ _h , the order of the group H is K _H , and ν = f (μ _h ). The other premise is that the re-encryption device 11 is replaced with the re-encryption device 21, the capability providing device 12 is replaced with the capability providing device 22, and the re-ciphertext acquisition device 13 is replaced with the re-ciphertext acquisition device 23. Except for this, it is the same as the first embodiment.

<Processing>
As illustrated in FIGS. 7 and 8, in the process of the second embodiment, steps S1103 to S1105, S1108, and S1200 to S1203 of the first embodiment are replaced with steps S2103 to S2105, S2108, and S2200 to S2203, respectively. It is a thing. Only the processing of steps S2103 to S2105, S2108, S2200 to S2203 will be described below.

<< Processing in Step S2103 >>
The input information providing unit 2104 of the re-encryption device 21 (FIG. 2) generates and outputs first input information τ ₁ and second input information τ ₂ corresponding to the input first ciphertext C1 (FIG. 2). 7 / step S2103). Hereinafter, the processing in step S2103 of this embodiment will be described with reference to FIG.

The first random number generating unit 2104a (FIG. 5) generates a uniform random number _{r 1} is a natural number from 0 to less than _{K H.} Generated random number _{r 1} is fed to the first input information calculating unit 2104b and the first calculation unit 2105 (Step S2103a). The first input information calculation unit 2104b calculates first input information τ ₁ = μ _h ^r1 C1 ^b using the input random number r ₁ , first ciphertext C1 and natural number b (step S2103b). Here, mu superscript r1 of _h is that of _{r 1.} Thus, in this application, when α is expressed as α ^βγ , where α is the first character, β is the second character, γ is a number, βγ means β _γ , that is, β subscript γ To do.

Second random number generation unit 2104c generates a uniform random number _{r 2} of the natural number of 0 or more and less than _{K H.} Generated random number _{r 2} is fed to the second input information calculation unit 2104d and the second calculation portion 2108 (Step S2103c). The second input information calculation unit 2104d calculates the second input information τ ₂ = μ _h ^r2 C1 ^a using the input random number r ₂ , the first ciphertext C1 and the natural number a (step S2103d).

The first input information calculation unit 2104b and the second input information calculation unit 2104d output the first input information τ ₁ and the second input information τ ₂ generated as described above (step S2103e). Note that the first input information τ ₁ and the second input information τ ₂ in this embodiment are information in which the relationship with the first ciphertext C1 is disturbed by the random numbers r ₁ and r ₂ , respectively. As a result, the re-encryption device 22 can conceal the first ciphertext C1 from the capability providing device 22. Further, the first input information τ ₁ of this embodiment further corresponds to the natural number b selected by the natural number selection unit 1102, and the second input information τ ₂ further corresponds to the natural number a selected by the natural number selection unit 1102. Thereby, the re-encryption device 21 can evaluate the re-encryption capability provided from the capability providing device 22 with high accuracy.

<< Processes in Steps S2200 to S2203 >>
As illustrated in FIG. 8, first input information τ ₁ = μ _h ^r1 C1 ^b is first input to the first output information calculation unit 2201 of the capability providing device 22 (FIG. 3), and the second input information τ ₂ = μ _h ^r2 C1 ^a is input to the second output information calculation unit 2202 (step S2200).

The first output information calculation unit 2201 uses the first input information τ ₁ = μ _h ^r1 C1 ^b , the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and F (μ _h ^r1 C1 ^b ) is correctly calculated with a probability larger than the probability, and the obtained calculation result is set as the first output information z ₁ . This calculation result may or may not be correct. That is, if even if the calculation results in the first output information calculating unit 2201 is ^{_{f (μ h r1 C1 b)}} , may not become ^{_{f (μ h r1 C1 b)}} . The example of the function f is a value obtained by decrypting the ciphertext with the first decryption key s ₁ according to the first encryption method, and with the second encryption key y ₂ according to the second encryption method. This is a homomorphic function for encryption. An example of the first encryption method and the second encryption method corresponding to such a function f is the RSA encryption method (step S2201).

The second output information calculation unit 2202 uses the second input information τ ₂ = μ _h ^r2 C1 ^a and the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and F (μ _h ^r2 C1 ^a ) is correctly calculated with ^a probability larger than the probability, and the obtained calculation result is set as the second output information z ₂ . This calculation result may or may not be correct. That is, if even if the calculation results of the second output information calculating unit 2202 is ^{_{f (μ h r2 C1 a)}} , may not become ^{_{f (μ h r2 C1 a)}} ( step S2202).

The first output information calculation unit 2201 outputs the first output information _{z 1,} the second output information calculation unit 2202 outputs the second output information _{z 2} (step S2203).

<< Processing in Steps S2104 and S2105 >>
Returning to FIG. 7, the first output information z ₁ is input to the first calculation unit 2105 of the re-encryption device 21 (FIG. 2), and the second output information z ₂ is input to the second calculation unit 2108. The first output information z ₁ and the second output information z ₂ correspond to the re-encryption capability given from the capability providing device 22 to the re-encryption device 21 (step S2104).

The first calculation unit 2105 calculates z ₁ v ^−r1 using the input random number r ₁ and the first output information z ₁ and ^sets the calculation result to u. The calculation result u is sent to the first power calculation unit 1106. Here, u = z ₁ v ^−r1 = f (C1) ^b x ₁ is ^satisfied . That is, z ₁ ν ^−r1 is an ^output of a ^{randomizable sampler} having an error X ₁ with respect to f (C1). The reason will be described later (step S2105).

<< Processing in Step S2108 >>
The second calculation unit 2108 calculates z ₂ v ^−r2 using the input random number r ₂ and the second output information z ₂ and ^sets the calculation result to v. The calculation result v is sent to the second power calculation unit 1109. ^{_{Here, v = z 2 ν -r2 =}} f (C1) becomes a _{x 2.} That is, z ₂ v ^−r2 is an ^output of a ^{randomizable sampler} having an error X ₂ with respect to f (C1). The reason will be described later (step S2108).

<< Reason ^why z ₁ ν -r ₁ and z ₂ ν ^-r ₂ are ^{output from a randomizable sampler} having errors X ₁ and X ₂ for f (C 1), respectively »
natural number c, the random number R and R ', capability providing device 22 the calculation result of the calculation and B (μ _h ^R C1 ^c) carried out using a μ _h ^R C1 ^c. That is, the calculation result returned from the first output information calculation unit 2201 or the second output information calculation unit 2202 to the re-encryption device 21 is z = B (μ _h ^R C1 ^c ). Further, a random variable X having a value in the group G is defined as X = B (μ _h ^{R ′} ) f (μ _h ^{R ′} ) ⁻¹ .

At this _{^{time, zν -R = B (μ h}} R C1 c) f (μ h) -R = Xf (μ h R C1 c) f (μ h) -R = Xf (μ h) R f (C1) c f ([mu] _h ) ^-R = f (C1) ^cX . That is, zν− ^R is an output of a randomizable sampler having an error X with respect to f (C1).

In the above formula expansion, X = B (μ _h ^{R ′} ) f (μ _h ^{R ′} ) ⁻¹ = B (μ _h ^R C1 ^c ) f (μ _h ^R C1 ^c ) ⁻¹ and B (μ _h ^R C1 ^c ) = Xf (μ _h ^R C1 ^c ). This property is based on the fact that the function f is a homomorphic function and R and R ′ are random numbers.

Therefore, considering that a and b are natural numbers and r ₁ and r ₂ are random numbers, similarly, z ₁ ν ^−r1 and z ₂ ν ^−r2 have errors X ₁ and X ₂ respectively for f (C1). This is the output of a randomizable sampler.

<Others>
As in the first embodiment, the first ciphertext C1 is input to the re-encryption device 2321 included locally in the re-ciphertext acquisition device 23, and the above-described diagram is transmitted between the re-encryption device 2321 and the capability providing device 22. The processing described in FIG. 7 and FIG. 8 may be executed. This processing is, for example, processing in which the re-encryption device 21 is replaced with the re-encryption device 2321. Alternatively, at the time of this processing, at least a part of the processing of the capability providing device 22 described above may be executed by the re-encryption device 21. Further, the re-encrypting device 2321 does not need to know what processing each of the re-encrypting device 21 and the capability providing device 22 is performing. The processing described in FIG. 8 only needs to be executed as a system including at least the re-encryption device 21 and the capability providing device 22.

[Third embodiment]
The third embodiment is a modification of the second embodiment, and the value of u or v is calculated by the above-described sampler when a = 1 or b = 1. In general, the amount of calculation of a sampler is smaller than that of a randomizable sampler. When a = 1 or b = 1, the sampler performs the calculation instead of the randomizable sampler, so that the calculation amount of the re-encryption system can be reduced. Hereinafter, the description will focus on the parts that are different from the first embodiment and the second embodiment, and overlapping description will be omitted for the common parts.

<Configuration>
As illustrated in FIG. 1, in the re-encryption system 3 of the third embodiment, the re-encryption device 21 is replaced with a re-encryption device 31, the capability providing device 22 is replaced with a capability providing device 32, and re-encryption is performed. The text acquisition device 23 is replaced with the re-ciphertext acquisition device 33.

  As illustrated in FIG. 2, the re-encryption device 31 of the third embodiment includes, for example, a natural number storage unit 1101, a natural number selection unit 1102, an integer calculation unit 1103, an input information provision unit 2104, a first calculation unit 2105, First power calculation unit 1106, first list storage unit 1107, second calculation unit 2108, second power calculation unit 1109, second list storage unit 1110, determination unit 1111, final output unit 1112, control unit 1113, and third calculation unit 3109.

  As illustrated in FIG. 3, the capability providing apparatus 32 according to the third embodiment includes, for example, a first output information calculation unit 2201, a second output information calculation unit 2202, a key storage unit 1204, a control unit 1205, and third output information. And a calculator 3203.

  As illustrated in FIG. 4, the re-ciphertext acquisition apparatus 33 according to the third embodiment includes, for example, a re-encryption apparatus 3331, a decryption unit 1312, a control unit 1313, and a key storage unit 1314. The configuration and processing of the re-encryption device 3331 are the same as those of the re-encryption device 31 in FIG.

<Processing>
Next, the processing of this embodiment will be described. Differences from the second embodiment will be described.

  As illustrated in FIGS. 7 and 8, the processing of the third embodiment includes steps S2103 to S2105, S2108, S2200 to S2203 of the second embodiment, steps S3103 to S3105, S3108, S2200 to S2203, and S3205, respectively. It has been replaced with S3209. Below, it demonstrates centering on the process of step S3103-S3105, S3108, S2200-S2203, and S3205-S3209.

<< Processing in Step S3103 >>
The input information providing unit 3104 of the re-encryption device 31 (FIG. 2) generates and outputs first input information τ ₁ and second input information τ ₂ corresponding to the input first ciphertext C1 (FIG. 2). 7 / step S3103).

  Hereinafter, the processing in step S3103 of this embodiment will be described with reference to FIG.

  The control unit 1113 (FIG. 2) controls the input information providing unit 3104 according to the natural number (a, b) selected by the natural number selecting unit 1102.

  Whether or not b is 1 is determined by the control unit 1113 (step S3103a). If it is determined that b ≠ 1, the processes of steps S2103a and S2103b described above are executed, and the process proceeds to step S3103g.

On the other hand, if it is determined that b = 1 in step S3103a, the third random number generation unit 3104e generates a random number _{r 3} of natural numbers from 0 to less than _{K H.} Random number _{r 3} generated is sent to the third input information calculating unit 3104f, and a third calculation unit 3109 (step S3103b). Third input information calculating unit 3104f is a ^{C1 r3} calculated using the random number _{r 3} which has been input and the first ciphertext C1, to do this the first input information tau ₁ (step S3103c). Thereafter, the process proceeds to step S3103g.

  In step S3103g, whether or not a is 1 is determined by the control unit 1113 (step S3103g). If it is determined that a ≠ 1, the processes in steps S2103c and S2103d described above are executed.

On the other hand, if it is determined that a = 1 at step S3103g, third random number generation unit 3104e generates a random number _{r 3} of natural numbers from 0 to less than _{K H.} Random number _{r 3} generated is sent to the third input information calculating section 3104F (step S3103h). Third input information calculating unit 3104f is a ^{C1 r3} calculated using the random number _{r 3} which has been input and the first ciphertext C1, to do this with a second input information tau ₂ (step S3103i).

The first input information calculation unit 2104b, the second input information calculation unit 2104d, and the third input information calculation unit 3104f correspond to the first input information τ ₁ and the second input information τ ₂ generated as described above corresponding to the natural numbers (a , B) and the information (step S3103e). Note that the first input information τ ₁ and the second input information τ ₂ of this embodiment are information in which the relationship with the first ciphertext C1 is disturbed by the random numbers r ₁ , r ₂ , and r ₃ , respectively. As a result, the re-encryption device 31 can conceal the first ciphertext C1 from the capability providing device 32.

<< Processing of S2200 to S2203 and S3205 to S3209 >>
Hereinafter, the processing of S2200 to S2203 and S3205 to S3209 of this embodiment will be described with reference to FIG.

  The control unit 1205 (FIG. 3) controls the first output information calculation unit 2201, the second output information calculation unit 2202, and the third output information calculation unit 3203 according to the input natural numbers (a, b).

Based on the control of the control unit 1205, the first input information τ ₁ = μ _h ^r1 C1 ^b when b ≠ 1 is input to the first output information calculation unit 2201 of the capability providing apparatus 32 (FIG. 3), and a ≠ 1 In this case, the second input information τ ₂ = μ _h ^r2 C1 ^a is input to the second output information calculation unit 2202. In addition, the first input information τ ₁ = C1 ^r3 when b = 1 and the second input information τ ₂ = C1 ^r3 when a = 1 are input to the third output information calculation unit 3203 (step S3200).

  The control unit 1113 determines whether b is 1 (step S3205). If it is determined that b ≠ 1, the process of step S2201 described above is executed. Thereafter, the control unit 1113 determines whether a is 1 (step S3208). If it is determined that a ≠ 1, the process of step S2202 described above is executed, and the process proceeds to step S3203.

On the other hand, if it is determined in step S3208 that a = 1, the third output information calculation unit 3203 uses the second input information τ ₂ = C1 ^r3 and the first decryption key s ₁ stored in the key storage unit 1204 and using the second encryption key y _2, f a (C1 ^r3) correctly calculated with greater probability than a certain probability, the calculation results obtained with the third output information z _3. This calculation result may or may not be correct. That is, if even if the calculation results in the third output information calculating unit 3203 is f ^{(C1 r3),} may not become f ^{(C1 r3)} (step S3209). Thereafter, the process proceeds to step S3203.

If it is determined in step S3205 that b = 1, the third output information calculation unit 3203 uses the second input information τ ₁ = C1 ^r3 and the first decryption key s ₁ stored in the key storage unit 1204 and using the second encryption key y _2, f a (C1 ^r3) correctly calculated with greater probability than a certain probability, the calculation results obtained with the third output information z _3. This calculation result may or may not be correct. That is, if even if the calculation results in the third output information calculating unit 3203 is f ^{(C1 r3),} may not become f ^{(C1 r3)} (step S3206).

  Thereafter, the control unit 1113 determines whether a is 1 (step S3207). When it is determined that a = 1, the process proceeds to step S3203, and when it is determined that a ≠ 1, the process proceeds to step S3203. The process proceeds to S2202.

In step S3203, the first output information calculation unit 2201 generates the first output information z ₁ outputs the first output information z _1, the second output information calculation unit 2202 to generate a second output information z ₂ second output information _{z 2} outputs a third output information calculation unit 3202 to generate a third output information _{z 3} outputs a third output information _{z 3} (step S3203).

<< Processing in Steps S3104 and S3105 >>
Returning to FIG. 7, under the control of the control unit 1113, the first output information z ₁ is input to the first calculation unit 2105 of the re-encryption device 31 (FIG. 2), and the second output information z ₂ is the second calculation. is input to the section 2108, the third output information _{z 3} is input to the third calculation unit 3109 (step S3104).

If b ≠ 1, the first calculation unit 2105 generates u by the process of step S2105 described above. If b = 1, the third calculation unit 3109 calculates z ₃ ^{1 / r3} and Let u be the calculation result. The calculation result u is sent to the first power calculation unit 1106. Here, when b = 1, u = z ₃ ^{1 / r3} = f (C1) × ₃ . That is, z ₃ ^{1 / r3} is a ^sampler having an error X ₃ with respect to f (C1). The reason will be described later (step S3105).

<< Process of Step S3108 >>
If a ≠ 1, the second calculation unit 2108 generates v by the process of step S2108 described above. If a = 1, the third calculation unit 3109 calculates z ₃ ^{1 / r3} and calculates Let v be the calculation result. The calculation result v is sent to the second power calculation unit 1109. Here, when a = 1, v = z ₃ ^{1 / r3} = f (C1) × ₃ . That is, z ₃ ^{1 / r3} is a ^sampler having an error X ₃ with respect to f (C1). The reason will be described later (step S3108).

If calculation of z ₃ ^{1 / r} ₃ , that is, calculation of the power root of z ₃ is difficult, u and / or v may be calculated as follows. The third calculation unit 3109 sequentially selects (α ₁ , β ₁ ), (α ₂ , β ₂ ),..., (Α _m , β) from the random number r ₃ and the set of z ₃ calculated based on the random number r _{3. m} ),... are stored in a storage unit (not shown). m is a natural number. When the least common multiple of α ₁ , α ₂ ,..., Α _m becomes 1, the third calculation unit 3109 sets γ ₁ , γ ₂ ,..., Γ _m as integers to γ ₁ α ₁ + γ ₂ α ₂ +. _{m α m} = 1 and becomes _{γ 1, γ 2, ...,} γ m is calculated to the gamma, gamma _2, ..., gamma using ^{_{m Π i = 1 m β i}} γi = β 1 γ1 β 2 γ2 ... Β _m ^γm may be calculated and the calculation result may be u and / or v.

<< Reason why z ₃ ^{1 / r3} is a sampler having an error X ₃ with respect to f (C1) >>
The R as a random number, capability providing device 32 the calculation result of the calculation and B (C1 ^R) performed using C1 ^R. That is, the calculation result returned from the first output information calculation unit 2201, the second output information calculation unit 2202, and the third output information calculation unit 3203 to the re-encryption device 31 is z = B (C1 ^R ). Further, a random variable X having a value in the group G is defined as X = B (C1 ^R ) ^{1 / R} f (C1) ⁻¹ .

In this ^{case, z 1 / R = B (} C1 R) 1 / R = Xf (C1) = f (C1) becomes X. That is, z ^{1 / R} is a sampler having an error X with respect to f (C1).

In the above formula ^deployment, X ^{= B (C1} R) is ^{1 / R f (C1 R)} -1, is used a property that is a ^{B (C1 R) 1 / R} = Xf (C1 R). This property is based on the fact that R is a random number.

Therefore, considering that r ₃ is a random number, similarly, z ^{1 / R} becomes a sampler having an error X ₃ with respect to f (C1).

<Others>
As in the first embodiment, the first ciphertext C1 is input to the re-encryption device 3331 that is included locally in the re-ciphertext acquisition device 33, and the above-described diagram is transmitted between the re-encryption device 3331 and the capability providing device 32. The processing described in FIG. 7 and FIG. 8 may be executed. This processing is, for example, processing in which the re-encrypting device 31 is replaced with the re-encrypting device 3331. Alternatively, at the time of this processing, at least a part of the processing of the capability providing device 32 described above may be executed by the re-encryption device 31. Further, the re-encrypting device 3331 does not need to know what processing each of the re-encrypting device 31 and the capability providing device 32 performs. The processing described in FIG. 8 only needs to be executed as a system including at least the re-encryption device 31 and the capability providing device 32.

[Fourth embodiment]
The re-encryption system of the fourth embodiment is another example that embodies the first randomizable sampler and the second randomizable sampler described above. Specifically, an example is shown in which the second encryption method is the ElGamal encryption method and the function f is a homomorphic function. The first encryption method is not particularly limited, and the first encryption method may be a stochastic encryption method such as an ElGamal encryption method or a definite encryption method such as an RSA encryption method. .

  Hereinafter, the description will focus on the parts that are different from the first embodiment, and overlapping descriptions will be omitted for the common parts.

  As illustrated in FIG. 1, in the re-encryption system 4 of the fourth embodiment, the re-encryption device 11 is replaced with a re-encryption device 41, the capability providing device 12 is replaced with a capability providing device 42, and re-encryption is performed. The text acquisition device 13 is replaced with the re-ciphertext acquisition device 43.

  As illustrated in FIG. 2, the re-encryption apparatus 41 of the fourth embodiment includes, for example, a natural number storage unit 1101, a natural number selection unit 1102, an integer calculation unit 1103, an input information provision unit 4104, a first calculation unit 4105, It has a first power calculation unit 1106, a first list storage unit 1107, a second calculation unit 4108, a second power calculation unit 1109, a second list storage unit 1110, a determination unit 4111, a final output unit 1112, and a control unit 1113. As illustrated in FIG. 6, the input information providing unit 4104 of this embodiment includes, for example, a first random number generation unit 4104 a, a first input information calculation unit 4104 b, a second random number generation unit 4104 c, and a second input information calculation unit 4104 d. A key storage unit 4104e.

  As illustrated in FIG. 3, the capability providing apparatus 42 according to the fourth embodiment includes, for example, a first output information calculation unit 4201, a second output information calculation unit 4202, a key storage unit 1204, and a control unit 1205.

<Processing premise>
In the fourth embodiment, direct product _{G 1} × _{G 2} groups G is a cyclic group _G 1, _{G 2,} mu _g1 is generator of the group _{G 1,} mu _g2 is generator of the group _{G 2,} the second encryption key y ₂ is μ _g2 ^s2 , the second ciphertext C2 is (μ _g1 ^r , my ₂ ^r ) εG ₁ × G ₂ , r is an integer random number, and the value u ^a is (c _1u , c _2u ) εG ₁ × G ₂ and the value v ^b is (c _1v , c _2v ) εG ₁ × G ₂ . G ₁ = G ₂ may be sufficient, or G ₁ ≠ G ₂ may be sufficient. As described above, the first encryption method is not limited. For example, when the first encryption method is an ElGamal encryption method, the group H is a direct product H ₁ × H of the cyclic groups H ₁ and H _{2. 2} , r ′ is an integer random number, μ _h1 is a generator of the group H ₁ , μ _h2 is a generator of the group H ₂ , the first encryption key y ₁ is μ _h2 ^s1 , and the first ciphertext C1 is (μ _h1 ^{r ′} , my ₁ ^{r ′} ) ∈H ₁ × H ₂ . It may be H ₁ = H ₂ or H ₁ ≠ H ₂ .

Note that when Α = (α ₁ , α ₂ ) ∈G ₁ × G ₂ , Β = (β ₁ , β ₂ ) ∈G ₁ × G ₂ , and ε is a natural number, Α ^ε is (α ₁ ^ε , α ₂ ^ε ), Α ^−ε represents (α ₁ ^−ε , α ₂ ^−ε ), and ΑΒ represents (α ₁ β ₁ , α ₂ β ₂ ). Similarly, when ε is a natural number, Α = (α ₁ , α ₂ ) εH ₁ × H ₂ , and Β = (β ₁ , β ₂ ) εH ₁ × H ₂ , ^{ε ε} is (α ₁ ^ε , α ₂ ^ε ), Α ^−ε represents (α ₁ ^−ε , α ₂ ^−ε ), and ΑΒ represents (α ₁ β ₁ , α ₂ β ₂ ). Furthermore, e (α, β) and (α, β) with respect ∈G ₁ × _{G 2} gives the original cyclic group _{G T} and bilinear mapping. Bilinear mapping examples are functions and algorithms for performing pairing operations such as Weil pairing and Tate pairing (Reference 3: Alfred. J. Menezes, "ELLIPTIC CURVE PUBLIC KEY CRYPTOSYSTEMS," KLUWER ACADEMIC PUBLISHERS , ISBN0-7923-9368-6, pp. 61-81, and Reference 4: RFC 5091, "Identity-Based Cryptography Standard (IBCS) # 1," Supersingular Curve Implementations of the BF and BB1 Cryptosystems etc.). Also, it is assumed that the first encryption key y ₁ and the second encryption key y ₂ are stored in the key storage unit 4104e included in the input information providing unit 4104 of the re-encryption device 11.

<Processing>
As illustrated in FIGS. 7 and 8, the process of the fourth embodiment includes steps S <b> 1103 to S <b> 1105, S <b> 1107, S <b> 1108, S <b> 1110, and S <b> 1120 to S <b> 1203, respectively. It is replaced with S4110, S4200 to S4203. Only the processing of steps S4103 to S4105, S4107, S4108, S4110, S4200 to S4203 will be described below.

<< Process of Step S4103 >>
The input information providing unit 4104 of the re-encryption device 41 (FIG. 2) generates and outputs first input information τ ₁ and second input information τ ₂ corresponding to the input first ciphertext C1 (FIG. 7). / Step S4103). Hereinafter, the processing in step S4103 of this embodiment will be described with reference to FIG.

The first random number generation unit 4104a (FIG. 6) generates an arbitrary element _h r ₁ εH of the group H. In this embodiment, the element _h r ₁ is selected randomly and uniformly from the group H (uniform random number). The generated element _h r ₁ is sent to the first input information calculation unit 4104b and the first calculation unit 4105 (step S4103a).

The first input information calculation unit 4104b uses the natural number b selected by the natural number selection unit 1102, the first ciphertext C1, the element _h r ₁ , and the first encryption key y ₁ extracted from the key storage unit 4104e. C1 ^b C1 ′ is calculated for a ciphertext C1 ′ obtained by encrypting the element _h r ₁ using the first encryption key y ₁ by one encryption method, and C1 ^b C1 ′ is set as the first input information τ ₁ . (Step S4103b).

The second random number generation unit 4104c generates an arbitrary element _h r ₂ εH of the group H. In this embodiment, the element _h r ₂ is selected randomly and uniformly from the group H (uniform random number). The generated element _h r ₂ is sent to the second input information calculation unit 4104d and the second calculation unit 4108 (step S4103c).

The second input information calculation unit 4104b uses the natural number a selected by the natural number selection unit 1102, the first ciphertext C1, the element _h r ₂ , and the first encryption key y ₁ extracted from the key storage unit 4104e. "About, ^C1 a C1" is ciphertext C1 by encrypting the original _h r ₂ using the first encryption information _{y 1} by first encryption scheme to calculate a, ^C1 a C1 "to the second input information tau ₂ (Step S4103d).

The first input information calculation unit 4104b outputs the first input information τ ₁ = C1 ^b C1 ′ generated as described above. The second input information calculation unit 4104d outputs the second input information τ ₂ = C1 ^a C1 ″ generated as described above (step S4103e).

<< Steps S4200 to S4203 >>
As illustrated in FIG. 8, first input information τ ₁ = C1 ^b C1 ′ is first input to the first output information calculation unit 4201 of the capability providing device 42 (FIG. 3), and the second input information τ ₂ = C1. ^a C2 ″ is input to the second output information calculation unit 4202 (step S4200).

The first output information calculation unit 4201 uses the first input information τ ₁ = C1 ^b C1 ′, the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and has a certain probability F (C1 ^b C1 ′) is correctly calculated with a greater probability, and the calculation result is set as the first output information z ₁ . This calculation result may or may not be correct. That is, 'when there may be, f ^(C1 b C1 calculation result in the first output information calculation unit 4201 f ^(C1 b C1)' may not become) (step S4201).

The function f in this embodiment encrypts the value obtained by decrypting the ciphertext with the first decryption key s ₁ according to the first encryption method with the second encryption key y ₂ according to the ElGamal encryption method. This is a homomorphic function. For example, when both the first encryption method and the second encryption method are ElGamal encryption methods, the function f is a value obtained by decrypting the ciphertext with the first decryption key s ₁ in accordance with the ElGamal encryption method. This is a homomorphic function for encrypting with the second encryption key y ₂ in accordance with the ElGamal cryptosystem.

The second output information calculation unit 4202 uses the second input information τ ₂ = C1 ^a C1 ″, the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and has a certain probability a greater probability f (C1 a C1 ^") can properly calculated, and a calculation result obtained with the second output information z _2. This calculation result may or may not be correct. That is, "In some cases where a, ^{f (C1} a C1 calculation result in the second output information calculation unit 4202 ^{f (C1} a C1)" may not become) (step S4202).

The first output information calculation unit 4201 outputs the first output information _{z 1,} the second output information calculation unit 4202 outputs the second output information _{z 2} (step S4203).

<< Processing in Steps S4104 and S4105 >>
Returning to FIG. 7, the first output information z ₁ is input to the first calculation unit 4105 of the re-encryption device 41 (FIG. 2), and the second output information z ₂ is input to the second calculation unit 4108 (step S4104). ).

The first calculation unit 4105 uses the input first output information z ₁ , the element _h r ₁ , and the second encryption key y ₂ read from the key storage unit 4104e (FIG. 6), and performs the second encryption method. _'for, z 1 (C2' second encryption key _{y 2} is ciphertext C2 to the original _h r ₁ encrypted ^{with) -1} was calculated for the calculation result as u (step S4105). The calculation result u is sent to the first power calculation unit 1106. Here, u = z ₁ (C2 ′) ⁻¹ = f (C1) ^b x ₁ is satisfied. That is, z ₁ (C2 ′) ⁻¹ is the output of a randomizable sampler with error X ₁ for f (C1). The reason will be described later.

<< Process of Step S4108 >>
The second calculation unit 4108 uses the input second output information z ₂ , the element _h r ₂ , and the second encryption key y ₂ read from the key storage unit 4104e (FIG. 6), and performs the second encryption method. For a ciphertext C2 ″ obtained by encrypting the element _h r ₂ using the second encryption key y ₂ , z ₂ (C2 ″) ⁻¹ is calculated and the calculation result is set as v. The calculation result v is sent to the second power calculation unit 1109. Here, v = z ₂ (C2 ″) ⁻¹ = f (C1) ^a x ₂ , that is, z ₂ (C2 ″) ⁻¹ is a randomizable sample having an error X ₂ with respect to f (C1). Is the output of the instrument. The reason will be described later.

<< Process of Step S4107 >>
The determination unit 4111 includes u ′ and v ′ among the pair (u, u ′) stored in the first list storage unit 1107 and the pair (v, v ′) stored in the second list storage unit 1110. Are included in the ciphertext class for the same plaintext. The determination unit 4111 of this embodiment uses the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) for u ′ = (c _1u , c _2u ) and v ′ = (c _1v , c _2v ). ) = E (μ _g1 , c _2v ) / e (c _1v , y ₂ ) is determined (step S4107). The reason why it can be determined that u ′ and v ′ belong to a ciphertext class for the same plaintext by determining whether u ′ and v ′ satisfy this relationship will be described later.

  If the set (v, v ′) is not stored in the second list storage unit 1110, the process of the next step S1108 is performed without performing the process of step S4107. If there is a pair of u ′ and v ′ belonging to the same ciphertext class for the same plaintext (if there is a pair of u ′ and v ′ satisfying the above relationship), the process proceeds to step S1114. If there is no pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S4108.

<< Processing in Step S4110 >>
The determination unit 4111 includes u ′ and v ′ in the pair (u, u ′) stored in the first list storage unit 1107 and the pair (v, v ′) stored in the second list storage unit 4110. Are included in the ciphertext class for the same plaintext. The determination unit 4111 of this embodiment uses the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) for u ′ = (c _1u , c _2u ) and v ′ = (c _1v , c _2v ). ) = E (μ _g1 , c _2v ) / e (c _1v , y ₂ ) is determined (step S4110). If there is a pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1114. If there is no pair of u ′ and v ′ belonging to the ciphertext class for the same plaintext, the process proceeds to step S1111.

Note that when the special groups G ₁ and G ₂ and the bilinear map e are used, the number of persons who can cause the re-encryption device 41 to execute the processes of steps S4107 and S4110 can be limited. Details of this will be described later.

<< Reason why z ₁ (C2 ′) ⁻¹ , z ₂ (C2 ″) ⁻¹ is an output of a randomizable sampler having errors X ₁ and X ₂ with respect to f (C1) >>
Assuming that an arbitrary element _h r ₁ is fixed, a probability distribution having a random space r in the second ciphertext C (y ₂ , m) = (μ _g1 ^r , my ₂ ^r ) as a probability space has the following relationship: It holds. However, D (s ₁ , C 1) represents a function for decrypting the first ciphertext C 1 with the first decryption key s ₁ in accordance with the first encryption method. Further, it is assumed that _h r ₂ ′ = D (s ₁ , C 1) ^a _h r ₂ . When r is a random number, there exists a certain r2 and f (C1 ^a C1 ″) (C2 ″) ^{−1
_{= (Μ g1 r, D (}} s 1, C1) a h r 2 y 2 r) (μ g1 r2, h r 2 y 2 r2) -1
So,
f (C1 ^a C1 ″) (C2 ″) ⁻¹
= (Μ _g1 ^r−r2 , D (s ₁ , C1) ^a y ₂ ^r−r2 )
It becomes. Therefore, the probability distribution f (C1 ^a C1 ″) (C2 ″) ⁻¹ is equal to the probability distribution f (C1) ^a .

Therefore, considering C1 ″ as a random variable and considering a random variable X ₂ = z ₂ f (C1 ^a C1 ″) ⁻¹ having a value in the group G,
z ₂ (C2 ″) ⁻¹ = z ₂ f (C1 ^a C1 ″) ⁻¹ f (C1 ^a C1 ″) (C2 ″) ⁻¹
Since it is, the probability distribution is equal to the probability distributions for _{x 2 ∈X 2 x 2 f (} C1) a.

Similarly, the probability distribution of z ₁ (C2 ′) ⁻¹ is equal to the probability distribution of f (C1) ^b x ₁ for x ₁ εX ₁ . "When considered a random variable, C1 a ^C1" C1 Since distribution of equal distribution of C1 ", the probability distribution of the random variable X ₂ is independent of a. Similarly, the probability distribution of the random variable X ₁ to b Therefore, z ₁ (C2 ′) ⁻¹ , z ₂ (C2 ″) ⁻¹ is the output of a randomizable sampler having errors X ₁ and X ₂ for f (C1), respectively.

"Relationship _{e (μ g1, c 2u)} / e (c 1u, y 2) = e (μ g1, c 2v) / e (c 1v, y 2) by determining whether meet, u 'and v The reason why it can be determined that 'and belong to a class of ciphertexts for the same plaintext >>
Assume that u ′ and v ′ belong to a ciphertext class for the same plaintext m. This case is the first randomized enable sampler and correctly calculate u = f (C1) ^b, the second random number of possible sampler is v = f (C1) ^a was correctly calculated (x ₁ and _{x 2} is the identity _{e g} in the group G) is likely. Therefore, it is highly likely that u ′ = (μ _g1 ^{r ″} , my ₂ ^{r ″} ) and v ′ = (μ _g1 ^{r ′ ″} , my ₂ ^{r ′ ″} ). Here, r ″ and r ′ ″ are values determined by a random number component of the ElGamal cryptosystem and a set of natural numbers selected by the natural number selection unit 1102. In this case, e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) with respect to u ′ = (c _1u , c _2u ) due to the property of the bilinear map e.
= E (μ _g1 , my ₂ ^{r ″} ) / e (μ _g1 ^{r ″} , y ₂ )
= E (μ _g1 , my ₂ ) ^{r ″} / e (μ _g1 , y ₂ ) ^{r ″}
_{= E (μ g1, m)} e (μ g1, y 2) / e (μ g1, y 2)
= E (μ _g1 , m)
There is a high possibility of satisfying. _{Further, v '= (c 1v,} c 2v) against _{e (μ g1, c 2v)} / e (c 1v, y 2)
= E (μ _g1 , my ₂ ^{r ′ ″} ) / e (μ _g1 ^{r ′ ″} , y ₂ )
= E (μ _g1 , my ₂ ) ^{r ′ ″} / e (μ _g1 , y ₂ ) ^{r ′ ″}
_{= E (μ g1, m)} e (μ g1, y 2) / e (μ g1, y 2)
= E (μ _g1 , m)
There is a high possibility of satisfying. Therefore, when u ′ and v ′ belong to a ciphertext class for the same plaintext m, the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _g1 , c _2v ) There is a high possibility that / e (c _1v , y ₂ ) is satisfied.

Next, it is assumed that u ′ and v ′ belong to a ciphertext class for different plaintexts. That is, it is assumed that _u ′ belongs to the ciphertext class for plaintext m _u and v ′ belongs to the ciphertext class for plaintext m _v (m _v ≠ m _u ). Then, u ′ = (μ _g1 ^{r ″} , m _u y ₂ ^{r ″} ) x ₁ and v ′ = (μ _g1 ^{r ′ ″} , m _v y ₂ ^{r ′ ″} ) x ₂ . Therefore, e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _g1 , m _u ) x ₁ is satisfied with respect to u ′ = (c _1u , c _2u ), and v ′ = ( _{c 1v,} c _2v) against _{e (μ g1, c 2v)} / e (c 1v, y 2) = e (μ g1, m v) satisfy _{x 2.} Therefore, when u ′ and v ′ belong to a class of ciphertexts for different plaintexts, the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) ≠ e (μ _g1 , c _2v ) / e There is a high possibility of (c _1v , y ₂ ).

<< Special groups G ₁ and G ₂ and bilinear map e >>
When the configurations of the groups G ₁ and G ₂ and the bilinear map e are limited as follows, it is possible to limit the persons who can cause the re-encryption device 41 to execute the processes of steps S4107 and S4110. Details are described below.

In this special example, N is a composite number of prime number ω and prime number ι, and groups G ₁ and G ₂ are points on the first elliptic curve defined on the remainder ring Z / NZ modulo the composite number N. A subgroup consisting of points on the second elliptic curve defined on the remainder field Z / _ωZ with the prime number ω modulo G _1ω and G _2ω , and G _1ι and G _2ι modulo the prime number ι subgroup of points on the third elliptic curve defined over residue field Z / ιZ, e (α, β) is the (α, β) ∈G ₁ × original cyclic group G _T relative to G ₂ The bilinear map to be given, e _ω (α _ω , β _ω ) gives the _element of the cyclic group G _Tω to (α _ω , β _ω ) ∈G _1ω × G _2ω , e _ι (α _ι , Β _ι ) is a third bilinear map that gives an _element of the cyclic group G _Tι for (α _ι , β _ι ) ∈ G _1ι × G _2ι , and HM is a point on the first elliptic curve on the second elliptic curve Point and third ellipse Isomorphic mapping which maps to the point above, HM ^-1 is the inverse image of isomorphism HM.

In this example, the bilinear map e (α, β) is defined on the first elliptic curve defined on the remainder ring Z / NZ. However, there is no known method for calculating the bilinear map e (α, β) defined on the elliptic curve defined on the remainder ring in polynomial time, and it is defined on the remainder ring that can be calculated in polynomial time. The construction method of the bilinear map e (α, β) defined on the defined elliptic curve is not known (Reference 5: Alexander W. Dent and Steven D. Galbraith, "Hidden Pairings and Trapdoor DDH Groups," ANTS 2006, LNCS 4076, pp. 436-451, 2006.). In such a setting, the determination unit 4111 directly calculates the bilinear map e on the remainder ring Z / NZ, and the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _{g1, c 2v) / e (} c 1v, it is impossible to determine whether they meet the _{y 2).}

On the other hand, e _ω (α _ω , β _ω ) and e _ι (α _ι , β _ι ) defined on elliptic curves defined on the remainder fields Z / ωZ and Z / ιZ can be calculated in polynomial time. Such as Weil pairing and Tate pairing (see references 3, 4 etc.). Miller's algorithm (reference document 6: VS Miller, “Short Programs for functions on Curves,” is an algorithm for performing such e _ω (α _ω , β _ω ) and e _ι (α _ι , β _ι ) in polynomial time. “1986, Internet <http://crypto.stanford.edu/miller/miller.pdf>” is well known, and e _ω (α _ω , β _ω ) and e _ι (α _ι , Β _ι ) for efficient execution of elliptic curves and cyclic groups (for example, Reference 4, Reference 7: A. Miyaji, M. Nakabayashi, S. Takano, “New explicit conditions of elliptic curve Traces for FR-Reduction, "IEICE Trans. Fundamentals, vol. E84-A, no05, pp. 1234-1243, May 2001", Reference 8: PSLM Barreto, B. Lynn, M. Scott, "Constructing elliptic curves with prescribed embedding degrees," Proc. SCN '2002, LNCS 2576, pp.257-267, Springer-Verlag. 2003 ", Reference 9: R. Dupont, A. Enge, F. Mor ain, "Building curves with arbitrary small MOV degree over finite prime fields," http://eprint.iacr.org/2002/094/ etc.).

Also, based on the Chinese remainder theorem, the direct product of the remainder field Z / ωZ and the remainder field Z / ιZ from the remainder ring Z / NZ modulo the composite number N (N = ω · ι) It is well known that there exists an isomorphic mapping, and there exists an isomorphic mapping that maps from the direct product of the remainder field Z / ωZ and the remainder field Z / ιZ to the remainder ring Z / NZ (reference 10: Johannes Buchman). , “Introduction to Cryptography”, Springer Fairlark Tokyo (2001/07), ISBN-10: 4431708669 ISBN-13, pp. 52-56). That is, there exists an isomorphic mapping HM that maps a point on the first elliptic curve to a point on the second elliptic curve and a point on the third elliptic curve, and an inverse image HM- ¹ . As an example, let HM be the isomorphism mapping the element κmod N of the remainder ring Z / NZ to the element κmod ω of the remainder field Z / ωZ and the element κmod ι of the remainder field Z / ιZ, and the residue field Z / ωZ Let HM ⁻¹ be a mapping that maps the element κ _ω mod ω of ω and the element κ _ι mod ι of the remainder field Z / ιZ to the element κ _ω ιι '+ κ _ι ωω' mod N of the remainder ring Z / NZ. However, ω ′ and ι ′ are natural numbers satisfying ωω ′ + ιι ′ = 1. Such ω ′ and ι ′ can be easily generated using the extended Euclidean algorithm. ωω '+ ιι' = from one _{relationship,} κ ω ιι '+ κ ι and the action of HM in _{ωω'modN κ ω ιι' + κ ι} ωω'mod ω = κ ω ιι'modω = κ ω (1-ωω ') Mod _ω = κ _ω mod ωεZ / ωZ
κ _ω ιι '+ κ _ι ωω' modι ＝ κ _ι ωω'modι ＝ κ _ι (1-ιι ') modι ＝ κ _ι modι∈Z ／ ιZ
Thus, it can be seen that the mapping in this example has a relationship between HM and HM- ¹ .

  Therefore, if a value obtained by prime factorizing the composite number N, that is, a value of the prime number ω and a prime number ι, is given, the determination unit 4111 defines on the remainder ring Z / NZ by the following steps A to D. A bilinear map e (α, β) on the first elliptic curve thus obtained can be calculated.

(Step A) The determination unit 4111 uses the isomorphism HM, and converts the point α∈G ₁ on the first elliptic curve defined on the remainder ring Z / NZ to the second defined on the remainder field Z / ωZ. Copy the point θ _ω (α) εG _1ω on the elliptic curve and the point θ _ι (α) εG _1ι on the third elliptic curve defined on the remainder field Z / ιZ.

(Step B) determining unit 4111, using the isomorphism HM, the second point Beta∈G ₂ on the first elliptic curve defined over residue ring Z / NZ, which is defined on the residue field Z / .omega.z Copy the point θ _ω (β) εG _2ω on the elliptic curve and the point θ _ι (β) εG _2ι on the third elliptic curve defined on the remainder field Z / ιZ.

(Step C) The determination unit 4111 includes e _ω (θ _ω (α), θ _ω (β)) and e _ι (θ _ι (α), θ _ι (β) in the second elliptic curve and the third elliptic curve. )

(Step D) The determination unit 4111 displays the inverse image HM ^{− on} the obtained calculation results e _ω (θ _ω (α), θ _ω (β)) and e _ι (θ _ι (α), θ _ι (β)). A value obtained by acting ¹ is defined as e (α, β).

Therefore, if values of prime number ω and prime number ι are given, determination unit 4111 follows steps A to D, e (μ _g1 , c _2u ), e (c _1u , y ₂ ), e (μ _g1 , c _2v ), e (c _1v , y ₂ ) and the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _g1 , c _2v ) / e (c _1v , y ₂ ) Or not.

On the other hand, there is no known method for performing prime factorization of a large composite number N in polynomial time. Therefore, in this setting, the determination unit 4111 to which at least one of the prime number ω and the prime number ι is not given is related to e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _g1 , c _2v ) / e (c _1v , y ₂ ) cannot be determined.

When the special groups G ₁ and G ₂ and the bilinear map e as described above are used, a person who can cause the re-encryption device 41 to execute the processes of steps S4107 and S4110 is at least one of the prime number ω and the prime number ι. Can be restricted to those who know.

<Others>
As in the first embodiment, the first ciphertext C1 is input to the re-encryption device 4341 that is included locally in the re-ciphertext acquisition device 43, and the above-described diagram is transmitted between the re-encryption device 4341 and the capability providing device 42. The processing described in FIG. 7 and FIG. 8 may be executed. This processing is, for example, processing in which the re-encryption device 41 is replaced with the re-encryption device 4341. Alternatively, at the time of this processing, at least a part of the processing of the capability providing device 42 described above may be executed by the re-encryption device 41. Further, the re-encrypting device 4341 does not need to know what processing each of the re-encrypting device 41 and the capability providing device 42 is performing. As long as the system includes at least the re-encrypting device 41 and the capability providing device 42, the processing described in FIG.

[Fifth embodiment]
In each of the above-described embodiments, the natural number storage unit 1101 of the re-encryption apparatus stores a plurality of types (a, b) of two prime numbers a and b that are relatively prime to each other, and stores these sets (a, b). It was decided that each process would be executed. However, one of a and b may be a constant. For example, a may be fixed to 1, or b may be fixed to 1. In other words, one of the first randomizable sampler and the second randomizable sampler may be replaced with a sampler. When one of a and b is a constant, there is no need to select a or b as a constant, and each processing unit treats it as a constant without inputting a or b as a constant. Calculations can be made. When a or b, which is a constant, is 1, f (C1) = u ^{b ′} v ^{a ′ is changed} to f (C1) = v or f (C1) without using a ′ or b ′. = U can be obtained.

  The fifth embodiment is an example of such a modification, in which b is fixed to 1 and the second randomizable sampler is replaced with a sampler. Below, it demonstrates centering on difference with 1st embodiment. Further, specific examples of the first randomizable sampler and the sampler are the same as those described in the second to fourth embodiments, and thus the description thereof is omitted.

<Configuration>
As illustrated in FIG. 1, in the re-encryption system 5 of the fifth embodiment, the re-encryption device 11 of the first embodiment is replaced with a re-encryption device 51, and the capability providing device 12 is replaced with the capability providing device 52. The re-ciphertext acquisition device 13 is replaced with the re-ciphertext acquisition device 53.

  As illustrated in FIG. 11, the re-encryption apparatus 51 according to the fifth embodiment includes, for example, a natural number storage unit 5101, a natural number selection unit 5102, an input information providing unit 5104, a first calculation unit 5105, and a first power calculation unit 1106. A first list storage unit 1107, a second calculation unit 5108, a second list storage unit 5110, a determination unit 5111, a final output unit 1112, and a control unit 1113.

  As illustrated in FIG. 3, the capability providing apparatus 52 according to the fifth embodiment includes, for example, a first output information calculation unit 5201, a second output information calculation unit 5202, a key storage unit 1204, and a control unit 1205.

  As illustrated in FIG. 4, the re-ciphertext acquisition device 53 of the second embodiment includes, for example, a re-encryption device 5351, a decryption unit 1312, a control unit 1313, and a key storage unit 1314. The configuration and processing of the re-encryption device 5351 are the same as those of the re-encryption device 51 of FIG.

<Processing premise>
The natural number storage unit 5101 of the re-encryption device 51 does not store the natural number b, and stores only a plurality of natural numbers a. The other premise is the same as that in any of the first to fourth embodiments described above.

<Processing>
As illustrated in FIG. 12, first, the natural number selection unit 5102 of the re-encryption device 51 (FIG. 11) reads one natural number a randomly from a plurality of natural numbers a stored in the natural number storage unit 5101. The read information on the natural number a is sent to the input information providing unit 5104 and the first power calculation unit 1106 (step S5100).

  The control unit 1113 sets t = 1 (step S1102).

The input information providing unit 5104 generates and outputs first input information τ ₁ and second input information τ ₂ corresponding to the input first ciphertext C1. Preferably, the first input information τ ₁ and the second input information τ ₂ are information that disturbs the relationship with the first ciphertext C1. Accordingly, the re-encryption device 51 can conceal the first ciphertext C1 from the capability providing device 52. In addition, preferably, the second input information τ ₂ of this embodiment further corresponds to the natural number a selected by the natural number selection unit 5102. As a result, the re-encryption device 51 can evaluate the re-encryption capability provided from the capability providing device 52 with high accuracy (step S5103). Specific examples of the first input information tau ₁ and the second input information tau ₂ sets, one of b = 1 and the first input information tau ₁ and the second input information of the fourth embodiment from the second embodiment tau _{It is a set of two} .

As illustrated in FIG. 8, the first input information τ ₁ is input to the first output information calculation unit 5201 of the capability providing device 52 (FIG. 3), and the second input information τ ₂ is input to the second output information calculation unit 5202. Input (step S5200).

The first output information calculation unit 5201 uses the first input information τ ₁ and the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and f with a probability larger than a certain probability. (Τ ₁ ) is correctly calculated, and the obtained calculation result is set as the first output information z ₁ (step S5201). The second output information calculation unit 5202 uses the second input information τ ₂ , the first decryption key s ₁ and the second encryption key y ₂ stored in the key storage unit 1204, and f ( τ ₂ ) is correctly calculated, and the obtained calculation result is set as second output information z ₂ (step S5202). That is, the first output information calculation unit 5201 and the second output information calculation unit 5202 can output a calculation result including an intentional or unintentional error. In other words, also when the calculation result in the first output information calculation section 5201 is not f Some cases of _{(τ 1) f (τ 1} ), the calculation result of the second output information calculation unit 5202 f (tau ₂ ) or not f (τ ₂ ). Specific examples of the set of first output information z ₁ and the second output information z _2, the first output information z ₁ and the second output information z of the second embodiment is either of b = 1 of the fourth embodiment It is a set of _two .

The first output information calculation unit 5201 outputs the first output information _{z 1,} the second output information calculation unit 5202 outputs the second output information _{z 2} (step S5203).

Returning to FIG. 12, the first output information z ₁ is input to the first calculation unit 5105 of the re-encryption device 51 (FIG. 11), and the second output information z ₂ is input to the second calculation unit 5108. The first output information z ₁ and the second output information z ₂ correspond to the re-encryption capability given from the capability providing device 52 to the re-encryption device 51 (step S5104).

First calculation unit 5105 generates the operation result u = f (C1) _{x 1} from the first output information _{z 1.} A specific example of the calculation result u is the calculation result u in which b = 1 in the second embodiment to the fourth embodiment. The calculation result u is sent to the first power calculation unit 1106 (step S5105).

The first power calculation unit 1106 calculates u ′ = u ^a . A set (u, u ′) of the calculation result u and u ′ calculated based on the calculation result is stored in the first list storage unit 1107 (step S1106).

The second calculation unit 5108 generates the operation result _{^{v = f (C1) a x}} 2 from the second output information _{z 2.} A specific example of the calculation result v is the calculation result v of any one of the second to fourth embodiments. The calculation result v is stored in the second list storage unit 5110 (step S5108).

  As in any of the first embodiment to the fourth embodiment, the determination unit 5111 includes the set (u, u ′) stored in the first list storage unit 1107 and the v stored in the second list storage unit 5110. Among them, it is determined whether or not u ′ and v belong to a ciphertext class for the same plaintext (step S5110). If there is a pair of u 'and v belonging to the same ciphertext class for the same plaintext, the process advances to step S5114. If there is no pair of u ′ and v belonging to the ciphertext class for the same plaintext, the process proceeds to step S1111.

  In step S1111, the control unit 1113 determines whether t = T (step S1111). T is a predetermined natural number. If t = T, the final output unit 1113 outputs information indicating that the calculation could not be performed, for example, the symbol “⊥” (step S1113), and ends the process. If not t = T, the control unit 1113 increments t by 1, that is, sets t = t + 1 (step S1112), and returns to step S5103.

In step S5114, the final output unit 1112 outputs u corresponding to u ′ included in the set of u ′ and v determined to belong to the ciphertext class for the same plaintext (step S5114). The u thus obtained corresponds to u ^{b ′} v ^{a ′} when b = 1 in the first to fourth embodiments. That is, u obtained in this way becomes f (C1) with high probability. Therefore, the above-described processing is repeated a plurality of times, and the most frequently used value among the values obtained in step S5114 may be set as the second ciphertext C2. As will be described later, depending on the setting, u = f (C1) with an overwhelming probability. In that case, the value obtained in step S5114 may be used as it is as the second ciphertext C2.

≪Reason for obtaining f (C1) ≫
Next, the reason why the decryption result f (C1) is obtained by the re-encryption apparatus 51 of this embodiment will be described. First, the matters necessary for explanation are defined.

Black-box:
The black box F (τ) of f (τ) means a processing unit that inputs τεH and outputs zεG. In this embodiment, the first output information calculation unit 5201 and the second output information calculation unit 5202 correspond to the black box F (τ) of the function f (τ), respectively. If the probability of satisfying z = f (τ) for an element τε _U H and z = F (τ) arbitrarily selected from group H is greater than δ (0 <δ ≦ 1),
Pr [z = f (τ) | τ∈ U H, z = F (τ)]> δ ... (1)
A black box F (τ) of f (τ) that satisfies the above is called a black box F (τ) of f (τ) with reliability δ (δ-reliable). Δ is a positive value and corresponds to the “certain probability” described above.

Self-corrector:
The self-corrector C ^F (x) means a processing unit that receives x∈H, performs calculation using the black box F (τ) of f (τ), and outputs j∈G∪⊥. In this embodiment, the re-encryption device 51 corresponds to the self-corrector C ^F (x).

Almost self-corrector:
If the self-corrector C ^F (x) receives x∈H and uses the black box F (τ) of f (τ) of δ-reliable, the probability that the correct value j = f (x) is output is incorrect. Assume that the value j ≠ f (x) is sufficiently larger than the probability of outputting. That is,
Pr [j = f (x) | j = C ^F (x), j ≠ ⊥]
> Pr [j ≠ f (x) | j = C ^F (x), j ≠ ⊥] + Δ (2)
Assuming that Δ is a certain positive value (0 <Δ <1). In such a case, the self-corrector C ^F (x) is said to be an all-most self-corrector. For example, Pr [j = f (x) | j = C ^F (x)]> (1/3) + Δ ′ for a certain positive value Δ ′ (0 <Δ ′ <1)
Pr [j = ⊥ | j = C ^F (x)] <1/3
Pr [j ≠ f (x) and j ≠ ⊥ | j = C ^F (x)] <1/3
If the condition is satisfied, the self-corrector C ^F (x) is an all-most self-corrector. Examples of Δ ′ are Δ ′ = 1/12 and 1/3.

Robust self-corrector:
The self-corrector C ^F (x) takes x∈H as an input and outputs a correct value j = f (x) or j = ⊥ using a black box F (τ) of f (τ) of δ-reliable. Assume that the probability is overwhelming. That is, Pr [j = f (x) or j = ⊥ | j = C ^F (x)]> 1-ξ (3) with respect to an error ξ (0 ≦ ξ <1) that can be ignored.
Assuming that In such a case, the self-corrector C ^F (x) is said to be a robust self-corrector. An example of the error ξ that can be ignored is the function value ξ (k) of the security parameter k. An example of the function value ξ (k) is such that {ξ (k) p (k)} converges to 0 for a sufficiently large k for an arbitrary polynomial p (k). Specific examples of the function value ξ (k) are ξ (k) = 2− ^k and ξ (k) = 2− ^√k .

  In addition, a robust self-corrector can be constructed from an all-most self-corrector. That is, a robust self-corrector can be configured by executing the all-most self-corrector a plurality of times for the same x and setting j as the most frequent output value excluding wrinkles. For example, a robust self-corrector can be constructed by executing an all-most self-corrector O (log (1 / ξ)) times for the same x and setting j as the most frequent output value. O (•) represents the O-notation.

Pseudo-free action:
Group G, set of natural numbers Ω = {0,. . . , M} (M is a natural number greater than or equal to ₁ ), realization values α∈X ₁ (α ≠ e _g ), β∈X ₂ , and a∈Ω of random variables X ₁ and X ₂ having values in group G , the probability becomes ^{α a = β Pr [α a} = β cutlet _{α ≠ e g | a∈ U Ω} , α∈X 1, β∈X 2] ... (4)
For the upper limit value regarding every possible X _1, X _2, referred to as pseudo-free indicator of the set (G, Omega), which will be expressed as P (G, Ω). There is a function ζ (k) that can be ignored,
P (G, Ω) <ζ (k) (5)
The operation defined by the pair (G, Ω) is a pseudo-free action. “Α ^a ” means that the operation defined in the group G is applied to α a times. An example of the function ζ (k) that can be ignored is that {ζ (k) p (k)} converges to 0 for a sufficiently large k for an arbitrary polynomial p (k). Specific examples of the function ζ (k) include ζ (k) = 2 ^−k and ζ (k) = 2 ^−√k . For example, when the probability of Expression (4) is less than O (2- ^k ) with ^respect to the security parameter k, the operation defined by the set (G, Ω) is a pseudo-free action. Further, for example, for those that are alpha ≠ e _g in any Arufa∈G, set Ω · α = {a (α ) | a∈Ω} number of elements | Ω · α | if exceeding 2 ^k, the set The operation defined by (G, Ω) is a pseudo-free action. Note that a (α) represents the result of applying a predetermined calculation to a and α. There are many such examples. For example, the group G is a residue group Z / pZ modulo a prime number p, the prime number p is on the order of 2 ^k , and the set Ω = {0,. . . A p-2}, a a (alpha) is alpha ^a ∈ Z / pZ, if it is _{α ≠ e g, Ω · α} = {α a | a = 0 ,. . . , P-2} = {eg, α ¹ _,. . . , Α ^p−2 }, and | Ω · α | = p−1. Since prime p is of the order of 2 ^k, then there exists a constant C, if k is sufficiently large | Ω · α |> meet C2 ^k. Here, the probability of the equation (4) is less than C ^- 12- ^k , and the operation defined by such a set (G, [Omega]) is a pseudo-free action.

A randomizable sampler with reliability δ ^γ (δ ^γ -reliable):
Each time a natural number a is given, a random number that uses a black box F (τ) of f (τ) of δ-reliable and returns w ^a x ′ corresponding to a sample x ′ according to a random variable X for w∈G a reduction can sampler, w ^{a x} '= w a is greater than [delta] ^gamma probability is (gamma positive constant), i.e.,
Pr [w ^a x ′ = w ^a ]> δ ^γ (6)
A sampler that satisfies the above condition is called a randomizable ^sampler with reliability δγ. Set of input information providing unit 5104 of the present embodiment and the second output information calculation unit 5202 and the second calculation unit 5108, for w = f (x), is a random number of possible sampler reliability [delta] ^gamma.

  Next, the reason why f (C1) is obtained by the re-encryption apparatus 51 of this embodiment will be described using these definitions.

In step S5110 of this embodiment, whether there is a pair of u ′ and v belonging to the ciphertext class for the same plaintext, that is, whether there is a pair of u ^a and v belonging to the ciphertext class for the same plaintext. Judgment. For set of input information providing unit 5104 of the present embodiment and the second output information calculation unit 5202 and the second calculation unit 5108 is a random number of possible sampler reliability [delta] ^gamma (equation (6)), the T k, If the value is larger than a constant value determined from δ and γ, u ^a and v belong to the same ciphertext class for the same plaintext with an asymptotically high probability (yes in step S5110). Arise. For example, if T ≧ 4 / δ ^γ, by belonging to the class of ciphertext and ^{u a} and v for the same plaintext (a yes in step S5110) probability inequality Markov to be greater than 1/2 Recognize.

Further, in this embodiment u = f (C1) _{x 1} and v = f ^(C1) because there so a _{x 2,} in the case where the ^{u a} and v belong to the class of the ciphertext for the same plaintext D _{(s 2 , f (C1) x 1)} = D (s 2, f (C1) x 2 1 / a) is satisfied. However, D (s ₂ , υ) represents a function for decrypting νεG with the second decryption key s ₂ in accordance with the second encryption method. In this case, if the second encryption method is a definite encryption method, x ₁ ^a = x ₂ is established. Even if the second encryption method is a stochastic encryption method, if f (C1) is a homomorphic function, x ₁ ^a = x ₂ holds.

if _{x 1} ^a = x ₂ is _established, and a case is x _{1 =} x 2 _{= e} If a _g and _{x 1} ≠ _{e g.} If it is _{x 1} = x 2 = _{e g,} since it is of a u = f (C1), u is output in step S5114 is correct f (C1). On the other hand, in the case of _{x 1} ≠ _{e g,} since it is of a u ≠ f (C1), u is output in step S5114 is not the right f (C1).

Whether the operation defined by the group (G, Ω) of the group G and the set Ω to which the natural number a belongs is a pseudo-free action, or T ² P (G, Ω) is about the pseudo-free index P (G, Ω) If asymptotically _small probability of _{x 1} ≠ _{e g} in the case of _^x 1 a = ^x ₂ (formula (4)) is asymptotically small. _Thus, the probability that _x 1 = _{e g} in the case of _^x 1 a = ^x ₂ is asymptotically large. Therefore, if the operation defined by the pair (G, Ω) is a pseudo-free action, or if T ² P (G, Ω) is asymptotically small, the ciphertext for the plaintext with the same u ^a and v The probability that an incorrect f (C1) is output when belonging to a class is sufficiently smaller than the probability that a correct f (C1) is output when u ^a and v belong to the same ciphertext class for the same plaintext. . In this case, the re-encryption device 51 can be said to be an all-most self-corrector (see equation (2)). Therefore, as described above, a robust self-corrector can be configured from the re-encryption device 51, and correct f (C1) can be obtained with an overwhelming probability. When the operation defined by (G, Ω) is a pseudo-free action, the probability that erroneous f (C1) is output when u ^a and v belong to the same ciphertext class for the same plaintext Can be ignored. In this case, the re-encryption device 51 outputs correct f (C1) or ⊥ with an overwhelming probability.

If k ₀ is determined for an arbitrary constant ρ, and the function value η (k ′) for an arbitrary k ′ that satisfies k ₀ <k ′ for this k ₀ is less than ρ, “η (k ′ ) Is asymptotically small. " An example of k ′ is a security parameter k. Further, Sadamari is k ₀ for any constant [rho, for this k ₀ k _{0 <If} function value for 'any k satisfying' k 1-eta of (k ') is less than [rho "eta ( k ′) is asymptotically large ”.

Further, as can be seen by replacing a with a / b, the above proof is that “u ′ and v ′ belong to the ciphertext class for the same plaintext as described in the first embodiment. randomizing allows sampler has correctly calculate u = f ^{(C1) b,} the second random number of possible sampler is v = f ^(C1) is correctly calculate ^a _{(x 1} and _{x 2} is the group G also a unit which is based on e _g) is likely "that proof.

《Reliable δγ randomizable ^sampler and safety》
Assume the following attacks.

  The black box F (τ) or its part intentionally outputs an incorrect z, or the value output from the black box F (τ) is altered to an incorrect z.

-W ^a x 'corresponding to an illegal z is output from a randomizable sampler.

The w ^a x ′ corresponding to illegal z also causes the self-corrector C ^F (C1) to determine that u ^a and v belong to the same ciphertext class for the same plaintext (yes in step S5110). Regardless, it increases the probability that the self-corrector C ^F (C1) will output an incorrect value.

Such attacks, if the probability distribution of the error of the output from the random number of possible sampler against natural number a given _{^{w a x 'D a = w}} a x'w -a depends on the natural number a It becomes possible. For example, if a fraud is performed such that v output from the second calculation unit 5108 is f (C1) ^a x ₁ ^a , u ^a = v is always satisfied regardless of the value of x ₁ and u It is determined that ^a and v belong to a ciphertext class for the same plaintext. Therefore, the error probability distribution D _{^a =} w _a x'w ^-a given w ^{a x} output from the random number of possible sampler against natural number a 'does not depend on the natural number a is desirable.

Alternatively, for any original a∈ ^∀ Ω set Omega, there are w a probability distribution of the error in _{^{x 'D a = w a x'w}} -a probability distribution D having a value in the group G can not be distinguished It is desirable that the sampler be a randomizable sampler (the probability distribution D _a and the probability distribution D are statistically approximated). The probability distribution D does not depend on the natural number a. Further, the inability to distinguish between probability distributions D _a probability distribution D, which means that it is impossible to distinguish between the probability distribution D _a probability distribution D by a polynomial time algorithm, for example, be ignored For possible ζ (0 ≦ ζ <1), _ΣgεG | Pr [gεD] −Pr [gεD _a ] | <ζ (7)
If it satisfies, the probability distribution D _a and the probability distribution D cannot be distinguished by the polynomial time algorithm. An example of ζ that can be ignored is the function value ζ (k) of the security parameter k. An example of the function value ζ (k) is such that {ζ (k) p (k)} converges to 0 for a sufficiently large k for an arbitrary polynomial p (k). Specific examples of the function value ζ (k) include ζ (k) = 2 ^−k and ζ (k) = 2 ^−√k . These points are the same in the first to fourth embodiments using the natural numbers a and b.

<Others>
As in the first to fourth embodiments, the first ciphertext C1 is input to the re-encryption device 5351 included locally in the re-ciphertext acquisition device 53, and the re-encryption device 5351 and the capability providing device 52 are connected. Thus, the processing described in FIGS. 8 and 12 may be executed. This processing is, for example, processing in which the re-encryption device 51 is replaced with the re-encryption device 5351. Alternatively, at the time of this processing, at least a part of the processing of the capability providing device 52 described above may be executed by the re-encryption device 51. Further, the re-encryption device 5351 does not need to know what processing each of the re-encryption device 51 and the capability providing device 52 performs. As long as the system includes at least the re-encryption device 51 and the capability providing device 52, the process illustrated in FIG.

[Modifications, etc.]
The random variables X ₁ , X ₂ and X ₃ may be the same or different.

Each of the first random number generation unit, the second random number generation unit, and the third random number generation unit generates the uniform random number, so that the re-encryption system is most secure. However, if the required level of security is not so high, at least some of the first random number generator, the second random number generator, and the third random number generator may generate random numbers that are not uniform random numbers. . Also, from the computational efficiency, as in the embodiments described above, it is desirable is a natural number of random numbers to be selected is a natural number from 0 to less than K _H, is K _H or more random natural number in place of it It may be selected.

Each time the re-encrypting device provides the first input information τ ₁ and the second input information τ ₂ corresponding to the same a and b to the capability providing device, the processing of the capability providing device may be executed a plurality of times. As a result, each time the re-encryption device provides the first input information τ ₁ and the second input information τ ₂ to the capability providing device once, the re-encryption device recognizes the first output information z ₁ and the second output information z. ₂ and a plurality of third output information z ₃ can be obtained. Thereby, the frequency | count of communication and the communication amount between a re-encryption apparatus and a capability provision apparatus can be reduced.

Further, the re-encryption device collectively provides a plurality of types of first input information τ ₁ and second input information τ ₂ to the capability providing device, and the corresponding first output information z ₁ , second output information z ₂ , it may be acquired together a plurality of third output information z _3. As a result, the number of exchanges between the re-encryption device and the capability providing device can be reduced.

  Data exchange between the units of the re-encryption device may be performed directly or via a storage unit (not shown). Similarly, data exchange between the units of the capability providing apparatus and the re-ciphertext acquisition apparatus may be performed directly or may be performed via a storage unit (not shown).

  In addition, it is confirmed whether u and v obtained in the first calculation unit and the second calculation unit of each embodiment are elements of the group G. If they are elements of the group G, the above-described processing is continued. If u, v or v is not an element of the group G, information indicating that the calculation could not be performed, for example, the symbol “⊥” may be output.

  In addition, the present invention is not limited to the above-described embodiment. For example, the various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads the program stored in its own recording device and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

1 to 5 Re-encryption system 11 to 51 Re-encryption device 12 to 52 Capability providing device 13 to 53 Re-ciphertext acquisition device

Claims (18)

A re-encryption device and a capability providing device;
G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) A function for converting to C2, a natural number where a and b are relatively prime, and a ciphertext that may be obtained by encrypting the plaintext with the second encryption key y ₂ in accordance with the second encryption scheme Is a class of ciphertexts to which the ciphertext belongs, X ₁ and X ₂ are random variables having values in the group G, x ₁ is an actual value of the random variable X ₁ , and x ₂ is a random variable X ₂ Realized value
The re-encryption device is
An input information providing unit that outputs first input information τ ₁ and second input information τ ₂ that are elements of the group H corresponding to the first ciphertext C1;
The capability providing device is
A first output information generating unit that correctly calculates f (τ ₁ ) with a probability larger than a certain probability using the first input information τ ₁ and sets the obtained calculation result as first output information z ₁ ;
Using the second input information τ ₂ to correctly calculate f (τ ₂ ) with a probability greater than a certain probability, and to obtain a second output information z ₂ as the second output information z ₂ Including
The re-encryption device further generates a calculation result u = f (C1) ^b x ₁ from the first output information z ₁ ;
A second calculation unit that generates ^a calculation result v = f (C1) ^a x ₂ from the second output information z ₂ ;
When the value u ^a for the operation result u and the value v ^b for the operation result v belong to the same ciphertext class, the values u for integers a ′ and b ′ satisfying a′a + b′b = 1. a final output unit that outputs ^{b ′} v ^{a ′} ,
Re-encryption system. The re-encryption system of claim 1, comprising:
The re-encryption device includes a natural number selection unit that selects at least one of the natural numbers a and b;
The first input information τ ₁ further corresponds to the natural number b, and the second input information τ ₂ further corresponds to the natural number a.
Re-encryption system. The re-encryption system according to claim 1 or 2,
The input information providing unit sets the information that disturbs the relationship with the first ciphertext C1 as the first input information τ ₁ and the second input information τ ₂ .
Re-encryption system. The re-encryption system according to any one of claims 1 to 3,
The function f is a homomorphic function;
Re-encryption system. The re-encryption system according to any one of claims 1 to 4,
The function f is a homomorphic function;
The input information providing unit
A first random number generator for generating an arbitrary element _h r ₁ of the group H;
C1 ^b C1 ′ corresponding to the element C1 ′ of the group H obtained by encrypting the element _h r ₁ with the first encryption key y ₁ in accordance with the first encryption method is used as the first input information τ. _A first input information calculation unit obtained as 1,
A second random number generator for generating an arbitrary element _h r ₂ of the group H;
C1 ^a C1 ″ corresponding to the element C1 ″ of the group H obtained by encrypting the element _h r ₂ with the first encryption key y ₁ according to the first encryption method is used as the second input information τ. _A second input information calculation unit obtained as 2;
The first output information calculation unit correctly calculates f (C1 ^b C1 ′) with a probability larger than a certain probability using the first input information C1 ^b C1 ′, and the obtained calculation result is the first output. Information z ₁ and
The second output information calculation unit correctly calculates f (C1 ^a C1 ″) with ^a probability larger than a certain probability using the second input information C1 ^a C1 ″, and obtains the obtained calculation result as the second output information. z ₂ and
The first calculation unit z ₁ (C2) corresponding to the element C2 ′ of the group H obtained by encrypting the element _h r ₁ with the second encryption key y ₂ according to the second encryption method. ') ^{Let -1} be u,
The second calculation unit z ₂ (C2 corresponding to the element C2 ″ of the group H obtained by encrypting the element _h r ₂ with the second encryption key y ₂ in accordance with the second encryption method. ”) ⁻¹ is said v,
Re-encryption system. The re-encryption system according to any one of claims 1 to 5,
Wherein the function f is homomorphic function, direct product _{G 1} × _{G 2} group G is a group _G 1, _{G 2,} mu _g1 is generator of the group _{G 1,} mu _g2 is generator of the group _{G 2, s 2} is the second decryption key corresponding to the second encryption key _{y 2,} the second encryption key _{y 2} is _mu ^{g2 s2,} r is an integer random number, the second ciphertext C2 is ^{_{(μ g1 r, my 2 r}} ), the value u ^a is (c _1u , c _2u ) εG ₁ × G ₂ , the value v ^b is (c _1v , c _2v ) εG ₁ × G ₂ , e (α, β) is (α, β) εG against ₁ × G ₂ is a bilinear mapping that gives the original finite-friendly換群G _T,
The final output unit satisfies the value u ^b when the relationship e (μ _g1 , c _2u ) / e (c _1u , y ₂ ) = e (μ _g1 , c _2v ) / e (c _1v , y ₂ ) is satisfied. output ^' va ^' ,
Re-encryption system. The re-encryption system of claim 6,
N is a composite number of a prime number ω and a prime number ι, and the groups G ₁ and G ₂ are each a subgroup consisting of points on a first elliptic curve defined on a remainder ring modulo the composite number N, G _1ω , G _2ω is a subgroup consisting of points on the second elliptic curve defined on the remainder field modulo the prime number ω, and G _1ι and G _2ι are the second groups defined on the remainder field modulo the prime number ι. A subgroup consisting of points on the three elliptic curves, e _ω (α _ω , β _ω ) gives the _element of the finite commutative group G _Tω for (α _ω , β _ω ) ∈G _1ω × G _2ω linear _{mapping, e ι (α ι, β} ι) is _{(α ι, β ι) ∈G} 1ι × G third bilinear mapping that gives a finite-friendly換群_{G Tiiota} former relative _2ι, HM is the first An isomorphism mapping HM ^-1 to a point on the second elliptic curve and a point on the third elliptic curve, and HM ^-1 is an inverse image of the isomorphism HM,
The re-encryption device is
Using the isomorphism HM, the point α on the first elliptic curve is mapped to the point θ _ω (α) on the second elliptic curve and the point θ _ι (α) on the third elliptic curve, and the isomorphism Using the mapping HM, the point β on the first elliptic curve is mapped to the point θ _ω (β) on the second elliptic curve and the point θ _ι (β) on the third elliptic curve, and e _ω (θ _ω (α), θ _ω (β)) and e _ι (θ _ι (α), θ _ι (β)) are obtained, and e _ω (θ _ω (α), θ _ω (β)) and e _ι (θ further including a determination unit that obtains the inverse image HM ⁻¹ for _ι (α), θ _ι (β)) as e (α, β) and determines whether or not the relationship is satisfied.
Re-encryption system. The re-encryption system according to any one of claims 1 to 4,
The function f is a homomorphic function, μ _h is a generator of the group H, K _H is the order of the group H, ν = f (μ _h ),
The input information providing unit
A first random number generator that generates a random number r ₁ of a natural number greater than or equal to 0;
A first input information calculation unit for calculating μ _h ^r1 C1 ^b as the first input information τ ₁ ;
A second random number generator that generates a random number r ₂ of a natural number greater than or equal to 0;
A second input information calculation unit for calculating μ _h ^r2 C1 ^a as the second input information τ ₂ ,
The first output information calculation unit correctly calculates f (μ _h ^r1 C1 ^b ) with a probability larger than a certain probability using the first input information μ _h ^r1 C1 ^b , and obtains the obtained calculation result in the first One output information z ₁
The second output information calculation unit correctly calculates f (μ _h ^r2 C1 ^a ) with ^a probability larger than a certain probability using the second input information μ _h ^r2 C1 ^a , and obtains the obtained calculation result as the second Output information z ₂
The first calculation unit calculates z ₁ v ^−r1 and ^sets the calculation result as u,
The second calculation unit calculates z ₂ v ^−r2 and ^sets the calculation result as v.
Re-encryption system. The re-encryption system of claim 8,
The first random number generator generates the random number r ₁ when b ≠ 1;
The first input information calculation unit calculates the μ _h ^r1 C1 ^b as the first input information τ ₁ when b ≠ 1;
The first output information calculation unit uses the first input information μ _h ^r1 C1 ^b when b ≠ 1 as the calculation result obtained as the first output information z ₁ .
The first calculation unit calculates z ₁ ν ^−r1 when b ≠ 1, and ^sets the calculation result as u,
The second random number generator generates the random number r ₂ when a ≠ 1,
The second input information calculation unit calculates μ _h ^r2 C1 ^a as the second input information τ ₂ when a ≠ 1;
The second output information calculation unit ^{sets the} calculation result obtained using the second input information μ _h ^r2 C1 ^a when a ≠ 1 as second output information z ₂ ,
The second calculation unit calculates z ₂ ν ^−r2 when a ≠ 1, and ^sets the calculation result as v,
The input information providing unit
A third random number generator that generates a random number r ₃ of a natural number greater than or equal to 0;
a third input information calculation unit that ^sets C1 ^r3 as the first input information τ ₁ when b = 1, and ^sets C1 ^r3 as the second input information τ ₂ when a = 1,
The capability providing device is
A third output information calculation unit that correctly calculates f (C1 ^r3 ) with a probability larger than a certain probability using the C1 ^r3 and ^sets the obtained calculation result as the third output information z ₃ ;
The re-encryption device is
a third calculation unit including z ₃ ^{1 / r3} as u when b = 1 and z ₃ ^{1 / r3} as v when a = 1,
Re-encryption system. The re-encryption system according to any one of claims 1 to 9,
The probability distribution of error for f (C1) ^b of the operation result u does not depend on the natural number b, and / or the probability distribution of error for f (C1) ^a of the operation result v does not depend on the natural number a. Alternatively, there is a probability distribution that does not depend on the natural number b, which cannot be distinguished from the error probability distribution of the calculation result u with respect to f (C1) ^b , and / or the calculation result v with respect to f (C1) ^a . There is a probability distribution that does not depend on the natural number a and cannot be distinguished from the probability distribution of errors.
Re-encryption system. The re-encryption system according to any one of claims 1 to 10,
The re-encryption system, wherein the natural number a or the natural number b is a constant. G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) = function for converting C2, the second encryption scheme set the ciphertext to the ciphertext elements may be obtained by encrypting the plain text by the second encryption key y ₂ in accordance with the , X ₁ and X ₂ are random variables having values in group G, x ₁ is a real value of random variable X ₁ , x ₂ is a real value of random variable X ₂ , and a and b are relatively prime Is a natural number,
A first calculation unit that generates an operation result u = f (C1) ^b x ₁ ;
A second calculation unit for generating an operation result v = f (C1) ^a x ₂ ;
When the value u ^a for the operation result u and the value v ^b for the operation result v belong to the same ciphertext class, the values u for integers a ′ and b ′ satisfying a′a + b′b = 1. a final output unit for outputting ^{b ′} v ^{a ′} ;
A re-encryption device. G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) = A function for converting to C2,
The first input information τ ₁ that is an element of the group H corresponding to the first ciphertext C1 and is output from the re-encryption apparatus according to claim 12, and f (τ ₁ ) is greater than a certain probability. A first output information generation unit that calculates correctly and sets the obtained calculation result as the first output information z ₁ ;
The second input information τ ₂ that is the element of the group H corresponding to the first ciphertext C1 and is output from the re-encryption device according to claim 12, and f (τ ₂ ) is greater than a certain probability. A second output information generation unit that calculates correctly and sets the obtained calculation result as the second output information z ₂ ;
Having ability providing device. G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) = function for converting C2, the second encryption scheme set the ciphertext to the ciphertext elements may be obtained by encrypting the plain text by the second encryption key y ₂ in accordance with the , X ₁ and X ₂ are random variables having values in group G, x ₁ is a real value of random variable X ₁ , x ₂ is a real value of random variable X ₂ , and a and b are relatively prime Is a natural number,
An input information providing step of outputting first input information τ ₁ and second input information τ ₂ which are elements of the group H corresponding to the first ciphertext C1 in the re-encryption device;
The capability providing apparatus uses the first input information τ ₁ to correctly calculate f (τ ₁ ) with a probability larger than a certain probability, and uses the obtained calculation result as the first output information z _1. Generation step;
The capability providing apparatus uses the second input information τ ₂ to correctly calculate f (τ ₂ ) with a probability larger than a certain probability, and uses the obtained calculation result as second output information z _2. An information generation step;
A first calculation step of generating an operation result u = f (C1) ^b x ₁ from the first output information z _{1 in} the re-encryption device;
A second calculation step of generating an operation result v = f (C1) ^a x ₂ from the second output information z _{2 in} the re-encryption device;
In the re-encryption device, when the value u ^a for the operation result u and the value v ^b for the operation result v belong to the same ciphertext class, an integer a ′ that satisfies a′a + b′b = 1. , B ′, a final output step that outputs ^a value u ^{b ′} v ^{a ′} ,
A re-encryption method. G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) = function for converting C2, the second encryption scheme set the ciphertext to the ciphertext elements may be obtained by encrypting the plain text by the second encryption key y ₂ in accordance with the , X ₁ and X ₂ are random variables having values in group G, x ₁ is a real value of random variable X ₁ , x ₂ is a real value of random variable X ₂ , and a and b are relatively prime Is a natural number,
A first calculation step of generating an operation result u = f (C1) ^b x ₁ in the first calculation unit;
A second calculation step of generating an operation result v = f (C1) ^a x ₂ in the second calculation unit;
In the final output unit, when the value u ^a for the calculation result u and the value v ^b for the calculation result v belong to the same ciphertext class, integers a ′ and b satisfying a′a + b′b = 1 A final output step that outputs ^a value u ^{b '} v ^a' for ^' ;
A re-encryption method. G, H finite friendly換群, f is first ciphertext C1 is given a plaintext m in accordance with the first encryption method first encryption key y ₁ in encrypted-obtained group H of the original when in, the first ciphertext C1, the plaintext m in accordance with the second encryption system which is the second encryption key y ₂ in the original group G obtained by encrypting the second ciphertext f (C1) = A function for converting to C2,
A probability larger than a certain probability using the first input information τ ₁ that is an element of the group H corresponding to the first ciphertext C1 and is output from the re-encryption device that executes the re-encryption method according to claim 15. And f (τ ₁ ) is correctly calculated, and the first output information generation unit which uses the obtained calculation result as the first output information z ₁ ,
A probability larger than a certain probability using the second input information τ ₂ that is an element of the group H corresponding to the first ciphertext C1 and is output from the re-encryption device that executes the re-encryption method according to claim 15. And f (τ ₂ ) is correctly calculated, and a second output information generation unit that uses the obtained calculation result as second output information z ₂ ;
A capability providing method.   A program for causing a computer to execute each step of the re-encryption method of claim 15.   A program for causing a computer to execute each step of the capability providing method of claim 16.

Images