JP5871827B2 - Safety enhancement system, safety enhancement device, verification device, and program - Google Patents

Description

  The present invention relates to security enhancement technology in the field of information security technology, and more particularly to technology for enhancing security against related key attacks.

  Several (algorithmically) security enhancement methods against a related key attack on a general cryptographic circuit (hereinafter simply referred to as “circuit”) having secret information have been proposed (for example, from Non-Patent Document 1). (See 5).

Rosario Gennaro, Anna Lysyanskaya, Tal Malkin, Silvio Micali, and Tal Rabin, “Algorithmic tamper-proof (ATP) security: Theoretical foundations for security against hardware tampering,” in Moni Naor, editor, TCC 2004, volume 2951 of Lecture Notes in Computer Science, pages 258-277, Springer, Heidelberg, 2004. Stefan Dziembowski, Krzysztof Pietrzak, and Daniel Wichs, “Non-malleable codes,” in Andrew Chi-Chih Yao, editor, ICS 2010, pages 434-452, Tsinghua University Press, 2010. Yuval Ishai, Manoj Prabhakaran, Amit Sahai, and David Wagner, “Private circuits ii: Keeping secrets in tamperable circuits,” in Serge Vaudenay, editor, EUROCRYPT 2006, volume 4004 of Lecture Notes in Computer Science, pages 308-327, Springer, Heidelberg , 2006. Sebastian Faust, Krzysztof Pietrzak, and Daniele Venturi, “Tamper-proof circuits: How to trade leakage for tamper-resilience,” In Luca Aceto, Monika Henzinger, and Jiri Sgall, editors, ICALP 2011, Part I, volume 6755 of Lecture Notes in Computer Science, pages 391-402, Springer-Verlag, 2011. Dana Dachman-Soled and Yael Tauman Kalai.Securing circuits against constant-rate tampering.In Reihaneh Safavi-Naini and Ran Canetti, editors, CRYPTO 2012, volume 7417 of Lecture Notes in Computer Science, pages 533-551, Springer, Heidelberg, 2012 .

  Non-Patent Document 1 proposes a security enhancement technique against an arbitrary related key attack. However, the strengthening method of Non-Patent Document 1 requires a reliable third party. This third party needs to be involved every time a public key is released and a cryptographic device is created. Also, with this strengthening technique, once a related key attack is detected, the circuit will be destroyed.

  Non-Patent Document 2 proposes a security enhancement technique against some related key attacks. The strengthening technique of Non-Patent Document 2 does not require a reliable third party. However, even with this strengthening technique, once the relevant key attack is detected, the circuit will be destroyed.

  Non-Patent Documents 3 to 5 do not require self-destruction. However, the circuit and the change to the secret are limited, and arbitrary functions are not captured.

  Thus, no technique has been proposed for improving the security against a related key attack on an arbitrary circuit without causing the circuit to self-destruct.

  At the time of security enhancement, auxiliary information having a specific correspondence with the secret information corresponding to the key information is obtained and output. However, it is difficult to specify related auxiliary information having the corresponding relationship with respect to related secret information different from this secret information from the auxiliary information.

  At the time of verification, it is determined whether the input auxiliary information has a specific correspondence with the confidential information. If the auxiliary information has the corresponding relationship with the confidential information, the key information corresponding to the confidential information or the Information obtained from the key information is obtained, and information indicating rejection is output when the auxiliary information does not have the corresponding relationship with the secret information.

  In the present invention, auxiliary information having a specific correspondence with secret information is used. It is difficult to specify the related auxiliary information from the auxiliary information. As a result, the security against a related key attack of an arbitrary circuit can be improved. In the present invention, it is not necessary to destroy the circuit.

FIG. 1 is a block diagram for explaining the configuration of the safety enhancement system according to the first and second embodiments. FIG. 2A is a flowchart for explaining the safety enhancement process of the first embodiment, and FIG. 2B is a flowchart for explaining the verification process of the first embodiment. FIG. 3A is a flowchart for explaining the safety enhancement process of the second embodiment, and FIG. 3B is a flowchart for explaining the verification process of the second embodiment. FIG. 4 is a block diagram for explaining the configuration of the safety enhancement system according to the third and fourth embodiments. FIG. 5A is a flowchart for explaining the safety enhancing process of the third embodiment, and FIG. 5B is a flowchart for explaining the verification process of the third embodiment. FIG. 6A is a flowchart for explaining the safety enhancement process of the fourth embodiment, and FIG. 6B is a flowchart for explaining the verification process of the fourth embodiment. FIG. 7 is a block diagram for explaining the configuration of the safety enhancing system of the fifth, sixth, and seventh embodiments. FIG. 8A is a flowchart for explaining the safety enhancing process of the fifth embodiment, and FIG. 8B is a flowchart for explaining the verification process of the fifth embodiment. FIG. 9 is a flowchart for explaining the verification processing of the sixth embodiment. FIG. 10A is a flowchart for explaining the safety enhancement processing of the seventh embodiment, and FIG. 10B is a flowchart for explaining the verification processing of the seventh embodiment.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
<Definition>
Symbols and terms used in each embodiment are defined.
[Cryptographic device]
The cryptographic device (Setup, Gen, C, X, Y, K) includes the following Setup, Gen, C, X, Y, K.
Setup (1 ^κ ) is a setup algorithm, which receives the security parameter 1 ^κ and outputs a common parameter pp. pp includes information on the sets X, Y, and K.
Gen (pp) is a key generation algorithm, which receives pp as input and randomly selects and outputs secret key information kεK.
C (pp, (k, x)) is a circuit, and inputs pp and (k, x) εK × X, and outputs yεY.
For example, C (pp, (k, x)) is a decryption circuit for common key encryption, k corresponds to a secret key, x corresponds to a ciphertext, and y corresponds to a plaintext.

[Public Key Cryptographic Device]
The public key type cryptographic device (Setup, Gen, C, X, Y, K, Ω) includes the following Setup, Gen, C, X, Y, K, Ω.
Setup (1 ^κ ) is a setup algorithm, which receives the security parameter 1 ^κ and outputs a common parameter pp. pp contains information of the set X, Y, K, Ω.
Gen (pp; r) is a key generation algorithm, which receives pp as input and outputs secret key information kεK and public key information p based on a random number rεΩ.
C (pp, (k, x)) is a circuit, and inputs pp and (k, x) εK × X, and outputs yεY.
For example, C (pp, (k, x)) is a decryption circuit for public key cryptography, where k is a decryption key, p is an encryption key, x is a ciphertext, and y is a plaintext. In addition, if C (pp, (k, x)) is a digital signature circuit, k is a signature key, p is a verification key, x is a message, and y is a signature.

[Key Encapsulation Mechanism (KEM)]
The key encapsulation method is composed of the following four sets.
Setup (1 ^κ ) is a setup algorithm, which receives the security parameter 1 ^κ and outputs a common parameter pp.
Gen _KEM (pp) is a key generation algorithm, which receives pp as an input and generates a key pair (pk, sk) of a public key pk and a secret key sk.
Encaps (pp, pk; s) is a key encryption algorithm, and inputs pp and pk, and outputs a key k based on the secret information sεS and its ciphertext c. S represents a set to which secret information belongs. In the following, Encaps (pp, pk) is expressed separately as Encaps ₁ (pp, pk; s) and Encaps ₂ (pp; s) for simplicity. Encaps ₁ (pp, pk; s) is an algorithm that outputs the ciphertext c, and Encaps ₂ (pp; s) is an algorithm that outputs the key k.
Decaps (pp, sk, c) is a key decryption algorithm, and inputs pp, sk, and c, and outputs a key k or ⊥. Note that ⊥ is information indicating rejection.

[Public-Key Encryption (PKE)]
The public key cryptosystem consists of the following four sets.
Setup (1 ^κ ) is a setup algorithm, which receives the security parameter (1 ^κ ) and outputs a common parameter pp.
Gen _PKE (pp) is a key generation algorithm, and receives pp as an input and generates a key pair (ek, dk) of an encryption key ek and a decryption key dk.
Enc (pp, ek, m; [rho) is the encryption algorithm takes the input of pp and ek and message m, and outputs the resulting ciphertext cm messages m based on a random number ρ∈R _PKE. R _PKE represents a random space.
Decaps (pp, dk, cm) is a decoding algorithm, which takes pp, dk, and cm as inputs and outputs a message m or ⊥.

[Non-Interactive Zero-Knowledge (NIZK)]
Let B be a binary relation and L be a language defined from B. That is, L = {xε {0,1} ^* : B (x, w) = 1 for some w}. The corresponding w when xεL is called evidence.
Non-interactive zero knowledge proof is a triadic algorithm and is written as NIZK = (G, P, V).
G (1 ^κ ) is a setup algorithm, which receives the security parameter 1 ^κ and outputs a common parameter crs _NIZK called CRS (Common Reference String). Note that 1 ^κ represents a column of 1 κ. κ is a predetermined integer of 1 or more.
P (crs _NIZK , x, w) is a prover algorithm. The common parameter crs _NIZK , the character string x∈L⊆ {0,1} ^* , and its evidence w are input, and a proof π of x∈L is obtained. Output.
V (crs _NIZK , x, π) is a verifier algorithm, which _receives the common parameter crs _NIZK , the character string x, and the proof π, and outputs yes (pass) / no (fail).

[Bilinear map]
Bilinear mapping _{e: G K × G K →} G T is bilinearity a map whose non-degenerate and efficiency calculations possible. _{However, G K,} G _T is an abelian that place the number is a prime number q.
Due to the bilinearity, e (h ₁ ^α , h ₂ ^β ) = e (h ₁ , h ₂ ) ^αβ for any h ₁ , h ₂ εG _K and any α, βεZ _q . The non-degenerative, of order in the _{G T} of _{e (h 1,} h 1) is q. Due to the efficient computability, e can be calculated efficiently. Z _q represents a remainder group by q. An example of a bilinear map is pairing.

[Mapping with collision difficulty (collision resistance)]
Map H has collision difficulty when an enemy operating in polynomial time receives information defining map H belonging to it from the genus of the map and security parameter 1 ^κ , γ ≠ δ and H (γ) = It represents that the set (γ, δ) of H (δ) can be output only with a negligible probability. An example of the mapping H having collision difficulty is a cryptographic hash function such as SHA-1. Usually, maps with collision difficulty also have unidirectionality.

<Principle>
The principle common to each embodiment will be described.
The security enhancing device stores secret information corresponding to secret key information, and obtains and outputs auxiliary information having a specific correspondence with the secret information. However, it is difficult to specify related auxiliary information having the corresponding relationship with respect to related secret information different from the secret information from the auxiliary information.

  The verification device determines whether the input auxiliary information has a specific correspondence with the secret information, and if the auxiliary information has the correspondence with the secret information, the secret key corresponding to the secret information Information or information obtained from the key information is obtained, and information indicating rejection is output when the auxiliary information does not have the corresponding relationship with the secret information.

  In the above configuration, auxiliary information having a specific correspondence with secret information is used. It is difficult to specify the related auxiliary information from the auxiliary information. As a result, it is possible to improve security against a related key attack of an arbitrary circuit without self-destruction. Although this configuration can be applied universally to an arbitrary circuit, here, a related key attack for a specific conventional configuration is illustrated, and it is shown that the related key attack does not lead to a scheme to which this principle is applied.

[An example of a conventional public key cryptographic device]
A conventional public key type cryptographic device will be exemplified below.
Setup (1 ^κ ) takes security parameter 1 ^κ as input, obtains G _K and q, generators g ₁ and g ₂ ∈G _K, and a mapping H: G _K ³ → Z _q that has collision difficulty, and is common Output as parameter pp = (G _K , q, g ₁ , g ₂ , H).
Gen (pp; r) takes pp as input, and the key information dk = (x1, x2, y1, y2, z1, z2) that is the secret information s and the key information ek = (X _ek , Y _ek ) that is the public information. , Z _ek ) = (g ₁ ^x1 · g ₂ ^x2 , g ₁ ^y1 · g ₂ ^y2 , g ₁ ^z1 · g ₂ ^z2 ) and output.
Enc (pp; ek, m) takes pp, ek, and message m as inputs, generates a random number r′∈Z _q , and c1 = g ₁ ^{r ′} , c2 = g ₂ ^{r ′} , E = m · Z _ek ^{r ′} , ω = H (c1, c2, E), ν = (X _ek ^ω · Y _ek ) ^{r ′} is obtained, and the ciphertext ct = (c1, c2, E, ν) is output.
Dec (pp; dk, ct) takes pp, dk, and ct as inputs, and if ctεG _K ⁴ , ct = (c1, c2, E, ν) to ω = H (c1, c2, E) ), And if c1 ^{x1 * ω + y1} · c2 ^{x2 * ω + y2} = ν, m = E / (c1 ^z1 · c2 ^z2 ) is output.

[Example of related key attack against conventional configuration]
The related key attack that breaks the following one-way direction is successful against the above-mentioned conventional public key type cryptographic device.
1. The enemy receives the ciphertext ct = (c1, c2, E, ν) of the message m.
2. The enemy selects Δ∈Z _q other than 0, and the key information dk = (x1, x2, y1, y2, z1, z2) is related to the related key information φ (x1, x2, y1, y2, z1, z2) = ( Dec is inquired about the mapping φ transferred to x1, x2, y1 + Δ, y2, z1, z2) and the new ciphertext ct ′ = (c1, c2, E, ν · c1 ^Δ ).
3. Dec applies the mapping φ to the key information dk, obtains related key information (x1, x2, y1 + Δ, y2, z1, z2), uses it to decrypt ct ′, and returns the message m to the enemy.
4). The enemy outputs m as it is.

  In this example, the secret information is key information. In addition, when the above-described principle is applied to an example of the above-described public key type cryptographic device, for example, a verification device is incorporated into a Dec and functions. Key information and related key information are confidential information, and the enemy does not know these information. Even if the enemy knows the auxiliary information for the key information (x1, x2, y1, y2, z1, z2), the auxiliary information (secret information) for the related key information (x1, x2, y1 + Δ, y2, z1, z2) Related auxiliary information having a specific correspondence relationship with related secret information different from the above. Therefore, the enemy cannot give the auxiliary information for the related key information to Dec. Therefore, the verification device returns a rejection to the inquiry from Dec, and Dec returns a rejection to the enemy. As a result, the enemy cannot decrypt the ciphertext ct ′ = (c1, c2, E, ν ′) and cannot obtain the message m.

<First Embodiment>
A first embodiment will be described. In this embodiment, the above principle is applied to a cryptographic device (Setup, Gen, C, X, Y, K). The security enhancing device of this embodiment generates auxiliary information using non-interactive zero knowledge proof (NIZK = (G, P, V)). The auxiliary information includes the first ciphertext corresponding to the secret information, the second ciphertext corresponding to the secret information and the random number, and the first ciphertext and the second ciphertext using the secret information and the random number as evidence information. And proof information for performing non-interactive zero knowledge proof. The verification apparatus of this embodiment performs non-interactive zero knowledge proof verification for the first ciphertext and the second ciphertext using the proof information included in the auxiliary information, and further, the verification ciphertext corresponding to the secret information and the first ciphertext Determine if the sentence matches.

[Constitution]
As illustrated in FIG. 1, the safety enhancement system 1 of this embodiment includes a setting device 110, a safety enhancement device 120, and a verification device 130. Each of the setting device 110, the safety enhancing device 120, and the verification device 130 is configured by reading a predetermined program into a general purpose or dedicated computer including a central processing unit (CPU), a random-access memory (RAM), and the like. Special equipment. The setting device 110, the safety enhancing device 120, and the verification device 130 are configured to exchange information through a network, a portable recording medium, or the like.

  The security enhancing device 120 is, for example, a key generating device that obtains a key used when performing encryption (the same applies to the security enhancing devices in the following embodiments in which the above-described principle is applied to a cryptographic device). The safety enhancing device 120 includes an input unit 121, a storage unit 122, an auxiliary information generation unit 123, and an output unit 124. The auxiliary information generation unit 123 includes a random number generation unit 123a, a key / key ciphertext generation unit 123b, an encryption unit 123c, and a proof generation unit 123d. The safety enhancing device 120 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 130 is, for example, a key generation device that obtains a key used when decrypting a ciphertext (the same applies to verification devices in the following embodiments in which the above-described principle is applied to a cryptographic device). The verification device 130 includes an input unit 131, a storage unit 132, a determination unit 133, a key control unit 136, and an output unit 137. The determination unit 133 includes a verification unit 133a, a key ciphertext generation unit 133b, and a ciphertext comparison unit 133c. The verification device 130 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
The setting apparatus 110 receives the security parameter (1 ^κ ) as input and executes the setup algorithm Setup (1 ^κ ) to obtain the common parameter pp. The common parameter pp is common to cryptographic devices, key encapsulation methods, and public key cryptosystems. Further, the setting device 110 executes the non-interactive zero knowledge proof setup algorithm G (1 ^κ ) with the security parameter (1 ^κ ) as an input, and obtains the common parameter crs _NIZK . Further, the setting device 110 executes a key generation algorithm key generation algorithm Gen _KEM (pp) to obtain a key pair (pk, sk). The setting device 110 executes a key generation algorithm Gen _PKE (pp) of the public key cryptosystem, and obtains a key pair (ek, dk). The setting device 110 outputs the common parameter crs = (pp, pk, ek, crs _NIZK ) obtained as described above. The common parameter crs is input to the input units 121 and 131 of the safety enhancing device 120 and the verification device 130 and stored in the storage units 122 and 132, respectively.

  In addition, the setting device 110 generates and outputs random secret information sεS. The secret information s is input to the input units 121 and 131 of the security enhancing device 120 and the verification device 130 and stored in the storage units 122 and 132.

[Safety enhancement processing (Fig. 2A)]
Random number generation unit 123a of the safety reinforcement device 120 generates and outputs a random number ρ∈R _PKE (step S121). The key / key ciphertext generation unit 123b executes the key encryption algorithm Encaps (pp, pk; s) using the common parameter pp, the public key pk, and the secret information s, and the key (key information) k and the corresponding key Ciphertext c (first ciphertext) is output (step S122). The encryption unit 123c executes the encryption algorithm Enc (pp, ek, m; ρ) using the common parameter pp, the encryption key ek, the secret information s, and the random number ρ, and the ciphertext τ ( (Second ciphertext) is obtained and output (step S123). The proof generation unit 123d _receives the common parameter crs _NIZK , the character string x = (c, τ) corresponding to the ciphertext c, τ, and the evidence information (s, ρ) as the evidence w, and the prover The algorithm P (crs _NIZK , (c, τ), (s, ρ)) is executed, and proof information π, which is the proof, is obtained and output. An example of the character string x is a bit combination value of the bit string expression values of c and τ. An example of the evidence information (s, ρ) is a bit combination value of a bit string expression value of s, ρ. In addition, the binary relation B of the non-interactive zero knowledge proof is defined as follows.
B (x, w) = {((c, τ), (s, ρ)): ((c, *) = Encaps (pp, pk; s) ； (τ = Enc (pp, ek, s; ρ) )))}
Here, “*” represents a wild card (step S124). The output unit 124 outputs auxiliary information aux = (c, τ, π) including the ciphertext c, τ and the certification information π (step S125). The obtained key k is used as, for example, a common key for encryption in accordance with a common key cryptosystem (the same applies to the subsequent embodiments in which the above principle is applied to a cryptographic device).

[Verification procedure (Fig. 2B)]
The auxiliary information aux = (c, τ, π) is input to the input unit 131 of the verification device 130 and stored in the storage unit 132. The verification unit 133a _receives the common parameter crs _NIZK , the ciphertext c, τ, and the proof information π, _executes the verifier algorithm V (crs _NIZK , (c, τ), π), and uses the proof information π. Non-interactive zero knowledge proof verification is performed on the ciphertexts c and τ, and it is determined whether the verification result is yes (step S131). If the verification result is no, the output unit 137 outputs ⊥ (step S135), and the process ends. If the verification result is yes, the key ciphertext generation unit 133b executes the algorithm Encaps ₁ (pp, pk; s) using the common parameter pp, the public key pk, and the secret information s, and corresponds to the secret information s. A verification ciphertext c ′ is obtained and output (step S132). The ciphertext comparison unit 133c determines whether the ciphertext c and the verification ciphertext c ′ match (step S133). When it is determined that these do not match (c ≠ c ′), the output unit 137 outputs ⊥ (step S135), and the process ends. When it is determined that the ciphertext c and the verification ciphertext c ′ match (c = c ′), the key control unit 136 uses the common parameter pp and the secret information s, and uses the algorithm Encaps ₂ (pp; s). To obtain and output a key k ′ corresponding to the secret information s (step S134). The output unit 137 outputs the key (key information) k ′ (step S136) and ends the process. The output key k ′ is used as, for example, a common key for decryption in accordance with a common key cryptosystem (the same applies to the subsequent embodiments in which the above-described principle is applied to a cryptographic device).

Second Embodiment
A second embodiment will be described. In this embodiment, the above-described principle is applied to a public key type cryptographic device (Setup, Gen, C, X, Y, K, Ω). The security enhancing device of this embodiment generates auxiliary information using non-interactive zero knowledge proof (NIZK = (G, P, V)). The auxiliary information includes the public key corresponding to the secret information, the first ciphertext corresponding to the secret information, the second ciphertext corresponding to the secret information and the random number, and the first information using the secret information and the random number as evidence information. And proof information for performing non-interactive zero knowledge proof for the ciphertext and the second ciphertext. The verification device of this embodiment performs non-interactive zero knowledge proof verification for the first ciphertext and the second ciphertext using the proof information included in the auxiliary information, and the verification ciphertext and the first ciphertext corresponding to the secret information And the verification public key corresponding to the secret information and the public key match. Hereinafter, the same reference numerals are used for items common to those described so far, and description thereof is omitted.

[Constitution]
As illustrated in FIG. 1, the safety enhancement system 2 of this embodiment includes a setting device 210, a safety enhancement device 220, and a verification device 230. The setting device 210, the safety enhancing device 220, and the verification device 230 are special devices configured by reading a predetermined program into a general-purpose or dedicated computer, respectively. The setting device 210, the safety enhancing device 220, and the verification device 230 are configured to exchange information through a network, a portable recording medium, or the like.

  The security enhancement device 220 is, for example, a key generation device that obtains a key used for encryption or signature, or a part thereof (in the subsequent embodiments in which the above-described principle is applied to a public key type cryptographic device). The same applies to safety enhancing devices). The safety enhancing device 220 includes an input unit 121, a storage unit 122, an auxiliary information generation unit 223, and an output unit 224. The auxiliary information generation unit 223 includes a random number generation unit 123a, a key / key ciphertext generation unit 223b, an encryption unit 123c, a proof generation unit 123d, and a key pair generation unit 223e. The safety enhancing device 220 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 230 is, for example, a generation device that obtains a key used when decrypting a ciphertext or verifying a signature (the verification device according to the embodiments after applying the above-described principle to a public key cryptographic device). The same). The verification device 230 includes an input unit 131, a storage unit 132, a determination unit 233, a key control unit 236, and an output unit 237. The determination unit 233 includes a verification unit 133a, a key ciphertext generation unit 133b, a ciphertext comparison unit 133c, and a public key comparison unit 233d. The verification device 230 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
The common parameter pp generated in the setup process of the setting apparatus 210 according to the present embodiment is common to the public key type cryptographic device, the key encapsulation method, and the public key encryption method. The contents of other setup processes are the same as those of the setting device 110 of the first embodiment. The setting device 210 outputs the generated common parameter crs = (pp, pk, ek, crs _NIZK ) and secret information sεS. These are input to the input units 121 and 131 of the safety enhancing device 220 and the verification device 230 and stored in the storage units 122 and 132, respectively.

[Safety enhancement processing (Fig. 3A)]
After the random number generator 123a of the security enhancing device 220 executes the process of step S121 described in the first embodiment, the key / ciphertext generator 223b performs the process of step S122 described in the first embodiment as “k”. Is replaced with “r” (step S222), and then the encryption unit 123c and the proof generation unit 123d execute the processing of steps S123 and S124 described in the first embodiment. Next, the key pair generation unit 223e of the security enhancing device 220 receives the common parameter pp and the secret information s, executes the key generation algorithm key-extract (pp, s), and executes the public key p and the secret key k (key Information) and a key pair (p, k) are obtained and output. However, key-extract (pp, s) receives the common parameter pp and the secret information s, executes the key encapsulation algorithm Encaps ₂ (pp; s) to obtain the key r, and public key cryptography. The key generation algorithm Gen (pp; r) of the physical device is executed, and the secret key kεK and the public key p are obtained and output. However, instead of obtaining a new key r, the key r obtained in step S222 may be used in key-extract (pp, s) (step S224). The output unit 224 outputs auxiliary information aux = (p, c, τ, π) including the public key p, the ciphertext c, τ, and the certification information π (step S225). The obtained secret key k is used for encryption in accordance with, for example, a public key cryptosystem (the same applies to the subsequent embodiments in which the above-described principle is applied to a public key type cryptographic device).

[Verification procedure (Figure 3B)]
The auxiliary information aux = (p, c, τ, π) is input to the input unit 131 of the verification device 230 and stored in the storage unit 132. Thereafter, the processes in steps S131 to S133 and S135 are executed as described in the first embodiment. When it is determined in step S133 that the ciphertext c and the verification ciphertext c ′ match (c = c ′), the public key comparison unit 233d receives the common parameter pp and the secret information s as input, and generates a key generation algorithm key. -Extract (pp, s) is executed to obtain a key pair (p ', k') of the verification public key p 'and the secret key k' corresponding to the secret information (step S233). Furthermore, the public key comparison unit 233d determines whether or not the verification public key p ′ and the public key p match (step S234). If it is determined that they do not match (p ≠ p ′), the output unit 237 outputs ⊥ (step S135), and the process is terminated. On the other hand, when it is determined that the verification public key p ′ and the public key p match (p = p ′), the key control unit 236 sends the secret key k ′ to the output unit 237, and the output unit 237 k ′ (key information) is output (step S236), and the process ends. The output secret key k ′ is used, for example, for decryption in accordance with a public key cryptosystem or for signature generation (the same applies to the subsequent embodiments in which the above principle is applied to a public key cryptographic device).

<Third Embodiment>
A third embodiment will be described. This embodiment, cryptographic device (Setup, Gen, C, X , Y, K) as, and K = _{G T,} it is obtained by applying the above principles to those used bilinear mapping. In this embodiment, h, z, V and W is the group _{G K} source, g is generator of the group _{G K,} mapping H has difficulty ^{_{collision, e: G K 2 → G}} T is located in bilinear mapping , Secret information is s = h ^σ ∈ G _K for random number σ, key information includes e (z, s) ∈ G _T , and auxiliary information is X = g ^σ ∈ _{G K} and T _G = (V · W ^{H (X))} and a ^sigma ∈G _K. Verification device of the present embodiment, it is determined whether _{e (g, T G) ∈G} T and ^{e (X, V · W H} (X)) and ∈G _T coincide, e (g, s) ∈G _T and e (X, h) determining whether the ∈G _T coincide.

[Constitution]
As illustrated in FIG. 3, the safety enhancement system 3 of this embodiment includes a setting device 310, a safety enhancement device 320, and a verification device 330. The setting device 310, the safety enhancing device 320, and the verification device 330 are special devices configured by reading a predetermined program into a general-purpose or dedicated computer, respectively. The setting device 310, the safety enhancing device 320, and the verification device 330 are configured to exchange information through a network, a portable recording medium, or the like.

  The security enhancing device 320 includes an input unit 121, a storage unit 122, a random number generation unit 323, a secret information generation unit 324, a key generation unit 325, an auxiliary information generation unit 326, and an output unit 327. The auxiliary information generation unit 326 includes group calculation units 326a and 326b. The safety enhancing device 320 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 330 includes an input unit 131, a storage unit 132, a determination unit 333, a key control unit 336, and an output unit 337. The determination unit 333 includes comparison units 333a and 333b. The verification device 330 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
The setting device 310 executes a setup algorithm Setup (1 ^κ ) with the security parameter (1 ^κ ) as an input, and a map H having collision difficulty with G _K , G _T , q, e, g as a common parameter pp: G _K → Z _q and obtain pp = (G _K , G _T , q, e, g, H). An example of the mapping H is a cryptographic hash function such as SHA-1. The setting device 310 randomly selects elements h, z, V, and WεG _K of the group G _K , and outputs crs = (pp, h, z, V, W). The common parameter crs is input to the input units 121 and 131 of the safety enhancing device 320 and the verification device 330 and stored in the storage units 122 and 132, respectively.

[Safety enhancement processing (Fig. 5A)]
The random number generation unit 323 of the safety enhancing device 320 selects and outputs the random number σεZ _q with pp as an input (step S321). The secret information generating unit 324, pp, as input sigma, and outputs the obtained secret information s = h ^σ ∈G _K for random sigma (step S322). The key generation unit 325, pp, z, as input s, secret key (key information) k = e (z, s ) generates ∈G _T and outputs (step S323). Group operation section 326a is, pp, X = g to give a ^sigma ∈G _K outputs as inputs the sigma (step S324). The group calculation unit 326b receives and outputs T _G = (V · W ^{H (X)} ) ^σ ∈ G _K with pp, X, and σ as inputs (step S325). The output unit 327, the auxiliary information aux = (X, _{T G)} and outputs the secret information s including the X and _{T G} (step S326).

[Verification procedure (Fig. 5B)]
The auxiliary information aux = (X, T _G ) and the secret information s are input to the input unit 131 of the verification device 330 and stored in the storage unit 132. Comparing unit 333a includes, pp, determines as input _{aux, e (g, T G} ) ∈G T and ^{e (X, V · W H} (X)) and ∈G _T match (Step S331) . When it is determined that they do not match (e (g, T _G ) ≠ e (X, V · ^{WH (X)} )), the output unit 337 outputs ⊥ (step S135), and the process ends. When it is determined that e (g, T _G ) and e (X, V · W ^{H (X)} ) match (e (g, T _G ) = e (X, V · W ^{H (X)} )) , comparison unit 333a includes, pp, as input s, determine e (g, s) ∈G _T and e (X, h) and ∈G _T match (step S332). When it is determined that they do not match (e (g, s) ≠ e (X, h)), the output unit 337 outputs ⊥ (step S135), and the process ends. When it is determined that e (g, s) and e (X, h) match (e (g, s) = e (X, h)), the key control unit 336 receives pp, z, and s as inputs. generates a secret key (key information) k '= e (z, s) ∈G T ( step S334), the output unit 337 outputs the key k (step S336).

<Fourth embodiment>
A fourth embodiment will be described. This embodiment, the public key type cryptographic device (Setup, Gen, C, X , Y, K, Ω) as, and K = _{G T,} obtained by applying the above principles to those used bilinear mapping is there. In this embodiment, h, z, V and W is the group _{G K} source, g is generator of the group _{G K,} mapping H has difficulty ^{_{collision, e: G K 2 → G}} T is located in bilinear mapping , S = h ^σ ∈ G _K for the random number σ, the key information includes e (z, s) ∈ G _T , and the auxiliary information is the public key corresponding to the secret information s and X = g ^σ ∈ G _K and ^{_{T G = (V · W H}} (X)) and a ^sigma ∈G _K. Verification device of the present embodiment, it is determined whether _{e (g, T G) ∈G} T and ^{e (X, V · W H} (X)) and ∈G _T coincide, e (g, s) ∈G _T and e (X, h) or to determine the ∈G _T match, further determines whether the verification public key corresponding to the secret information and the public key matches.

[Constitution]
As illustrated in FIG. 4, the safety enhancement system 4 of this embodiment includes a setting device 410, a safety enhancement device 420, and a verification device 430. The setting device 410, the safety enhancing device 420, and the verification device 430 are special devices configured by reading a predetermined program into a general-purpose or dedicated computer, respectively. The setting device 410, the safety enhancing device 420, and the verification device 430 are configured to be able to exchange information through a network, a portable recording medium, or the like.

  The security enhancing device 420 includes an input unit 121, a storage unit 122, a random number generation unit 323, a secret information generation unit 324, an auxiliary information generation unit 426, and an output unit 427. The auxiliary information generation unit 426 includes a key generation unit 426c and group calculation units 326a and 326b. The safety enhancing device 420 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 430 includes an input unit 131, a storage unit 132, a determination unit 433, a key control unit 436, and an output unit 437. The determination unit 433 includes comparison units 333a and 333b and a public key comparison unit 433c. The verification device 430 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
In addition to the common parameter pp of the third embodiment, the setting device 410 according to the present embodiment further generates common parameters of the public key type cryptographic device, and sets them as the common parameters pp so that the common parameters crs = (pp, h, V, W). The contents of the other setup processes are the same as those of the setting device 310 of the third embodiment. The setting device 410 outputs crs = (pp, h, V, W), and the common parameter crs is input to the input units 121 and 131 of the safety enhancing device 420 and the verification device 430, respectively, and the storage units 122 and 132 are stored. Stored in

[Safety enhancement processing (Fig. 6A)]
The random number generation unit 323 and the secret information generation unit 324 of the security enhancing device 420 execute the processes of steps S321 and S322 described in the third embodiment. The key generation unit 426c receives the common parameter pp and the secret information s, executes the key generation algorithm key-extract (pp, s), and sets the public key p and the secret key k (key information) corresponding to the secret information s. The key pair (p, k) is obtained and output (step S423). Thereafter, the same processes as steps S324 and S325 described in the third embodiment is executed, the output portion 427, auxiliary information including the p and X and _{T G aux = (p, X} , T G) and secret information s Is output (step S426).

[Verification procedure (Fig. 6B)]
The auxiliary information aux = (p, X, T _G ) and the secret information s are input to the input unit 131 of the verification device 430 and stored in the storage unit 132. Thereafter, the processes in steps S331, 332, and S135 are executed as described in the third embodiment. When it is determined in step S332 that e (g, s) and e (X, h) match (e (g, s) = e (X, h)), the public key comparison unit 433c uses the common parameter pp. And secret information s as inputs, and a key generation algorithm key-extract (pp, s) is executed, and a key pair (p of the verification public key p ′ corresponding to the secret information s and the secret key k ′ (key information)) ', K'). The public key comparison unit 433c determines whether the verification public key p ′ and the public key p match (step S434). When it is determined that the verification public key p ′ and the public key p do not match (p ≠ p ′), the output unit 437 outputs ⊥ (step S135), and the process ends. When it is determined that the verification public key p ′ and the public key p match (p = p ′), the key control unit 436 sends the secret key k ′ to the output unit 437, and the output unit 437 sends the secret key k ′. (Key information) is output (step S436), and the process ends.

<Fifth Embodiment>
A fifth embodiment will be described. Also in this embodiment, the above-described principle is applied to a public key type cryptographic device (Setup, Gen, C, X, Y, K, Ω) using a bilinear mapping. However, in this embodiment, diverting a part of the auxiliary information ^aux X = g σ ∈G _K as the public key p. That is, the public key p of this embodiment includes a X = g ^sigma is a part of the auxiliary information aux, secret key k corresponding thereto (key information) includes secret information s = h σ ∈G _^K. Thereby, the size of the auxiliary information aux can be made smaller than that in the fourth embodiment.

[Constitution]
As illustrated in FIG. 7, the safety enhancement system 5 of this embodiment includes a setting device 510, a safety enhancement device 520, and a verification device 530. The setting device 510, the safety enhancing device 520, and the verification device 530 are special devices configured by reading a predetermined program into a general-purpose or dedicated computer, respectively. The setting device 510, the safety enhancing device 520, and the verification device 530 are configured to be able to exchange information through a network, a portable recording medium, or the like.

  The security enhancing device 520 includes an input unit 121, a storage unit 122, a random number generation unit 323, a secret information generation unit 324, an auxiliary information generation unit 526, and an output unit 527. The auxiliary information generation unit 526 includes group calculation units 326a and 326b. The safety enhancing device 520 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 530 includes an input unit 131, a storage unit 132, a determination unit 333, a key control unit 536, and an output unit 537. The verification device 530 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
The setting device 510 of this embodiment generates the same common parameter pp = (G _K , G _T , q, e, g, H) as in the third embodiment, and the common parameter crs = (pp, h, V, W). Get. The setting device 510 outputs crs = (pp, h, V, W). The crs is input to the input units 121 and 131 of the safety enhancing device 520 and the verification device 530 and stored in the storage units 122 and 132, respectively.

[Safety enhancement processing (Fig. 8A)]
The random number generation unit 323 and the secret information generation unit 324 of the security enhancing device 520 execute the processes of steps S321 and S322 described in the third embodiment. However, the secret information s obtained in step S322 functions as a secret key (key information). Thereafter, the group calculation unit 326a and 326b of the auxiliary information generation unit 526 executes the processing of steps S324 and S325 described in the third ^embodiment, X = g σ ∈G _K and ^{_{T G = (V · W H}} ( ^X) ) Obtain and output ^σ ∈ G _K. However, the output unit 524, the auxiliary information aux = (X, _{T G)} containing the X and _{T G} and outputs the secret information s. However, X is not only used as auxiliary information, but also used as a public key for encryption processing and the like (step S326).

[Verification procedure (Fig. 8B)]
The auxiliary information aux = (X, T _G ), the secret information s, and the message x to be encrypted are input to the input unit 131 of the verification device 530 and stored in the storage unit 132. Thereafter, the processes in steps S331, 332, and S135 are executed as described in the third embodiment. When it is determined in step S332 that e (g, s) and e (X, h) match (e (g, s) = e (X, h)), the key control unit 536 stores the secret information s. Using the secret key k ′, the ciphertext C _PP (s, x) (information obtained from the key information) for the message x is obtained (step S534), and the output unit 537 outputs the ciphertext C _PP (s, x). (Step S536), the process ends. Incidentally, to obtain a ciphertext _C PP (s, x) in step S534, instead of outputting the ciphertext _C PP (s, x) in step S536, secret information s is a secret key k 'in step S534, step In S536, the secret key k ′ (key information) may be output.

<Sixth Embodiment>
A sixth embodiment will be described. Also in this embodiment, the above-described principle is applied to a public key type cryptographic device (Setup, Gen, C, X, Y, K, Ω) using a bilinear mapping. However, in this embodiment, Waters ID-based encryption is used as a public key type cryptographic device, and further auxiliary information aux X = g ^σ ∈ _{G K} and T _G = (V · W ^{H (X)} ) ^σ ∈ G _K the diverted as a master public key mpk, using the secret information ^s = h σ ∈G _K as a master secret key (key information) msk. Thereby, the size of the auxiliary information aux can be made smaller than that in the fourth embodiment.

[Constitution]
As illustrated in FIG. 7, the safety enhancement system 6 of this embodiment includes a setting device 610, a safety enhancement device 520, and a verification device 630. The verification device 630 is a special device configured by reading a predetermined program into a general-purpose or dedicated computer. The setting device 610, the safety enhancing device 520, and the verification device 630 are configured to exchange information through a network, a portable recording medium, or the like.

  The verification device 630 includes an input unit 131, a storage unit 132, a determination unit 333, a key control unit 636, and an output unit 637. The verification device 630 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
Setting device 610 of this embodiment, the same common parameters _pp = the third embodiment _{(G K, G T, q} , e, g, H) to generate, _Y 0 random addition from the group _{G K, Y} 1, .., Y _n εG _K is selected, and common parameters crs = (pp, h, V, W, Y ₀ , Y ₁ ,..., Y _n ) are obtained. However, n is a positive integer. The setting device 610 outputs crs = (pp, h, V, W, Y ₁ ,..., Y _n ), and crs is input to the input units 121 and 131 of the safety enhancing device 620 and the verification device 630, respectively. The data is input and stored in storage units 122 and 132.

[Safety enhancement processing]
The safety enhancement process of this embodiment is the same as that of the fifth embodiment. However, X = g ^σ and T _G = (V · W ^{H (X)} ) ^σ function as a master public key mpk, and secret information s = h ^σ functions as a master secret key (key information) msk. The master public key mpk is used to generate a public key corresponding to ID = (ID ₁ ,..., ID _n ) ∈ {0, 1} ⁿ , and the master secret key msk is used to generate a secret key corresponding to ID. Used.

とする（ステップＳ６３４）。出力部６３７は秘密鍵ｋ’を出力し（ステップＳ６３６）、処理を終える。 [Verification procedure (Figure 9)]
The auxiliary information aux = (X, T _G ), the secret information s, and the ID are input to the input unit 131 of the verification device 530 and stored in the storage unit 132. Thereafter, the processes in steps S331, 332, and S135 are executed as described in the third embodiment. When it is determined in step S332 that e (g, s) and e (X, h) match (e (g, s) = e (X, h)), the key control unit 636 sets the common parameter pp to Master secret key (key information) msk = s and ID are input, random number dεZ _q is generated, and secret corresponding to ID = (ID ₁ ,..., ID _n ) ε {0, 1} ⁿ A key k ′ = dk _ID (information obtained from key information) is generated as follows.
k ′ = dk _ID = (g ^d , s · (WatH (ID)) ^d ) ∈G _K ²
However, WatH (ID)

(Step S634). The output unit 637 outputs the secret key k ′ (step S636) and ends the process.

<Seventh embodiment>
A seventh embodiment will be described. Also in this embodiment, the above-described principle is applied to a public key type cryptographic device (Setup, Gen, C, X, Y, K, Ω) using a bilinear mapping. However, in this embodiment, a variant of the Boyen-Mei-Waters key encapsulation method is used as a public key type cryptographic device. The auxiliary information in this embodiment includes R = h ^ρ and T = (v · w ^{H (R)} ) ^ρ in addition to X = g ^σ and T _G = (V · W ^{H (X)} ) ^σ . However, v, w is the original group G _K, ρ is a random number. The form verification apparatus determines whether e (g, T _G ) and e (X, V · W ^{H (X)} ) match, and e (g, s) and e (X, h) are It is determined whether they match, and further, it is determined whether e (g, T) and e (R, v · w ^{H (R)} ) match.

[Constitution]
As illustrated in FIG. 7, the safety enhancement system 7 of this embodiment includes a setting device 710, a safety enhancement device 720, and a verification device 730. The setting device 710, the safety enhancing device 720, and the verification device 730 are special devices configured by reading a predetermined program into a general-purpose or dedicated computer, respectively. The setting device 710, the safety enhancing device 720, and the verification device 730 are configured to be able to exchange information through a network, a portable recording medium, or the like.

  The security enhancing device 720 includes an input unit 121, a storage unit 122, a random number generation unit 323, a secret information generation unit 324, an auxiliary information generation unit 726, a key generation unit 725, and an output unit 727. The auxiliary information generation unit 726 includes group calculation units 326a, 326b, 726d, and 726e and a random number generation unit 726c. The safety enhancing device 720 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 122 and is read by each unit as necessary.

  The verification device 530 includes an input unit 131, a storage unit 132, a determination unit 733, a key control unit 736, and an output unit 737. The determination unit 733 includes comparison units 333a, 333b, and 733c. The verification device 730 executes each process under the control of a control unit (not shown). Data obtained by each unit is stored in the storage unit 132 and read by each unit as necessary.

[Setup process]
Setting device 710 of this embodiment, the same common parameters _pp = the third embodiment _{(G K, G T, q} , e, g, H) to generate the same pp third embodiment, h, V, W In addition, the elements v, wεG _K are selected at random, and the common parameter crs = (pp, h, V, W, v, w) is obtained. The common parameter crs is input to the input units 121 and 131 of the safety enhancing device 720 and the verification device 730 and stored in the storage units 122 and 132, respectively.

[Safety enhancement processing (Fig. 10A)]
The random number generation unit 323 and the secret information generation unit 324 of the security enhancing device 720 execute the processing of steps S321 and S322 described in the third embodiment, and the group calculation units 326a and 326b described in the third embodiment. Steps S324 and S325 are executed. Next, the random number generation unit 726c selects and outputs the second random number ρεZ _q with pp as an input (step S721). The group calculation unit 726d receives pp and ρ, and obtains and outputs R = g ^ρ ∈ G _K for the random number ρ (step S722). The group calculation unit 726e receives pp, v, w, R, and ρ, and obtains and outputs T = (v · w ^{H (R)} ) ^ρ ∈ G _K (step S723). The key generation unit 725 receives pp, X, h, and ρ, and obtains and outputs a key (key information) k = e (X, h) ^ρ ∈ G _K. The output unit 727, the auxiliary information aux = containing X and _{T G} R and _{T (X, T G, R} , T) were ciphertext, and outputs the corresponding auxiliary information aux the key k and the secret information s (Step S726).

[Verification procedure (FIG. 10B)]
The auxiliary information aux = (X, T _G , R, T), the key k, and the secret information s are input to the input unit 131 of the verification device 730 and stored in the storage unit 132. Thereafter, the processes in steps S331, 332, and S135 are executed as described in the third embodiment. When it is determined in step S332 that e (g, s) and e (X, h) match (e (g, s) = e (X, h)), the comparison unit 733c determines that e (g, T) ) ∈G _T and ^{e (R, v · w H} (R)) determines the ∈G _T match (step S733). When it is determined that they do not match (e (g, T) ≠ e (R, v · w ^{H (R)} )), the output unit 737 outputs ⊥ (step S135), and the process ends. When it is determined that e (g, T) and e (R, v · w ^{H (R)} ) match (e (g, T) = e (R, v · w ^{H (R)} )), the key control unit 736, pp, an input R, the s, the key (key information) k '= e (R, s) to obtain ∈G _T output, the output unit 737 is a key k' to output a.

<Other variations, etc.>
In addition, this invention is not limited to the above-mentioned embodiment. For example, a plurality of safety enhancing devices and verification devices may exist. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  When the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  This program is distributed, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads a program stored in its own recording device and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and each time the program is transferred from the server computer to the computer. The processing according to the received program may be executed sequentially.

  In the above embodiment, the processing functions of the apparatus are realized by executing a predetermined program on a computer. However, at least a part of these processing functions may be realized by hardware.

1-7 Safety Enhancement System 110-710 Setting Device 120-720 Safety Enhancement Device 130-730 Verification Device

Claims (10)

A storage unit for storing secret information corresponding to the secret key information, the auxiliary information generation unit for outputting with the aid information with a specific relationship with respect to the secret information, and safety-enhancing device including,
A determination unit that determines whether the input auxiliary information has the specific correspondence with the secret information, and corresponds to the secret information when the auxiliary information has the correspondence with the secret information And a key control unit that obtains secret key information to be obtained or information obtained from the key information, and outputs information indicating rejection when the auxiliary information does not have the corresponding relationship with the secret information. And having
It is difficult to specify related auxiliary information having the corresponding relationship with respect to related secret information different from the secret information from the auxiliary information.
Safety enhancement system characterized by that. The safety enhancement system of claim 1,
The auxiliary information includes a first ciphertext corresponding to the secret information, a second ciphertext corresponding to the secret information and a random number, and the first ciphertext and the secret information and the random number as evidence information. and certification information for the non-interactive zero-knowledge proof for a second cipher text, only including,
The determination unit is
A verification unit that performs non-interactive zero-knowledge proof verification for the first ciphertext and the second ciphertext using the proof information;
A ciphertext comparison unit that determines whether the verification ciphertext corresponding to the secret information matches the first ciphertext,
Safety enhancement system characterized by that. The safety enhancement system of claim 1,
h, z, V and W is the group G _K source, g is generator of the group G _K, mapping H has difficulty collision, e is bilinear mapping,
The secret information is a s = h ^σ for the random number σ,
The key information includes e (z, s);
Wherein the auxiliary information ^is, X = g σ and ^{_{T G = (V · W H}} (X)) viewed contains a ^sigma,
The determination unit is
a first comparison unit that determines whether e (g, T _G ) and e (X, V · ^{WH (X)} ) match;
e (g, s) and e (X, h) and safety enhancement system in which the second comprises a comparing unit, and it is characterized in determining whether the match. The safety enhancement system according to claim 2 or 3,
The auxiliary information, further, only contains a public key corresponding to the secret information,
The determination unit further includes a public key comparison unit that determines whether the verification public key corresponding to the secret information matches the public key;
Safety enhancement system characterized by that. The safety enhancement system of claim 1,
h, V and W is the group G _K source, g is generator of the group G _K, mapping H has difficulty collision, e is bilinear mapping,
The secret information is a s = h ^σ for the random number σ,
The key information includes s;
Wherein the auxiliary information ^is, X = g σ and ^{_{T G = (V · W H}} (X)) viewed contains a ^sigma,
The determination unit is
a first comparison unit that determines whether e (g, T _G ) and e (X, V · ^{WH (X)} ) match;
e (g, s) and e (X, h) and safety enhancement system in which the second comprises a comparing unit, and it is characterized in determining whether the match. The safety enhancement system according to claim 5,
v, w , R and T are members of said group G _K ;
Wherein the auxiliary information further, R = h ^[rho and T = for the second random number ^{ρ (v · w H (R} )) viewed contains a ^[rho,
The determination unit includes a third comparison unit that determines whether e (g, T) and e (R, v · w ^{H (R)} ) match.
Safety enhancement system characterized by that.   The safety enhancing device in the safety enhancing system according to any one of claims 1 to 6.   The verification apparatus in the safety enhancement system in any one of Claim 1 to 6. A program for causing a computer to function as the safety enhancing device according to claim 7 . A program for causing a computer to function as the verification device according to claim 8 .

Images