JP6075785B2 - Cryptographic communication system, cryptographic communication method, program - Google Patents

Description

  The present invention relates to a public key cryptosystem, and more particularly to a cryptographic communication system, a cryptographic communication method, and a program that realize RKA-KDM-CCA security.

  In this specification, the security of ciphertext of key-dependent plaintext is called KDM security, and the security against related key attacks is called RKA security. The security of the ciphertext of the key-dependent plaintext in the related key attack environment is called RKA-KDM security. Moreover, just because KDM is safe and RKA is safe does not mean it is RKA-KDM safe.

  There are theoretical and practical applications for encrypting plaintext that depends on the secret key. A theoretical application is automatic verification of protocols using cryptography. If a protocol that passes automatic verification uses a KDM secure encryption method, security is ensured in a cryptographic sense. A practical application is disk encryption. For example, BitLocker, a disk encryption software, sometimes encrypts the private key itself. To ensure this safety, KDM safety is necessary. As a past study of KDM secure encryption method, there is Non-Patent Document 1. The security of key-dependent plaintext in an environment where a decryption oracle exists is called KDM-CCA security. As the KDM-CCA secure public key cryptosystem, the Camenisch, Chandran, Shoup system (Non-patent Document 2) and the Hofheinz system (Non-patent Document 3) are known. Also, as the RKA-KDM-CPA secure common key encryption method, the Applebaum method (Non-Patent Document 4) and the Bohl, Davies, Hofheinz method (Non-Patent Document 5) are known.

Isamu Teranishi. Survey of key dependent message (KDM) security. IEICE Fundamentals Review, 6 (1): 26-36, 2012. Jan Camenisch, Nisanth Chandran, and Victor Shoup.A public key encryption scheme secure against key dependent chosen plaintext and adaptive chosen ciphertext attacks.In Antoine Joux, editor, EUROCRYPT 2009, volume 5479 of LNCS, pages 351-368.Springer, Heidelberg, 2009. Dennis Hofheinz. Circular chosen-ciphertext security with compact ciphertexts.In Thomas Johansson and Phong Q.Nguyen, editors, EUROCRYPT 2013, volume 7881 of LNCS, pages 520-536.Springer, Heidelberg, 2013. Benny Applebaum. Garbling XOR gates “for free” in the standard model. In Amit Sahai, editor, TCC2013, volume 7785 of LNCS, pages 162-181. Springer, Heidelberg, 2013. See also http://eprint.iacr.org / 2012/516. Florian Bohl, Gareth T. Davies, and Dennis Hofheinz. RKA-KDM secure encryption from public-key encryption. Cryptology ePrint Archive, Report 2013/653, 2013. Available at http://eprint.iacr.org/2013/653.

  While RKA-KDM-CPA is a secure common key encryption method, Non-Patent Document 5 is known, but RKA-KDM-CCA secure public key encryption method has not been studied so far. Was also unknown. Accordingly, an object of the present invention is to provide a cryptographic communication system, a cryptographic communication method, and a program that realize an RKA-KDM-CCA secure public key cryptosystem.

  The cryptographic communication system of the present invention includes a parameter device, a key generation device, an encryption device, and a decryption device.

  The parameter device includes a condition parameter setting unit, an RSA modulus generation unit, a random generation source setting unit, and a parameter generation unit. The condition parameter setting unit sets a condition parameter indicating the length of the composite number, the number of messages, and the length of the filter prime. The RSA modulus generation unit receives the security parameter and generates a composite number of the first and second Bram prime numbers and the RSA modulus. The random generator setting unit includes a first sub-group for random numbers, which is a sub-group of a predetermined order, out of a set that is less than the third power of the composite number and is relatively prime to the third power of the composite number. The second random generation source is set. The parameter generation unit receives the security parameter and generates a filter key and a trap door.

  The key generation device includes a secret key parameter selection unit, a public key parameter calculation unit, a public key generation unit, and a secret key generation unit. The secret key parameter selection unit randomly selects the first, second, third, and fourth secret key parameters from the plaintext space. The public key parameter calculation unit calculates the first and second public key parameters based on the first and second random generators and the first, second, third, and fourth secret key parameters. The public key generation unit generates a public key from the first and second public key parameters. The secret key generation unit generates a secret key from the first, second, third, and fourth secret key parameters.

  The encryption apparatus includes a random number selection unit, a signature key generation unit, a common key selection unit, a tag setting unit, a first intermediate ciphertext calculation unit, a second intermediate ciphertext calculation unit, and a check ciphertext calculation. Part, a masked ciphertext calculation part, a common key encryption part, a signature part, and a ciphertext generation part. The random number selection unit randomly selects the first and second random numbers from a set of numbers less than a quarter of the combined number. The signature key generation unit receives a security parameter and generates a verification key and a signature key, which are a disposable signature key pair. The common key selection unit randomly selects a common key that is a random key for common key encryption. The tag setting unit assumes that the tag includes a core tag and an auxiliary tag, uses the verification key as an auxiliary tag, and randomly selects the core tag from the tag space. The first intermediate ciphertext calculation unit calculates a pair of first intermediate ciphertexts based on the first random number and the first and second random generators. The second intermediate ciphertext calculation unit calculates a pair of second intermediate ciphertexts based on the second random number and the first and second random generators. The check ciphertext calculation unit calculates a check ciphertext based on the first and second public key parameters, the verification key, the first random number, and the composite number. The masked ciphertext calculation unit calculates a masked ciphertext based on the first and second public key parameters, the verification key, the first and second random numbers, the composite number, the common key, and the message. The common key encryption unit encrypts the filter value of the lossy algebra filter of the message converted for filter input with the common key to generate a common key ciphertext. The signature unit generates a disposable signature of the public key, the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag using the signature key. The ciphertext generation unit generates a ciphertext including a pair of first and second intermediate ciphertexts, a check ciphertext, a masked ciphertext, a common key ciphertext, a core tag, a verification key, and a disposable signature.

  The decryption device includes a falsified public key calculation unit, a verification unit, a verification result confirmation unit, a check ciphertext confirmation unit, a mask key calculation unit, a mask decryption result confirmation unit, a converted plaintext calculation unit, a message A confirmation unit, a tag generation unit, a common key decryption unit, a decryption result confirmation unit, and a message output unit are included. The falsified public key calculation unit performs the first and second random generation sources based on the first, second, third, and fourth falsified secret key parameters that are parameters that may have been falsified. Calculate the falsified public key parameter and calculate the falsified public key. The verification unit verifies a message composed of the falsified public key, the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag using the verification key and the disposable signature. Output the verification result. The verification result confirmation unit confirms the verification result, outputs the verification result if the verification result is a verification success, and outputs a reject symbol if the verification is a failure, and stops the processing. The check ciphertext confirming unit calculates whether the check ciphertext is calculated by using the first intermediate ciphertext pair, the first, second, third, and fourth falsified secret key parameters, the verification key, and the composite number. If it is a true value, if it is a true value, a check ciphertext is output, otherwise a reject symbol is output and the process is stopped. The mask key calculation unit calculates a mask key from the first and second intermediate ciphertext pairs, the first, second, third, and fourth falsified secret key parameters and the verification key. The mask decryption result confirmation unit obtains the mask decryption result by decrypting the masked ciphertext using the mask key, and is a set of only the numbers that are less than the third power of the composite number and relatively prime to the third power of the composite number Check whether the mask decryption result belongs to the plaintext subgroup which is the subgroup whose order is the square of the composite number. If so, output the mask decryption result; otherwise, reject Outputs a symbol and stops processing. The converted plaintext calculation unit performs logarithmic calculation on the mask decryption result to calculate the converted plaintext, and obtains a message. The message confirmation unit confirms whether or not the message belongs to the plaintext space. If the message belongs, the message confirmation unit outputs a message. Otherwise, the message confirmation unit outputs a reject symbol and stops the processing. The tag generation unit generates a tag from the auxiliary tag and the core tag using the verification key as an auxiliary tag. The common key decryption unit decrypts the common key ciphertext using the common key and outputs a decryption result. The decoding result confirmation unit confirms whether or not the decoding result is equal to the filter value, and outputs a message if they are equal, otherwise outputs a reject symbol and stops the processing. The message output unit outputs a message when a reject symbol is not output during operation of each unit of the decoding device.

  According to the cryptographic communication system of the present invention, an RKA-KDM-CCA secure public key cryptosystem can be realized.

The block diagram which decomposes | disassembles and shows the lossy algebra filter algorithm of a prior art to the component of an apparatus. FIG. 2 is a block diagram showing a prior art RSA modulus generation algorithm as a component of the apparatus. The block diagram which decomposes | disassembles and shows the common key encryption algorithm of a prior art to the component of an apparatus. The block diagram which decomposes | disassembles and shows the disposable signature algorithm of a prior art to the component of an apparatus. BRIEF DESCRIPTION OF THE DRAWINGS The figure which shows the outline of the encryption communication system of Example 1 of this invention. The figure which shows the outline of the encryption communication system of the modification of Example 1 of this invention. The block diagram which shows the structure of the parameter apparatus of Example 1 of this invention. The flowchart which shows operation | movement of the parameter apparatus of Example 1 of this invention. 1 is a block diagram illustrating a configuration of a key generation device according to a first embodiment of the present invention. The flowchart which shows operation | movement of the key generation apparatus of Example 1 of this invention. 1 is a block diagram illustrating a configuration of an encryption device according to a first embodiment of the present invention. 5 is a flowchart showing the operation of the encryption apparatus according to the first embodiment of the present invention. 1 is a block diagram showing a configuration of a decoding device according to Embodiment 1 of the present invention. 5 is a flowchart showing the operation of the decoding apparatus according to the first embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

≪Preparation≫
Before discussing the first embodiment, this section describes terms used in the following. In the following, κ∈N is a security parameter.

<Lossy Algebraic Filter, LAF>
(l _LAF , n) -LAF is a family of functions determined by the filter key fpk and the tag t. l _LAF is the length parameter of the prime p for filtering, and n is the number of messages. Therefore, the filter prime p is a prime number of l _LAF bits, Z ⁿ _p is an n-dimensional vector space of Z _p elements, and n messages X = (X ₁ ,..., X _n ) ∈Z ⁿ _p And the filter value LAF _{fpk, t} (X) of the lossy algebra filter as an output. There are injective and lossy tags. The tag t can be divided into t = (t _a , t _c ). In particular, t _c is called _a core tag and t _a is called an auxiliary tag.

  The lossy algebra filter algorithm consists of a set of four algorithms. Specifically, LAF = (FGen, FEval, TagSample, FTag) is expressed. Hereinafter, each algorithm of the lossy algebra filter algorithm will be described with reference to FIG. FIG. 1 is a block diagram illustrating a prior art lossy algebraic filter algorithm broken down into device components. As shown in FIG. 1, the lossy algebra filter algorithm is executed by each of a parameter generation unit (FGen) 51, a function evaluation unit (FEval) 52, a tag sampling unit (TagSample) 53, and a lossy tag sampling unit (FTag) 54. It is a general term for algorithms to perform. In this specification, the name of an algorithm such as FGen is written in parentheses after the name of each corresponding component.

<Parameter generation unit (FGen) 51>
The parameter generation unit (FGen) 51 receives the security parameter 1 ^κ and outputs (filter key, trapdoor) = (fpk, ftd). The filter key fpk includes a prime number p of l _LAF (κ) bits and a description of a tag space T = {0,1} ^* × T _c . T _c is a set of all core tags. If you use trapdoor ftd, you can sample lossy tags.

<Function Evaluation Unit (FEval) 52>
The function evaluation unit (FEval) 52 receives the filter key fpk, the tags tεT, and XεZ ⁿ _p, and outputs the filter value LAF _{fpk, t} (X) of the lossy algebra filter.

<Tag sampling unit (TagSample) 53>
Tag sampling unit (TagSample) 53 is a filter key fpk as input, samples the core tags t _c ∈T _c. At this time, an injective tag is sampled with an overwhelming probability as the core tag t _c .

<Lossy Tag Sampling Unit (FTag) 54>
The lossy tag sampling unit (FTag) 54 receives the trap door ftd and the auxiliary tag t _a ε {0,1} ^* , and the core tag t _c εT such that the tag t = (t _a , t _c ) becomes lossy. Sample _c . See Non-Patent Document 3 for the specific configuration method of this algorithm.

<RSA modulus generation algorithm>
Hereinafter, the RSA modulus generation algorithm will be described with reference to FIG. FIG. 2 is a block diagram illustrating the prior art RSA modulus generation algorithm as a component of the apparatus. As shown in FIG. 2, the RSA modulus generation algorithm means an algorithm executed by the RSA modulus generation unit (GenN) 6. The RSA modulus generator (GenN) 6 receives the security parameter 1 ^κ , generates 1 _N- bit first and second Blum prime numbers P and Q, and outputs a composite number N = PQ. l _N is a length parameter of the composite number N.

<Properties of RSA modulus>
For the composite number N output by the RSA modulus generator (GenN) 6, a set of only prime numbers that are relatively prime to the third power of the composite number N (N ³ ) in the range of 0 to N ³ -1 (less than N ³ ) Is

think of. The order of this group is φ (N ³ ) = N ² · φ (N). Since P and Q are odd prime numbers, φ (N) / 4 = (P-1) (Q-1) = 4 is a positive integer. N ² and φ (N) / 4 divide φ (N ³ ) and have their respective orders

There are subgroups. G _rnd

Represents a subgroup of order φ (N) / 4. G _rnd is also referred to as a random number subgroup. G _msg is

It represents a subgroup of order N ^2. G _msg is also referred to as a plaintext subgroup. The generator h of G _msg is defined as h = 1 + N mod N ³ . At this time, the cyclic group generated by the generating element h of G _msg <h> is equal to the plaintext for subgroup G _msg. In this group, the discrete logarithm can be easily solved. Given N, h, X = h ^x ∈G _msg ,

There is an efficient algorithm for obtaining the above (Reference Non-Patent Document 1).
(Reference Non-Patent Document 1: Ivan Damgard and Mads Jurik. A generalization, a simplification and some applications of Paillier's probabilistic public-key system. In Kwangjo Kim, editor, PKC2001, volume 1992 of LNCS, pages 119-136. Springer, Heidelberg , 2001.)

<Common key encryption algorithm>
IND-CPA secure and key-unique common key encryption is used as the common key encryption algorithm. The common key encryption algorithm consists of two algorithms (E, D). Hereinafter, each algorithm of the conventional common key encryption algorithm will be described with reference to FIG. FIG. 3 is a block diagram showing a conventional common key encryption algorithm broken down into the components of the apparatus. As shown in FIG. 3, the common key encryption algorithm means a generic name of algorithms executed by each of the common key encryption unit (E) 71 and the common key decryption unit (D) 72. The common key encryption unit (E) 71 receives the common key Kε {0,1} ^κ and the plaintext M, and outputs a ciphertext C. The common key decryption unit (D) 72 receives the common key Kε {0,1} ^κ and the ciphertext C, and outputs a plaintext M or a reject symbol (⊥). The key-unique common key encryption algorithm (E, D) means that for any ciphertext C, D (K, C) ≠ ⊥ is at most one common key K.

<Disposable signature algorithm>
The prior art disposable signature algorithm consists of three algorithms (OGen, OSign, OVrfy). Hereafter, each algorithm of the disposable signature algorithm of a prior art is demonstrated with reference to FIG. FIG. 4 is a block diagram showing the disposable signature algorithm of the prior art disassembled into the components of the apparatus. As shown in FIG. 4, the conventional disposable signature algorithm means a generic name of algorithms executed by the signature key generation unit (OGen) 81, the signature unit (OSign) 82, and the verification unit (OVrfy) 83. The signature key generation unit (OGen) 81 receives the security parameter 1 ^κ and outputs a disposable signature key pair (verification key, signature key) = (ovk, osk). The signature part (OSign) 82 receives the signature key osk and the message M and outputs a disposable signature σ. The verification unit (OVrfy) 83 receives the verification key ovk, the message M, and the disposable signature σ, and outputs a verification result (0 or 1). In this specification, 0 is a value indicating a verification failure and 1 is a value indicating a verification success.

  The outline of the cryptographic communication system according to the first embodiment will be described below with reference to FIG. FIG. 5 is a diagram showing an outline of the cryptographic communication system 1000 according to the present embodiment. As shown in FIG. 5, the cryptographic communication system 1000 according to the present embodiment includes a parameter device 1, a key generation device (Gen) 2, an encryption device (Enc) 3, and a decryption device (Dec) 4. The parameter device 1, the key generation device (Gen) 2, the encryption device (Enc) 3, and the decryption device (Dec) 4 are connected by a network 9 so that they can communicate wirelessly or by wire. Details and operation of each device will be described later. Note that the key generation device (Gen) 2 and the decryption device (Dec) 4 may be configured as a single device. Therefore, a modification as shown in FIG. 6 can be implemented. FIG. 6 is a diagram showing an outline of a cryptographic communication system 1000 ′ according to a modification of the present embodiment. As shown in FIG. 6, the above-described decryption device 4 can be modified to a decryption device 4 ′ including a key generation unit 2 and a decryption unit 4. At this time, the key generation unit 2 and the decryption unit 4 perform exactly the same operations as the key generation device 2 and the decryption device 4 described above. In the following, each device will be described according to the configuration of the cryptographic communication system 1000. However, when the system is configured as the cryptographic communication system 1000 ′, a key generation device 2 and a decryption device 4 described later are used as the key generation unit 2 and the decryption device, respectively. It may be read as part 4.

<Parameter device 1>
Next, the parameter device 1 constituting the cryptographic communication system 1000 of the present embodiment will be described with reference to FIGS. FIG. 7 is a block diagram showing the configuration of the parameter device 1 of the present embodiment. FIG. 8 is a flowchart showing the operation of the parameter device 1 of the present embodiment. As shown in FIG. 7, the parameter device 1 includes a condition parameter setting unit 11 and a common parameter generation unit (Pars) 12. The common parameter generation unit (Pars) 12 includes an RSA modulus generation unit (GenN) 6, a random generation source setting unit 121, and a parameter generation unit (FGen) 51.

The condition parameter setting unit 11 sets a condition parameter indicating the length of the composite number, the number of messages, and the length of the prime number for filtering (S11). Specifically, the condition parameter setting unit 11 sets the length parameter of the composite number as l _N ≧ 25κ + 8, sets the number of messages n as n = 6, and sets the length parameter of the filter prime p as l _LAF. Set = (l _N + κ + 1) / (n-6). The RSA modulus generator (GenN) 6 receives the security parameter and generates a composite number of the first and second Blum prime numbers and the RSA modulus (S6). Specifically, the RSA modulus generation unit (GenN) 6 receives the security parameter 1 ^κ and uses the algorithm GenN (1 ^κ ) to obtain the first and second Blum prime numbers P and Q and the composite number N. . The random generator setting unit 121 is a subgroup for random numbers that is a subgroup of a predetermined order among a set of only numbers that are less than the third power of the composite number and relatively prime to the third power of the composite number. 1. A second random generator is set (S121). Specifically, the random generator setting unit 121 sets the first and second random generators g ₁ and g ₂ as random generators of the random number subgroup G _rnd . The parameter generation unit (FGen) 51 receives a security parameter and generates a filter key and a trap door (S51). Specifically, the parameter generation unit (FGen) 51 receives the security parameter 1 ^κ and generates (filter key, trapdoor) = (fpk, ftd) ← FGen (1 ^κ ). The common parameter generation unit (Pars) 12 outputs the common parameter pp = (N, g ₁ , g ₂ , fpk). The symbol [p ₁ , p _m ) represents a set of numbers from p ₁ to p _m -1 (p ₁ , ..., p _m -1).

And Therefore, the plaintext space is

It is. any

For M = a + b ・ p2 ^k + c ・ p2 ^4k

Exists. A function for obtaining the triple (a, b, c) is α. A function that converts plaintext into LAF input

Define This is set as ζ (M) = (a, b mod p, c ₀ ,..., C _n−3 ) ∈Z ⁿ _p . C ₀ , ..., c _n-3 are the coefficients c,

This is a disassembled

<Key generator (Gen) 2>
Hereinafter, the key generation device (Gen) 2 constituting the cryptographic communication system 1000 according to the present embodiment will be described with reference to FIGS. FIG. 9 is a block diagram showing the configuration of the key generation device (Gen) 2 of this embodiment. FIG. 10 is a flowchart showing the operation of the key generation device (Gen) 2 of this embodiment. As shown in FIG. 9, the key generation device (Gen) 2 includes a secret key parameter selection unit 21, a public key parameter calculation unit 22, a public key generation unit 23, and a secret key generation unit 24. The key generation device (Gen) 2 receives the common parameters pp = (N, g ₁ , g ₂ , fpk) as input. The secret key parameter selection unit 21 randomly selects the first, second, third, and fourth secret key parameters from the plaintext space (S21). Specifically, the secret key parameter selection unit 21 sets s ₁ , s ₂ , s ₃ , and s ₄ as first, second, third, and fourth secret key parameters, respectively, and j = 1, 2, 3, 4, about,

Choose at random. The public key parameter calculation unit 22 calculates the first and second public key parameters based on the first and second random generators and the first, second, third, and fourth secret key parameters (S22). Specifically, the public key parameter calculation unit 22 sets the first and second public key parameters u and v as

And calculate. The public key generation unit 23 generates a public key from the first and second public key parameters (S23). Specifically, the public key generation unit 23 generates a public key as pk = (u, v) εG ² _rnd . The secret key generation unit 24 generates a secret key from the first, second, third, and fourth secret key parameters (S24). Specifically, the secret key generation unit 24 obtains the secret key.

Output as.

<Encryption device (Enc) 3>
Hereinafter, the encryption device (Enc) 3 constituting the cryptographic communication system 1000 of this embodiment will be described with reference to FIGS. FIG. 11 is a block diagram showing the configuration of the encryption device (Enc) 3 of this embodiment. FIG. 12 is a flowchart showing the operation of the encryption device (Enc) 3 of this embodiment. As shown in FIG. 11, the encryption device (Enc) 3 includes a random number selection unit 31, a signature key generation unit (OGen) 81, a common key selection unit 32, a tag setting unit 33, and a first intermediate ciphertext. Calculation unit 34, second intermediate ciphertext calculation unit 35, check ciphertext calculation unit 36, masked ciphertext calculation unit 37, common key encryption unit (E) 71, and signature unit (OSign) 82 And a ciphertext generation unit 38. The encryption device (Enc) 3 receives a common parameter pp, a public key pk, and a message (plain text) M as inputs. In addition,

It is. The random number selection unit 31 randomly selects the first and second random numbers from a set of numbers less than a quarter of the combined number (S31). Specifically, the random number selection unit 31 randomly selects the first and second random numbers r, ρ (r, ρ∈Z _{N / 4} ). The signature key generation unit (OGen) 81 receives a security parameter as an input, and generates a verification key and a signature key, which are a disposable signature key pair (S81). Specifically, the signature key generation unit (OGen) 81 generates a disposable signature key pair (verification key, signature key) as (ovk, osk) ← OGen. The common key selection unit 32 randomly selects a common key that is a random key for common key encryption (S32). Specifically, the common key space is represented as {0,1} ^k, and the common key selection unit 32 randomly selects the common key K, which is a random key for common key encryption, as K∈ {0,1} ^k . . The tag setting unit 33 assumes that the tag includes a core tag and an auxiliary tag, uses the verification key as an auxiliary tag, and randomly selects a core tag from the tag space (S33). Specifically, the tag setting unit 33 sets the auxiliary tag t _a = ovk, randomly selects the core tag t _c ← T _c , and sets the tag as t = (t _a , t _c ). The first intermediate ciphertext calculation unit 34 calculates a pair of first intermediate ciphertexts based on the first random number and the first and second random generators (S34). Specifically, the first intermediate ciphertext calculation unit 34 calculates (G ₁ , G ₂ ) = (g ₁ ^r , g ₂ ^r ) with the first intermediate ciphertext pair as G ₁ and G ₂ . The second intermediate ciphertext calculation unit 35 calculates a pair of second intermediate ciphertexts based on the second random number and the first and second random generators (S35). Specifically, the second intermediate ciphertext calculation unit 34 calculates (F ₁ , F ₂ ) = (g ₁ ^ρ , g ₂ ^ρ ) with the second intermediate ciphertext pair as F ₁ and F ₂ . The check ciphertext calculation unit 36 calculates a check ciphertext based on the first and second public key parameters, the verification key, the first random number, and the composite number (S36). Specifically, the check ciphertext calculation unit 36 obtains the check ciphertext Z,

And calculate. The masked ciphertext calculation unit 37 calculates a masked ciphertext based on the first and second public key parameters, the verification key, the first and second random numbers, the composite number, the common key, and the message (S37). Specifically, the masked ciphertext calculation unit 37 converts the masked ciphertext Y into

And calculate. The common key encryption unit 71 generates a common key cipher text by encrypting the filter value of the lossy algebra filter of the message converted for filter input with the common key (S71). Specifically, the common key encryption unit 71 generates a common key ciphertext _CE as C _E = E (K, LAF _{fpk, t} (ζ (M))). The signature unit (OSign) 82 generates a disposable signature of the public key, the first and second intermediate ciphertext, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag using the signature key. (S82). Specifically, the signature unit 82 generates a disposable signature σ as σ = OSign (osk, (pk, G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c )). Finally, the ciphertext generation unit 38 generates a ciphertext including the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, the core tag, the verification key, and the disposable signature. (S38). Specifically, the ciphertext generation unit 38 generates the ciphertext C as C = (G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c , ovk, σ). The encryption device (Enc) 3 outputs C as a ciphertext.

<Decoding device (Dec) 4>
Hereinafter, the decryption device (Dec) 4 constituting the cryptographic communication system 1000 of this embodiment will be described with reference to FIGS. FIG. 13 is a block diagram showing the configuration of the decoding device (Dec) 4 of this embodiment. FIG. 14 is a flowchart showing the operation of the decoding device (Dec) 4 of this embodiment. As illustrated in FIG. 13, the decryption device (Dec) 4 includes a falsified public key calculation unit 40, a verification unit (OVrfy) 83, a verification result confirmation unit 41, a check ciphertext confirmation unit 42, and a mask key calculation. Unit 43, mask decryption result confirmation unit 44, converted plaintext calculation unit 45, message confirmation unit 46, tag generation unit 47, common key decryption unit (D) 72, decryption result confirmation unit 48, message An output unit 49 is included. The decryption device (Dec) 4 has a common parameter pp and a falsified secret key.

Then, the ciphertext C = (G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c , ovk, σ) is input. ξ ₁ , ξ ₂ , ξ ₃ , and ξ ₄ are referred to as first, second, third, and fourth tampered secret key parameters, respectively. The falsified secret key is a secret key that may have been falsified by an attacker. If no falsification has been made, ξ _j = s _j (j = 1, 2, 3, 4). The falsified public key calculation unit 40 determines the first and second random generators based on the first, second, third, and fourth falsified secret key parameters that are parameters that may have been falsified. 2. Calculate the falsified public key parameter and calculate the falsified public key (S40). Specifically, the falsified public key calculation unit 40 obtains the falsified public key,

And calculate. The verification unit (OVrfy) 83 verifies a message composed of a falsified public key, a first and second intermediate ciphertext pair, a check ciphertext, a masked ciphertext, a common key ciphertext, and a core tag, and a disposable signature. It verifies using and outputs a verification result (S83). Specifically, the verification unit (OVrfy) 83 displays the verification result

Is generated and output. The verification result confirmation unit 41 confirms the verification result, and outputs the verification result when the verification result is the verification success, and outputs the reject symbol (⊥) when the verification is the failure and stops the processing (S41). . Specifically, the verification result confirmation unit 41

Make sure that If the verification result is not 1, the verification result confirmation unit 41 outputs a reject symbol (⊥) and stops the processing. The check ciphertext confirmation unit 42 calculates the check ciphertext using the first intermediate ciphertext pair, the first, second, third, and fourth falsified secret key parameters, the verification key, and the composite number. If it is a true value, if it is a true value, a check ciphertext is output, otherwise a reject symbol (⊥) is output and the process is stopped (S42). Specifically, the check ciphertext confirmation unit 42 determines that the check ciphertext Z is

Make sure that The check ciphertext confirmation unit 42 indicates that the check ciphertext Z is a true value.

If it is not equal to, a reject symbol (⊥) is output and the process is stopped. The mask key calculation unit 43 calculates a mask key from the first and second intermediate ciphertext pairs, the first, second, third, and fourth falsified secret key parameters and the verification key (S43). Specifically, the mask key calculation unit 43 obtains the mask key Z ′,

And calculate. The mask decryption result confirmation unit 44 decrypts the masked ciphertext using the mask key to obtain a mask decryption result, and the mask decryption result confirmation unit 44 obtains a mask decryption result that is less than the third power of the composite number and is relatively prime to the third power of the composite number. Check whether the mask decoding result belongs to the plaintext subgroup G _msg which is a subgroup whose order is the square of the composite number in the set, and if so, output the mask decoding result, If not, a reject symbol (⊥) is output and the process is stopped (S44). Specifically, the mask decoding result confirmation unit 44 determines that the mask decoding result YZ ′ ⁻¹ is

Make sure that When the mask decoding result YZ′− ¹ does not belong to the plaintext subgroup G _msg , the mask decoding result confirmation unit 44 outputs a reject symbol (⊥) and stops the processing. The converted plaintext calculation unit 45 performs logarithmic calculation on the mask decryption result to calculate the converted plaintext, and acquires a message (S45). Specifically, the converted plaintext calculation unit 45 calculates the converted plaintext d as d = dlog _h (YZ ′ ⁻¹ ) and parses it as d = K + 2 ^k · M. The message confirmation unit 46 confirms whether or not the message belongs to the plaintext space. If the message belongs, the message confirmation unit 46 outputs a message. If not, the message confirmation unit 46 outputs a reject symbol and stops the processing (S46). Specifically, the message confirmation unit 46

Make sure that If the message M does not belong to the plaintext space, the message confirmation unit 46 outputs a reject symbol (⊥) and stops the processing. The tag generation unit 47 generates a tag from the auxiliary tag and the core tag using the verification key as an auxiliary tag (S47). Specifically, the tag generation unit 47 sets the tag t = (ovk, t _c ). The common key decryption unit (D) 72 decrypts the common key ciphertext using the common key and outputs a decryption result D (K, C _E ) (S72). The decoding result confirmation unit 48 confirms whether or not the decoding result is equal to the filter value, and outputs a message if they are equal, otherwise outputs a reject symbol and stops the processing (S48). Specifically, the decoding result confirmation unit 48 confirms that D (K, C _E ), which is the decoding result, is D (K, C _E ) = LAF _{fpk, t} (ζ (M)). If D (K, C _E ) = LAF _{fpk, t} (ζ (M)) is not satisfied, the decoding result confirmation unit 48 outputs a reject symbol (⊥) and stops the processing. The message output unit 49 outputs a message when the reject symbol (⊥) is not output during the operation of each unit of the decoding device (Dec) 4 (S49).

  As described above, according to the cryptographic communication system 1000 of the present embodiment and the cryptographic communication system 1000 ′ of the modified example, the RKA-KDM-CCA secure public key cryptosystem can be realized, and the related key attack can be prevented. Can also protect the key-dependent plaintext ciphertext.

≪Summary of invention≫
The present invention is based on the Hofheinz method (Non-Patent Document 3) having KDM-CCA safety. Differences between the Hofheinz method and the present invention will be described.

<Encryption>
The signature generation procedure differs between the present invention and the Hofheinz method. This is a procedure (step S82) in the signature part (OSign) 82 in the first embodiment. In the Hofheinz method,
A disposable signature is generated as σ _H = OSign (osk, (G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c )). In the present invention, after adding σ ← OSign (osk, (pk, G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c )) and the public key pk, a disposable signature is generated .

<Decryption>
In the present invention, a public key regeneration procedure is added to the decryption algorithm of the Hofheinz method. It is the procedure (step S40) in the falsification public key calculation part 40 in Example 1. FIG. In the present invention, the disposable signature is verified using the regenerated public key. It is the procedure (step S83) in the verification part (OVrfy) 83 in Example 1. FIG. In the case of the Hofheinz method, there is no public key regeneration procedure (S40), and step S83 is performed by OVrfy (ovk, (G ₁ , G ₂ , F ₁ , F ₂ , Z, Y, C _E , t _c ), Make sure that σ) = 1. Otherwise, output reject (⊥) and stop.

  In the present invention, the public key pk is used as a fingerprint of the secret key sk, and a disposable signature is attached to each fingerprint, thereby associating the ciphertext with the public key used for encryption. This can provide resistance to related key attacks. Here, regarding the falsified private key

It is preferable not to confirm that. If confirmed, it is vulnerable to related key attacks.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (6)

A cryptographic communication system including a parameter device, a key generation device, an encryption device, and a decryption device,
The parameter device is:
A condition parameter setting unit for setting a condition parameter indicating the length of the composite number, the number of messages, and the length of the prime number for the filter;
An RSA modulus generator that receives a security parameter as input and generates a composite number of the first and second Blum prime numbers and the RSA modulus;
First and second random generation in a subgroup for random numbers, which is a subgroup of a predetermined order, out of a set that is less than the third power of the composite number and is relatively prime to the third power of the composite number A random generator setting unit for setting the source;
The security parameter as an input, including a filter key and a parameter generation unit that generates a trap door,
The key generation device includes:
A secret key parameter selection unit for randomly selecting the first, second, third, and fourth secret key parameters from the plaintext space;
A public key parameter calculator that calculates first and second public key parameters based on the first and second random generators and the first, second, third, and fourth secret key parameters;
A public key generator for generating a public key from the first and second public key parameters;
A secret key generation unit that generates a secret key from the first, second, third, and fourth secret key parameters,
The encryption device is:
A random number selection unit that randomly selects first and second random numbers from a set of numbers less than a quarter of the composite number;
A signature key generation unit that generates a verification key and a signature key, which is a disposable signature key pair, with the security parameter as an input,
A common key selection unit that randomly selects a common key that is a random key for common key encryption; and
A tag comprising a core tag and an auxiliary tag, the verification key as the auxiliary tag, and a tag setting unit that randomly selects the core tag from a tag space;
A first intermediate ciphertext calculator that calculates a pair of first intermediate ciphertexts based on the first random number and the first and second random generators;
A second intermediate ciphertext calculator that calculates a pair of second intermediate ciphertexts based on the second random number and the first and second random generators;
A check ciphertext calculation unit that calculates a check ciphertext based on the first and second public key parameters, the verification key, the first random number, and the composite number;
A masked ciphertext calculation unit that calculates a masked ciphertext based on the first and second public key parameters, the verification key, the first and second random numbers, the composite number, the common key, and a message;
A common key encryption unit that generates a common key ciphertext by encrypting a filter value of a lossy algebra filter of the message converted for filter input with the common key;
A signature for generating a disposable signature for the public key, the first and second intermediate ciphertext, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag, using the signature key. And
Ciphertext generation for generating a ciphertext including the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, the core tag, the verification key, and the disposable signature. Including
The decoding device
First and second falsified public key parameters are calculated based on the first and second random generators and the first, second, third, and fourth falsified secret key parameters that may have been tampered with. A falsified public key calculation unit for calculating a falsified public key;
A message comprising the falsified public key, the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag is used as the verification key and the disposable signature. A verification unit that verifies and outputs the verification result, and
A verification result confirmation unit that confirms the verification result, outputs a verification result when the verification result is a verification success, outputs a reject symbol when the verification is a failure, and stops processing;
The check ciphertext is a true value calculated using the first intermediate ciphertext pair, the first, second, third, and fourth falsified secret key parameters, the verification key, and the composite number. Confirming that, if it is the true value, outputs the check ciphertext, otherwise outputs the reject symbol and stops the processing,
A mask key calculator for calculating a mask key from the pair of the first and second intermediate ciphertexts, the first, second, third and fourth falsified secret key parameters and the verification key;
Decrypting the masked ciphertext using the mask key to obtain a mask decryption result, and among a set of only numbers that are less than the third power of the composite number and relatively prime to the third power of the composite number, Check whether the mask decryption result belongs to the plaintext subgroup which is a subgroup whose order is the square of the composite number, and if it belongs, output the mask decryption result, otherwise A mask decoding result confirmation unit that outputs reject symbols and stops processing;
A converted plaintext calculation unit that performs logarithmic calculation on the mask decryption result to calculate converted plaintext, and obtains the message;
Confirming whether or not the message belongs to the plaintext space, outputting the message if it belongs, otherwise outputting the reject symbol and stopping the processing;
Using the verification key as the auxiliary tag, a tag generation unit that generates the tag from the auxiliary tag and the core tag,
A common key decryption unit that decrypts the common key ciphertext using the common key and outputs a decryption result;
Confirming whether or not the decoding result is equal to the filter value; if equal, outputs the message; otherwise, outputs a reject symbol and stops processing;
A message output unit that outputs the message when the reject symbol is not output during operation of each unit of the decoding apparatus; The cryptographic communication system according to claim 1,
An encryption communication system in which the key generation device and the decryption device are included in a single device. An encryption communication method executed by a parameter device, a key generation device, an encryption device, and a decryption device,
The parameter device is:
A condition parameter setting step for setting a condition parameter indicating the length of the composite number, the number of messages, and the length of the filter prime;
RSA modulus generation step for receiving a security parameter as input and generating a composite number of the first and second Blum prime numbers and the RSA modulus;
First and second random generation in a subgroup for random numbers, which is a subgroup of a predetermined order, out of a set that is less than the third power of the composite number and is relatively prime to the third power of the composite number A random generator setting step for setting the source, and
With the security parameter as an input, execute a parameter generation step for generating a filter key and a trap door,
The key generation device includes:
A secret key parameter selection step of randomly selecting the first, second, third, and fourth secret key parameters from the plaintext space;
A public key parameter calculating step of calculating first and second public key parameters based on the first and second random generators and the first, second, third and fourth secret key parameters;
A public key generating step for generating a public key from the first and second public key parameters;
Performing a secret key generation step of generating a secret key from the first, second, third, and fourth secret key parameters;
The encryption device is:
A random number selection step of randomly selecting first and second random numbers from a set of numbers less than a quarter of the composite number;
A signature key generation step for generating a verification key and a signature key, which is a disposable signature key pair, with the security parameter as an input;
A common key selection step of randomly selecting a common key that is a random key for common key encryption;
A tag comprising a core tag and an auxiliary tag, the verification key as the auxiliary tag, and a tag setting step for randomly selecting the core tag from a tag space;
A first intermediate ciphertext calculation step of calculating a first intermediate ciphertext pair based on the first random number and the first and second random generators;
A second intermediate ciphertext calculation step of calculating a second intermediate ciphertext pair based on the second random number and the first and second random generators;
A check ciphertext calculation step of calculating a check ciphertext based on the first and second public key parameters, the verification key, the first random number, and the composite number;
A masked ciphertext calculation step of calculating a masked ciphertext based on the first and second public key parameters, the verification key, the first and second random numbers, the composite number, the common key, and a message;
A common key encryption step of generating a common key cipher text by encrypting a filter value of a lossy algebra filter of the message converted for filter input with the common key;
A signature for generating a disposable signature for the public key, the first and second intermediate ciphertext, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag, using the signature key. Steps,
Ciphertext generation for generating a ciphertext including the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, the core tag, the verification key, and the disposable signature. Perform steps and
The decoding device
First and second falsified public key parameters are calculated based on the first and second random generators and the first, second, third, and fourth falsified secret key parameters that may have been tampered with. A falsified public key calculating step for calculating a falsified public key;
A message comprising the falsified public key, the first and second intermediate ciphertext pairs, the check ciphertext, the masked ciphertext, the common key ciphertext, and the core tag is used as the verification key and the disposable signature. A verification step for verifying and outputting a verification result;
A verification result confirmation step of confirming the verification result, outputting a verification result if the verification result is a verification success, and outputting a reject symbol if the verification is a failure, and stopping the processing;
The check ciphertext is a true value calculated using the first intermediate ciphertext pair, the first, second, third, and fourth falsified secret key parameters, the verification key, and the composite number. Confirming that, if it is the true value, outputting a check ciphertext, otherwise outputting the reject symbol and stopping the processing,
A mask key calculating step of calculating a mask key from the pair of the first and second intermediate ciphertexts, the first, second, third and fourth falsified secret key parameters and the verification key;
Decrypting the masked ciphertext using the mask key to obtain a mask decryption result, and among a set of only numbers that are less than the third power of the composite number and relatively prime to the third power of the composite number, Check whether the mask decryption result belongs to the plaintext subgroup which is a subgroup whose order is the square of the composite number, and if it belongs, output the mask decryption result, otherwise A mask decoding result confirmation step of outputting reject symbols and stopping processing;
A converted plaintext calculation step of performing logarithm calculation on the mask decryption result to calculate converted plaintext, and obtaining the message;
Confirming whether or not the message belongs to the plaintext space, outputting the message if it belongs, otherwise outputting the reject symbol and stopping the processing; and
A tag generation step of generating the tag from the auxiliary tag and the core tag using the verification key as the auxiliary tag;
A common key decryption step of decrypting the common key ciphertext using the common key and outputting a decryption result;
Confirming whether or not the decoding result is equal to the filter value, outputting the message if they are equal, and outputting the reject symbol otherwise to stop the processing;
If the reject symbol is not output when each step of the decoding apparatus is executed, a message output step for outputting the message is executed. The encryption communication method according to claim 3,
An encryption communication method, wherein the key generation device and the decryption device are included in a single device, and the single device executes all the steps executed by the key generation device and the decryption device.   The program for functioning a computer as an encryption apparatus contained in the encryption communication system of Claim 1 or 2.   A program for causing a computer to function as a decryption device included in the encryption communication system according to claim 1.

Images