JP6189788B2 - Key generation device, re-encryption device, and program - Google Patents

Description

  The present invention relates to an encryption technique, and more particularly to a technique that enables a ciphertext encrypted with a certain encryption key to be decrypted using a decryption key different from the decryption key corresponding to the encryption key. .

In the public key cryptosystem, a ciphertext encrypted with a certain encryption key (public key) can be decrypted only by a person having a decryption key (secret key) corresponding to the public key. For example, when the plaintext m is transmitted from the user h to the user i, the user h generates the ciphertext CT _i using the encryption key EK _i of the user i and transmits it to i. Only a user having the decryption key DK _i corresponding to the encryption key EK _i can decrypt this CT _i . In addition, a proxy re-encryption scheme is a scheme that uses a conversion key to convert the ciphertext into a ciphertext that can be decrypted using a different decryption key. This method is composed of a user who delegates decryption authority, a user who is delegated decryption authority, and a proxy that converts ciphertext. For example, when the user i delegates the decryption authority to the user j, the conversion key RK _{i, j} is created and delegated to the proxy. The proxy having the conversion key RK _{i, j} converts the input ciphertext CT _i into the ciphertext CT _j and outputs it. In this case, a user with the decryption key DK _j corresponding to the encryption key EK _j can obtain plaintext decodes the CT _j. When the conversion key RK _{i, j} allows conversion from user i to user j and from user j to user i, the conversion key is said to be bidirectional. When the conversion key RK _{i, j} only allows conversion from user i to user j, the conversion key is said to be unidirectional. A proxy re-encryption scheme was first proposed in Non-Patent Document 1. Since then, various proxy re-encryption schemes have been proposed based on discrete logarithm problems and elliptic discrete logarithm problems. As proxy re-encryption methods based on the lattice problem, there are methods disclosed in Non-Patent Documents 2 to 6.

Matt Blaze, Gerrit Bleumer, and Martin Strauss.Divertible protocols and atomic proxy cryptography, in Kaisa Nyberg, editor, EUROCRYPT’98, volume 1403 of LNCS, pages 127-144, Springer, Heidelberg, 1998. Yoshinori Aono, Xavier Boyen, Le Trieu Phong, and Lihua Wang.Key-private proxy re-encryption under LWE, in Goutam Paul and Paul Vaudenay, editors, INDOCRYPT 2013, volume 8250 of LNCS, pages 1-18, Springer, Heidelberg, 2013. Nishanth Chandran, Melissa Chase, Feng-Hao Liu, Ryo Nishimaki, and Keita Xagawa.Re-encryption, functional re-encryption, and multi-hop re-encryption: A framework for achieving obfuscation-based security and instantiations from lattices.In Hugo Krawczyk, editor, PKC 2014, volume 8383 of LNCS, pages 95-112, Springer, Heidelberg, 2014. Elena Kirshanova, Proxy re-encryption from lattices, in Hugo Krawczyk, editor, PKC 2014, volume 8383 of LNCS, pages 77-94, Springer, Heidelberg, 2014. Keita Kusagawa, Indistinguishability against related key attacks and two-way proxy re-encryption, SCIS 2011, 2011. Keita Xagawa and Keisuke Tanaka, Proxy re-encryption based on learning with errors, SCIS 2010, 2010.

Consider a unidirectional conversion key RK _{i → j} that performs conversion from user i to user j. If the information of users i and j does not leak from this unidirectional conversion key, it is said that there is key anonymity. Non-Patent Documents 2, 3 and 4 have been proposed as unidirectional proxy re-encryption schemes based on the lattice problem that has been proposed so far. However, these methods do not have key anonymity. For example, in the methods of Non-Patent Document 2 and Non-Patent Document 3, the conversion key RK _{i → j} is composed of the basic conversion key rk _{i → j} and the encryption key ek _j of the conversion destination user j. Information (public key certificate or the like) for specifying the user j is associated with the encryption key ek _j which is a public key. Therefore, if the encryption key ek _j can be specified, the corresponding user can be specified. Therefore, in these methods, the user j can be easily specified from the conversion key RK _{i → j} .

  This invention is made | formed in view of such a point, and makes it a subject to provide the technique which can suppress that the information of a conversion destination leaks from a conversion key.

  Using the first decryption key and the second encryption key, obtaining a basic conversion key for converting the first ciphertext into the second ciphertext, using the second encryption key, and randomizing the second encryption key Get a random key. However, the first decryption key is a key for decrypting the first ciphertext, the second decryption key is a key for decrypting the second ciphertext, and the second encryption key corresponds to the second decryption key The ciphertext encrypted using the randomizing key can be decrypted with the second decryption key.

  The basic conversion key and the randomized key generated as described above can be used as the conversion key. The random key is obtained by randomizing the second encryption key. Thereby, a third party such as an attacker cannot specify the second encryption key from the randomization key. As a result, it is possible to suppress leakage of conversion destination information from the conversion key.

FIG. 1 is a block diagram illustrating a functional configuration of the re-encryption system according to the embodiment. FIG. 2 is a block diagram illustrating a functional configuration of the key generation device 12 according to the embodiment. FIG. 3 is a block diagram illustrating a functional configuration of the re-encryption apparatus according to the embodiment. FIG. 4A is a flowchart for illustrating the key generation processing of the embodiment. FIG. 4B is a flowchart for illustrating the re-encryption process of the embodiment.

Embodiments of the present invention will be described below.
[principle]
First, the principle will be described. In the following, the first ciphertext is re-encrypted into the second ciphertext. A key for generating the first ciphertext is referred to as a first encryption key, and a key for decrypting the first ciphertext is referred to as a first decryption key. A key for generating the second ciphertext is called a second encryption key, and a key for decrypting the second ciphertext is called a second decryption key. That is, the first encryption key corresponds to the first decryption key, and the second encryption key corresponds to the second decryption key. The decryption result (plain text) obtained by decrypting the first ciphertext with the first decryption key is equal to the decryption result obtained by decrypting the second ciphertext with the second decryption key. The first ciphertext and the second ciphertext are ciphertexts encrypted according to an asymmetric encryption method (for example, a public key encryption method, an ID-based encryption method, a function encryption method, etc.). The encryption scheme for the first ciphertext and the encryption scheme for the second ciphertext may be the same or different from each other. An example of an asymmetric encryption scheme is a homomorphic encryption scheme. At least the second ciphertext is a ciphertext obtained according to the homomorphic encryption method, and has homomorphism. The first ciphertext may or may not be a ciphertext obtained according to a homomorphic encryption scheme. For example, the first ciphertext and the second ciphertext are ciphertexts conforming to the lattice cryptosystem or the NTRU cryptosystem.

  The key generation device uses the first decryption key and the second encryption key to obtain a basic conversion key for converting the first ciphertext into the second ciphertext, and uses the second encryption key to obtain the second encryption key. Randomize the key to get a randomized key. However, the ciphertext encrypted using the randomization key can be decrypted with the second decryption key. The basic conversion key and the randomization key thus obtained are used as a conversion key for re-encrypting the first ciphertext into the second ciphertext. The random key is obtained by randomizing the second encryption key. Therefore, a third party such as an attacker cannot specify the second encryption key from the randomization key. Thereby, it can suppress that the information of a conversion destination leaks from a conversion key.

  The re-encryption device receives the first ciphertext, converts the first ciphertext to the second ciphertext using the basic conversion key of the conversion key, and encrypts the first value using the randomization key of the conversion key. To obtain a disturbed ciphertext having homomorphism, and performing a predetermined “calculation” on the second ciphertext and the disturbed ciphertext to obtain a modified ciphertext. However, a value obtained by performing the “calculation” on an arbitrary second value and the first value is equal to the second value. For example, the “first value” is a unit element of the set in which the “operation” is defined. When this “operation” is an additive operation, the “first value” is an additive unit element (zero element). For example, when this “calculation” is addition (modified ciphertext = second ciphertext + disturbed ciphertext), the “first value” is 0. Alternatively, when this “operation” is a multiplicative operation, the “first value” is a multiplicative unit element. For example, when this “operation” is multiplication (modified ciphertext = second ciphertext × disturbed ciphertext), the “first value” is 1.

  Due to the homomorphism of the second ciphertext and the disturbed ciphertext, the value obtained by decrypting the modified ciphertext with the second decryption key is the same as the above for the decryption result of the second ciphertext and the decryption result of the disturbed ciphertext. It is equal to the value obtained by performing "calculation" of As described above, both the second ciphertext and the disturbed ciphertext can be decrypted with the second decryption key, the decryption result of the second ciphertext is plaintext, and the decryption result of the disturbed ciphertext is the first value. Due to the nature of the above “calculation”, the value obtained by performing the “calculation” on the plaintext and the first value is plaintext. That is, the modified ciphertext is a ciphertext obtained by re-encrypting the first ciphertext.

[Embodiment]
Hereinafter, embodiments will be described with reference to the drawings.
<Reconvertible encryption method>
First, the reconvertible encryption method π = (SU, G, E, D, RKG, Switch) is defined as follows.

SU: The common parameter generation algorithm SU is a stochastic algorithm that takes κ as an input and outputs a common parameter pp (pp ← SU (1 ^κ )). Where κ is a security parameter (a positive integer). 1 ^κ is a sequence of 1 κ bits.

  G: The key generation algorithm G is a probabilistic algorithm that takes pp as input and outputs a pair (ek, dk) of an encryption key and a decryption key ((ek, dk) ← G (pp)).

E: The encryption algorithm E is a probabilistic algorithm that takes pp, ek, and plaintext μ as input, internally generates random numbers, and outputs ciphertext c (c = E (pp, ek, μ)). However, the encryption algorithm E is in accordance with an asymmetric cryptosystem that is a homomorphic cipher, and the ciphertext c has homomorphism.
D: The decryption algorithm D is an algorithm that takes pp, dk, and ciphertext c as input and outputs plaintext μ ′ (μ ′ ← D (pp, dk, c)).

RKG: Conversion key generation algorithm RKG is a stochastic algorithm that takes pp, dk _α and ek _β as inputs and outputs a basic conversion key rk _{α → β} (rk _{α → β} ← RKG (pp, dk _α , ek _β )). However, dk _α is a decryption key obtained for the user α (decryption key for the user α to perform decryption), and ek _β is an encryption key obtained for the user β (the user β decrypts the decryption key). Encryption key for generating ciphertext that can be performed). All the keys are obtained by the key generation algorithm G. Basic conversion key rk _{α → β,} the first ciphertext generated using the encryption key ek _alpha corresponding to the decryption key dk _alpha, the possible decoded by the decoding key dk _beta corresponding to the encryption key ek _beta 2 is a key for conversion to ciphertext.

RG: Randomized key generation algorithm RG is a probabilistic algorithm that takes pp, ek _β as input and outputs a randomized key (rpp _β , rk _β ) ((rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch is a stochastic algorithm that takes pp, rk _{α → β} and ciphertext c _α as input and outputs ciphertext c _β (c _β ← Switch (pp, rk _{α → β} , c _α )). ). However, the ciphertext c _α is a ciphertext that can be decrypted with the decryption key dk _α of the user α, and the ciphertext c _β is a ciphertext that can be decrypted with the decryption key dk _β of the user β. dk _β corresponds to the encryption key ek _β described above.

<Proxy re-encryption method>
Using the above-described re-transformable encryption method π, the proxy re-encryption method Π = (Setup, Gen, Enc1, Dec1, Enc2, Dec2, RekeyGen, ReEnc) of this embodiment is configured as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp. “Γ ← η” means “a value obtained by η is γ (γ = η)”.

Gen _y : Algorithm Gen _y takes PP = pp as an input, and a pair of encryption key and decryption key before re-encryption corresponding to user y∈ {α, β} (ie k _y , idk _y ) ← G ( pp) and the re-encrypted encryption key / decryption key pair (oek _y , odk _y ) <-G (pp) are obtained and output. However, in the case of a scheme that can re-encrypt the ciphertext after re-encryption (multi-hop re-encryption scheme), iek _y = oeky _y and idk _y = odky _y may be used (ie k _y , idk _y ) ← G (pp) resulting set directly at _{(oek y,} odk y) may be set.

Enci: The algorithm Enci generates a ciphertext before re-encryption. Algorithm Enci is, PP = and pp, IEK _y, an input plaintext _{μ, ict y = E (pp} , iek y, μ) is calculated, and outputs the ict _y as ciphertext.

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. Algorithm Deci is, PP = and pp, idk _y, an input ciphertext _{ict y, μ '= D (} pp, idk y, ict y) to calculate the, mu' outputs as a plaintext.

Enco: The algorithm Enco generates a ciphertext after re-encryption. Algorithm Enco is, PP = and pp, oek _y, an input plaintext _{μ, oct y = E (pp} , oek y, μ) is calculated, and outputs the oct _y as ciphertext.

Deco: Algorithm Deco decrypts the ciphertext after re-encryption. Algorithm Deco is, PP = pp, odk _y, the ciphertext oct _y as _{input, μ '= D (pp,} odk y, oct y) to calculate the, mu' outputs as a plaintext.

RekeyGen: Algorithm RekeyGen takes PP = pp, idk _α (first decryption key) and oek _β (second encryption key) as inputs, and calculates rk _{α → β} ← RKG (pp, idk _α , oek _β ). Rk _{α → β} is a basic conversion key, (rpp _β , rk _β ) ← RG (pp, oek _β ) is calculated and (rpp _β , rk _β ) is a randomized key, and RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) are output as conversion keys. However, the ciphertext encrypted using the randomized key (rpp _β , rk _β ) can be decrypted with odk _β (second decryption key).

ReEnc: Algorithm ReEnc takes PP = pp, RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ), ict _α (first ciphertext) and calculates the following. However, ict _α = E (pp, iek _α , μ).
1) c ′ ← Switch (pp, rk _{α → β} , ict _α )
2) c ″ ← E (rpp _β , rek _β , 0)
3) oct _β ← c '+ c''
The algorithm ReEnc outputs oct _B as the converted ciphertext. In this example, the “first value” is 0 and the “predetermined calculation” is addition.

<Configuration>
As illustrated in FIG. 1, the re-encryption system 1 of this embodiment includes a management device 11, key generation devices 12 and 13, an encryption device 14, decryption devices 15 and 16, and a re-encryption device 17. As illustrated in FIG. 2, the key generation device 12 of this embodiment includes an input unit 121, an output unit 122, a storage unit 123, a key pair generation unit 124, a basic conversion key generation unit 125, a randomized key generation unit 126, and A conversion key synthesis unit 127 is included. In addition, as illustrated in FIG. 3, the re-encryption device 17 according to the present exemplary embodiment includes an input unit 171, an output unit 172, a storage unit 173, a basic conversion unit 174, a disturbance encryption unit 175, and a calculation unit 176. Each device has a predetermined program read into a general-purpose or dedicated computer including a processor (hardware processor) such as a CPU (central processing unit) and a memory such as a random-access memory (RAM). It is a device configured. The CPU is a kind of electronic circuit, but a part or all of the processing units constituting the device may be configured by other electronic circuits. Each device is configured to exchange information. For example, each device is configured to be able to communicate through a network such as the Internet.

<Processing>
In the following, the key generation device 12 generates a key and a conversion key corresponding to the user α, the key generation device 13 generates a key corresponding to the user β, and the encryption device 14 generates an encryption key corresponding to the user α. An example will be described in which a ciphertext is generated using the re-encryption device 17 and converted into a modified ciphertext that can be decrypted with a decryption key corresponding to the user β.

<< Processing of Management Device 11 >>
The management apparatus 11 executes the algorithm Setup with 1 ^κ as an input, and outputs a common parameter pp. The common parameter pp is sent to each device constituting the re-encryption system 1.

<< Key generation processing of the key generation device 13 >>
The key generation device 13 generates a key corresponding to the user β. As a premise of this key generation processing, it is assumed that the common parameter pp described above is input to the key generation device 13 and stored in a storage unit (not shown) of the key generation device 13. The key generation device 13 extracts the common parameter pp from the storage unit, executes the algorithm Gen _β , sets the encryption key and decryption key (iek _β , idk _β ) before re-encryption, and after re-encryption A pair of encryption keys and decryption keys (oek _β , odk _B ) is obtained and output. However, in the case of the multi-hop re-encryption method, it is only necessary to obtain iek _β = oek _β and idk _B = odk _β . The decryption keys idk _β and odk _β are secret information of the user β, and are securely sent to the decryption device 15 used by the user β and stored securely in the decryption device 15. On the other hand, the encryption keys iek _β and oek _β are public information, and may be output from the key generation device 13 as necessary, or may be stored in a device accessible by each device.

<< Key generation process of key generation apparatus 12 >>
The key generation device 12 generates a key and a conversion key corresponding to the user α. The key generation processing of the key generation device 12 will be described with reference to FIGS. 2 and 4A. As a premise of this key generation process, it is assumed that the common parameter pp and the encryption keys iek _β and oek _β described above are input to the input unit 121 of the key generation device 12 and stored in the storage unit 123.

The key pair generation unit 124 receives the common parameter pp, executes the algorithm Gen _α , sets the encryption key and decryption key (iek _α , idk _α ) before re-encryption, and encryption after re-encryption A key / decryption key pair (oek _α , odk _α ) is obtained and output. However, in the case of the multi-hop re-encryption scheme, it is only necessary to obtain iek _α = oek _α and idk _α = odk _α . The (iek _α , idk _α ) and (oek _α , odk _α ) output from the key pair generation unit 124 are stored in the storage unit 123 (step S124). The decryption keys idk _α and odk _α are secret information of the user α. The decryption keys idk _α and odk _α are output from the output unit 122, are securely sent to the decryption device 16 used by the user α, and are securely stored in the decryption device 16. On the other hand, the encryption keys iek _α and oek _α are public information, and may be output from the output unit 122 of the key generation device 12 as necessary, or may be stored in an accessible device.

The basic conversion key generation unit 125, the randomization key generation unit 126, and the conversion key synthesis unit 127 execute the algorithm RekeyGen to generate the conversion key RK _{α → β} . The basic conversion key generation unit 125 receives the common parameter pp, the decryption key idk _α (first decryption key), and the encryption key oek _β (second encryption key), and an encryption key corresponding to the decryption key idk _α. a first ciphertext obtained using IEK _alpha, base conversion key rk for converting the second cipher text can be decrypted by decryption key odk _beta corresponding to the encryption key _{oek β α → β ← RKG (} pp , Idk _α , oek _β ) are obtained and output (step S125).

Randomized key generating unit 126, common parameters pp, and encryption key Oek _B (second encryption key) as input, the _{(rpp β, rek β) ←} RG (pp, oek β) encryption key Oek _beta by Randomize to obtain and output randomized keys (rpp _β , rk _β ). This randomization is performed so that the ciphertext obtained by encrypting the arbitrary value using the randomization key (rpp _β , rk _β ) can be decrypted with the decryption key odk _β (step S126).

The conversion key composition unit 127 receives the basic conversion key rk _{α → β} and the randomized key (rpp _β , rk _β ), and includes the conversion key RK _{α → β} = (rk _{α → β} , rpp _β , rk _β). ) Is output. The conversion key RK _{α → β} is sent to the output unit 122, and the output unit 122 sends the conversion key RK _{α → β} to the re-encryption device 17 (step S127).

<< Encryption processing in the encryption device 14 >>
The encryption device 14 receives PP = pp, iek _α and plaintext μ, executes the algorithm Enci to calculate ict _α = E (pp, iek _α , μ), and outputs ict _α as the first ciphertext To do.

<< Decoding processing in the decoding device 16 >>
A process in which the decryption device 16 decrypts the first ciphertext ict _α before re-encryption will be described. When the first ciphertext ict _α is input to the decryption device 16, the decryption device 16 uses PP = pp, idk _α (first decryption key for decrypting the first ciphertext) and the first ciphertext ict _α . Then, the algorithm Deci is executed to calculate μ ′ = D (pp, idk _α , ic t _α ), and μ ′ is output as plain text.

<< Re-encryption process in re-encryption device 17 >>
A process in which the re-encryption device 17 re-encrypts the first ciphertext ict _α will be described with reference to FIGS. 3 and 4B. As a premise of this re-encryption processing, the above-mentioned common parameter pp, first ciphertext ict _α , and conversion key RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) are input to the re-encryption device 17. It is assumed that the data is input to the unit 171 and stored in the storage unit 173.

The basic conversion unit 174 receives PP = pp, rk _{α → β} (basic conversion key) and the first ciphertext ict _α , executes the conversion algorithm Switch, and c ′ ← Switch (pp, rk _{α → β} , ict _α )) and c ′ is output as the second ciphertext. The second ciphertext c ′ has homomorphism (step S174).

The disturbance encryption unit 175 receives rpp _β (randomized key) and lek _β (randomized key) as input, and executes the encryption algorithm E to calculate c ″ ← E (rpp _β , rk _β , 0) Then, c ″ is output as a disturbed ciphertext that is a ciphertext of 0 (first value). The disturbed ciphertext c ″ has homomorphism (step S175).

The calculation unit 176 receives the second ciphertext c ′ and the disturbed ciphertext c ″, calculates oct _β ← c ′ + c ″, and outputs oct _β as a modified ciphertext. Note that a value (second value + 0) obtained by adding the arbitrary second value and 0 (first value) is equal to the second value (step S176).

<< Decoding processing in the decoding device 15 >>
A process in which the decryption device 15 decrypts the re-encrypted modified ciphertext oct _β will be described. When the modified ciphertext oct _β is input to the decryption device 15, the decryption device 15 uses PP = pp, odk _β (second decryption key for decrypting the second ciphertext) and the modified ciphertext oct _β . Then, the algorithm Deco is executed to calculate μ ′ = D (pp, odk _β , oct _β ), and μ ′ is output as plain text.

  In the following, the re-convertible encryption method π = (SU, G, E, which can configure the proxy re-encryption method Π = (Setup, Gen, Enc1, Dec1, Enc2, Dec2, RekeyGen, ReEnc) of the above embodiment. D, RKG, Switch) will be specifically described. In the first to eighth embodiments, an example in which a lattice encryption scheme is used as an asymmetric encryption scheme will be described. In the ninth and tenth embodiments, an example in which an NTRU encryption scheme is used will be described. Both the lattice encryption method and the NTRU encryption method are public key encryption methods, and are homomorphic encryption methods. The configuration and processing of the re-encryption system are the same as those in the above-described embodiment except that the re-convertible encryption method π is embodied and the proxy re-encryption method Π is embodied. Therefore, the following description focuses on the specific configurations of the reconvertible encryption method π and the proxy re-encryption method Π.

  In Example 1, Reference 1 (Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. (Leveled) fully homomorphic encryption without bootstrapping, in Shafi Goldwasser, editor, ITCS 2012, pages 309-325. ACM, 2012 An example of applying the method of.

<Definition of deterministic algorithms BD and P2>
The deterministic algorithms BD and P2 described in Reference 1 are defined as follows.
Assume that p ^δ−1 ≦ q <p ^δ is satisfied for integers p, δ, and q (for example, prime numbers) of 1 or more. That is, q can be expressed as a number of p-adic δ digits.

を満たすように計算し、（ｕ_１，・・・，ｕ_δ）∈Ｚ_ｐ ^ｎδを出力する。ただし、Ｚ_ｐは整数ｐ（例えばｐ≧２）を法とした整数の剰余類の集合である。Ｚ_ｐの例はｐを法とした整数の剰余類の代表元の集合である。例えば、Ｚ_ｐは整数ｚに対するｚ ｍｏｄ ｐの集合、すなわちＺ_ｐ＝｛０，・・・，ｐ−１｝である。また、ｎは１以上の整数であり、ｘ∈Ｚ_ｐ ^ｎはｘがＺ_ｐのｎ個の元からなることを意味する。 BD: The algorithm BD takes a vector xεZ _q ⁿ as an input, and for k = 1,..., Δ, a vector u _k εZ _p ⁿ

Calculated so as to _satisfy, and outputs _{(u 1, ···, u δ} ) ∈Z p nδ. Here, Z _p is a set of integer remainder classes modulo integer p (eg, p ≧ 2). Examples of Z _p is a representative source of the set of integers of residue classes modulo to p. For example, Z _p is a set of z mod p for an integer z, ie, Z _p = {0,..., P−1}. Further, n is an integer equal to or greater than 1, and x∈Z _pn ^means that x is composed of n _elements of Z _p .

を出力する。ただし、

は行列のクロネッカー積であり、［・］^Ｔは［・］の転置を表す。アルゴリズムＰ２は、サイズｎ×ｇの行列Ｓ＝［ｓ_１，・・・，ｓ_ｇ］∈Ｚ_ｑ ^ｎ×ｇを入力にとる場合に、サイズｎδ×ｇの行列［Ｐ（ｓ_１），・・・，Ｐ（ｓ_ｇ）］∈Ｚ_ｑ ^ｎδ×ｇを出力する。ただし、ｇは１以上の整数であり、Ｓ∈Ｚ_ｑ ^ｎ×ｇはサイズｎ×ｇの行列Ｓの各要素がＺ_ｑの元であることを表す。これらのアルゴリズムの定義より、任意のベクトルｘ∈Ｚ_ｑ ^ｎおよび行列Ｓ∈Ｚ_ｑ ^ｎ×ｇについて、ＢＤ（ｘ）Ｐ２（Ｓ）＝ｘＳ∈Ｚ_ｑ ^ｇを満たす。 P2: Algorithm P2 takes a vector sεZ _q ⁿ as input,

Is output. However,

Is the Kronecker product of the matrix and [•] ^T represents the transpose of [•]. The algorithm P2 takes a matrix S = [s ₁ ,..., S _g ] ∈Z _q ^{n × g} of size ^{n × g} and inputs a matrix [P (s ₁ ),. .., P (s _g )] εZ _q ^{nδ × g} is output. However, g is an integer greater than or ^{equal to} 1, and SεZ _q ^{n × g} represents that each element of the matrix S of size n × g is an element of Z _q . From the definition of these algorithms, BD (x) P2 (S) = xSεZ _q ^g is satisfied for an arbitrary vector xεZ _q ⁿ and a matrix SεZ _q ^{n × g} .

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described. SU, G, E, D, and Switch are based on Reference 1.

で定義される。ν∈（０，１）および整数ｑ≧１について、ガウス分布Ｎ（０，ν^２／２π）に従って得られるサンプルｘに対し、

で表される分布をχとする。ただし、（０，１）は０より大きく１より小さな閉区間｛ν｜０＜ν＜１｝を表し、

は実数ωの天井関数を表し、実数ωに対してω以上の最小の整数を意味する。 SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a matrix AεZ _q ^{m × n,} and outputs a common parameter pp = (κ, 1 ⁿ , q, m, g, χ, A). (Pp ← SU ( ^1κ )). However, n, m, and g are integers of 1 or more. In addition, a Gaussian distribution N (0, σ ² ) having an average of 0 and a variance σ ² is a real density function.

Defined by For a sample x obtained according to a Gaussian distribution N (0, ν ² / 2π) for ν∈ (0,1) and an integer q ≧ 1,

Let χ be the distribution represented by However, (0,1) represents a closed interval {ν | 0 <ν <1} that is larger than 0 and smaller than 1.

Represents the ceiling function of a real number ω, and means the smallest integer greater than or equal to ω with respect to the real number ω.

G: The key generation algorithm G takes pp as input, randomly selects a matrix SεZ _q ^{n × g} , and selects a matrix XεZ _q ^{m × g} of size ^{m × g} according to the distribution χ ^{m × g} . That is, each element of the matrix X follows the distribution χ. The key generation algorithm G calculates B = AS + XεZ _q ^{m × g} , sets ek = B and dk = (S, B), and outputs a pair (ek, dk) of an encryption key and a decryption key (( ek, dk) <-G (pp)).

を計算し、暗号文ｃ＝（Ｕ，Ｃ）∈Ｚ_ｑ ^ｎ×Ｚ_ｑ ^ｇを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: Encryption algorithm E is, pp, take ek = B∈Z _q ^{m × g,} the input plaintext μ∈Z _p ^g, the vector e∈ {-1, + ^1} of m elements ^m randomly selects ,

And ciphertext c = (U, C) εZ _q ⁿ × Z _q ^g is output (c = E (pp, ek, μ)).

を計算し、平文μ’∈Ｚ_ｐ ^ｇを出力する（μ’←Ｄ（ｐｐ，ｄｋ，ｃ））。なお、ベクトルψ＝（ψ_１，・・・，ψ_Ｉ）とすると、ψ ｍｏｄ θは（ψ_１ ｍｏｄ θ，・・・，ψ_Ｉ ｍｏｄ θ）を意味する。 D: The decryption algorithm D takes pp, dk = (S, B), ciphertext c = (U, C) as input, calculates d = C-US mod q,

It was calculated, and outputs the plaintext ^{_{μ'∈Z p g (μ '← D}} (pp, dk, c)). When the vector ψ = (ψ ₁ ,..., Ψ _I ), ψ mod θ means (ψ ₁ mod θ,..., Ψ _I mod θ).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (S _α , B _α ), ek _β = B _β . However, dk _α = (S _α , B _α ) is a decryption key obtained for the user α, and ek _β = B _β is an encryption key obtained for the user β. All the keys are obtained by the key generation algorithm G. The conversion key generation algorithm RKG randomly selects a matrix Yε {−1, + 1} ^{nδ × m} of size nδ × m, and M _{α → β} = Y [A | B _β ] + [O | −P2 (S _α )] ΕZ _q ^{nδ × (n + g)} and the basic transformation key rk _{α → β} = M _{α → β} εZ _q ^{nδ × (n + g)} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β)). However, [A | B _β ] ∈Z _q ^{m × (n + g)} for the matrix A∈Z _q ^{m × n} and the matrix B _β ∈Z _q ^{m × g} is equal to that of the matrix B _β after n columns of the matrix A. It is a matrix of size m × (n + g) connecting g columns. O is a zero matrix OεZ _q ^{nδ × m} of size nδ × ^m , and all elements are zero.

RG: The randomized key generation algorithm RG takes pp, ek _β = B _β as an input, randomly selects a matrix Y′∈ {−1, + 1} ^{m × m} of size m × m, and [T _β | N _β ] = Y ′ [A | B _β ] εZ _q ^{m × (n + g)} , and the randomized key (rpp _β , rek _β ) = (T _β , N _β ) εZ _q ^{m × n} × Z _q ^{m ×} outputs the ^{_{g ((rpp β, rek β}} ) ← RG (pp, ek β)).

Switch: The conversion algorithm Switch receives pp, rk _{α → β} = M _{α → β} ∈ Z _q ^{nδ × (n + g)} , ciphertext c _α = (U _α , C _α ) ∈Z _q ⁿ × Z _q ^g Take. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (S _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (S _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD having the vector U _α εZ _q ⁿ as an input to obtain a vector BD (U _α ) εZ _q ^nδ , and U ′ | C ′ = BD (U _α ) M _{α → β} Let ∈Z _q ^{n + g} . However, U′∈Z _q ⁿ and C′∈Z _q ^g , and a vector obtained by combining C ′ after U ′ is BD (U _α ) M _{α → β} . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈Z _q ⁿ × Z _q ^g . _{(c β ← Switch (pp,} rk α → β, c α)).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, m, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, randomly selects a matrix S _y εZ _q ^{n × g,} and has a matrix X _y εZ _q ^{m of} size m × g. ^× select ^g in accordance with the distribution χ ^{m × g.} The algorithm Gen _y calculates B _y = AS _y + X _y ∈Z _q ^{m × g} , iek _y = oek _y = B _y and idky _y = odk _y = (S _y , B _y ), and the encryption key and A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

を計算し、ｃ_ｙ＝（Ｕ_ｙ，Ｃ_ｙ）∈Ｚ_ｑ ^ｎ×Ｚ_ｑ ^ｇを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μ, and a vector e _y ε {− 1, + 1} ^m is chosen at random,

Was _{calculated, c y = (U y,} C y) to ∈Z ^{_q n} × _{Z q} ^g is output as the ciphertext ict _y.

を計算し、平文μ’∈Ｚ_ｐ ^ｇを出力する。 Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (S _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y S} y mod q,

The calculated, and outputs the plaintext μ'∈Z _p ^g.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (S _α , B _α ) (first decryption key), oek _β = B _β (second encryption key), and a matrix Y of size nδ × m ∈ {−1, + 1} ^{nδ × m} is randomly selected, and M _{α → β} = Y [A | B _β ] + [O | −P2 (S _α )] ∈Z _q ^{nδ × (n + g)} is calculated, The basic conversion key rk _{α → β} = M _{α →} βεZ _q ^{nδ × (n + g)} is obtained. The algorithm RekeyGen randomly selects a matrix of size m × m Y′ε {−1, + 1} ^{m × m} , and [T _β | N _β ] = Y ′ [A | B _β ] εZ _q ^{m × (n + g )} To obtain a randomized key (rpp _β , rk _β ) = (T _β , N _β ) εZ _q ^{m × n} × Z _q ^{m × g} . The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) U ′ | C ′ = BD (U _α ) M _{α →} βεZ _q ^{n + g} is obtained, (U _β , C _β ) = (U ′, C ′ + C _α ) is obtained, and the ciphertext c ′ = ( U _β , C _β ) = (U ′, C ′ + C _α ) εZ _q ⁿ × Z _q ^g is obtained.
2) rpp _β = T _β , rek _β = N _β , a plaintext zero element as input, a vector e _β ε {-1, + 1} ^m consisting of m elements is randomly selected, and a ciphertext c '' = obtain _{(e β T β, e β} N β).
3) Oct _β = (U ′, C ′ + C _α ) + (e _β T _β , e _β N _β ) = (U ′ + e _β T _β , C ′ + C _α + e _β N _β ) as converted ciphertext Output.

  The second embodiment is a modification of the first embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the first embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 1.

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described.
SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a matrix AεZ _q ^{m × n,} and outputs a common parameter pp = (κ, 1 ⁿ , q, m, g, χ, A). (Pp ← SU ( ^1κ )).

G: The key generation algorithm G takes pp as input, randomly selects a matrix SεZ _q ^{n × g} , and selects a matrix XεZ _q ^{m × g} of size ^{m × g} according to the distribution χ ^{m × g} . Each element of the matrix X follows the distribution χ. The key generation algorithm G calculates B = AS + pX∈Z _q ^{m × g} , sets ek = B and dk = (S, B), and outputs a pair (ek, dk) of the encryption key and the decryption key (( ek, dk) <-G (pp)).

E: Encryption algorithm E is, pp, take ek = B∈Z _q ^{m × g,} the input plaintext μ∈Z _p ^g, the vector e∈ {-1, + ^1} of m elements ^m randomly selects , C = (U, C) = (eA, eB + μ), and outputs ciphertext c = (U, C) εZ _q ⁿ × Z _q ^g (c = E (pp, ek, μ)) .

D: The decryption algorithm D takes pp, dk = (S, B), ciphertext c = (U, C) as input, calculates d = C-US mod q, and calculates μ ′ = d mod p. , and outputs the plaintext ^{_{μ'∈Z p g (μ '← D}} (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (S _α , B _α ), ek _β = B _β . The conversion key generation algorithm RKG randomly selects a matrix Yε {−1, + 1} ^{nδ × m} of size nδ × m, and M _{α → β} ← Y [A | B _β ] + [O | −P2 (S _α )] ΕZ _q ^{nδ × (n + g)} and the basic transformation key rk _{α → β} = M _{α → β} εZ _q ^{nδ × (n + g)} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β)).

RG: The randomized key generation algorithm RG takes pp, ek _β = B _β as an input, randomly selects a matrix Y′∈ {−1, + 1} ^{m × m} of size m × m, and [T _β | N _β ] = Y ′ [A | B _β ] εZ _q ^{m × (n + g)} , and the randomized key (rpp _β , rek _β ) = (T _β , N _β ) εZ _q ^{m × n} × Z _q ^{m ×} outputs the ^{_{g ((rpp β, rek β}} ) ← RG (pp, ek β)).

Switch: The conversion algorithm Switch receives pp, rk _{α → β} = M _{α → β} ∈ Z _q ^{nδ × (n + g)} , ciphertext c _α = (U _α , C _α ) ∈Z _q ⁿ × Z _q ^g Take. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (S _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (S _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD having the vector U _α εZ _q ⁿ as an input to obtain a vector BD (U _α ) εZ _q ^nδ , and U ′ | C ′ ← BD (U _α ) M _{α → β} Let ∈Z _q ^{n + g} . However, U′∈Z _q ⁿ and C′∈Z _q ^g , and a vector obtained by combining C ′ after U ′ is BD (U _α ) M _{α → β} . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈Z _q ⁿ × Z _q ^g . _{(c β ← Switch (pp,} rk α → β, c α)).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, m, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, randomly selects a matrix S _y εZ _q ^{n × g,} and has a matrix X _y εZ _q ^{m of} size m × g. ^× select ^g in accordance with the distribution χ ^{m × g.} The algorithm Gen _y calculates B _y = AS _y + pX _y ∈Z _q ^{m × g} , and iek _y = oek _y = B _y and idk _y = odk _y = (S _y , B _y ), and the encryption key and A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μ, and a vector e _y ε {− 1, + ^{1} m} randomly _{selected, c y = (U y,} C y) = (e y a, e y B y + μ) was _{calculated, c y = (U y,} C y) ∈Z q n × outputs the _Z ^{q g} as ciphertext ict _y.

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (S _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y S} y mod q, μ '= calculates the d y mod p, and outputs the plaintext μ'∈Z _p ^g.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

  RekeyGen: Same as Example 1.

  ReEnc: Same as in Example 1.

  The third embodiment is also a modification of the first embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the first embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 1.

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described.

SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a matrix AεZ _q ^{n × n} , and outputs a common parameter pp = (κ, 1 ⁿ , q, g, χ, A) (pp ← SU (1 ^κ )).

G: key generation algorithm G takes the input of pp, the matrix S∈Z _q ^{n × g} size n × g to select according to the distribution chi ^{n × g,} the distribution matrix X∈Z _q ^{n × g} size n × g Choose according to χ ^{n × g} . The key generation algorithm G calculates B = AS + XεZ _q ^{n × g} , sets ek = B and dk = (S, B), and outputs a pair (ek, dk) of an encryption key and a decryption key (( ek, dk) <-G (pp)).

を計算し、暗号文ｃ＝（Ｕ，Ｃ）∈Ｚ_ｑ ^ｎ×Ｚ_ｑ ^ｇを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: Encryption algorithm E ^{_{is, pp, ek = B∈Z q n}} × g, taken up in the input plaintext μ∈Z _p ^g, consisting of n element vector _e 1, _{e 2} ∈Z _q ⁿ and g-number of Select each element of a vector e ₃ ∈Z _q ^g consisting of elements according to the distribution χ,

And ciphertext c = (U, C) εZ _q ⁿ × Z _q ^g is output (c = E (pp, ek, μ)).

を計算し、平文μ’∈Ｚ_ｐ ^ｇを出力する（μ’←Ｄ（ｐｐ，ｄｋ，ｃ））。 D: The decryption algorithm D takes pp, dk = (S, B), ciphertext c = (U, C) as input, calculates d = C-US mod q,

It was calculated, and outputs the plaintext ^{_{μ'∈Z p g (μ '← D}} (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (S _α , B _α ), ek _β = B _β . The transformation key generation algorithm RKG selects each element of a matrix Y ₁ , Y ₂ εZ _q ^{nδ × n} of size ^{nδ × n} and a matrix Y ₃ εZ _q ^{nδ × g} of size nδ × g according to the distribution χ, and M _{α → β} = Y ₁ [A | B _β ] + [Y ₂ | Y ₃ ] + [O | −P2 (S _α )] ∈Z _q ^{nδ × (n + g)} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈Z _q ^{nδ × (n + g)} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )).

RG: Randomized key generation algorithm RG is, pp, taking to the input ek β ₌ B β, matrix _{Y 1} size _{n × n ', Y 2'} ∈Z q n × n and the size n × g matrix _{Y 3} 'of each element of ∈ Z _q ^{n × g} to select according to the distribution _{χ, [T β | n β} ] = Y 1 '[a | B β] + [Y 2' | Y 3 '] ∈Z q n × (n + g) And a randomized key (rpp _β , rk _β ) = (T _β , N _β ) ∈Z _q ^{n × n} × Z _q ^{n × g} is output ((rpp _β , rk _β ) ← RG (pp, ek _β)).

Switch: The conversion algorithm Switch receives pp, rk _{α → β} = M _{α → β} ∈ Z _q ^{nδ × (n + g)} , ciphertext c _α = (U _α , C _α ) ∈Z _q ⁿ × Z _q ^g Take. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (S _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (S _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD having the vector U _α εZ _q ⁿ as an input to obtain a vector BD (U _α ) εZ _q ^nδ , and U ′ | C ′ = BD (U _α ) M _{α → β} Let ∈Z _q ^{n + g} . However, U′∈Z _q ⁿ and C′∈Z _q ^g , and a vector obtained by combining C ′ after U ′ is BD (U _α ) M _{α → β} . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈Z _q ⁿ × Z _q ^g . _{(c β ← Switch (pp,} rk α → β, c α)).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, selects a matrix S _y εZ _q ^{n × g} of size n × ^g according to the distribution χ ^{n × g} , and size n × Choose the matrix X _y ∈ Z _q ^{n × g} of ^g according to the distribution χ ^{n × g} . The algorithm Gen _y calculates B _y = AS _y + X _y ∈Z _q ^{n × g} , iek _y = oek _y = B _y and idky _y = odk _y = (S _y , B _y ), and the encryption key and A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

を計算し、ｃ_ｙ＝（Ｕ_ｙ，Ｃ_ｙ）∈Ｚ_ｑ ^ｎ×Ｚ_ｑ ^ｇを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μ, and a vector _y e ₁ , _y consisting of n elements. choose each element of a vector _y e ₃ ∈Z _q ^g consisting of e ₂ ∈Z _q ⁿ and g elements according to the distribution χ,

Was _{calculated, c y = (U y,} C y) to ∈Z ^{_q n} × _{Z q} ^g is output as the ciphertext ict _y.

を計算し、平文μ’∈Ｚ_ｐ ^ｇを出力する。 Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (S _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y S} y mod q,

The calculated, and outputs the plaintext μ'∈Z _p ^g.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (S _α , B _α ) (first decryption key), oek _β = B _β (second encryption key), and a matrix Y of size nδ × n ₁ , Y ₂ εZ _q ^{nδ × n} and a size Y of nδ × g matrix Y ₃ εZ _q ^{nδ × g} are selected according to the distribution χ, and M _{α → β} = Y ₁ [A | B _β ] + [ Y ₂ | Y ₃ ] + [O | −P 2 (S _α )] εZ _q ^{nδ × (n + g)} is calculated, and the basic conversion key rk _{α → β} = M _{α →} βεZ _q ^{nδ × (n + g)} is ^calculated . obtain. Algorithm RekeyGen the matrix _{Y 1} size _{n × n ', Y 2'} ∈Z q n × matrix of ⁿ and the size n × g _{Y 3} 'wish accordance ∈ Z _q ^{n ×} distribution of each element of ^g chi, [T _{β | n β] = Y 1} '[a | B β] + [Y 2' | Y 3 '] ∈Z q n to calculate the ^{× (n + g),} a random key _{(rpp β, rek β) =} (T _beta, obtaining ^{_{n β) ∈Z q n × n}} × Z q n × g. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) U ′ | C ′ = BD (U _α ) M _{α →} βεZ _q ^{n + g} is obtained, (U _β , C _β ) = (U ′, C ′ + C _α ) is obtained, and the ciphertext c ′ = ( U _β , C _β ) = (U ′, C ′ + C _α ) εZ _q ⁿ × Z _q ^g is obtained.
2) rpp _β = T _β , rek _β = N _β , a zero element as plain text, and a vector e ₁ , e ₂ εZ _q ⁿ consisting of ⁿ elements and a vector e ₃ ε consisting of g elements Each element of Z _q ^g is selected according to the distribution χ to obtain c ″ = (e ₁ T _β + e ₂ , e ₁ N _β + e ₃ ).
3) oct _β = (U ′, C ′ + C _α ) + (e ₁ T _β + e ₂ , e ₁ N _β + e ₃ ) = (U ′ + e ₁ T _β + e ₂ , C ′ + C _α + e ₁ N _β + e ₃ ) is output as converted ciphertext.

  The fourth embodiment is a modification of the third embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the first embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 1.

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described.

SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a matrix AεZ _q ^{n × n} , and outputs a common parameter pp = (κ, 1 ⁿ , q, g, χ, A) (pp ← SU (1 ^κ )).

G: The key generation algorithm G takes pp as input, selects a matrix S _y εZ _q ^{n × g} of size ^{n × g} according to the distribution χ ^{n × g} , and selects the matrix SεZ _q ^{n × g} as distribution χ ^{n × g} Choose according to. The key generation algorithm G calculates B = AS + pXεZ _q ^{n × g} , sets ek = B and dk = (S, B), and outputs a pair (ek, dk) of the encryption key and the decryption key (( ek, dk) <-G (pp)).

E: Encryption algorithm E ^{_{is, pp, ek = B∈Z q n}} × g, taken up in the input plaintext μ∈Z _p ^g, consisting of n element vector _e 1, _{e 2} ∈Z _q ⁿ and g-number of Each element of the vector e ₃ ∈Z _q ^g consisting of elements is selected according to the distribution χ, and c = (U, C) = (e ₁ A + pe ₂ , e ₁ B + e ₃ + μ) is calculated, and the ciphertext c = (U, C) εZ _q ⁿ × Z _q ^g is output (c = E (pp, ek, μ)).

D: The decryption algorithm D takes pp, dk = (S, B), ciphertext c = (U, C) as input, calculates d = C-US mod q, and calculates μ ′ = d mod p. , and outputs the plaintext ^{_{μ'∈Z p g (μ '← D}} (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (S _α , B _α ), ek _β = B _β . The transformation key generation algorithm RKG selects each element of a matrix Y ₁ , Y ₂ εZ _q ^{nδ × n} of size ^{nδ × n} and a matrix Y ₃ εZ _q ^{nδ × g} of size nδ × g according to the distribution χ, and M _{α → β} = Y ₁ [A | B _β ] + p [Y ₂ | Y ₃ ] + [O | −P2 (S _α )] ∈Z _q ^{nδ × (n + g)} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈Z _q ^{nδ × (n + g)} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )).

RG: Randomized key generation algorithm RG is, pp, taking to the input ek β ₌ B β, matrix _{Y 1} size _{n × n ', Y 2'} ∈Z q n × n and the size n × g matrix _{Y 3} 'of each element of ∈ Z _q ^{n × g} to select according to the distribution _{χ, [T β | n β} ] = Y 1 '[a | B β] + p [Y 2' | Y 3 '] ∈Z q n × (n + g) And a randomized key (rpp _β , rk _β ) = (T _β , N _β ) ∈Z _q ^{n × n} × Z _q ^{n × g} is output ((rpp _β , rk _β ) ← RG (pp, ek _β)).

Switch: The conversion algorithm Switch receives pp, rk _{α → β} = M _{α → β} ∈ Z _q ^{nδ × (n + g)} , ciphertext c _α = (U _α , C _α ) ∈Z _q ⁿ × Z _q ^g Take. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (S _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (S _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD having the vector U _α εZ _q ⁿ as an input to obtain a vector BD (U _α ) εZ _q ^nδ , and U ′ | C ′ = BD (U _α ) M _{α → β} Let ∈Z _q ^{n + g} . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈Z _q ⁿ × Z _q ^g . _{(c β ← Switch (pp,} rk α → β, c α)).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, selects a matrix S _y εZ _q ^{n × g} of size n × ^g according to the distribution χ ^{n × g} , and size n × Choose the matrix X _y ∈ Z _q ^{n × g} of ^g according to the distribution χ ^{n × g} . The algorithm Gen _y calculates B _y = AS _y + pX _y ∈Z _q ^{n × g} , iek _y = oek _y = B _y and idk _y = odk _y = (S _y , B _y ), and the encryption key and A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μ, and a vector _y e ₁ , _y consisting of n elements. Each element of a vector _y e ₃ ∈Z _q ^g consisting of e ₂ ∈Z _q ⁿ and g elements is selected according to the distribution χ, and c _y = (U _y , C _y ) = ( _y e ₁ A + p _y e ₂ , _y e ₁ B _y + _y e ₃ + μ) is calculated, and c _y = (U _y , C _y ) εZ _q ⁿ × Z _q ^g is output as the ciphertext tic _y .

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (S _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y S} y mod q, μ '= calculates the d y mod p, and outputs the plaintext μ'∈Z _p ^g.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (S _α , B _α ) (first decryption key), oek _β = B _β (second encryption key), and a matrix Y of size nδ × n ₁ , Y ₂ εZ _q ^{nδ × n} and a matrix Y ₃ εZ _q ^{nδ × g} of size size nδ × g are selected according to the distribution χ, and M _{α → β} = Y ₁ [A | B _β ] + p [ Y ₂ | Y ₃ ] + [O | −P 2 (S _α )] εZ _q ^{nδ × (n + g)} is calculated, and the basic conversion key rk _{α → β} = M _{α →} βεZ _q ^{nδ × (n + g)} is ^calculated . obtain. Algorithm RekeyGen the matrix _{Y 1} size _{n × n ', Y 2'} ∈Z q n × matrix of ⁿ and the size n × g _{Y 3} 'wish accordance ∈ Z _q ^{n ×} distribution of each element of ^g chi, [T _{β | n β] = Y 1} '[a | B β] + p [Y 2' | Y 3 '] ∈Z q n to calculate the ^{× (n + g),} a random key _{(rpp β, rek β) =} (T _beta, obtaining ^{_{n β) ∈Z q n × n}} × Z q n × g. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) U ′ | C ′ = BD (U _α ) M _{α →} βεZ _q ^{n + g} is obtained, (U _β , C _β ) = (U ′, C ′ + C _α ) is obtained, and the ciphertext c ′ = ( U _β , C _β ) = (U ′, C ′ + C _α ) εZ _q ⁿ × Z _q ^g is obtained.
2) rpp _β = T _β , rek _β = N _β , a zero element as plain text, and a vector e ₁ , e ₂ εZ _q ⁿ consisting of ⁿ elements and a vector e ₃ ε consisting of g elements Each element of Z _q ^g is selected according to the distribution χ to obtain c ″ = (e ₁ T _β + pe ₂ , e ₁ N _β + e ₃ ).
3) oct _β = (U ′, C ′ + C _α ) + (e ₁ T _β + pe ₂ , e ₁ N _β + e ₃ ) = (U ′ + e ₁ T _β + pe ₂ , C ′ + C _α + e ₁ N _β + e ₃ ) is output as converted ciphertext.

  In the fifth embodiment, the same configuration as that of the first embodiment is realized on a polynomial ring.

<Definition of deterministic algorithms BD and P2>
The deterministic algorithms BD and P2 described in Reference 1 are defined as follows.
k (κ) is an integer function, and n (κ) = 2 ^{k (κ)} . Let f (x) = x ⁿ +1. However, n is an integer of 1 or more. Let q (κ) be an integer function and q = q (κ) be a prime number. Let R = Z [x] / (f (x)) and R _q = R / qR. It is assumed that p ^δ−1 ≦ q <p ^δ is satisfied for integers p and δ of 1 or more.

を満たすように計算し、（ｕ_１，・・・，ｕ_δ）∈Ｒ_ｐ ^δを出力する。（ｕ_１，・・・，ｕ_δ）∈Ｒ_ｐ ^δは（ｕ_１，・・・，ｕ_δ）がδ個の環Ｒの元からなるとを意味する。 BD: The algorithm BD takes xεR _q as input and sets u _k εR _p for k = 1,.

And (u ₁ ,..., U _δ ) ∈R _p ^δ is output. (U ₁ ,..., U _δ ) ∈R _p ^δ means that (u ₁ ,..., U _δ ) is made up of δ rings R.

を出力する。これらのアルゴリズムの定義より、任意のｘ，ｓ∈Ｒ_ｑについて、ＢＤ（ｘ）Ｐ２（ｓ）＝ｘｓ∈Ｒ_ｑを満たす。 P2: Algorithm P2 takes sεR _q as input,

Is output. The definition of these algorithms, any x, the _{s∈R q, BD (x) P2} (s) = satisfy xs∈R _q.

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described. SU, G, E, and D are reference 1 and reference 2 (Vadim Lyubashevsky, Chris Peikert, and Oded Regev, On ideal lattices and learning with errors over rings, in Henri Gilbert, editor, EUROCRYPT 2010, volume 6110 of LNCS, pages 1-23, Springer, Heidelberg, 2010.). Switch is based on Reference 1.

SU: The common parameter generation algorithm SU takes κ as an input, selects a matrix AεR _q ^{m × 1} at random, and outputs a common parameter pp = (κ, 1 ⁿ , q, m, g, χ, A). (Pp ← SU ( ^1κ )). However, n, m, and g are integers of 1 or more. The definitions of the distribution χ and the ceiling function are the same as those in the first embodiment.

G: The key generation algorithm G takes pp as an input, randomly selects sεR _q , and selects a matrix XεR _q ^{m × 1} of size ^{m × 1} according to the distribution χ ^{m × 1} . That is, each element of the matrix X follows the distribution χ. The key generation algorithm G calculates B = As + XεR _q ^{m × 1} , sets ek = B and dk = (s, B), and outputs a pair (ek, dk) of an encryption key and a decryption key (( ek, dk) <-G (pp)).

を計算し、暗号文ｃ＝（Ｕ，Ｃ）∈Ｒ_ｑ×Ｒ_ｑを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: The encryption algorithm E takes pp, ek = B∈R _q ^{m × 1} , plaintext μ∈R _p as input, and randomly selects e∈R _q ^m consisting of ^m elements,

And ciphertext c = (U, C) εR _q × R _q is output (c = E (pp, ek, μ)).

を計算し、平文μ’∈Ｒ_ｐを出力する（μ’←Ｄ（ｐｐ，ｄｋ，ｃ））。 D: The decryption algorithm D takes pp, dk = (s, B), ciphertext c = (U, C) as input, calculates d = C-Us mod q,

And plaintext μ′∈R _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (s _α , B _α ), ek _β = B _β . However, dk _α = (s _α , B _α ) is a decryption key obtained for the user α, and ek _β = B _β is an encryption key obtained for the user β. All the keys are obtained by the key generation algorithm G. The transformation key generation algorithm RKG randomly selects a matrix YεR ₂ ^{δ × m} of size δ × m, and M _{α → β} = Y [A | B _β ] + [O | −P2 (s _α )] εR _q ^{δ × 2} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )). However, for the matrix A∈R _q ^{m × 1} and matrix ^{_{B β ∈R q m × 1 [}} A | B β] ∈R q m × 2 is one of the matrix B _beta after one column of the matrix A Matrix of size m × 2 obtained by concatenating the columns. Further, O is the column O∈R _q ^δ consisting of [delta] number of zero elements, all elements are 0 and R _q.

RG: The randomized key generation algorithm RG takes pp, ek _β = B _β as an input, randomly selects a matrix Y′∈R ₂ ^{m × m} of size m × m, and [T _β | N _β ] = Y ′. [A | B _β ] ∈R _q ^{m × 2} is calculated, and a randomized key (rpp _β , rek _β ) = (T _β , N _β ) ∈R _q ^{m × 1} × R _q ^{m × 1} is output ( (Rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} and ciphertext c _α = (U _α , C _α ) ∈R _q × R _q as inputs. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (s _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (s _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD with U _α εR _q as an input to obtain BD (U _α ) εR _q ^δ , and (U ′, C ′) = BD (U _α ) M _{α → β} ε Let R _q × R _q . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈R _q × R _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, m, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, randomly selects s _y εR _q , and distributes a matrix X _y εR _q ^{m × 1} of size m × 1 Choose according to χ ^{m × 1} . The algorithm Gen _y calculates B _y = As _y + X _y ∈R _q ^{m × 1} and sets iek _y = oek _y = B _y and idky _y = odk _y = (s _y , B _y ) A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

を計算し、ｃ_ｙ＝（Ｕ_ｙ，Ｃ_ｙ）∈Ｒ_ｑ×Ｒ_ｑを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μεR _p , and e _y ε consisting of m elements. Choose R _q ^m at random,

Was _{calculated, c y = (U y,} C y) a ∈R _q × _{R q} is output as the ciphertext ict _y.

を計算し、平文μ’∈Ｒ_ｐを出力する。 Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (s _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y s} y mod q,

And plaintext μ′∈R _p is output.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (s _α , B _α ) (first decryption key), oek _β = B _β (second encryption key), and a matrix Y of size δ × m ∈ R ₂ ^{δ × m} is selected at random, and M _{α → β} = Y [A | B _β ] + [O | −P2 (s _α )] ∈R _q ^{δ × 2} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} is obtained. The algorithm RekeyGen randomly selects a matrix Y′εR ₂ ^{m × m} of size m × m, and (T _β , N _β ) = Y ′ [A | B _β ] εR _q ^{m × 1} × R _q ^{m × 1} is calculated, and the randomized key (rpp _β , rk _β ) = (T _β , N _β ) εR _q ^{m × 1} × R _q ^{m × 1} is obtained. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) (U ', C' ) = give _{BD (U α) M α →} β ∈R q × R q, give _{(U β, C β) =} (U ', C' + C α), the ciphertext c ′ = (U _β , C _β ) = (U ′, C ′ + C _α ) ∈R _q × R _q is obtained.
2) rpp _β = T _β , rek _β = N _β , a zero element as a plaintext is input, e _β ∈R _q ^m consisting of m elements is randomly selected, and a ciphertext c ″ = (e _β T _β , e _β N _β ) ∈R _q × R _q is obtained.
_{3) oct β = (U '} , C' + C α) + (e β T β, e β N β) = (U '+ e β T β, C' + C α + e β N β) ∈R q × R q Is output as converted ciphertext.

  The sixth embodiment is a modification of the fifth embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the fifth embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 5.

<Reconvertible encryption method>
The reconvertible encryption method π = (SU, G, E, D, RKG, Switch) of this embodiment will be described.
SU: The common parameter generation algorithm SU takes κ as an input, selects a matrix AεR _q ^{m × 1} at random, and outputs a common parameter pp = (κ, 1 ⁿ , q, m, g, χ, A). (Pp ← SU ( ^1κ )).

G: The key generation algorithm G takes pp as an input, randomly selects sεR _q , and selects a matrix XεR _q ^{m × 1} of size ^{m × 1} according to the distribution χ ^{m × 1} . The key generation algorithm G calculates B = As + pXεR _q ^{m × 1} , sets ek = B and dk = (s, B), and outputs a pair (ek, dk) of an encryption key and a decryption key (( ek, dk) <-G (pp)).

E: The encryption algorithm E takes pp, ek = B∈R _q ^{m × 1} , plaintext μ∈R _p as input, and randomly selects e∈R _q ^m consisting of ^m elements, and c = (U, C) = (eA, eB + μ) is calculated and ciphertext c = (U, C) ∈R _q × R _q is output (c = E (pp, ek, μ)).

D: The decryption algorithm D takes pp, dk = (s, B) and ciphertext c = (U, C) as input, calculates d = C−Us mod q, and calculates μ ′ = d mod p. , Plaintext μ′εR _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (s _α , B _α ), ek _β = B _β . The transformation key generation algorithm RKG randomly selects a matrix YεR ₂ ^{δ × m} of size δ × m, and M _{α → β} = Y [A | B _β ] + [O | −P2 (s _α )] εR _q ^{δ × 2} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )).

RG: The randomized key generation algorithm RG takes pp, ek _β = B _β as an input, randomly selects a matrix Y′∈R ₂ ^{m × m} of size m × m, and [T _β | N _β ] = Y ′. [A | B _β ] ∈R _q ^{m × 2} is calculated, and a randomized key (rpp _β , rek _β ) = (T _β , N _β ) ∈R _q ^{m × 1} × R _q ^{m × 1} is output ( (Rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} and ciphertext c _α = (U _α , C _α ) ∈R _q × R _q as inputs. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (s _α , B _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (s _β , B _β ). dk _β corresponds to the encryption key ek _β = B _β described above. The transformation algorithm Switch executes an algorithm BD with U _α εR _q as an input to obtain BD (U _α ) εR _q ^δ , and (U ′, C ′) = BD (U _α ) M _{α → β} ε Let R _q × R _q . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈R _q × R _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, 1 ⁿ , q, m, g, χ, A).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input, randomly selects s _y εR _q , and distributes a matrix X _y εR _q ^{m × 1} of size m × 1 Choose according to χ ^{m × 1} . The algorithm Gen _y calculates B _y = As _y + pX _y ∈R _q ^{m × 1} , iek _y = oek _y = B _y and idk _y = odk _y = (s _y , B _y ), and the encryption key A set of decryption keys (iek _y = oek _y , idk _y = odk _y ) is output.

Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = B _y , plaintext μ, and e _y εR _q ^m consisting of m elements. the chosen _{randomly, c y = (U y,} C y) = (e y a, e y B y + μ) to calculate _{the, c y = (U y,} C y) ciphertext ∈R _q × _{R q} and outputs it as ict _y.

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci is expressed as PP = pp, idk _y = (s _y , B _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y s} y mod q, μ '= calculates the d y mod p, and outputs the plaintext μ'∈R _p.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

  RekeyGen: Same as Example 5.

  ReEnc: Same as in Example 5.

  In Example 7, SU, G, E, and D are based on Reference 2 and Switch is based on Reference 3 (Zvika Brakerski and Vinod Vaikuntanathan, Fully homomorphic encryption from ring-LWE and security for key dependent messages, in Phillip Rogaway, editor , CRYPTO 2011, volume 6841 of LNCS, pages 505-524, Springer, Heidelberg, 2011.). Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the fifth embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 5.

<Reconvertible encryption method>
SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a∈R _q , and outputs a common parameter pp = (κ, n, q, χ, a) (pp ← SU (1 ^κ )) .

G: The key generation algorithm G takes pp as input and selects s, xεR _q according to the distribution χ. The key generation algorithm G calculates b = as + xεR _q , sets ek = b and dk = (s, b), and outputs a pair (ek, dk) of the encryption key and the decryption key ((ek, dk) ) ← G (pp)).

を計算し、暗号文ｃ＝（Ｕ，Ｃ）∈Ｒ_ｑ×Ｒ_ｑを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: The encryption algorithm E takes pp, ek = b∈R _q , plaintext μ∈R _p as input, and selects e ₁ , e ₂ , e ₃ ∈R _q according to the distribution χ,

And ciphertext c = (U, C) εR _q × R _q is output (c = E (pp, ek, μ)).

を計算し、平文μ’∈Ｒ_ｐを出力する（μ’←Ｄ（ｐｐ，ｄｋ，ｃ））。 D: The decryption algorithm D takes pp, dk = (s, b), ciphertext c = (U, C) as input, and calculates d = C-Us mod q,

And plaintext μ′∈R _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (s _α , b _α ), ek _β = b _β . The conversion key generation algorithm RKG selects Y ₁ , Y ₂ , Y ₃ ∈ R _q ^{1 × δ according} to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ [a | b _β ] + [Y ₂ | Y ₃ ] + [O | −P2 (s _α )] ∈R _q ^{2 × δ} is calculated, and a basic conversion key rk _{α → β} = M _{α →} β∈R _q ^{2 × δ} is output (rk _{α → β} ← RKG (Pp, dk _α , ek _β )).

RG: The randomized key generation algorithm RG takes pp, ek _β = b _β as input, selects Y ₁ ′, Y ₂ ′, Y ₃ ′ ∈R _q according to the distribution χ, and (T _β , N _β ) = Y ₁ ′ [a | b _β ] + [Y ₂ ′ | Y ₃ ′] ∈R _q ² is calculated, and the randomized key (rpp _β , rk _β ) = (T _β , N _β ) ∈R _q × R _q Is output ((rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} and ciphertext c _α = (U _α , C _α ) ∈R _q × R _q as inputs. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (s _α , b _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (s _β , b _β ). dk _β corresponds to the encryption key ek _β = b _β described above. The transformation algorithm Switch executes an algorithm BD with U _α εR _q as an input to obtain BD (U _α ) εR _q ^δ , and (U ′, C ′) = BD (U _α ) M _{α → β} ε Let R _q × R _q . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈R _q × R _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, n, q, χ, a).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input and selects s _y , x _y εR _q according to the distribution χ. Algorithm Gen _{y calculates} a _{b y = as y + x y} ∈R q, iek y = oek y = b y and _{idk y = odk y = (s} y, b y) and, for encryption and decryption keys A set (iek _y = oek _y , idk _y = odk _y ) is output.

を計算し、ｃ_ｙ＝（Ｕ_ｙ，Ｃ_ｙ）∈Ｒ_ｑ×Ｒ_ｑを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = b _y , plaintext μ, and _y e ₁ , _y e ₂ , _y e ₃ ε select the R _q at random,

Was _{calculated, c y = (U y,} C y) a ∈R _q × _{R q} is output as the ciphertext ict _y.

を計算し、平文μ’∈Ｒ_ｐを出力する。 Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci has the following formula: PP = pp, idk _y = (s _y , b _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y s} y mod q,

And plaintext μ′∈R _p is output.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (s _α , b _α ) (first decryption key), oek _β = b _β (second encryption key), and inputs Y ₁ , Y ₂ , Y ₃ ∈ R _q ^{1 × δ} is selected according to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ [a | b _β ] + [Y ₂ | Y ₃ ] + [O | −P2 (s _α )] ∈R _q ^{2 × δ} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{2 × δ} is obtained. Algorithm RekeyGen _{is, Y 1 ', Y 2'} , Y 3 ' and ∈R _q select according to the distribution _{χ, (T β, N β} ) = Y 1' [a | b β] + [Y 2 '| Y 3' ] ΕR _q ² is calculated, and the randomized key (rpp _β , rek _β ) = (T _β , N _β ) εR _q ^m × R _q ^m is obtained. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) (U ', C' ) = give _{BD (U α) M α →} β ∈R q × R q, give _{(U β, C β) =} (U ', C' + C α), the ciphertext c ′ = (U _β , C _β ) = (U ′, C ′ + C _α ) ∈R _q × R _q is obtained.
2) rpp _β = T _β , rek _β = N _β , the zero element as plain text is input, _β e ₁ , _β e ₂ , _β e ₃ ∈R _q are selected according to the distribution χ, and the ciphertext c ″ = ( obtaining _{T β e 1 + β e 2} , N β β e 1 + β e 3) ∈R q × R q.
_{3) oct β = (U '} , C' + C α) + (T β e 1 + β e 2, N β β e 1 + β e 3) = (U '+ T β e 1 + β e 2, C '+ C _α + N _{β β} e ₁ + _β e ₃ ) εR _q × R _q is output as the converted ciphertext.

  The eighth embodiment is a modification of the seventh embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the fifth embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 5.

<Reconvertible encryption method>
SU: The common parameter generation algorithm SU takes κ as an input, randomly selects a∈R _q , and outputs a common parameter pp = (κ, n, q, χ, a) (pp ← SU (1 ^κ )) .

G: The key generation algorithm G takes pp as input and selects s, xεR _q according to the distribution χ. The key generation algorithm G calculates b = as + pxεR _q , sets ek = b and dk = (s, b), and outputs a pair (ek, dk) of the encryption key and the decryption key ((ek, dk) ) ← G (pp)).

を計算し、暗号文ｃ＝（Ｕ，Ｃ）∈Ｒ_ｑ×Ｒ_ｑを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: The encryption algorithm E takes pp, ek = b∈R _q , plaintext μ∈R _p as input, and selects e ₁ , e ₂ , e ₃ ∈R _q according to the distribution χ,

And ciphertext c = (U, C) εR _q × R _q is output (c = E (pp, ek, μ)).

D: The decryption algorithm D takes pp, dk = (s, b) and ciphertext c = (U, C) as input, calculates d = C−Us mod q, and calculates μ ′ = d mod p. , Plaintext μ′εR _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (s _α , b _α ), ek _β = b _β . The conversion key generation algorithm RKG selects Y ₁ , Y ₂ , Y ₃ ∈ R _q ^{1 × δ according} to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ [a | b _β ] + p [Y ₂ | Y ₃ ] + [O | −P2 (s _α )] ∈R _q ^{2 × δ} is calculated, and a basic conversion key rk _{α → β} = M _{α →} β∈R _q ^{2 × δ} is output (rk _{α → β} ← RKG (Pp, dk _α , ek _β )).

RG: The randomized key generation algorithm RG takes pp, ek _β = b _β as input, selects Y ₁ ′, Y ₂ ′, Y ₃ ′ ∈R _q according to the distribution χ, and (T _β , N _β ) = Y ₁ ′ [a | b _β ] + p [Y ₂ ′ | Y ₃ ′] ∈R _q ² is calculated, and the randomized key (rpp _β , rk _β ) = (T _β , N _β ) ∈R _q × R _q Is output ((rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{δ × 2} and ciphertext c _α = (U _α , C _α ) ∈R _q × R _q as inputs. However, the ciphertext c _α = (U _α , C _α ) is a ciphertext that can be decrypted with the decryption key dk _α = (s _α , b _α ) of the user α, and the ciphertext c _β is the decryption key dk of the user β. It is a ciphertext that can be decrypted with _β = (s _β , b _β ). dk _β corresponds to the encryption key ek _β = b _β described above. The transformation algorithm Switch executes an algorithm BD with U _α εR _q as an input to obtain BD (U _α ) εR _q ^δ , and (U ′, C ′) = BD (U _α ) M _{α → β} ε Let R _q × R _q . The conversion algorithm Switch further calculates (U _β , C _β ) = (U ′, C ′ + C _α ), and outputs the ciphertext c _β = (U _β , C _β ) ∈R _q × R _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, n, q, χ, a).

Gen _y : Algorithm Gen _y (where yε {α, β}) takes pp as input and selects s _y , x _y εR _q according to the distribution χ. Algorithm Gen _{y calculates} a _{b y = as y + px y} ∈R q, iek y = oek y = b y and _{idk y = odk y = (s} y, b y) and, for encryption and decryption keys A set (iek _y = oek _y , idk _y = odk _y ) is output.

を計算し、ｃ_ｙ＝（Ｕ_ｙ，Ｃ_ｙ）∈Ｒ_ｑ×Ｒ_ｑを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = b _y , plaintext μ, and _y e ₁ , _y e ₂ , _y e ₃ ε select the R _q at random,

Was _{calculated, c y = (U y,} C y) a ∈R _q × _{R q} is output as the ciphertext ict _y.

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci has the following formula: PP = pp, idk _y = (s _y , b _y ), cipher text ic t _y = c _y = (U _y , C as input _y), calculates a _{d y = C y -U y s} y mod q, μ '= calculates the d y mod p, and outputs the plaintext μ'∈R _p.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (s _α , b _α ) (first decryption key), oek _β = b _β (second encryption key), and inputs Y ₁ , Y ₂ , Y ₃ ∈ R _q ^δ is selected according to the distribution χ ^δ , and M _{α → β} = Y ₁ [a | b _β ] + p [Y ₂ | Y ₃ ] + [O | −P2 (s _α )] ∈R _q ^{2 × δ} To obtain the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{2 × δ} . Algorithm RekeyGen _{is, Y 1 ', Y 2'} , Y 3 ' and ∈R _q select according to the distribution _{χ, (T β, N β} ) = Y 1' [a | b β] + p [Y 2 '| Y 3' ] ΕR _q ² is calculated, and the randomized key (rpp _β , rek _β ) = (T _β , N _β ) εR _q ^m × R _q ^m is obtained. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc is PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = (U _α , C _α ) (first cipher) Sentence) as input and calculate:
1) (U ', C' ) = give _{BD (U α) M α →} β ∈R q × R q, give _{(U β, C β) =} (U ', C' + C α), the ciphertext c ′ = (U _β , C _β ) = (U ′, C ′ + C _α ) ∈R _q × R _q is obtained.
2) rpp _β = T _β , rek _β = N _β , the zero element as plain text is input, _β e ₁ , _β e ₂ , _β e ₃ ∈R _q are selected according to the distribution χ, and the ciphertext c ″ = ( obtaining _{T β e 1 + p β e} 2, N β β e 1 + β e 3) ∈R q × R q.
_{3) oct β = (U '} , C' + C α) + (T β e 1 + p β e 2, N β β e 1 + β e 3) = (U '+ T β e 1 + p β e 2, C '+ C _α + N _{β β} e ₁ + _β e ₃ ) εR _q × R _q is output as the converted ciphertext.

  The switch of Example 9 is based on Reference 3. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the fifth embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 5.

<Reconvertible encryption method>
SU: The common parameter generation algorithm SU takes κ as an input and outputs a common parameter pp = (κ, n, q, χ) (pp ← SU (1 ^κ )).

G: The key generation algorithm G takes pp as input, selects f ′, gεR _q according to the distribution χ, and sets f = pf ′ + 1 mod q. However, when f is R _q and does not have an inverse element, f′εR _q is selected again and f is newly calculated. This redo is performed until f has an inverse element at _Rq . The key generation algorithm G uses f having an inverse element in R _q , calculates b = pgf ⁻¹ mod q, sets ek = b and dk = (f, b), and sets of encryption key and decryption key ( ek, dk) is output ((ek, dk) ← G (pp)).

を計算し、暗号文ｃ＝Ｃ∈Ｒ_ｑを出力する（ｃ＝Ｅ（ｐｐ，ｅｋ，μ））。 E: The encryption algorithm E takes pp, ek = bεR _q , plaintext μεR _p as input, and selects e ₁ , e ₂ εR _q according to the distribution χ,

And ciphertext c = CεR _q is output (c = E (pp, ek, μ)).

を計算し、平文μ’∈Ｒ_ｐを出力する（μ’←Ｄ（ｐｐ，ｄｋ，ｃ））。 D: The decryption algorithm D takes pp, dk = (f, b), ciphertext c = C as input, calculates d = fC mod q,

And plaintext μ′∈R _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (f _α , b _α ), ek _β = b _β . The transformation key generation algorithm RKG selects Y ₁ , Y ₂ εR _q ^{1 × δ according} to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ b _β + Y ₂ −P2 (f _α ) εR _q ^{1 × δ} And the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )).

RG: Randomized key generation algorithm RG takes pp, ek _β = b _β as input, selects Y ₁ ′, Y ₂ ′ ∈R _q according to distribution χ, and calculates N _β = Y ₁ ′ b _β + Y ₂ ′ Then, the randomized key (rpp _β , rk _β ) = (pp, N _β ) is output ((rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} and cipher text c _α = C _α ∈ R _q as inputs. However, the ciphertext c _α = C _α is a ciphertext that can be decrypted with the decryption key dk _α = (f _α , b _α ) of the user α, and the ciphertext c _β is a decryption key dk _β = (f _β , B _β ). dk _β corresponds to the encryption key ek _β = b _β described above. The conversion algorithm Switch executes an algorithm BD with C _α εR _q as an input to obtain BD (C _α ) εR _q ^δ , and C ′ = BD (C _α ) M _{α → β} εR _q . The conversion algorithm Switch outputs the ciphertext c _β = C′εR _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, n, q, χ).

Gen _y : Algorithm Gen _y (where y∈ {α, β}) takes pp as input, selects f _y ′, g _y ∈ R _q according to the distribution χ, and sets f _y = pf _y ′ +1 mod q. . However, if _fy is R _q and does not have an inverse _element, fy′εR _q is selected again and _fy is newly calculated. This redo is performed until _fy has an inverse _element at R _q . Algorithm Gen _y uses the _{f y} with inverse with ^{_{R q, b y = pg y}} f y -1 The mod q _{calculated, iek y = oek y = b} y and _{idk y = odk y = (f} y , B _y ), and outputs a pair of encryption key and decryption key (ie k _y = oek _y , idk _y = odk _y ).

を計算し、ｃ_ｙ＝Ｃ_ｙ∈Ｒ_ｑを暗号文ｉｃｔ_ｙとして出力する。 Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = b _y , plaintext μ, and distributes _y e ₁ , _y e ₂ εR _q Choose according to χ,

Was _calculated, and outputs the c _y = _C y ∈R _q as ciphertext ict _y.

を計算し、平文μ’∈Ｒ_ｐを出力する。 Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci takes PP = pp, idk _y = (f _y , b _y ), and cipher text ic t _y = c _y = C _y as input. , D _y = f _y C _y mod q,

And plaintext μ′∈R _p is output.

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (f _α , b _α ) (first decryption key), oek _β = b _β (second encryption key) and inputs Y ₁ , Y ₂ εR _q ^{1 × δ} is selected according to the distribution χ ^{1 × δ} , M _{α → β} = Y ₁ b _β + Y ₂ −P ₂ (f _α ) ∈R _q ^{1 × δ} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} is obtained. Algorithm RekeyGen is, _{Y 1} ', _{Y 2'} to ∈R _q select according to the distribution chi, calculate the _{N β = Y 1 'b β} + Y 2' ∈R q, random key _{(rpp β, rek β) =} ( pp, _Nβ ) is obtained. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc takes PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = C _α (first ciphertext) as input. Calculate the following:
1) C '= give _{BD (C α) M α →} β ∈R q, the ciphertext c' and = C β = C'∈R _q.
2) rpp _β = pp, rek _β = N _β , zero element as plain text is input, _β e ₁ , _β e ₂ ∈R _q are selected according to distribution χ, and ciphertext c ″ = N _{β β} e ₁ + _β e ₂ ∈ R _q is obtained.
3) Output oct _β = C ′ + N _{β β} e ₁ + _β e ₂ ∈R _q as the converted ciphertext.

  The tenth embodiment is a modification of the ninth embodiment. Unless otherwise specified in the present embodiment, the definitions of symbols are the same as those in the fifth embodiment.

<Definition of deterministic algorithms BD and P2>
Same as Example 5.

<Reconvertible encryption method>
SU: The common parameter generation algorithm SU takes κ as an input and outputs a common parameter pp = (κ, n, q, χ) (pp ← SU (1 ^κ )).

G: The key generation algorithm G takes pp as input, selects f ′, gεR _q according to the distribution χ, and sets f = pf ′ + 1 mod q. However, when f is R _q and does not have an inverse element, f′εR _q is selected again and f is newly calculated. This redo is performed until f has an inverse element at _Rq . The key generation algorithm G uses f having an inverse element in R _q , calculates b = pgf ⁻¹ mod q, sets ek = b and dk = (f, b), and sets of encryption key and decryption key ( ek, dk) is output ((ek, dk) ← G (pp)).

E: The encryption algorithm E takes pp, ek = bεR _q , plaintext μεR _p as input, selects e ₁ , e ₂ εR _q according to the distribution χ, and c = C = be ₁ + pe ₂ + μ The ciphertext c = CεR _q is output (c = E (pp, ek, μ)).

D: The decryption algorithm D takes pp, dk = (f, b) and ciphertext c = C as input, calculates d = fC mod q, calculates μ ′ = d mod p, and plaintext μ′∈R _p is output (μ ′ ← D (pp, dk, c)).

RKG: The conversion key generation algorithm RKG receives pp, dk _α = (f _α , b _α ), ek _β = b _β . The transformation key generation algorithm RKG selects Y ₁ , Y ₂ εR _q ^{1 × δ according} to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ b _β + pY ₂ −P2 (f _α ) εR _q ^{1 × δ} And the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} is output (rk _{α → β} ← RKG (pp, dk _α , ek _β )).

RG: Randomized key generation algorithm RG takes pp, ek _β = b _β as input, selects Y ₁ ′, Y ₂ ′ ∈R _q according to distribution χ, and calculates N _β = Y ₁ ′ b _β + pY ₂ ′ Then, the randomized key (rpp _β , rk _β ) = (pp, N _β ) is output ((rpp _β , rk _β ) ← RG (pp, ek _β )).

Switch: The conversion algorithm Switch takes pp, rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} and cipher text c _α = C _α ∈ R _q as inputs. However, the ciphertext c _α = C _α is a ciphertext that can be decrypted with the decryption key dk _α = (f _α , b _α ) of the user α, and the ciphertext c _β is a decryption key dk _β = (f _β , B _β ). dk _β corresponds to the encryption key ek _β = b _β described above. The conversion algorithm Switch executes an algorithm BD with C _α εR _q as an input to obtain BD (C _α ) εR _q ^δ , and C ′ = BD (C _α ) M _{α → β} εR _q . The conversion algorithm Switch outputs the ciphertext c _β = C′εR _q (c _β ← Switch (pp, rk _{α → β} , c _α )).

<Proxy re-encryption method>
In the case of the re-convertible encryption method π, the proxy re-encryption method Π is as follows.

Setup: The algorithm Setup calculates pp ← SU (1 ^κ ) with κ as an input, and outputs PP = pp = (κ, n, q, χ).

Gen _y : Algorithm Gen _y (where y∈ {α, β}) takes pp as input, selects f _y ′, g _y ∈ R _q according to the distribution χ, and sets f _y = pf _y ′ +1 mod q. . However, if _fy is R _q and does not have an inverse _element, fy′εR _q is selected again and _fy is newly calculated. This redo is performed until _fy has an inverse _element at R _q . Algorithm Gen _y uses the _{f y} with inverse with ^{_{R q, b y = pg y}} f y -1 The mod q _{calculated, iek y = oek y = b} y and _{idk y = odk y = (f} y , B _y ), and outputs a pair of encryption key and decryption key (ie k _y = oek _y , idk _y = odk _y ).

Enci: The algorithm Enci generates a ciphertext before re-encryption. When generating a ciphertext corresponding to the user yε {α, β}, the algorithm Enci receives PP = pp, iek _y = b _y , plaintext μ, and distributes _y e ₁ , _y e ₂ εR _q select according _{χ, c y = C y =} b y y e 1 + p y e 2 + μ
Was _calculated, and outputs the c _y = _C y ∈R _q as ciphertext ict _y.

Deci: The algorithm Deci decrypts the ciphertext before re-encryption. When the ciphertext corresponding to the user yε {α, β} is decrypted, the algorithm Deci takes PP = pp, idk _y = (f _y , b _y ), and cipher text ic t _y = c _y = C _y as input. , D _y = f _y C _y mod q, μ _y ′ = d _y mod p, and output plaintext μ′∈R _p .

  Enco: The algorithm Enco generates a ciphertext after re-encryption. The algorithm Enco in this embodiment is the same as the algorithm Enci.

  Deco: Algorithm Deco decrypts the ciphertext after re-encryption. The algorithm Deco in this embodiment is the same as the algorithm Deci.

RekeyGen: The algorithm RekeyGen receives PP = pp, idk _α = (f _α , b _α ) (first decryption key), oek _β = b _β (second encryption key) and inputs Y ₁ , Y ₂ εR _q ^{1 × δ} is selected according to the distribution χ ^{1 × δ} , and M _{α → β} = Y ₁ b _β + pY ₂ −P2 (f _α ) ∈R _q ^{1 × δ} is calculated, and the basic conversion key rk _{α → β} = M _{α → β} ∈ R _q ^{1 × δ} is obtained. Algorithm RekeyGen _{is, Y 1 ', Y 2'} ∈R q select according to distribution chi, calculate the _{N β = Y 1 'b β} + pY 2' ∈R q, random key _{(rpp β, rek β) =} ( pp, _Nβ ) is obtained. The algorithm RekeyGen outputs RK _{α → β} = (rk _{α → β} , rpp _β , rk _β ) as a conversion key.

ReEnc: Algorithm ReEnc takes PP = pp, RK _{α → β} = (rk _{α → β} = M _{α → β} , rpp _β , rk _β ), ict _α = c _α = C _α (first ciphertext) as input. Calculate the following:
1) C '= give _{BD (C α) M α →} β ∈R q, the ciphertext c' and = C β = C'∈R _q.
2) rpp _β = pp, rek _β = N _β , zero element as plain text is input, _β e ₁ , _β e ₂ ∈ R _q are selected according to distribution χ, and ciphertext c ″ = N _{β β} e ₁ + p _β e ₂ ∈ R _q is obtained.
3) Output oct _β = C ′ + N _{β β} e ₁ + p _β e ₂ ∈R _q as the converted ciphertext.

[Modifications, etc.]
The present invention is not limited to the embodiment described above. For example, instead of each device exchanging information via a network, at least some of the devices may exchange information via a portable recording medium. Alternatively, at least some of the devices may exchange information via a non-portable recording medium. That is, the combination which consists of a part of these apparatuses may be the same apparatus. For example, the decryption device 15 may be a device that further functions as the key generation device 13, and the decryption device 16 may be a device that further functions as the key generation device 12.

  The various processes described above are not only executed in time series according to the description, but may also be executed in parallel or individually as required by the processing capability of the apparatus that executes the processes. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  When the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. An example of a computer-readable recording medium is a non-transitory recording medium. Examples of such a recording medium are a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  This program is distributed, for example, by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, this computer reads a program stored in its own recording device and executes a process according to the read program. As another execution form of the program, the computer may read the program directly from the portable recording medium and execute processing according to the program, and each time the program is transferred from the server computer to the computer. The processing according to the received program may be executed sequentially. The above-described processing may be executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by an execution instruction and result acquisition without transferring a program from the server computer to the computer. Good.

  In the above embodiment, the processing functions of the apparatus are realized by executing a predetermined program on a computer. However, at least a part of these processing functions may be realized by hardware.

12 Key generation device 125 Basic conversion key generation unit 126 Randomization key generation unit 17 Re-encryption device 174 Basic conversion unit 175 Disturbance encryption unit

Claims (6)

The first decryption key is a key for decrypting the first ciphertext, the second decryption key is a key for decrypting the second ciphertext having homomorphism , and the second encryption key is the second ciphertext. A key corresponding to the decryption key,
A basic conversion key generating unit that obtains a basic conversion key for converting the first ciphertext into the second ciphertext using the first decryption key and the second encryption key;
A randomized key generation unit that uses the second encryption key to randomize the second encryption key to obtain a randomized key;
The modified ciphertext obtained by performing a predetermined operation on the second ciphertext and the disturbed ciphertext having homomorphism obtained by encrypting the first value using the randomization key is the Ri decodable der second decryption key, the value obtained by performing the operation on said first value and an optional second value is equal to the second value, the key generation device. The key generation device according to claim 1 ,
The key generation device, wherein the first ciphertext and the second ciphertext are ciphertexts conforming to a lattice cryptosystem or an NTRU cryptosystem. The basic conversion key is a key for converting the first ciphertext to the second ciphertext, the second decryption key is a key for decrypting the second ciphertext, and the second encryption key is the second ciphertext. a key corresponding to the decryption key, a key randomized key randomized said second encryption key, prior Symbol second ciphertext have homomorphism,
A basic conversion unit that converts the first ciphertext into the second ciphertext using the basic conversion key;
A disturbing encryption unit that obtains a disturbed ciphertext having homomorphism by encrypting a first value using the randomizing key;
An operation unit that performs a predetermined operation on the second ciphertext and the disturbed ciphertext to obtain a modified ciphertext,
The re-encryption apparatus, wherein the transformed ciphertext can be decrypted with the second decryption key, and a value obtained by performing the calculation on an arbitrary second value and the first value is equal to the second value. The re-encryption device according to claim 3 ,
The re-encryption device, wherein the first ciphertext and the second ciphertext are ciphertexts conforming to a lattice cryptosystem or an NTRU cryptosystem. Program for causing a computer to function as a key generating apparatus according to claim 1 or 2. The program for functioning a computer as a re-encryption apparatus of Claim 3 or 4 .

Images