JPH04253437A - Public information setting method for cryptographic key sharing system - Google Patents

Abstract

PURPOSE:To share a cryptographic key with high safety by allocating integers, which are primes one and another, to the set of respective parts and setting the public information of each user as the common multiple of the integer allocated to the part set to which the user belongs. CONSTITUTION:A sub system 101 a cryptographic sentence applied through a line 103 and a partial set S applied through a line 104 by a receiving means 1031. A common file reading means 1024 reads out the public information of each user belonging to this partial set S, and a greatest common divisor calculating means 102 calculates a greatest common divisor gcds of these users. In this case, a cryptographic key K1 generating means 1023 generates a cipher K1 by using this gcds, constant (n) from a constant holding means 1009, secret information Z1 from a secret information holding means 1012 and public information X1 from a public information holding means 1014.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for setting public information in a key sharing system in which a cryptographic key used in a conventional cryptographic system is shared by an arbitrary subset of a predetermined user group without mutual communication.

0002

[Prior Art] A conventionally known method for setting public information in a key sharing system in which an arbitrary subset of a predetermined user group shares an encryption key without mutual communication is Akiyama and Torii.・There is Hasebe's method. This is the 1990 International Symposium on Information Theory and its Applications (International S
ymposium onInformation
Akiyama, Torii, and Hasebe's paper “ID-Based Key Manageme” published in the Proceedings page 991-994 (and Its Applications)
nt system using Discre
teExponentiation Calcula
tion” (hereinafter referred to as Document 1).

[0003] As an encryption key shared by an arbitrary subset (group) of a predetermined set of m users, a predetermined first constant is used as public information of users belonging to the group. In the same paper, in a cryptographic key sharing method that uses the remainder raised by the reciprocal of the greatest common divisor and divided by a predetermined second constant,
Path Number Genera in Section 4.1
We propose a public information setting method using the tion algorithm.

0004

[Problem to be solved by the invention] In this method, the prime number m
This generates about (m-1)/2, but this has the problem that when a group of three or more people share a key, the greatest common divisor becomes 1 and only obvious keys can be shared. An object of the present invention is to provide a public information setting method that eliminates the above-mentioned drawbacks.

[0005]

[Means for Solving the Problems] The first public information setting method of the present invention uses a predetermined public information setting method to share an encryption key with an arbitrary subset of a predetermined set of users. In a cryptographic key sharing method in which a constant is raised to the power of the reciprocal of the greatest common divisor of the public information of users belonging to the subset, and the remainder is divided by a predetermined second constant as the cryptographic key. The public information setting method is characterized in that mutually prime integers are assigned to each subset, and each user's public information is made a common multiple of the integers assigned to the subset to which the user belongs.

[0006] The second public information setting method of the present invention is to share secret information distributed to each user in advance in order to share an encryption key with an arbitrary subset of a predetermined set of users. , in a method for setting public information in an encryption key sharing method in which the remainder of the value generated from the public information of users belonging to the subset and divided by a predetermined second constant is used as the encryption key. , when the number of users is m, an integer from the first group is assigned to a subset consisting of m-1 users, and an integer from the second group is assigned to a subset other than the aforementioned subset. , is characterized in that each user's public information is a common multiple of the integers assigned to the subset to which the user belongs.

[0007]

[Embodiment] An example will be described in which the public information setting method of the present invention is applied to an encryption key distribution system when m users are connected to each other through an unsecured communication channel as shown in FIG.

[0008] As shown in FIG. 2, the encryption key distribution method uses a constant n
, a secure communication channel 104(i) for transmitting public information Xi, and secret information Yi, a communication channel 108 for storing everyone's public information Xi in a shared file 105, and communication connecting the shared file 105 and each subsystem 101(i). channel 106.

FIG. 2 shows a first subsystem 101(1).
means to encrypt a transmission message that the user wants to broadcast only to broadcast group S, and send it to broadcast group S, and a second subsystem 101(i) that is a member of broadcast group S receives and decrypts it. The means to do so are shown.

First, this encryption key distribution method will be explained. First, the preparation stage will be explained with reference to FIG. As an initial setting, m users are set (step 35).
). A trusted center 100 is selected to share the encryption key with this arbitrary subset of users (step 36).

Next, the selected center 100 creates public information for each user (step 37). The method of creating this public information is the present invention, and the details will be described later. Based on the constants p, q, n, α created in step 37 and the public information Xi, the center 100 stores the secret information Zi of the user i.

[Math 1]

0012

(Step 38). Here a
(mod b) means the remainder when a is divided by b.

[0014] Each subsystem 101(i) (user i)
The constant n, the public information Xi and the secret information Zi are secretly distributed through the secure communication channel 104(i) (step 39). On the other hand, the center 100 uses the communication channel 10 to prevent the public information Xi of each user from being altered.
8 and recorded in the shared file 105 so that anyone can refer to it (step 40). Each subsystem 1
01(i) (user i) secretly receives constant n, public information Xi, and secret information Zi (step 41). n and α are stored in the constant holding means 1009(i) (step 42), and the secret information Zi is stored in the secret information holding means 1012.
(i) (step 43), and public information Xi is stored in the secret information holding means 1014(i) (step 4
4).

Next, an embodiment in which each communicating party accesses public information stored in the shared file 105 and sends an encrypted signal will be described in detail with reference to FIG. 2.

An arbitrary subset S={1, 2, . . . , k} that the first subsystem 1 (sender 1) broadcasts is input. Note that this set S also includes sender 1. The shared file reading means 1018 retrieves the public information X1, X2, X2, corresponding to the broadcast group S from the shared file 105.
..., read out Xk. Here, greatest common divisor calculation means 10
13 as gcdS public information X1, X2 ,...,Xk
Calculate the greatest common divisor of.

Next, 1 secret information holding means 1012 (1
) reads the secret information Z1 from the constant holding means 1009 (
The constant n is read from 1), the public information X1 is read from the public information holding means 1014 (1) of 1, and the encryption key K1 generating means 1019 uses gcdS

[Number 2
]

[0018]

An encryption key K1 is generated according to the following. Encryption means 1 encrypts and broadcasts the transmitted message using this key K1.
020 and sends the ciphertext to the non-secure communication channel by the sending means 1008, and at the same time, the broadcast group set S is also sent to the line 104 by the sending means 1008.

Let each user i belonging to the subset S be a second subsystem 101(i). This subsystem receives by receiving means 1031 the ciphertext provided via line 103 and the subset S provided via line 104. The public information of each user belonging to this subset S is read by the shared file reading means 1024, and the greatest common divisor gcdS thereof is calculated by the greatest common divisor calculating means 1021.

gcdS and constant holding means 1009(i)
constant n from , and secret information holding means 1012 of i (
The encryption key K is obtained using the secret information Zi from i) and the public information Xi from i's public information holding means 1014(i).
The i generation means 1023 is

[Math 3]

[0022]

An encryption key Ki is generated according to the following.

[0024] At this time,

[Math 4]

[0025]

[0026] Therefore, subsystem 101(1
)'s encryption key K1 generated by the encryption key generation means 1019 and the encryption key Ki generated by the encryption key Ki generation means 1023 of the subsystem 101(i) are the same, so key sharing can be realized. That is, the user i can decrypt the ciphertext using the encryption key Ki by the decryption means 1025.

By accessing the public information Xi of each correspondent from the shared file 105 in this manner, an encryption key common to any subset can be generated at any time. However, security varies depending on how public information is set. For example, in the method of Document 1 mentioned above, the greatest common divisor of a subset of three or more people is 1, so the encryption key of this subset is α
becomes. Anyone can obtain α by multiplying their private information by the value of their public information. Therefore, the encryption key of this subset can be easily obtained even by a person who does not belong to this subset, and the ciphertext will always be decrypted. The public information setting method of the present invention overcomes this weakness.

Next, a first embodiment of the public information setting method of the present invention used in the cryptographic key distribution method described using FIGS. 2 and 3 will be described in detail using FIG. 1. Referring to FIG. 1, there is shown the means by which the center 100 generates public information for each user in one embodiment of the present invention.

First, large prime numbers p and q are selected (step 11). Next, the product of two large prime numbers p and q is n
(Step 12). Furthermore, α is GF (
p) and is selected as a positive integer less than n to serve as a primitive element in GF(q) (step 13).

Next, 2m - m-2 prime numbers that are not factors of (p-1) and (q-1) are generated (step 14
). This prime number is assigned to each true subset of users consisting of two or more users (step 15). Thereafter, public information Xi for each user i is set as the product of all prime numbers assigned to the subset that includes the user (step 16).

Next, regarding the second embodiment, FIG. 4 and FIG.
Explain using. Similar to the first embodiment, first large prime numbers p, q are selected (step 11), and then these two
The product of two large prime numbers p and q is found as n (
Step 12). Furthermore, α is GF(p) and GF(q)
is selected as a positive integer less than n to serve as a primitive element (step 13).

Next, m prime numbers that are not factors of (p-1) and (q-1) are first generated and subscripts from 1 to m are attached (step 17). This is assigned to each subset of size m-1 (step 18). Here, a subset of size m-1 means a set of m-1 users. Next, assign m+1 to the variable prno and set the variable sz
Substitute m-2 into , set the unique multiplicity of each prime number to 1, and further set the maximum multiplicity to 1 (step 19). When sz is 2 or more, repeat the following. Integer numbers are assigned to subsets of size sz (step 21), and so on until all subsets of size sz have been assigned integer numbers. This assignment (step 21) continues until all subsets of size sz have been assigned integer numbers. The details of this allocation method will be explained in detail later using FIG. When the assignment is completed, the maximum value of the unique multiplicity of each prime number is assigned as the maximum multiplicity, and the value of sz is decreased by one (step 23). This is repeated until sz is 2 or more. If sz becomes less than 2, the public information Xi of each user is set as the least common multiple of the integers assigned to the subset including the user (step 16).

Next, the method of allocating integers to subsets of size sz (step 21) will be explained in detail with reference to FIG. First, one subset S of size sz is fixed (step 24). The least common multiple G of the integers assigned to the set including this subset S is calculated (step 25). At this time, since the size of the set containing this S is larger than the size of S, an integer has already been allocated at this point. Therefore, G can be calculated. Among the prime factors of this least common multiple G, the one whose multiplicity is equal to the unique multiplicity is searched for (step 26). If there is a prime number that is less than the maximum multiplicity among them, the prime number with the smallest subscript among them is set as p (step 28). The unique multiplicity of this prime number p is 1
(step 29), and an integer obtained by multiplying the least common multiple G by p is assigned to this subset (step 34).

When the multiplicity of all the prime factors of the least common multiple G is not equal to the unique multiplicity, or when the unique multiplicity of all the equal prime factors is greater than the maximum multiplicity, a new prime is generated ( step 30), a new subscript prno is added to this prime number (step 31), and prn
o is increased by one (step 32), and the unique multiplicity of the prime number p is set to 1 (step 33). Assign the product of prime number p and least common multiple G to this subset S (step 34
). In this way, integers are assigned to subsets of size sz.

The third embodiment is a case where the subset to be broadcast is limited. At this time, step 1 in Figure 1
In step 4, prime numbers are generated as many times as there are subsets to be broadcasted, and in step 15, prime numbers are assigned only to the subsets to be broadcasted, and 1 is assigned to the other subsets. Alternatively, in step 21 of FIG. 4, FIG. 5 may be executed only for the subset of size sz to be broadcasted, and 1 may be assigned to the others.

Furthermore, in the embodiment of the present invention, prime numbers and integers based on prime numbers are used as integers to be assigned to subsets, but the integers are not limited to prime numbers, and may be relatively prime integers.

If the public information setting method of the present invention is used in the cryptographic key distribution system described with reference to FIGS. 2 and 3, the following features can be provided.

First of all, since a sufficiently large number of prime numbers are used, the greatest common divisor is not 1 in any subgroup S, and a non-trivial key can always be shared. This compensates for the weaknesses of the method in Document 1.

Second, the key KS of any subgroup S will not be revealed due to the collusion of users who do not belong to S. This is because, if the prime number assigned to the subset S is PS, then if KS is known, α1/PSmo
dn should be known, but the secret information of users who do not belong to S does not have this factor. Therefore, KS cannot be obtained.

Although the second embodiment has an increased degree of complexity, it can be implemented using fewer types of prime numbers. The reason for the complexity is to prevent the key KS of any subgroup S from being revealed due to the collusion of users who do not belong to S.

The purpose of the third embodiment is to enable public information to be generated with relatively little effort when the number of groups that share a key is limited.

An example of the center 100 and subsystem 101(i) used in the embodiment will be explained with reference to FIG.

The system shown in FIG. 6 includes a terminal unit (TMU) 301 such as a personal computer equipped with a communication processing function.
, a read-only memory (ROM) 302, a random access memory (RAM) 303, and a random number generator (R).
NG) 304 and signal processor (SP) 306 and T
MU301, ROM302, RAM303, RNG30
4 and a common bus 305 that interconnects the SPs 306.

[0044] RNG304 generates random numbers according to instructions from SP306. This is used when only the center 100 generates a prime number. In the case of the center 100, the ROM 407 stores constants α, n and secret information p, q. p, q are TM
The secret information may be stored in the RAM from U to each user each time the secret information is created. ROM407 has subsystem 10
0(i), constant n, public information Xi and secret information Z
I remember i. Zi may be stored in the RAM each time an encryption key is generated from the TMU. The above operations are realized based on a program stored in the ROM. The RAM 303 is used to temporarily store intermediate calculation results and the like during execution of these steps.

Furthermore, the systems 100 and 101 may be data processing devices such as general-purpose computers or IC cards.

[0046]

As described above in detail, by using the present invention, it is possible to realize highly secure key sharing without fear of collusion.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing a first embodiment of the present invention.

FIG. 2 is a diagram showing an example in which encrypted communication is performed using the first, second, and third examples of the present invention.

FIG. 3 is a diagram showing preparation for encrypted communication using the first, second, and third embodiments of the present invention.

FIG. 4 is a diagram showing a second embodiment of the present invention.

FIG. 5 is a diagram showing details of step 21 of the second embodiment of the present invention.

FIG. 6 is a diagram showing the configuration of the center 100 and subsystem 101(i).

FIG. 7 is a diagram showing connections of m subsystems.

[Explanation of symbols]

100 Center 101(i) Subsystem 104(i) Safety communication channel 105 Shared file 106(i) Communication channel 108 Communication channel 1008 Sending means 1009(i) Constant n holding means 1009(1) Constant n holding means 1012(i) i's secret information holding means 1012 (1
) Private information holding means 1013 of 1 Greatest common divisor calculation means 1014 (i) Public information holding means 1014 of i
) 1 public information holding means 1018 shared file reading means 1019 encryption key generation means 1020 encryption means 1021 greatest common divisor calculation means 1023 encryption key generation means 1024 shared file reading means 1025 decryption means 1031 reception means

Claims (2)

[Claims] [Claim 1] In order to share a combined cryptographic key among an arbitrary subset of a predetermined set of users, a predetermined first constant is set as public information of users belonging to the subset. In a method for setting public information in a cryptographic key sharing system in which the remainder of the power raised by the reciprocal of the greatest common divisor and divided by a predetermined second constant is used as the cryptographic key, each subset is given a relatively prime integer. A public information setting method characterized in that the public information of each user is set as a common multiple of the integers assigned to the subset to which the user belongs. Claim 2: In order to share an encryption key with an arbitrary subset of a predetermined set of users, secret information distributed in advance to each user is disclosed to the users belonging to the subset. Multiply by the value generated from the information,
In a method for setting public information in an encryption key sharing method in which the remainder obtained by dividing this by a predetermined second constant is used as an encryption key, when the number of users is m, a subset of m-1 users is Allocate an integer from one group, allocate an integer from the second group to a subset other than the above subset, and set each user's public information as a common multiple of the integer allocated to the subset to which he or she belongs. A public information setting method characterized by: