JPH11212455A - Method and system for proving identity of original ordinary text from plural cipher texts - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prove the identity of an ordinary text from plural cipher texts enciphered by RSA encryption without presenting the original ordinary text. SOLUTION: In a prover side device 100, an ordinary text P included in a proper range is selected, and the ordinary text P is enciphered by plural RSA public keys (e, N1 ),..., (e, Nn ) to generate cipher texts C1 ,..., C0 , and they are opened. In the prover side device 100, it is proved for a confirmer that the ordinary text is known and the ordinary text is included in the range Q, and thereby, the identity of the original ordinary text P can be confirmed from cipher texts C1 ,..., C0 in a confirmer side device 200.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a method and a system for proving the identity of an original plaintext from a plurality of ciphertexts encrypted by RSA (Rivest, Shamir, Adleman) encryption which is a public key encryption. .

[0002]

2. Description of the Related Art Elgamal (El, one of the public key cryptosystems)
Gamal) A proof protocol (Binding ElGamal protocol) that proves the identity of the original plaintext from multiple ciphertexts is described in the document "ERVerheul, B.-J.Koops and HC.
A. van Tilborg .: Binding ElGamal. A Fraud-Detectab
le Alternative to Key-Escrow Proposals, Advances i
n Cryptography-Eurocrypt'97 Proceedings, Springer
Verlag, 1997, pp. 119-133 ".

[0003] The protocol will be described below.

[0004] Party A of Country A sends a secret message D to Party B of Country B
Suppose you send

[0005] Here, it is assumed that Party A deposits the session key S in a TRP (Trusted Retrieval Parties: TRP in Country _A as TRP _A and TRP in Country _B as TRP _B ) in each country.

[0006] In addition, Otsu, TRP _A, each of the secret key of the TRP _B x _M, x _A, and x _B, each y _M of the public key, y _A, and y _B. Where the published primes p and q = ord
_P (g), integer g (0 <g <p),

[0007]

(Equation 35)

[0008] Also, ord _P (g) = m for a prime number p and a positive integer g means that m is

[0009]

[Equation 36]

[0010] Indicates that it is the smallest positive integer that satisfies.

(1) Party A is an integer j, k (0 <j, k <
q) and the session key S (0 <S <q) are randomly selected, and the data blocks (E _S (D), G, R _M , R _A ,
R _B , bind) is created and used as transmission data.

Here,

[0013]

(37)

(Where w = H (E _S (D), G, R _M ,
R _A , R _B , bind), where H is a secure one-way function, and w <ν <q for the security parameter ν. Z is other public information such as ID information of Party B. ).

(2) Otsu, TRP _A and TRP _B are each

[0016]

(38)

Thus, the session key S can be decrypted. As a result, the message D can be decrypted from the cipher text E _S (D).

(3) In addition, not only the second party, TRP _A and TRP _B , but also anyone

[0019]

[Equation 39]

[0020] By ensuring that holds, it can be confirmed that the ciphertext R _M, R _A, original plaintext from R _B (session key S) are identical.

That is, it is possible to confirm that the session key used to create the ciphertext E _S (D) and the session key deposited in each TRP are the same without knowing the session key. .

[0022]

In recent years, with the spread of various services on information networks, encryption technology for protecting confidential data and realizing an authentication function has become indispensable. However, the misuse of these technologies can hinder law enforcement such as criminal investigations. As a countermeasure against such abuse of cryptographic technology, the US government has proposed a mechanism called key escrow or key recovery. In this mechanism, a user deposits a secret encryption key for encryption with a trusted organization, and when necessary for law enforcement, the investigating authority can use this encryption key according to a certain procedure. To make it legally accessible.

An information infrastructure (KMI: Key Management I) for utilizing public key cryptography on the Internet.
There is a movement to promote the introduction of key recovery along with the construction of the nfrastructure).

Here, it is conceivable that an unauthorized user may change the key actually encrypting data to another convenient key different from the key deposited at a trusted organization. In this case, a correct encryption key may not be obtained as required. On the other hand, if a trusted third party checks the key deposited each time, it is inefficient. For this reason, in order to detect fraud efficiently and safely, there is a demand for a method capable of proving only the validity of a key without presenting a key to be deposited to a confirmer.

The proof protocol described in the above-mentioned conventional technique does not show a key to be deposited to a verifier,
Only the validity of the key can be proved. However, this proof protocol is premised on application to El Gamal cryptography, and is not considered for application to RSA cryptography, which is currently the most widely used public key cryptography.

The present invention has been made based on the above circumstances, and its purpose is to provide the most widely used RS at present.
The purpose of the A cipher is to prove the identity of a plaintext from a plurality of ciphertexts without leaking the original plaintext.

[0027]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, the present invention proves the identity of an original plaintext from a plurality of ciphertexts created by a prover to a confirmer without indicating the plaintext. a method of, in the apparatus of the prover, an appropriate range to select the plaintext P contained in the Omega, the public key e ₁ a plaintext P multiple, ..., encrypts a plurality of ciphertext e _n respectively C ₁ ,
..., we obtain a C _n, dark ciphertext C _1, ..., a step that exposes the C _n, relative confirmer, knowing plaintext P, and, plaintext P is within such a range by proving to be included in the Omega, provided in the confirmation of the apparatus, dark ciphertext C _1, · · ·, the steps of the original plaintext P from C _n is capable confirmed to have identity, the It is characterized by the following.

More specifically, as a first step, in the prover's device, for the public key (e, N _i ) (1 ≦ i ≦ n), an integer N and 0 <P <N <N _{i are} satisfied. Choose plaintext P,
Ciphertext C _i (1 ≦ i ≦ n)

[0029]

(Equation 40)

(Where N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} , ..., consisting of N _n relationship. here, d _i is the public key (e, N _i) is a secret key for _{the, L i = lcm (P i} -1, Q i -1) is.) And the ciphertext C
exposing _i (1 ≦ i ≦ n) and an integer N;
And, as a second step, (1) in the prover's device,

[0031]

[Equation 41]

The following integers r _i and s _i are selected,

[0033]

(Equation 42)

Calculating u _i , v _i to the confirmer, and (2) in the confirmer's device, e _i ∈
{0, 1} and e ′ _i {0, 1,..., E−1}
Randomly selecting and sending e _i , e ′ _{i to} the prover _; and (3) in the prover's device:

[0035]

[Equation 43]

Calculating w _i , z _i to the confirmer, and (4) when e _i = 0 in the confirmer's device,

[0037]

[Equation 44]

It is determined whether or not the following holds. When e _i = 1, the determination formula

[0039]

[Equation 45]

It is determined whether or not the above condition is satisfied.

[0041]

[Equation 46]

(Where y = φ (C ₁ , C ₂ ,..., C
_n ) and φ is

[0043]

[Equation 47]

Represents a ring isomorphism ) To determine whether or not is satisfied.
To (4) are repeated from i = 1 to t. When all of a series of determination formulas in step (4), which are repeated t times, are satisfied in the device of the confirmer, the cipher text C It is confirmed that the original plaintext P of _i (1 ≦ i ≦ n) has the same identity.

Note that, instead of repeating the above series of steps (1) to (4) t times between the prover's device and the confirmer's device,

[0046]

[Equation 48]

The following integers r _i and s _i are selected.

[0048]

[Equation 49]

Calculating u _i , v _i that satisfies
Including one-way function f, with respect to _{g, e 1 e 2 ··· e} t = f ({u 1, u 2, ···, u t and v _1, v _2, a · · · v _t Public information｝) e ′ ₁ e ′ ₂ ... E ′ _h = g (｛u ₁ , u ₂ ,..., U _t
.., Where e ₁ e ₂ ... _Et is f (｛u ₁ , u ₂ ,.
u _t and v _1, v _{2, 2} of · · · v public information including _t})
, E ′ _i {0, 1,..., E−1}
(1 ≦ i ≦ h). ), And

[0050]

[Equation 50]

U _i , v _i , w _i , z
_i (1 ≦ i ≦ t) to the confirmer, wherein e ₁ e ₂ ... _et = f (｛u ₁ , u ₂ ,. _t and v _1, v _2, public information including _{··· v t}) e'1 e'} 2 ··· e'h = g ({u 1, u 2, ···, u t
Calculating public information｝), and when e _i = 0, a judgment formula

[0052]

(Equation 51)

It is determined whether or not the above holds. When e _i = 1, the determination formula

[0054]

(Equation 52)

It is determined whether or not the condition is satisfied.

[0056]

(Equation 53)

(Where y = φ (C ₁ , C ₂ ,..., C
_n ) and φ is

[0058]

(Equation 54)

Represents a ring isomorphism ) Is determined whether or not the ciphertext C _i (1) is satisfied when a series of determination expressions is satisfied in the device of the confirmer.
It may be confirmed that the original plaintexts P satisfying ≦ i ≦ n) have the same identity.

[0060]

Embodiments of the present invention will be described below.

First, as a first embodiment of the present invention, a plurality of RSAs created by a prover are created by an interactive exchange between a prover side device and a verifier side device.
The case where the identity of the original plaintext is confirmed from the ciphertext will be described.

FIG. 1 shows a schematic configuration of a certification system to which the first embodiment of the present invention is applied. As shown in FIG. 1, the system according to the present embodiment includes a prover-side device 100 and a confirmer-side device 200. The prover-side device 100 and the confirmer-side device 200 are connected to each other by a communication line 300.

FIG. 2 shows a schematic configuration of the prover apparatus 100 shown in FIG. As shown in FIG. 2, the prover-side device 100 includes an RSA encryption device 101, a random number generator 10
2. Power multiplier 103, remainder arithmetic unit 104, arithmetic unit 1
05, and a communication device 106. here,
RSA encryption device 101, random number generator 102, exponentiation multiplier 103, remainder arithmetic unit 104, and arithmetic unit 105
May be provided as hardware, or may be realized by executing a predetermined program in an information processing device. This predetermined program can be stored in a storage medium such as a CD-ROM.

FIG. 3 shows a schematic configuration of the confirmer-side device 200 shown in FIG. As shown in FIG. 3, the confirmer-side device 200 includes a random number generator 201, a power multiplier 202, a remainder calculator 203, a calculation device 204, and a communication device 2.
05. Here, a random number generator 201, a power multiplier 202, a remainder arithmetic unit 203, and an arithmetic unit 204
May be provided as hardware, or may be realized by executing a predetermined program in an information processing device. This predetermined program can be stored in a storage medium such as a CD-ROM.

The operation of the certification system to which the present embodiment having the above configuration is applied will be described with reference to FIG. FIG.
FIG. 2 is a diagram for explaining a flow of information in the certification system shown in FIG. 1.

1. First Step In the prover-side device 100, the RSA ciphertext generation device 1
01, an integer N such that 0 <P <N <N _i and a plaintext P are selected for the public key (e, N _i ) (1 ≦ i ≦ n).
Ciphertext C _i (1 ≦ i ≦ n)

[0067]

[Equation 55]

(However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} , ..., consisting of N _n relationship. here, d _i is the public key (e, N _i) is a secret key for _{the, L i = lcm (P i} -1, Q i -1) is.) Is calculated by

Next, the ciphertext C _i (1 ≦ i ≦ n) and the integer N are made public by the communication device 106 or other means.

2. Second stage The following series of steps (1) to (4) are performed from i = 1 to t
Repeat until

Step (1): In the prover apparatus 100, the random number generator 102

[0072]

[Equation 56]

The following integers r _i and s _i are generated.

Next, the power multiplier 103 and the remainder arithmetic unit 10
4, and the arithmetic unit 105,

[0075]

[Equation 57]

Is calculated. Then, the obtained u _i and v _i are
The information is transmitted to the confirmer-side device 200 via the communication device 106.

[0077] Step (2): the confirmation side apparatus 200, the random number generator 201, e _i ∈ {0,1} and _{e'i ∈ {0,1, ···,} e-1} randomly Generate. Then, the generated e _i, a _e'i, the communication device 20
5 to the prover-side apparatus 100.

Step (3): In the prover side apparatus 100, the remainder arithmetic unit 104 and the arithmetic unit 105

[0079]

[Equation 58]

Is calculated. Then, the obtained w _i and z _i are
The information is transmitted to the confirmer-side device 200 via the communication device 106.

Step (4): In the checker side apparatus 200, when e _i = 0 by the exponentiation multiplier 202, the remainder operation unit 203, and the operation unit 204, the judgment formula

[0082]

[Equation 59]

It is determined whether or not the above holds. When e _i = 1, a determination formula

[0084]

[Equation 60]

It is determined whether or not the condition is satisfied.

[0086]

[Equation 61]

(Where y = φ (C ₁ , C ₂ ,..., C
_n ) and φ is

[0088]

(Equation 62)

[0109] The following is a ring isomorphism mapping. ) Is determined.

In the confirmer-side apparatus 200, the arithmetic unit 2
04, when all of the series of determination formulas in step (4) performed t times are satisfied, that is, using information including information associated with the public key (e, N _i ), If the prover confirms that the plaintext P is known and has proved that the plaintext P is included in the predetermined range Ω, the original plaintext of the ciphertext C _i (1 ≦ i ≦ n) is obtained. Confirm that P has the same identity.

According to the above-described first embodiment, the prover knows the plaintext P to the verifier by the interactive exchange between the prover side device 100 and the verifier side device 200. Further, it can be proved that the plaintext P is included in the predetermined range Ω. Thus, confirmer can be obtained from a plurality of RSA cryptogram C _i prover created to confirm the identity of the original plaintext P.

[0092] In the present embodiment, the random number e _i generated in step (2), the _e'i, may be e _i = _e'i. In this case, the amount of data exchanged between the sender device 100 and the confirmer device 200 can be reduced.

The first embodiment of the present invention has been described above.

Next, a second embodiment of the present invention will be described.

In the present embodiment, instead of repeating the interactive exchange between the prover-side device 100 and the confirmer-side device 200 in the first embodiment, it is unilaterally sent from the prover-side device 100. A case will be described with reference to FIG. 5 where the confirmer-side apparatus 200 confirms the identity of the original plaintext from the plurality of RSA ciphertexts created by the prover based on the information.

FIG. 5 is a diagram for explaining the flow of information in the second embodiment of the present invention. Note that the configuration of the proof system of the present embodiment, and the configurations of the prover-side device and the confirmer-side device are the same as those of the first embodiment shown in FIGS.

1. Processing in the Prover Side Device 100 The public key (e, _Ni ) is obtained by the RSA encryption device 101.
For (1 ≦ i ≦ n), an integer N such that 0 <P <N <N _i
And plaintext P, and ciphertext C _i (1 ≦ i ≦ n)

[0098]

[Equation 63]

(However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} , ..., consisting of N _n relationship. here, d _i is the public key (e, N _i) is a secret key for _{the, L i = lcm (P i} -1, Q i -1) is.) Is calculated by Then, the obtained ciphertext C _i
(1 ≦ i ≦ n) and the integer N are disclosed by the communication device 106 or other means.

Next, the random number generator 102

[0101]

[Equation 64]

The following integers r _i and s _i are generated.

Next, the power multiplier 103 and the remainder arithmetic unit 10
4. By the arithmetic unit 105,

[0104]

[Equation 65]

U _i , v _i satisfying the equation are calculated. Further, for one-way functions f, g, e ₁ e ₂ ... _Et = f (｛u ₁ , u ₂ ,. u _t and v _1, v _2, ··· v public information including _{t}) e'1 e'2 ···} e'h = g ({u 1, u 2, ···, u t
.., Where e ₁ e ₂ ... _Et is f (｛u ₁ , u ₂ ,.
u _t and v _1, v _{2, 2} of · · · v public information including _t})
, E ′ _i {0, 1,..., E−1}
(1 ≦ i ≦ h). ) Is calculated. then,

[0106]

[Equation 66]

Is calculated. Then, the obtained u _i , v _i , w
_i and z _i (1 ≦ i ≦ t) are transmitted to the confirmer-side device 200 via the communication device 106.

2. Multiplier 202 to be processed by the checker side device, remainder arithmetic unit 203, arithmetic unit 204
_{By, e 1 e 2 ··· e t} = f ({u 1, u 2, ···, u t and v _1, v _2, public information including ··· v _{t}) e'1} e' ₂ ... e ' _h = g (ｇu ₁ , u ₂ ,..., U _t
Calculate public information｝). Then, when e _i = 0, the judgment formula

[0109]

[Equation 67]

It is determined whether or not the above holds. When e _i = 1, the determination formula

[0111]

[Equation 68]

It is determined whether or not the above condition is satisfied.

[0113]

[Equation 69]

(However, y = φ (C ₁ , C ₂ ,..., C
_n ) and φ is

[0115]

[Equation 70]

Represents a ring isomorphism ) Is determined.

In the confirmer side apparatus 200, the arithmetic unit 2
04 indicates that the prover knows the plaintext P when all of the above-described determination formulas are satisfied, that is, by using information including information associated with the public key (e, _Ni ) in some way, and When it is confirmed that the plaintext P has been included in the predetermined range Ω, the ciphertext C _i (1
It is confirmed that the original plaintext P of ≦ i ≦ n) has the same identity.

According to the above-described second embodiment, the prover can communicate with the confirmer without repeatedly performing the interactive exchange between the prover-side device 100 and the confirmer-side device 200. It is possible to prove that the plaintext P is known and that the plaintext P is included in the predetermined range Ω.
Therefore, the verification party, the identity of the original plaintext P from a plurality of RSA cryptogram C _i prover created can be confirmed efficiently.

In this embodiment, the one-way functions f and g are made the same, and the random numbers e _i ,
the _e'i, may be e _i = _e'i. In this case, the amount of data exchanged between the sender device 100 and the confirmer device 200 can be reduced, and the calculation load on both devices can be reduced.

[0120] In the embodiments described above, has been described exchanged between the prover device a confirmation of the apparatus, the decryption person with the private key d _i, of course, its own device (Information processing device: not shown)

[0121]

[Equation 71]

By calculating the [0122], it is possible to decode the plaintext P from ciphertext C _i.

[0123]

As described above, according to the present invention,
In a situation where the same plaintext must be encrypted with each recipient's public key and sent to multiple recipients, the sender may send his or her own convenient plaintext to the recipients separately. Fraud can be detected without presenting plaintext.

[Brief description of the drawings]

FIG. 1 is a diagram showing a schematic configuration of a certification system to which a first embodiment of the present invention is applied.

FIG. 2 is a diagram showing a schematic configuration of a prover apparatus 100 shown in FIG.

FIG. 3 is a diagram showing a schematic configuration of a confirmer apparatus 200 shown in FIG. 1;

FIG. 4 is a diagram for explaining the flow of information in a certification system to which the first embodiment of the present invention has been applied.

FIG. 5 is a diagram illustrating a flow of information in a certification system to which a second embodiment of the present invention has been applied.

[Explanation of symbols]

 REFERENCE SIGNS LIST 100 Prover side device 101 RSA encryption device 102, 201 Random number generator 103, 202 Multiplier 104, 203 Remainder operator 105, 204 Arithmetic device 106, 205 Communication device 200 Confirmer device 300 Communication line

Claims (19)

[Claims] 1. A method for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext. select the plaintext P contained in the public key e ₁ a plaintext P multiple, ..., e _n each plurality of ciphertext C ₁ encrypted with, ..., determine the C _n, dark Circular C _1, ···, C _n
Publishing, to a verifier, knowing the plaintext P; and
By proving that the plaintext P is included in the range Ω,
In confirmation of the apparatus, dark ciphertext C _1, · · ·, the original of a plurality of ciphertext original plaintext P from C _n is characterized by comprising the steps of: enabling confirmed that the identity How to prove the identity of a plaintext 2. A method for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein a proper range Ω select the plaintext P contained in the public key e ₁ a plaintext P multiple, ..., e _n each plurality of ciphertext C ₁ encrypted with, ..., determine the C _n, dark Circular C _1, ···, C _n
And certifying that the plaintext P is known to the verifier and that the plaintext P is included in the range Ω by interactive communication with the verifier's device. And that the prover knows the plaintext P by interactive communication with the prover's device, and that the plaintext P has the range Ω
, The ciphertext C ₁ ,...
· How to prove the identity of the plurality of the ciphertext the original plaintext, characterized in that it comprises the step of original plaintext P from C _n is confirmed to have identity. 3. A method for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, and as a first step, a method of certifying in a device of the prover For the public key (e, N _i ) (1 ≦ i ≦ n), 0 <P <
An integer N such that N <N _i and a plaintext P are selected, and the ciphertext C _i (1
≤ i ≤ n) (However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡ 1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} ,. becomes n _n relationship. here, d _i is the public key (e, n _i) is a secret key for, is calculated by _{L i = lcm (P i -1} , Q i -1) is a.) And publishing the ciphertext C _i (1 ≦ i ≦ n) and the integer N. As a second step, (1) in the prover's device: The following integers r _i and s _i are selected. The calculated, u _i, v and sending _i to the confirmer, in the apparatus of (2) confirmer, e _i ∈ {0, 1} and _e'i ∈ {0,1, ···, randomly selects e-1}, and sending e _i, a _e'i to the prover, (3) the apparatus of the prover, Equation 4] And transmitting w _i and z _i to the confirmer. (4) In the confirmer's device, when e _i = 0, the judgment formula Is determined, and when e _i = 1, the determination formula It is determined whether or not the condition is satisfied. (However, y = φ (C ₁ , C ₂ ,..., C _n )
Is: The ring isomorphism ) Is determined, and a series of steps (1) to (4) consisting of:
If the series of determination formulas in step (4), which are repeated t times, are satisfied in the device of the confirmer, the ciphertext C _i (1 ≦ i ≦ n) A method of proving the identity of an original plaintext from a plurality of ciphertexts, characterized in that it is confirmed that the plaintexts P have the same identity. 4. A method of proving the identity of the original plain text from the plurality of ciphertext according to claim 2, characterized in that the random number e _i, a _e'i, and the e _i = _e'i A method of proving the identity of the original plaintext from multiple ciphertexts. 5. A method for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext. select the plaintext P contained in the public key e ₁ a plaintext P multiple, ..., e _n each plurality of ciphertext C ₁ encrypted with, ..., determine the C _n, dark Circular C _1, ···, C _n
And transmitting to the verifier information indicating that the prover knows the plaintext P and that the plaintext P is included in the range Ω. , from the information, that the prover knows the plaintext P, and, by confirming that the plaintext P is included in the range Omega, dark ciphertext C _1, · · ·, based on the C _n A method of verifying the identity of the original plaintext from a plurality of ciphertexts, comprising a step of confirming that the plaintexts P have the same identity. 6. A method of certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein a public key (e , N _i ) (1 ≦ i ≦ n), 0 <P <
An integer N such that N <N _i and a plaintext P are selected, and the ciphertext C _i (1
≤ i ≤ n) (However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡ 1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} ,. becomes n _n relationship. here, d _i is the public key (e, n _i) is a secret key for, is calculated by _{L i = lcm (P i -1} , Q i -1) is a.) Publishing the ciphertext C _i (1 ≦ i ≦ n) and the integer N; The following integers r _i and s _i are selected. Calculating a u _i, v _i satisfying, one-way function f, with respect to _{g, e 1 e 2 ··· e} t = f ({u 1, u 2, ···, u t and v _1, v _2, ··· v public information including _{t}) e'1 e'2 ···} e'h = g ({u 1, u 2, ···, u t
.., Where e ₁ e ₂ ... _Et is f (｛u ₁ , u ₂ ,.
u _t and v _1, v _{2, 2} of · · · v public information including _t})
, E ′ _i {0, 1,..., E−1}
(1 ≦ i ≦ h). ), And A is calculated, obtained _{u i, v i, w i} , z i (1 ≦ i ≦ t)
And a step of transmitting to the confirmer and in confirmation of the _{apparatus, e 1 e 2 ··· e t} = f ({u 1, u 2, ···, u t and v _1, v _2, .. Public information including v _t ) e ′ ₁ e ′ ₂ ... E ′ _h = g (｛u ₁ , u ₂ ,..., U _t
Calculating public information｝), and when e _i = 0, a judgment formula Is determined, and when e _i = 1, the determination formula It is determined whether or not the following condition is satisfied. (However, y = φ (C ₁ , C ₂ ,..., C _n )
Is: The ring isomorphism ) Determining whether the ciphertext C _i (1 ≦ i ≦ n) is equal to the original plaintext P when the series of determination formulas is satisfied in the verifier's device. A method of proving the identity of an original plaintext from a plurality of ciphertexts, characterized in that the identity of the original plaintext is verified. 7. A method for proving the identity of an original plaintext from a plurality of ciphertexts according to claim 6, wherein the one-way functions f and g are the same and a random number e
_{i, e'i} a, e _i = _e'i and a plurality of ways of proving the identity of the original plaintext from the ciphertext, characterized that the the. 8. A method of proving the identity of the original plain text from the plurality of ciphertext according to claim 3, 4, 6 or 7, in the apparatus of decoding who has the secret key d _i, [ Equation 17 A method of proving the identity of the original plaintext from a plurality of ciphertexts, comprising the step of: 9. A storage medium storing a program for a method of certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a confirmer without indicating the plaintext, The program is stored in an information processing apparatus according to claim 3, 4, 6,
A program for certifying the identity of an original plaintext from a plurality of ciphertexts, characterized by causing the method to prove the identity of the original plaintext from the plurality of ciphertexts described in 7 or 8. Storage medium in which is stored. 10. A storage medium storing a program for a method of certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a confirmer without indicating the plaintext, The program is stored in an information processing apparatus according to claim 3, 4, 6,
7. A method of certifying the identity of an original plaintext from a plurality of ciphertexts described in 7 or 8, wherein the step of executing the steps in a device of a prover is performed. A storage medium storing a program for a method of proving identity. 11. A storage medium storing a program for a method for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, The program is stored in an information processing apparatus according to claim 3, 4, 6,
7. A method of certifying the identity of an original plaintext from a plurality of ciphertexts described in 7 or 8, wherein the step of executing a step in a device of a verifier is performed. A storage medium storing a program for a method of proving identity. 12. A system for proving the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein a plaintext P included in an appropriate range Ω is obtained. select, public key e ₁ a plaintext P multiple of, ···, e _n multiple of ciphertext C ₁ encrypted with each,..., asked for C _n, the dark ciphertext C _1, ..., C _n
Means for disclosing, to the verifier, knowing the plaintext P; and
Means for proving that the plaintext P is included in the range Ω;
A prover-side device comprising: a prover knows the plaintext P;
There by ensuring that included in the scope Omega, dark ciphertext C _1, · · ·, and confirmed side apparatus provided with a means for confirming that the original plaintext P from C _n have the same properties, A system for proving the identity of an original plaintext from a plurality of ciphertexts, characterized by: 13. A system for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein the prover-side device and the verifier-side device becomes in a prover side apparatus selects the plaintext P included in the appropriate range Omega, exposes plaintext P multiple keys e _1, ···, e _n each plurality of encrypted ciphertext C ₁ ,..., I asked for C _n, the dark ciphertext C _1, ···, C _n
And means for proving that the plaintext P is known to the verifier and that the plaintext P is included in the range Ω by interactive communication between the verifier and the verifier. And the verifier side communicates with the prover side apparatus that the prover knows the plaintext P, and that the plaintext P falls within the range Ω.
, The ciphertext C ₁ ,...
· A system to verify the identity of the original plain text from the plurality of ciphertext, characterized in that it comprises means to verify that the original plaintext P from C _n have the same properties. 14. A system for proving the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein the prover-side device and the verifier-side device The prover-side apparatus obtains 0 <P <for the public key (e, N _i ) (1 ≦ i ≦ n).
An integer N such that N <N _i and a plaintext P are selected, and the ciphertext C _i (1
≤ i ≤ n) (However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡ 1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} ,. becomes n _n relationship. here, d _i is the private key for the public key _{(e, n i), L} i = lcm (P i -1, Q i -1) is a.) to calculate , The ciphertext C _i (1 ≦ i ≦ n)
And a means for publishing an integer N. Integers r _i and s _i are selected as The calculated, and transmits u _i, the v _i to check side apparatus receives the e _{i, e'i} sent from the acknowledgment side apparatus thereto, Equation 21] , And means for repeating a series of actions such as transmitting w _i and z _i to the confirmer from i = 1 to t. The confirmer-side device is sent from the prover-side device. In response to u _i and v _i , e
_i {0, 1} and e ′ _i {0, 1,..., e−
1｝ at random, means for transmitting e _i , e ′ _i to the prover side device, and e _i in response to w _i , z _i sent from the prover side device.
When = 0, the judgment formula It is determined whether or not the following holds. When e _i = 1, the determination formula It is determined whether or not the above condition is satisfied. (However, y = φ (C ₁ , C ₂ ,..., C _n )
Is: The ring isomorphism ) And means for determining whether or not a series of determination formulas repeatedly performed in response to w _i and z _i transmitted t times from the prover side device are satisfied. Means for confirming that the original plaintext P of the sentence C _i (1 ≦ i ≦ n) has the same identity, a system for proving the identity of the original plaintext from a plurality of ciphertexts. 15. A system for proving the identity of the original plain text from the plurality of ciphertext according to claim 14, random number e _i, a _e'i, characterized in that the e _i = _e'i A system that proves the identity of the original plaintext from multiple ciphertexts. 16. A system for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein the prover-side device and the verifier-side device becomes in a prover side apparatus selects the plaintext P included in the appropriate range Omega, exposes plaintext P multiple keys e _1, ···, e _n each plurality of encrypted ciphertext C ₁ ,..., I asked for C _n, the dark ciphertext C _1, ···, C _n
And a means for transmitting to the confirmer apparatus information indicating that the prover knows the plaintext P and that the plaintext P is included in the range Ω. device, from the information, that the prover knows the plaintext P, and, by confirming that the plaintext P is included in the range Omega, dark ciphertext C _1, · · ·, C _n A system for certifying the identity of an original plaintext from a plurality of ciphertexts, comprising means for confirming that the original plaintext P has the same identity from the original plaintext. 17. A system for certifying the identity of an original plaintext from a plurality of ciphertexts created by a prover to a verifier without indicating the plaintext, wherein the prover-side device and the verifier-side device The prover-side apparatus obtains 0 <P <for the public key (e, N _i ) (1 ≦ i ≦ n).
An integer N such that N <N _i and a plaintext P are selected, and the ciphertext C _i (1
≤ i ≤ n) (However, N _i = P _i Q _i (P _i and Q _i are prime numbers) ed _i ≡ 1 (modL _i ) M ₁ = N ₁ ,..., N _k M ₂ = N _{k + 1} ,. becomes n _n relationship. here, d _i is the private key for the public key _{(e, n i), L} i = lcm (P i -1, Q i -1) is a.) to calculate , The ciphertext C _i (1 ≦ i ≦ n)
And a means for disclosing the integer N, Integers r _i and s _i are selected as U _i , v _i that satisfy
respect _{g, e 1 e 2 ··· e} t = f ({u 1, u 2, ···, u t and v _1, v _2, public information including ··· v _t}) e' ₁ e ′ ₂ ... E ′ _h = g (｛u ₁ , u ₂ ,..., U _t
.., Where e ₁ e ₂ ... _Et is f (｛u ₁ , u ₂ ,.
u _t and v _1, v _{2, 2} of · · · v public information including _t})
, E ′ _i {0, 1,..., E−1}
(1 ≦ i ≦ h). ) And means for calculating A is calculated, obtained _{u i, v i, w i} , z i (1 ≦ i ≦ t)
And means for transmitting to the confirmer to confirm side apparatus, u _i sent from the prover side device, v _i, w _i, in response to z _i e ₁ e ₂ ··· e _{t = f ({u 1,} u 2, ···, u t and v _1, v _2, public information including _{··· v t}) e'1 e'} 2 ··· e'h = g ( ｛U ₁ , u ₂ , ..., u _t
Is calculated, and when e _i = 0, the judgment formula Is determined, and when e _i = 1, the determination formula It is determined whether or not the above condition is satisfied. (However, y = φ (C ₁ , C ₂ ,..., C _n )
Is: The ring isomorphism ) Is determined, and if a series of determination expressions is satisfied, the ciphertext C _i (1 ≦ i)
≤n) means for confirming that the original plaintexts P have the same identity, a system for proving the identity of the original plaintexts from a plurality of ciphertexts. 18. A system for proving the identity of an original plaintext from a plurality of ciphertexts according to claim 17, wherein the one-way functions f and g are the same and a random number e
_i, the _e'i, proving the identity of e _i = _e'i and the a to the plurality of ciphertext, wherein the original that plaintext system. 19. A system for certifying the identity of an original plaintext from a plurality of ciphertexts according to claim 14, 15, 17 or 18, further comprising a decryption device, wherein the decryption device comprises: by using the secret key d _i the decryption person has [number 34] A system for certifying the identity of the original plaintext from a plurality of ciphertexts, comprising means for decrypting the plaintext P by calculating