WO2017203743A1 - Cipher apparatus, decoding apparatus, and cipher system - Google Patents

Abstract

The purpose of this invention is to make it possible to configure cipher such as attribute-based cipher that is effective even in the case where a quantum computer is made. A cipher system (1) uses a plurality of groups that are associated by an isogeny φ_t regarding an integer t of t ∈ [d] and a pairing computation e_t regarding an integer t of t ∈ [0, d]. The cipher system (1) is provided with: a cipher apparatus (20) that generates ciphertext including a cipher element of a certain group among the plurality of groups; and a decoding apparatus (30) that decodes the ciphertext generated by the cipher apparatus (20) using a decoding key including a key element of a group different from the certain group among the plurality of groups.

Description

Encryption device, decryption device, and encryption system

This invention relates to an anti-quantum cryptosystem.

Quantum computers are being developed worldwide. Research is also underway on cryptosystems such as lattice cryptosystems that can maintain security against quantum computers, that is, have quantum resistance. However, it has been pointed out that it is still difficult to set an accurate data size for lattice encryption, and a construction method based on other mathematical principles has been desired.

Many attribute-based ciphers (hereinafter referred to as ABE) using pairing operations on elliptic curves have been proposed. Non-Patent Document 1 describes one method of attribute-based encryption using a pairing operation on an elliptic curve.

Also, Non-Patent Document 2 describes a public key cryptosystem having quantum resistance using the same kind of mapping.

However, all attribute-based cryptography using elliptic curve pairing has been found to be devastatingly damaged by the quantum computer uncovering the master secret key. There was no attribute-based encryption with quantum resistance.
An object of the present invention is to make it possible to configure an encryption scheme such as attribute-based encryption that is effective even when a quantum computer is made.

The encryption device according to the present invention provides:
An encryption device in an encryption system using a plurality of groups associated by homogenous mapping and pairing operation,
A ciphertext generating unit configured to generate a ciphertext including a certain group of cipher elements of the plurality of groups;

In the present invention, by using a plurality of groups associated by the homogeneous mapping and the pairing operation, it is possible to construct a cipher such as an attribute-based encryption that is effective even when a quantum computer is created.

Explanatory drawing of the same kind pairing group used with the IBE system which concerns on Embodiment 1. FIG. 1 is a configuration diagram of a cryptographic system 1 according to Embodiment 1. FIG. 1 is a configuration diagram of a key generation device 10 according to Embodiment 1. FIG. 1 is a configuration diagram of an encryption device 20 according to Embodiment 1. FIG. 1 is a configuration diagram of a decoding device 30 according to Embodiment 1. FIG. 4 is a flowchart of a setup algorithm according to the first embodiment. Explanatory drawing of the same kind pairing group which concerns on Embodiment 1. FIG. 4 is a flowchart of a KeyGen algorithm according to the first embodiment. 4 is a flowchart of an Enc algorithm according to the first embodiment. 3 is a flowchart of a Dec algorithm according to the first embodiment. Explanatory drawing of the attack method with respect to the IBE system which concerns on Embodiment 1. FIG. The block diagram of the key generation apparatus 10 which concerns on the modification 1. FIG. The block diagram of the encryption apparatus 20 which concerns on the modification 1. FIG. The block diagram of the decoding apparatus 30 which concerns on the modification 1. FIG. FIG. 3 is a configuration diagram of a cryptographic system 1 according to a second embodiment. FIG. 3 is a configuration diagram of a key generation device 10 according to a second embodiment. FIG. 4 is a configuration diagram of an encryption device 20 according to a second embodiment. FIG. 4 is a configuration diagram of a decoding device 30 according to a second embodiment. 10 is a flowchart of an IPG generation algorithm according to the fifth embodiment. FIG. 10 is an explanatory diagram of algorithms Isog _{L to κ} (E ₀ ) according _{to the} fifth embodiment. FIG. 10 is an explanatory diagram of algorithms Isog _{L to κ} (E ₀ ) according _{to the} fifth embodiment.

Embodiment 1 FIG.
In Embodiment 1, an ID-based encryption (hereinafter referred to as IBE) method having quantum resistance will be described.

*** Explanation of notation ***
The notation used in Embodiment 1 will be described.

When A is a random value or distribution, Equation 101 represents selecting y from A randomly according to the distribution of A. That is, in Equation 101, y is a random number.

When A is a set, Equation 102 represents selecting y from A uniformly. That is, in Equation 102, y is a uniform random number.

The number 103 represents a field of order q.

The field of order _q is simply referred to as F _{q in the} text.

[N]: = {1,. . . , N}, [0, n]: = {0} ∪ [n]: = {0,. . . , N}. n is an integer of 0 or more.

For two vectors y ^→ and v ^→ of the equation 104, y ^→ · v ^→ indicates the inner product shown in Formula 105.

*** Explanation of concept ***
With reference to FIG. 1, the same kind pairing group (henceforth IPG) used with the IBE system which concerns on Embodiment 1 is demonstrated.

The IPG has a plurality of groups associated with each other by a homogeneous map and a pairing operation.
Specifically, IPG is a group _{G 0,} t = 1 ,. associated with the group _{G 0} and isogeny phi _t . . , Each group _{G t} of d, t = 0,. . . , And a group _{G T} is attached corresponding with each group _{G t} and the group G _{^ t} and pairing operation _{e t} of d. Then, the IPG, and if it is converted by the pairing operation _{e 0} from the group _{G 0} × group G _{^ 0,} t = 1 ,. . . , On which has been converted from the group G ₀ × group G ^ ₀ by isogenies phi _t for any integer t of d in the group G _t × group G ^ _t, in the case that has been converted by the pairing operation e _t The results are equal.

More precisely, IPG is defined as follows:
In the IPG generation algorithm Gen ^IPG (1 ^λ , d), a master key pair of the public parameter pk ^IPG and the master secret key sk ^IPG shown in Expression 106 is randomly generated.

_{Here, (G t, G ^ t} , e t, G T) is pairing operation _e t: is asymmetrical pairing group _{G t} × _{G ^ t} → number of prime number having a _{G T} q. a g _{^ t} ∈G _{^ t.} Homogeneous map φ _t : G ₀ → G _t and is given by the same kind between different elliptic curves. g _t = φ _t (g ₀ ) ∈G _t .
The IPG has compatibility shown in Equation 107.

Here, g _T = e ₀ (g ₀ , g ^ ₀ ) ≠ 1. Further, G _t ≠ G ^ _t .

*** Explanation of configuration ***
The configuration of the IBE method according to the first embodiment will be described.
The IBE method includes a Setup algorithm, a KeyGen algorithm, an Enc algorithm, and a Dec algorithm.
The Setup algorithm receives the security parameter 1 ^λ and outputs the public parameter pk and the master secret key sk.
The KeyGen algorithm receives a public parameter pk, a master secret key sk, and an identifier ID, and outputs a decryption key sk _ID corresponding to the identifier ID.
The Enc algorithm receives the public parameter pk, the message m in the message space msg, and the identifier ID ′, and outputs a ciphertext ct _{ID ′} .
The Dec algorithm receives the public parameter pk, the decryption key sk _ID corresponding to the identifier ID, and the ciphertext ct _{ID ′} encrypted under the identifier ID ′, and receives the message m′εmsg or decryption. Outputs identification information 示 す indicating failure.

With reference to FIG. 2, the configuration of the cryptographic system 1 according to the first embodiment will be described.
The encryption system 1 includes a key generation device 10, an encryption device 20, and a decryption device 30.
The key generation device 10, the encryption device 20, and the decryption device 30 are computers. The key generation device 10, the encryption device 20, and the decryption device 30 are connected via a network.

The key generation apparatus 10 receives the security parameter 1 ^λ and executes the Setup algorithm to generate the public parameter pk and the master secret key sk. Further, the key generation device 10 receives the public parameter pk, the master secret key sk, and the identifier ID, executes the KeyGen algorithm, and generates a decryption key sk _ID .
The key generation device 10 discloses the public parameter pk and outputs the decryption key sk _ID to the decryption device 30 corresponding to the identifier ID. The key generation device 10 stores the master secret key sk.

The encryption device 20 receives the public parameter pk, the message m, and the identifier ID ′, executes the Enc algorithm, and generates a ciphertext ct _{ID ′} . The encryption device 20 outputs the ciphertext ct _{ID ′} to the decryption device 30.

The decryption device 30 receives the public parameter pk, the decryption key sk _ID, and the ciphertext ct _{ID ′} , executes the Dec algorithm, and receives the message m ′ or the identification information ⊥ indicating that decryption has failed. Generate.

With reference to FIG. 3, the configuration of the key generation apparatus 10 according to the first embodiment will be described.
The key generation device 10 includes hardware including a processor 11, a storage device 12, and an input / output interface 13. The processor 11 is connected to other hardware via a signal line, and controls these other hardware.

The key generation device 10 includes a master key generation unit 14, a decryption key generation unit 15, and a key output unit 16 as functional components. The functions of the master key generation unit 14, the decryption key generation unit 15, and the key output unit 16 are realized by software.
The storage device 12 stores a program that realizes the functions of the respective units of the key generation device 10. This program is read by the processor 11 and executed by the processor 11. Thereby, the function of each part of the key generation device 10 is realized.

With reference to FIG. 4, the configuration of encryption apparatus 20 according to Embodiment 1 will be described.
The encryption device 20 includes hardware including a processor 21, a storage device 22, and an input / output interface 23. The processor 21 is connected to other hardware via a signal line, and controls these other hardware.

The encryption device 20 includes an input reception unit 24, a ciphertext generation unit 25, and a ciphertext output unit 26 as functional components. The functions of the input reception unit 24, the ciphertext generation unit 25, and the ciphertext output unit 26 are realized by software.
The storage device 22 stores a program that realizes the functions of the respective units of the encryption device 20. This program is read by the processor 21 and executed by the processor 21. Thereby, the function of each part of the encryption apparatus 20 is implement | achieved.

With reference to FIG. 5, the configuration of decoding apparatus 30 according to Embodiment 1 will be described.
The decoding device 30 includes hardware including a processor 31, a storage device 32, and an input / output interface 33. The processor 31 is connected to other hardware via a signal line, and controls these other hardware.

The decryption device 30 includes an input reception unit 34, a decryption unit 35, and a message output unit 36 as functional components. The functions of the input reception unit 34, the decoding unit 35, and the message output unit 36 are realized by software.
The storage device 32 stores a program that realizes the functions of each unit of the decoding device 30. This program is read by the processor 31 and executed by the processor 31. Thereby, the function of each part of the decoding apparatus 30 is implement | achieved.

The processors 11, 21, 31 are ICs (Integrated Circuits) that perform processing. Specific examples of the processors 11, 21, and 31 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

As a specific example, the storage devices 12, 22, and 32 include a RAM (Random Access).
Memory) and HDD (Hard Disk Drive). The storage devices 12, 22, and 32 are portable storage media such as an SD (Secure Digital) memory card, a CF (Compact Flash), a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, and a DVD. May be.

The input / output interfaces 13, 23, and 33 are interfaces for receiving data input from the outside and outputting the data to the outside. Specific examples of the input / output interfaces 13, 23, and 33 include USB (Universal Serial Bus), PS / 2, HDMI (registered trademark, High-Definition Multimedia Interface) for connecting an input device such as a keyboard and an output device such as a display. ). Further, as a specific example, the input / output interfaces 13, 23, and 33 are NICs (Networks) that transmit and receive data from the outside via a network.
(Interface Card).

Information, data, signal values, and variable values indicating the processing results of the functions of the respective units realized by the processor 11 are stored in the storage device 12 or in a register or cache memory in the processor 11. Similarly, information, data, signal values, and variable values indicating the processing results of the functions of the respective units realized by the processor 21 are stored in the storage device 22, a register in the processor 21, or a cache memory. Similarly, information, data, signal values, and variable values indicating the results of processing of the functions of the respective units realized by the processor 31 are stored in the storage device 32, or a register or cache memory in the processor 31.

It is assumed that a program for realizing each function realized by the processor 11 is stored in the storage device 12. Similarly, it is assumed that a program for realizing each function realized by the processor 21 is stored in the storage device 22. Similarly, it is assumed that a program for realizing each function realized by the processor 31 is stored in the storage device 32. However, this program may be stored in a portable storage medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD.

In FIG. 3, only one processor 11 is shown. However, the key generation device 10 may include a plurality of processors that replace the processor 11. The plurality of processors share the execution of a program that realizes the function of each unit of the key generation device 10. Each processor is an IC that performs processing in the same manner as the processor 11. Similarly, the encryption device 20 may include a plurality of processors that replace the processor 21. The decoding device 30 may include a plurality of processors that replace the processor 31.

*** Explanation of operation ***
The operation of the cryptographic system 1 according to the first embodiment will be described with reference to FIGS. 3 to 9.
The operation of the cryptographic system 1 according to the first embodiment corresponds to the cryptographic method according to the first embodiment. The operation of the cryptographic system 1 according to the first embodiment corresponds to the processing of the cryptographic program according to the first embodiment.

The Setup algorithm according to the first embodiment will be described with reference to FIGS. 3 and 6.
The Setup algorithm is executed by the key generation device 10.

(Step S11: IPG generation processing)
The master key generation unit 14 receives an input of the security parameter 1 ^λ through the input / output interface 13. The master key generation unit 14 receives the received security parameter 1 ^λ and d = 1, executes the IPG generation algorithm Gen ^IPG (1 ^λ , d), and executes the public parameter pk ^IPG shown in Expression 108 and the master. A master key pair with the secret key sk ^IPG is generated.

That is, as shown in FIG. 7, in the first embodiment, and the group _{G t} and the group G _{^ t} and pairing operation _{e t} for t = 0, 1, and the group _{G T,} and the isogeny phi ₁ product Is done.
Incidentally, as shown in FIG. 7, the conversion is "decryption key generation (KeyGen)" from _{G 0} to _{G 1,} to _{G 0} × conversion "encryption (Enc)" from G _{^ 0} to _{G T} , converted from _{G 1} × _{G ^ 1} to _{G T} is roughly correspond to "decode (Dec)".

(Step S12: Hash function generation process)
The master key generation unit 14 generates a random hash function H that converts an element of the field F _q that is an identifier space into an element of the group G ₀ .

(Step S13: Master key generation process)
The master key generation unit 14 uses the public parameter pk ^IPG generated in step S11 and the hash function H generated in step S12, so that the public parameter pk: = (((G _t , G ^ _t , g ^ _t , E _t ) _{t = 0,1} , G _T , H). The key output unit 16 outputs the public parameter pk to the encryption device 20 and the decryption device 30 by outputting the public parameter pk to an external public server or the like via the input / output interface 13.
Also, the master key generation unit 14 uses the master secret key ^{sk IPG} generated in step S11, the master secret key sk: = generating a phi _1. The master key generation unit 14 writes the generated master secret key sk in the storage device 12.

That is, the master key generation unit 14 executes the Setup algorithm shown in Equation 109 to generate a master key pair.

The KeyGen algorithm according to Embodiment 1 will be described with reference to FIGS.
The KeyGen algorithm is executed by the key generation device 10.

(Step S21: ID reception process)
The decryption key generation unit 15 receives input of an identifier ID of a user who uses the decryption key sk _ID via the input / output interface 13.

(Step S22: Key element generation process)
Decryption key generating unit 15 is input with the identifier ID received in step S21, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0. The decryption key generation unit 15 converts the element h ₀ with the homogeneous map φ ₁ included in the master secret key sk to generate the element h ₁ .

(Step S23: Key element output processing)
Key output unit 16, the identifier ID received in step S21, the decryption key _{sk ID} to the key elements and element _{h 1} generated in step S22, and outputs to the decoding device 30 via the input-output interface 13 . At this time, the key output unit 16 prevents the decryption key sk _ID from leaking to a third party by a method such as encryption by some encryption method.

That is, the decryption key generation unit 15 executes the KeyGen algorithm expressed by Equation 110 to generate a decryption key sk _ID .

The Enc algorithm according to the first embodiment will be described with reference to FIGS. 4 and 9.
The Enc algorithm is executed by the encryption device 20.

(Step S31: Input acceptance process)
The input reception unit 24 receives input of the public parameter pk generated by the key generation device 10, the message m to be encrypted, and the identifier ID ′ as a decryption condition via the input / output interface 23.

(Step S32: Ciphertext Generation Processing)
Ciphertext generator 25 is input with the identifier ID 'received in step S31, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0. In addition, the ciphertext generation unit 25 generates a uniform random number ζ.
The ciphertext generation unit 25 generates an element c represented by Formula 111 using the uniform random number ζ.

In addition, the ciphertext generation unit 25 generates the element z shown in Expression 112 using the element h ₀ and the uniform random number ζ. Then, the ciphertext generating unit 25 generates the element c _T : = z · m using the message m received in step S31 and the element z.

(Step S33: Ciphertext Output Process)
Ciphertext output unit 26, the identifier ID received in step S31 to 'and generated elements c in step S32, the ciphertext _{ct ID} to encryption elements and _{c T',} output interface 23 decodes Output to device 30.

That is, the encryption device 20 executes the Enc algorithm expressed by Equation 113 to generate a ciphertext ct _{ID ′} .

The Dec algorithm according to the first embodiment will be described with reference to FIGS.
The Dec algorithm is executed by the decoding device 30.

(Step S41: input acceptance process)
The input receiving unit 34 receives input of the public parameter pk and decryption key sk _ID generated by the key generation device 10 and the ciphertext ct _{ID ′} generated by the encryption device 20 via the input / output interface 33. .

(Step S42: Decoding determination process)
The decryption unit 35 determines whether or not the identifier ID included in the decryption key sk _ID received in step S41 is equal to the identifier ID ′ included in the ciphertext ct _{ID ′} . Thereby, it is determined whether or not the ciphertext ct _{ID ′} can be decrypted with the decryption key sk _ID .
When it is determined that they are equal, that is, when it is determined that decoding is possible, the decoding unit 35 proceeds with the process to step S43, and when not, proceeds with the process to step S45.

(Step S43: Decoding process)
The decryption unit 35 performs a pairing operation e ₁ on the element h ₁ included in the decryption key sk _ID received in step S41 and the encryption element c included in the ciphertext ct _{ID ′} , and calculates the element z ′. . The decoding unit 35 calculates the message m ′: = c _T · (z ′) ⁻¹ using the calculated element z ′.

(Step S44: Message output processing)
The message output unit 36 outputs the message m ′ calculated in step S42 via the input / output interface 33.

(Step S45: identification information output process)
The message output unit 36 outputs the identification information box via the input / output interface 33.

That is, the decryption device 30 executes the Dec algorithm expressed by Equation 114, and decrypts the ciphertext ct _{ID ′} using the decryption key sk _ID .

*** Effects of Embodiment 1 ***
As described above, the cryptographic system 1 according to Embodiment 1 implements the IBE method using IPG. Here, the master secret key sk: = φ ₁ generated by the key generation device 10 has quantum resistance. Therefore, the master secret key sk is not broken even by the quantum computer.

The effect of the first embodiment will be described in detail with reference to FIG.
The IBE method according to the first embodiment has a hierarchical structure in which the secret key has two layers. That is, in the IBE method according to Embodiment 1, the secret key has a two-layer structure of the upper layer master secret key and the lower layer decryption key.
If the master secret key is revealed, a decryption key for any identifier ID can be generated using a conventional stochastic polynomial time machine. Therefore, in order to attack efficiently, the attacker first tries to reveal the master secret key. If the master secret key is protected, the attacker must break the ciphertext one by one. A method of attacking the master secret key is called “master key level attack”, and a method of attacking ciphertexts one by one is called “user level attack”.
When a quantum computer is developed, in the cryptographic system 1 according to the first embodiment, although a user level attack becomes possible, a master key level attack can be prevented.
Even if the quantum computer is completed, the development speed is considered to be relatively slow at the initial stage, as in the case of existing computers. At least at the initial stage, portable handheld quantum computers do not spread, and such quantum computers are considered expensive. Therefore, it is considered that the user level attack is very inefficient. In the cryptographic system 1 according to the first embodiment, it is possible to prevent a master key level attack while realizing an efficient IBE scheme. Therefore, the IBE method realized by the cryptographic system 1 according to the first embodiment is considered to be efficient and useful for a while even if the quantum computer is completed.

*** Other configurations ***
<Modification 1>
In the first embodiment, the functions of the respective units of the key generation device 10, the encryption device 20, and the decryption device 30 are realized by software. As a first modification, the functions of the units of the key generation device 10, the encryption device 20, and the decryption device 30 may be realized by hardware. The first modification will be described with respect to differences from the first embodiment.

With reference to FIGS. 12 to 14, configurations of the key generation device 10, the encryption device 20, and the decryption device 30 according to the first modification will be described.
When the functions of the respective units are realized by hardware, the key generation device 10, the encryption device 20, and the decryption device 30 are replaced with the processing circuits 17, 21 and 31 and the storage devices 12, 22, and 32, instead of the processing circuit 17, 27, 37. The processing circuits 17, 27, and 37 are dedicated electronic circuits that implement the functions of the respective units of the key generation device 10, the encryption device 20, and the decryption device 30 and the functions of the storage devices 12, 22, and 32.

The processing circuits 17, 27, and 37 are a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA (Gate Array), an ASIC (Application Specific Integrated Circuit), and an FPGA (Field-Programmable Gate). Array) is assumed.
The key generation device 10, the encryption device 20, and the decryption device 30 may include a plurality of processing circuits that substitute for the processing circuits 17, 27, and 37. The function of each unit is realized as a whole by the plurality of processing circuits. Each processing circuit is a dedicated electronic circuit, like the processing circuits 17, 27, and 37.

<Modification 2>
As a second modification, some functions may be realized by hardware, and other functions may be realized by software. That is, some of the functions of the key generation device 10, the encryption device 20, and the decryption device 30 may be realized by hardware, and the other functions may be realized by software.

The processors 11, 21, 31, the storage devices 12, 22, 32, and the processing circuits 17, 27, 37 are collectively referred to as “processing circuits”. That is, the function of each part is realized by a processing circuit.

Embodiment 2. FIG.
In Embodiment 2, an ABE method having quantum resistance will be described. In the second embodiment, differences from the first embodiment will be described.
In the second embodiment, an attribute is given as an element of a polynomial-sized universe [d] specified by (t, 1) ε [d] × [1] = [d] × U for tε [d]. Explain the case. That is, a case of an attribute set Γ⊂ [d] described later will be described.

*** Explanation of concept ***
The concept used in the ABE method according to the second embodiment will be described.
The span program will be described. Since the span program is an existing concept, only the necessary range will be briefly explained here.

The span program on the field F _q is a labeled matrix S: = (M, ρ). Here, the matrix M is a (L row × r column) matrix on the field _Fq . The labels ρ are {(t, v), (t ′, v ′),. . . } Are labels given to the rows of the matrix M according to attributes. Note that all rows are labeled with one attribute. That is, ρ: {1,. . . , L} → {(t, v), (t ′, v ′),. . . }.
The span program accepts or rejects input according to the following criteria: Let Γ be an attribute set. That is, Γ: = {(t _j , x _j )} _{1 ≦ j ≦ d ′} (x _j εU _tj ). The span program S accepts the attribute set Γ only if 1 ^→ ε span <(M _i ) _{ρ (i) εΓ} >. The span program S accepting the attribute set Γ is represented as R (S, Γ) = 1. That is, the span program S accepts the attribute set Γ only when a vector with all elements being 1 is obtained by linear combination of rows (M _i ) _{ρ (i) εΓ} of the matrix M. The matrix S is called an access structure.

*** Explanation of configuration ***
In the second embodiment, a key policy type ABE (hereinafter referred to as KP-ABE) method in which a policy that is a decryption condition is set for a decryption key will be described. It is also possible to realize a ciphertext policy type ABE in which a policy is set for ciphertext based on the same concept.
In particular, in the second embodiment, a tagged KP-ABE method will be described. In the tagged KP-ABE method, the relationship R ⁺ ((tag, S), (tag ′,) is applied to the decryption key parameter (tag, S) and the ciphertext parameter (tag ′, Γ). Γ)): = Eq (tag, tag ′) ∧R (S, Γ). Here, only when tag = tag ′, Eq (tag, tag ′) = 1. If Eq (tag, tag ′) = 1∧R (S, Γ) = 1, the ciphertext can be decrypted with the decryption key.

The KP-ABE method includes a Setup algorithm, a KeyGen algorithm, an Enc algorithm, and a Dec algorithm.
The Setup algorithm receives the security parameter 1 ^λ and outputs the public parameter pk and the master secret key sk.
The KeyGen algorithm uses a public parameter pk, a master secret key sk, an input tag tag, and an access structure S: = (M, ρ) as inputs, and a decryption key sk _tag, corresponding to the input tag tag and the access structure S. _S is output.
The Enc algorithm uses the public parameter pk, the message m in the message space msg, the input tag tag ′, and the attribute set Γ: = {(t _j , x _j )} _{1 ≦ j ≦ d ′} as input, and the ciphertext ct _{tag ′, Γ} is output.
The Dec algorithm includes a public parameter pk, a decryption key sk _{tag, S} corresponding to the input tag tag and the access structure S, and a ciphertext ct _{tag ′, Γ} encrypted under the input tag tag ′ and the attribute set Γ. Is input, and the message m′εmsg or the identification information を indicating that decoding has failed is output.

The configuration of the cryptographic system 1 according to the second embodiment will be described with reference to FIG.
The encryption system 1 includes a key generation device 10, an encryption device 20, and a decryption device 30.
The key generation device 10, the encryption device 20, and the decryption device 30 are computers. The key generation device 10, the encryption device 20, and the decryption device 30 are connected via a network.

The key generation apparatus 10 receives the security parameter 1 ^λ and executes the Setup algorithm to generate the public parameter pk and the master secret key sk. Further, the key generation device 10 receives the public parameter pk, the master secret key sk, the input tag tag, and the access structure S: = (M, ρ), executes the KeyGen algorithm, and performs the decryption key sk _{tag. , S} is generated.
The key generation device 10 discloses the public parameter pk _, and outputs the decryption key sk _{tag, S} to the decryption device 30 corresponding to the input tag tag and the access structure S. The key generation device 10 stores the master secret key sk.

The encryption device 20 receives the public parameter pk, the message m, the input tag tag ′, and the attribute set Γ, and executes the Enc algorithm to generate the ciphertext ct _{tag ′, Γ} . The encryption device 20 outputs the ciphertext ct _{tag ′, Γ} to the decryption device 30.

The decryption device 30 receives the public parameter pk, the decryption key sk _{tag, S,} and the ciphertext ct _{tag ′, Γ} and executes the Dec algorithm to indicate that the message m ′ or decryption has failed. Generate identification information ⊥.

The configuration of the key generation device 10 shown in FIG. 16, the encryption device 20 shown in FIG. 17, and the decryption device 30 shown in FIG. 18 is the same as that of the key generation device 10 shown in FIG. 3 and the encryption device shown in FIG. 20 and the configuration of the decoding device 30 shown in FIG. However, the information inputted and outputted by each component is different.

*** Explanation of operation ***
With reference to FIGS. 16 to 18 and FIGS. 6 to 10, the operation of the cryptographic system 1 according to the second embodiment will be described.
The operation of the cryptographic system 1 according to the second embodiment corresponds to the cryptographic method according to the second embodiment. The operation of the cryptographic system 1 according to the second embodiment corresponds to the processing of the cryptographic program according to the second embodiment.

With reference to FIG. 16 and FIG. 6, the Setup algorithm according to the second embodiment will be described.
The Setup algorithm is executed by the key generation device 10.

(Step S11: IPG generation processing)
The master key generation unit 14 receives an input of the security parameter 1 ^λ through the input / output interface 13. The master key generation unit 14 receives the received security parameter 1 ^λ and an integer d equal to or greater than 1, and executes the IPG generation algorithm Gen ^IPG (1 ^λ , d) to execute the public parameter pk ^IPG shown in Formula 115. And a master key pair of the master secret key sk ^IPG .

That is, as shown in FIG. 1, in the first embodiment, t = 0, 1,. . . , A group _{G t} and the group G _{^ t} and pairing operation _{e t} for d, and the group _{G T,} t = 1 ,. . . , D and a homogeneous map φ _t is generated. That is, d + 1 pairing groups are used.
Here, t = 1,. . . , D, the attribute is set to the group G _t and the group G ^ _t . Therefore, the value of the integer d is determined according to the number of attributes to be set.

(Step S12: Hash function generation process)
As in the first embodiment, the master key generation unit 14 generates a hash function H.

(Step S13: Master key generation process)
The master key generation unit 14 uses the public parameter pk ^IPG generated in step S11 and the hash function H generated in step S12, so that the public parameter pk: = (((G _t , G ^ _t , g ^ _t , E _t ), _{tε [0, d]} , G _T , H). The key output unit 16 outputs the public parameter pk to the encryption device 20 and the decryption device 30 by outputting the public parameter pk to an external public server or the like via the input / output interface 13.
Further, the master key generation unit 14 generates the master secret key sk: = (φ _t ) _{tε [d]} using the master secret key sk ^IPG generated in step S11. The master key generation unit 14 writes the generated master secret key sk in the storage device 12.

That is, the master key generation unit 14 executes the Setup algorithm shown in Expression 116 to generate a master key pair.

The KeyGen algorithm according to the second embodiment will be described with reference to FIGS. 16 and 8.
The KeyGen algorithm is executed by the key generation device 10.

(Step S21: ID reception process)
The decryption key generation unit 15 receives input of the input tag tag of the user who uses the decryption key sk _{tag, S} and the access structure S: = (M, ρ) via the input / output interface 13. The access structure S indicates a range that can be decrypted with the decryption key sk _{tag, S.}

(Step S22: Key element generation process)
Decryption key generating unit 15 is input with the input tag tag received in step S21, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0.
The decryption key generation unit 15 randomly selects a vector u ^→ 1 ^→ 1 ^→ u ^→ = 1. The decryption key generation unit 15 includes s _i : = M _i · u ^→ and t: = ρ (i) for i∈ [L], and is included in the master secret key sk as shown in Expression 117. The element h ₀ is converted by the homogeneous map φ _t to generate the element k _i .

(Step S23: Key element output processing)
The key output unit 16 uses the input tag tag and the access structure S received in step S21 and the decryption key sk _{tag, S} having the key element k _i for i∈ [L] generated in step S22 as key elements. And output to the decoding device 30 via the input / output interface 13. At this time, the key output unit 16 prevents the decryption key sk _{tag, S} from leaking to a third party by a method such as encryption by some encryption method.

That is, the decryption key generation unit 15 executes the KeyGen algorithm expressed by Equation 118 to generate the decryption key sk _{tag, S.}

The Enc algorithm according to the second embodiment will be described with reference to FIGS.
The Enc algorithm is executed by the encryption device 20.

(Step S31: Input acceptance process)
The input receiving unit 24 inputs the public parameter pk generated by the key generation device 10, the message m to be encrypted, the input tag tag ′ and the attribute set Γ as the decryption conditions via the input / output interface 23. Accept.

(Step S32: Ciphertext Generation Processing)
Ciphertext generator 25 is input with the input tag tag 'received in step S31, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0. In addition, the ciphertext generation unit 25 generates a uniform random number ζ.
Ciphertext generating unit 25, for each integer t included in the attribute set gamma, using a uniform random zeta, generates an element c _t shown in Formula 119.

In addition, the ciphertext generation unit 25 generates the element z shown in Expression 120 using the element h ₀ and the uniform random number ζ. Then, the ciphertext generating unit 25 generates the element c _T : = z · m using the message m received in step S31 and the element z.

(Step S33: Ciphertext Output Process)
The ciphertext output unit 26 encrypts the input tag tag ′ and the attribute set Γ received in step S31, and the element c _t and the element c _T for each integer t included in the attribute set Γ generated in step S32. The ciphertext ct _{tag ′, Γ} as an element is output to the decryption device 30 via the input / output interface 23.

That is, the encryption device 20 executes the Enc algorithm expressed by Equation 121 to generate ciphertext ct _{tag ′, Γ} .

The Dec algorithm according to the second embodiment will be described with reference to FIGS.
The Dec algorithm is executed by the decoding device 30.

(Step S41: input acceptance process)
The input receiving unit 34, via the input / output interface 33, the public parameter pk and the decryption key sk _{tag, S} generated by the key generation device 10, the ciphertext ct _{tag ′, Γ} generated by the encryption device 20 _, and Accepts input.

(Step S42: Decoding determination process)
The decryption unit 35 determines whether or not the input tag tag included in the decryption key sk _{tag, S} received in step S41 is equal to the input tag tag ′ included in the ciphertext ct _{tag ′, Γ} . Further, the decryption unit 35 determines whether or not the access structure S included in the decryption key sk _{tag, S} accepts the attribute set Γ included in the ciphertext ct _{tag ′, Γ} . Thus, it is determined whether or not the ciphertext ct _{tag ′, Γ} can be decrypted with the decryption key sk _{tag, S.}
When it is determined that the input tag tag is equal to the input tag tag ′ and the access structure S is determined to accept the attribute set Γ, the decryption unit 35 proceeds to step S43. Proceed to step S45.

(Step S43: Decoding process)
The decoding unit 35 calculates a complementary coefficient α _i satisfying Expression 122 for ρ (i) εΓ. Note that M _i is the i-th row of the matrix M.

Using the calculated complementary coefficient α _i , the decryption unit 35 uses the element k _i included in the decryption key sk _{tag, S} received in step S41 and the cipher element c _t included in the ciphertext ct _{tag ′, Γ.} The pairing calculation shown in Expression 123 is performed for and, and the element z ′ is calculated.

The decoding unit 35 calculates the message m ′: = c _T · (z ′) ⁻¹ using the calculated element z ′.

The processing from step S44 to step S45 is the same as in the first embodiment.

That is, the decryption apparatus 30 executes the Dec algorithm expressed by Equation 124, and decrypts the ciphertext ct _{ID ′} using the decryption key sk _ID .

As shown in Equation 125, the ciphertext ct _{tag ′, Γ} can be decrypted with the decryption key sk _{tag, S} in step S43.

*** Effects of Embodiment 2 ***
As described above, the cryptographic system 1 according to the second embodiment implements the ABE method using IPG. Here, the master secret key sk: = φ _t generated by the key generation device 10 has the quantum resistance as in the first embodiment. Therefore, the master secret key sk is not broken even by the quantum computer.

Embodiment 3 FIG.
In the third embodiment, the ABE method in the case where the attribute x _t : = (x _{t, j} ) _{jε [n]} is an element of the universe U: = {0, 1} ⁿ for any partial universe identifier t will be described. To do. In the third embodiment, differences from the second embodiment will be described.

In the third embodiment, a hierarchical structure for two instances tε [d] and jε [n] of a small universe of ABE is used. Then, in the third embodiment, in the instance of the lower hierarchy, special form of secret sharing predicates n-out-of-2n are used to identifier matching for the identifier x _t binary length n.

*** Explanation of operation ***
The operation of the cryptographic system 1 according to Embodiment 3 will be described with reference to FIGS. 16 to 18 and FIGS.
The operation of the cryptographic system 1 according to the third embodiment corresponds to the cryptographic method according to the third embodiment. The operation of the cryptographic system 1 according to the third embodiment corresponds to the processing of the cryptographic program according to the third embodiment.

With reference to FIG. 16 and FIG. 6, the Setup algorithm according to the third embodiment will be described.
The Setup algorithm is executed by the key generation device 10.

(Step S11: IPG generation processing)
The master key generation unit 14 receives an input of the security parameter 1 ^λ through the input / output interface 13. The master key generation unit 14 executes the IPG generation algorithm Gen ^IPG (1 ^λ , 2dn) with the received security parameter 1 ^λ and the integer ddn of 1 or more and the integer 2dn of the integer n of 1 or more as inputs. Thus, a master key pair of the public parameter pk ^IPG and the master secret key sk ^IPG shown in Expression 126 is generated.

That is, in the first embodiment, t = 0, 1,. . . , D and j = 1,. . . , The group _{G t} for n and iota = 0, _1, and _{j, iota} and the group _{G ^ t, j, iota} and pairing operation _{e t,} and the group _{G T,} t = 1 ,. . . , D and j = 1,. . . , N and ι = 0,1, a homogeneous map φ _{t, j, ι} is generated. That is, 2dn + 1 pairing groups are used.
Here, t = 1,. . . , D and j = 1,. . . , N and ι = 0, 1, the attributes are set to the group G _{t, j, ι} and the group G ^ _{t, j, ι} . Therefore, the values of the integers d and n are determined according to the number of attributes to be set.

(Step S12: Hash function generation process)
As in the first embodiment, the master key generation unit 14 generates a hash function H.

(Step S13: Master key generation process)
The master key generation unit 14 uses the public parameter pk ^IPG generated in step S11 and the hash function H generated in step S12, so that the public parameter pk: = (((G _t , G ^ _t , g ^ _t , E _t ) _{tε [0, d], jε [n], ιε [0} , _1] , G _T , H). The key output unit 16 outputs the public parameter pk to the encryption device 20 and the decryption device 30 by outputting the public parameter pk to an external public server or the like via the input / output interface 13.
Further, the master key generation unit 14 uses the master secret key sk ^IPG generated in step S11, and uses the master secret key sk: = (φ _{t, j, ι} ) _{t∈ [d], j∈ [n], Generate ι∈ [0,1]} . The master key generation unit 14 writes the generated master secret key sk in the storage device 12.

That is, the master key generation unit 14 executes the Setup algorithm shown in Equation 127 to generate a master key pair.

The KeyGen algorithm according to the second embodiment will be described with reference to FIGS. 16 and 8.
The KeyGen algorithm is executed by the key generation device 10.

The processing in step S21 is the same as that in the second embodiment.

(Step S22: Key element generation process)
Decryption key generating unit 15 is input with the input tag tag received in step S21, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0.
The decryption key generation unit 15 randomly selects a vector u ^→ 1 ^→ 1 ^→ u ^→ = 1. The decryption key generation unit 15 sets s _i : = M _i · u ^→ for i∈ [L], and s _i = Σ _{j = 1} ⁿ τ _{i, j} , random number τ ^→ : = (τ _{i, j} ) is selected. Using the random number τ ^→ , the decryption key generation unit 15 converts the element h ₀ with the homogeneous map φ _{t, j, ι} included in the master secret key sk as shown in the equation 128, and generates the element k _{i, j} Is generated.

(Step S23: Key element output processing)
The key output unit 16 uses the input tag tag and the access structure S received in step S21, and the elements k _{i, j} for iε [L] and jε [n] generated in step S22 as key elements. The decryption key sk _{tag, S} to be output to the decryption device 30 via the input / output interface 13. At this time, the key output unit 16 prevents the decryption key sk _{tag, S} from leaking to a third party by a method such as encryption by some encryption method.

That is, the decryption key generation unit 15 generates the decryption key sk _{tag, S} by executing the KeyGen algorithm expressed by Equation 129.

The Enc algorithm according to the second embodiment will be described with reference to FIGS.
The Enc algorithm is executed by the encryption device 20.

The processing in step S31 is the same as that in the second embodiment.

(Step S32: Ciphertext Generation Processing)
Ciphertext generator 25 is input with the input tag tag 'received in step S31, by calculating the hash function H included in the public parameter pk, and generates an element h ₀ is an element of the group G _0. In addition, the ciphertext generation unit 25 generates a uniform random number ζ.
The ciphertext generation unit 25 uses the uniform random number ζ for each integer t and each integer j of (t, x _t : = (x _{t, j} ) ∈ {0,1} ⁿ ) ∈Γ included in the attribute set Γ. Is used to generate an element _{ct, j} shown in Equation 130.

In addition, the ciphertext generation unit 25 generates the element z shown in Formula 131 using the element h ₀ and the uniform random number ζ. Then, the ciphertext generating unit 25 generates the element c _T : = z · m using the message m received in step S31 and the element z.

(Step S33: Ciphertext Output Process)
The ciphertext output unit 26 receives the input tag tag ′ and the attribute set Γ received in step S31, and the elements c _t, j for each integer t and j∈ [n] included in the attribute set Γ generated in step S32 _. Cipher text ct _{tag ′, Γ} having _j and element c _T as encryption elements is output to the decryption device 30 via the input / output interface 23.

That is, the encryption device 20 executes the Enc algorithm expressed by Equation 132 to generate the ciphertext ct _{tag ′, Γ} .

The Dec algorithm according to the second embodiment will be described with reference to FIGS.
The Dec algorithm is executed by the decoding device 30.

The processing from step S41 to step S42 is the same as that in the second embodiment.

(Step S43: Decoding process)
The decoding unit 35 calculates a complementary coefficient α _i that satisfies Equation 133.

Using the calculated complementary coefficient α _i , the decryption unit 35 uses the element k _{i, j} included in the decryption key sk _{tag, S} received in step S41 and the encryption element included in the ciphertext ct _{tag ′, Γ.} The pairing operation shown in Equation 134 is performed for c _{t, j} and the element z ′ is calculated.

The decoding unit 35 calculates the message m ′: = c _T · (z ′) ⁻¹ using the calculated element z ′.

The processing from step S44 to step S45 is the same as that in the second embodiment.

That is, the decryption device 30 executes the Dec algorithm expressed by Equation 135, and decrypts the ciphertext ct _{ID ′} using the decryption key sk _ID .

As shown in Formula 136, the ciphertext ct _{tag ′, Γ} can be decrypted with the decryption key sk _{tag, S} in step S43.

*** Effects of Embodiment 3 ***
As described above, the cryptographic system 1 according to Embodiment 3 realizes the ABE method for a large universe using IPG. Here, the master secret key sk: = φ _t generated by the key generation device 10 has quantum resistance as in the second embodiment. Therefore, the master secret key sk is not broken even by the quantum computer.

Embodiment 4 FIG.
In the fourth embodiment, a hierarchical IBE (hereinafter, HIBE) method will be described. In the fourth embodiment, differences from the first embodiment will be described.

*** Explanation of operation ***
The operation of the cryptographic system 1 according to the fourth embodiment will be described with reference to FIGS.
The operation of the cryptographic system 1 according to the fourth embodiment corresponds to the cryptographic method according to the fourth embodiment. The operation of the cryptographic system 1 according to the fourth embodiment corresponds to the processing of the cryptographic program according to the fourth embodiment.

The Setup algorithm according to the first embodiment will be described with reference to FIGS. 3 and 6.
The Setup algorithm is executed by the key generation device 10.

The processing in step S11 is the same as that in the first embodiment.

(Step S12: Hash function generation process)
The master key generation unit 14 generates a random hash function H _t for converting an element of the field F _q that is an identifier space into an element of the group G _t for t = 0,1.

(Step S13: Master key generation process)
The master key generation unit 14 uses the public parameter pk ^IPG generated in step S11 and the hash function H generated in step S12, so that the public parameter pk: = ((G
_{t, G ^ t, g ^} t, e t, H t) t = 0,1, to generate a _{G T).} The key output unit 16 outputs the public parameter pk to the encryption device 20 and the decryption device 30 by outputting the public parameter pk to an external public server or the like via the input / output interface 13.
Also, the master key generation unit 14 uses the master secret key ^{sk IPG} generated in step S11, the master secret key sk: = generating a phi _1. The master key generation unit 14 writes the generated master secret key sk in the storage device 12.

That is, the master key generation unit 14 executes the Setup algorithm shown in Formula 137 to generate a master key pair.

The KeyGen algorithm according to the fourth embodiment will be described with reference to FIGS.
The KeyGen algorithm is executed by the key generation device 10.

(Step S21: ID reception process)
The decryption key generation unit 15 receives input of an identifier ID of a user who uses the decryption key sk _ID via the input / output interface 13. Here, the identifier ID is composed of ID _i for i∈ [j]. j is an integer of 2 or more.

(Step S22: Key element generation process)
The decryption key generation unit 15 generates an element d ^ _i for i∈ [j−1] as shown in Formula 138.

The decryption key generation unit 15 calculates the hash function H ₀ included in the public parameter pk, using ID ₁ constituting the identifier ID received in step S21 as an input, and obtains the element h ₁ that is an element of the group G ₀ Generate. Also, the decryption key generation unit 15 sets ID ₁ ,. . . , ID _i as input, the hash function H ₁ included in the public parameter pk is calculated to generate an element h _i that is an element of the group G ₁ . Then, the decryption key generation unit 15 generates an element d _j obtained by converting the element h ₁ with the same kind of mapping φ ₁ included in the master secret key sk as shown in Expression 139.

(Step S23: Key element output processing)
The key output unit 16 uses the identifier ID received in step S21, and the decryption key sk _ID generated using the element d ^ _j and the element d _j for iε [j-1] generated in step S22 as key elements. Is output to the decoding device 30 via the input / output interface 13. At this time, the key output unit 16 prevents the decryption key sk _ID from leaking to a third party by a method such as encryption by some encryption method.

That is, the decryption key generation unit 15 executes the KeyGen algorithm expressed by Equation 140 to generate a decryption key sk _ID .

The Enc algorithm according to the first embodiment will be described with reference to FIGS. 4 and 9.
The Enc algorithm is executed by the encryption device 20.

(Step S31: Input acceptance process)
The input reception unit 24 receives input of the public parameter pk generated by the key generation device 10, the message m to be encrypted, and the identifier ID ′ as a decryption condition via the input / output interface 23. Here, the identifier ID ′ is composed of ID ′ _i for i∈ [j].

(Step S32: Ciphertext Generation Processing)
The ciphertext generator 25 generates a uniform random number ζ. The ciphertext generation unit 25 generates an element c ^ ₀ shown in Formula 141 using the uniform random number ζ.

The ciphertext generation unit 25 sets ID ′ ₁ ,. . . , ID ′ _i as input, the hash function H ₁ included in the public parameter pk is calculated, and the element h _i that is an element of the group G ₁ is generated. Ciphertext generating unit 25 uses the element _{h i,} to produce an element _{c i} shown in Formula 142.

Ciphertext generating unit 25, as input ₁ 'ID constituting the' identifier ID received in step S31, by calculating the hash function H ₀ included in the public parameter pk, an element of the group G ₀ elements h ₁ is generated. Also, the ciphertext generation unit 25 generates the element z shown in Expression 143 using the element h ₁ and the uniform random number ζ. Then, the ciphertext generating unit 25 generates the element c _T : = z · m using the message m received in step S31 and the element z.

(Step S33: Ciphertext Output Process)
The ciphertext output unit 26 uses the identifier ID ′ received in step S31 and the elements c ^ ₀ , (c _i ) _{iε [2, j]} and c _T generated in step S32 as encryption elements. The sentence ct _{ID ′} is output to the decryption device 30 via the input / output interface 23.

That is, the encryption device 20 executes the Enc algorithm shown in Formula 144 to generate the ciphertext ct _{ID ′} .

The Dec algorithm according to the first embodiment will be described with reference to FIGS.
The Dec algorithm is executed by the decoding device 30.

The processing from step S41 to step S42 is the same as in the first embodiment.

(Step S43: Decoding process)
Decoding unit 35, shown in element d _^ and _j and element _{d j,} the element c _{^ 0} and element _{c i} and the number 145 included in the ciphertext _{ct ID 'included} in the decryption key _{sk ID} received in step S41 Perform an operation to calculate the element z ′. The decoding unit 35 calculates the message m ′: = c _T · (z ′) ⁻¹ using the calculated element z ′.

The processing from step S44 to step S45 is the same as in the first embodiment.

That is, the decryption apparatus 30 executes the Dec algorithm expressed by Equation 146 to decrypt the ciphertext ct _{ID ′} with the decryption key sk _ID .

As shown in Expression 147, the ciphertext ct _{tag ′, Γ} can be decrypted with the decryption key sk _{tag, S} in step S43.

*** Effects of Embodiment 4 ***
As described above, the cryptographic system 1 according to the fourth embodiment implements the HIBE method using IPG. Here, the master secret key sk: = φ _t generated by the key generation device 10 has the quantum resistance as in the first embodiment. Therefore, the master secret key sk is not broken even by the quantum computer.

Embodiment 5 FIG.
In the fifth embodiment, the IPG generation algorithm Gen ^IPG (1 ^λ , d) will be specifically described using an elliptic curve.

*** Explanation of operation ***
With reference to FIG. 19, the process of the IPG generation algorithm Gen ^IPG (1 ^λ , d) according to the fifth embodiment will be described.

(Step S51: Element generation processing)
The master key generation unit 14 has a sufficiently large hyperelliptic curve E ₀ / F _p2 for the odd prime p.
(Here, p2 is ^{p 2)} randomly generating.
The master key generation unit 14, a suitable ^{(L ~,} kappa) and asymmetric pairing groups quantile r comprised subgroup of an elliptic curve _{E 0 (G 0, G ^} 0, G T; e 0) Is generated. e ₀ is the veil pairing e _{weil, 0} in the elliptic curve E ₀ , for any h ₀ ∈G ₀ and h ^ ₀ ∈G ^ ₀ , e ₀ (h ₀ , h ^ ₀ ): = e _{weil , 0} (h ₀ , h ^ ₀ ) ^Ψ . Ψ = a ^(L ~) ^κ.
The master key generation unit 14 selects from the group _{G 0} elements _{g 0} uniformly, evenly select an element g _{^ 0} from the group G _{^ 0.}

(Step S52: Homogeneous generation process)
The master key generation unit 14, the algorithm ISOG _{L ~,} running _{kappa (E 0),} t∈ for [d], the elliptic curve _{E t} as the elliptic curve _{E 0} and the like, an elliptic curve from the elliptic curve _{E 0} A trapdoor ξ _t for calculating a homogeneous map to E _t is randomly generated. As the algorithm Isog L˜ _{, κ} (E ₀ ), the Isog L˜ _{, κ} ^djp algorithm described in Non-Patent Document 3 shown in FIG. 20 can be used. Further, as the algorithms Isog L˜ _{, κ} (E ₀ ), the Isog L˜ _{, κ} ^clg algorithm described in Non-Patent Documents 4 and 5 shown in FIG. 21 can be used.

(Step S53: Homogeneous element generation processing)
The master key generation unit 14 uses the elliptic curve E _t and the trap door ξ _t generated in step S52, φ _t : = φ _ξt , G _t : = φ _t (G ₀ ), and G ^ _t : =. For φ _t (G ^ ₀ ), g _t : = φ _t (g ₀ ), and g ^ _t : = φ _t (g ^ ₀ ), h _t ∈G _t and h ^ _t ∈G ^ _t e _t (h _t , ＾ _t ): = e _{weil, t} (h _t , ＾ _t ) Here, e _{weil, t} is Weil pairing in the elliptic curve E _t .

(Step S54: Element output process)
The master key generation unit 14, generated at step S51 and step _{S53 (G t, G ^ t} , g t, g ^ t, e t) t∈ [0, d], the public parameters ^{pk IPG} the _{G T} , (Φ _t ) _{tε [d]} , (ξ _t ) _{tε [d]} is output as the master secret key sk ^IPG .

That is, the IPG generation algorithm Gen ^IPG (1 ^λ , d) is as shown in Formula 148.

*** Effect of Embodiment 5 ***
As described above, the cryptographic system 1 according to Embodiment 5 can implement the IPG generation algorithm Gen ^IPG (1 ^λ , d) using an elliptic curve.

Embodiment 6 FIG.
In the first to fourth embodiments, detailed description using an elliptic curve is omitted in order to simplify the description and facilitate understanding. In the sixth embodiment, a specific configuration using an elliptic curve will be described. In the sixth embodiment, the IBE method described in the first embodiment and the ABE method described in the second embodiment will be described.
The ABE method described in the third embodiment and the HIBE method described in the fourth embodiment can also have a specific configuration using an elliptic curve by a similar method.

*** Explanation of operation ***
The IBE method described in Embodiment 1 will be described.
The Setup algorithm is as shown in Equation 149.

The KeyGen algorithm is as follows:

The Enc algorithm is as shown in Formula 151.

The Dec algorithm is as shown in Formula 152.

As shown in Formula 153, the ciphertext ct _{ID ′} can be decrypted with the decryption key sk _ID . Here, deg (φ ₁ ) = L ₁ ^{to κ} .

The ABE method described in the second embodiment will be described.
The Setup algorithm is as shown in Equation 154.

The KeyGen algorithm is as shown in Equation 155.

The Enc algorithm is as shown in Equation 156.

The Dec algorithm is as shown in Equation 157.

As shown in Formula 158, the ciphertext ct _{ID ′} can be decrypted with the decryption key sk _ID .

*** Effects of Embodiment 6 ***
As described above, in the cryptographic system 1 according to the sixth embodiment, the IBE method and the ABE method can be specifically configured using an elliptic curve.

Embodiment 7 FIG.
In the first to sixth embodiments, the IPG is configured using the same kind of mapping and the pairing calculation. However, the IPG may be configured using a trapdoor homomorphic map (hereinafter, TH) instead of the homogeneous map.

When the following three conditions are satisfied, the mapping φ: = φ _ξ : G ₀ → G ₁ for two randomly selected cyclic groups G ₀ and G ₁ of prime order q is TH.
(Condition 1: Homomorphic mapping)
The map φ is a non-trivial homomorphic map. Non-trivial is, for example, non-zero for additive groups.
(Condition 2: TH-DH (TH-Diffie-Hellman) refractory assumption)
Any stochastic polynomial time machine B, given (g ₀ , φ (g ₀ ), g), for g ₀ , g uniformly chosen from the randomly selected map φ and group G ₀ Calculate φ (g) only with a negligible probability.
(Condition 3: Polynomial size trapdoor)
Given a polynomial-sized trapdoor _ξ for φ: = φξ, there exists a probabilistic polynomial time machine B that computes φ (g) for any gεG ₀ .

There are the following three examples of TH using an elliptic curve. In the following three examples, when “˜” is added to the shoulder of a group, the group is a pairing group.
(Example 1: Power method)
_{G 0: = G 1: =} G ~ is elliptic curve cyclic group. phi: The = phi _xi], exponentiation in the group G, i.e. a scalar multiplication on the curve. That is, _φξ : g → ^gξ . Here, ξ is a scalar.
(Example 2: Pairing)
G ₀ : = G ₁ ^to G ₁ : = G ₁ ^to _T are pairing groups. phi: The = phi _xi], a pairing operation on ^{G ~.} That is, _φξ : g → e (g, ξ). Here, ξ is an element of the group G in the case of symmetric pairing or the group G ^ in the case of asymmetric pairing.
(Example 3: Homogeneous mapping)
G ₀ : = G ₁ ^to ₀ and G ₁ : = G ₁ ^to ₁ are two different elliptic curve cyclic groups obtained from two curves E and E ′, respectively. phi: The = phi _xi], a isogeny from the group ^G _{~ 0} to the group ^G _{~ 1.} That is, _φξ : E → E ′: = E / C. Here, ξ: = C is a cyclic subgroup of the curve E.

1 encryption system, 10 key generation device, 11 processor, 12 storage device, 13 input / output interface, 14 master key generation unit, 15 decryption key generation unit, 16 key output unit, 20 encryption device, 21 processor, 22 storage device, 23 input / output interface, 24 input reception unit, 25 ciphertext generation unit, 26 ciphertext output unit, 30 decryption device, 31 processor, 32 storage device, 33 input / output interface, 34 input reception unit, 35 decryption unit, 36 message output Department.

Claims (16)

1. An encryption device in an encryption system using a plurality of groups associated by homogenous mapping and pairing operation,
   An encryption apparatus comprising: a ciphertext generation unit that generates a ciphertext including a certain group of cipher elements of the plurality of groups.
2. The encryption system, the group _{G 0,} and the group _{G t} associated with the group _{G 0} and isogenies phi _t, together are attached corresponding with the group _{G 0} and the group G _{^ 0} and pairing operation _{e 0,} encryption device according to claim 1 using a group G _T is attached corresponding with the group G _t and the group G ^ _t and pairing operation e _t.
3. The ciphertext, the cipher element c _T containing elements z of the group G _T which is generated by performing the pairing operation e ₀ for the elements of the element and the group G ^ ₀ of the group G _0, the The encryption apparatus according to claim 2, further comprising an encryption element c that is an element of the group G ^ _t .
4. The cryptographic system uses the group G _t and the group G ^ _t for an integer t with t = 1,
   The ciphertext, said as the cipher element c and the encryption element c _T, element c shown in Equation 1, the encryption apparatus of claim 3 including c _T.
   

   
5. The cryptographic system has t = 0,. . . , D using the group G _t and the group G ^ _t for the integer t,
   The encryption apparatus according to claim 3, wherein the ciphertext includes elements c _t and c _T represented by Equation 2 as the cipher element c and the cipher element c _T.
   

   
6. The cryptographic system has t = 0,... For an integer d greater than or equal to 1 and an integer n greater than or equal to 1. . . , D and j = 0,. . . , N and the group G _{t, j, ι} and the group G ^ _{t, j, ι} for the integers ι = 0 and 1 _{, ι} ,
   The encryption apparatus according to claim 3, wherein the ciphertext includes elements c _{t, j} , and c _T shown in Formula 3 as the encryption element c and the encryption element c _T.
   

   
7. The cryptographic system uses the group G _t and the group G ^ _t for an integer t with t = 1,
   The encryption apparatus according to claim 3, wherein the ciphertext includes elements c ^ ₀ , c _i , and c _T shown in Equation 9 as the encryption element c and the encryption element c _T.
   

   
8. A decryption device in a cryptographic system using a plurality of groups associated by a homogeneous mapping and a pairing operation,
   A decrypting device comprising a decrypting unit that decrypts ciphertext including a cipher element of a group of the plurality of groups using a decryption key including a key element of a group different from the certain group of the plurality of groups .
9. The encryption system, the group _{G 0,} and the group _{G t} associated with the group _{G 0} and isogenies phi _t, together are attached corresponding with the group _{G 0} and the group G _{^ 0} and pairing operation _{e 0,} decoding apparatus according to claim 8 using a group G _T is attached corresponding with the group G _t and the group G ^ _t and pairing operation e _t.
10. The ciphertext, the cipher element c _T containing elements z of the group G _T which is generated by performing the pairing operation e ₀ for the elements of the element and the group G ^ ₀ of the group G _0, the A cryptographic element c that is an element of the group G ^ _t ,
    The decryption key includes a key element k of the group G _t ,
    Said decoding unit, the key for the element k and the encryption element c 'calculates a calculated said elements z' element z performs the pairing operation e _t and the encryption element c _T and the encryption using The decryption device according to claim 9, which decrypts a sentence.
11. The cryptographic system uses the group G _t and the group G ^ _t for an integer t with t = 1,
    The ciphertext includes elements c and c _T shown in Equation 5 as the cipher element c and the cipher element c _T.
    Including
    The decryption key includes an element h ₁ shown in Equation 6 as the key element k.
    It said decoding unit, for said element c and the element h _1, performs a pairing operation e _1, the decoding apparatus according to claim 10 for decoding the ciphertext.
    

    

    
12. The cryptographic system has t = 0,. . . , D using the group G _t and the group G ^ _t for the integer t,
    The ciphertext includes elements c _t and c _T shown in Equation 7 as the cipher element c and the cipher element c _T ,
    The decryption key, as the key element k, includes elements k _i of the equation 8,
    It said decoding unit, for said element c _t and the element k _i, performs a pairing operation shown in Formula 9, the decoding apparatus according to claim 10 for decoding the ciphertext.
    

    

    

    
13. The cryptographic system has t = 0,... For an integer d greater than or equal to 1 and an integer n greater than or equal to 1. . . , D
    Integer t and j = 0,. . . , N and the group G _{t, j, ι} and the group G ^ _{t, j, ι} for the integers ι = 0 and 1 _{, ι} ,
    The ciphertext includes elements c _{t, j} and c _T shown in Equation 10 as the cipher element c and the cipher element c _T ,
    The decryption key includes, as the key element k, elements k _{i, j} shown in Equation 11;
    The decryption device according to claim 10, wherein the decryption unit decrypts the ciphertext by performing a pairing operation represented by Formula 12 on the element ct _{, j} and the element ki _{, j} .
    

    

    

    
14. The cryptographic system uses the group G _t and the group G ^ _t for an integer t with t = 1,
    The ciphertext includes, as the cipher element c and the cipher element c _T , elements c ^ ₀ , c _i , c _T shown in Equation 13;
    The decryption key includes elements d ^ _i and d _j shown in Equation 14 as the key element k,
    It said decoding unit, the said element _c ^ 0, _{c i} element _d ^ i, the _{d j,} performs pairing operation shown in Formula 15, the decoding apparatus according to claim 10 for decoding the ciphertext.
    

    

    

    
15. An encryption system using a plurality of groups associated by a homogeneous map and a pairing operation,
    An encryption device that generates a ciphertext including a group of cipher elements of the plurality of groups;
    An encryption system comprising: a decryption device that decrypts a ciphertext generated by the encryption device using a decryption key including a key element of a group different from the certain group of the plurality of groups.
16. The group G ₀ , the group G _t associated with the group G ₀ by the homomorphism map φ _t , the group G ₀ and the group G ^ _{0 are associated} with the pairing operation e ₀ , and the group G _t and an encryption system that uses a group G _T is attached corresponding with the group G ^ _t and pairing operation e _t,
    And elements of the group G _0, and the encryption element c _T containing elements z of the generated said group G _T by performing the pairing operation e ₀ for the element of the group G ^ _0, the group G ^ an encryption device that generates a ciphertext including a cipher element c that is an element of _t ;
    Using the decryption key comprising a key element k of said group G _t, said about the key element k and the encryption element c 'calculates a calculated said elements z' element z performs the pairing operation e _t a cryptographic system comprising a decoding device for decoding the cipher text using the said encryption component c _T.

Images