WO2023218559A1 - Pseudorandom function generation device, watermark extraction device, and program - Google Patents

Abstract

This pseudorandom function generation device generates a pseudorandom function C^~ in the manner below, in which a watermark m∈{0,1}^Lm is embedded in a pseudorandom function that outputs an output value y∈Ran for the input of an input value x∈Dom. Here, Dom denotes an input space, Ran denotes an output space, Lm denotes a positive integer, and x1||x2 represents a connection between x1 and x2. (1) A setup unit outputs a public parameter pp and a watermark extraction key xk. (2) A key generation unit takes the public parameter pp for input and outputs a PRF key prfk and a public tag τ. (3) A watermark embedding unit takes the public key pp, the PRF key prfk and a watermark m for input and outputs a pseudorandom function C^~ in which a message m||0 that is a bit connection of the watermark m and 0 is embedded.

Description

Pseudo-random number function generator, watermark extraction device, and program

The present invention relates to a technology of pseudo-random number functions embedded with digital watermarks, and particularly relates to a technology that is resistant to attacks using quantum computing devices.

Pseudo-random number generation functions with embedded digital watermarks (hereinafter sometimes simply referred to as "watermarks") have been proposed (for example, see Non-Patent Documents 1 to 5).

However, a conventional pseudo-random number generation function with an embedded watermark does not have any resistance to attacks such as providing a quantum computing device that imitates the operation of the pseudo-random number generation function but has the watermark removed.

The present invention has been made in view of these points, and provides a quantum computing device that imitates the operation of a pseudo-random number generation function with an embedded watermark, but has the watermark removed. The purpose is to provide the technology that we have.

The pseudo-random number function generation device generates a pseudo-random number generation function C~ in which a watermark m∈{0,1} ^Lm is embedded in a pseudo-random number generation function that outputs an output value y∈Ran in response to an input value x∈Dom. Generate like this. Here, Dom is the input space, Ran is the output space, Lm is a positive integer, and x ₁ ||x ₂ represents the connection of x ₁ and x ₂ .
(1) The setup unit outputs the public parameter pp and the watermark extraction key xk.
(2) The key generation unit takes the public parameter pp as input and outputs the PRF key prfk and the public tag τ.
(3) The watermark embedding unit takes the public parameter pp, PRF key prfk, and watermark m as input, and generates a pseudorandom number generation function C~ in which a message m||0, which is a bit concatenation of watermark m and 0, is embedded. Output.

The watermark extraction device detects a quantum computing device that imitates the operation of such a pseudo-random number generation function C~, but whose watermark has been removed, as follows.
Here, the classical input/output quantum device C=(q,U), which imitates the operation of the pseudorandom number generation function C~, is a unitary device that performs a unitary transformation U on the quantum bit string of quantum state q and the quantum state q. , A ^ε,δ _P,D (q) is an approximate projection device that takes a quantum state q as an input and outputs a measured value p of the quantum state q, and the approximate projection device A ^{ε ,δ} _P,D (q) is the parameter ε, δ satisfying 0≦ε, δ<1, and the set of binary projection measurement devices P=(P _b,x,y ,Q _b,x,y ) _{b, x,y} , and the probability distribution D of the measured values, ε'=ε/(Lm+1), λ is the security parameter, δ'=2 ^-λ , and P _b,x,y = U _x,y ⁺ |b><b|U _x,y , Q _b,x,y =IP _b,x,y , b is a variable vector representing the quantum state to be measured, and |b > represents the ket vector of b, <b| represents the bra vector of b, |b><b| represents the projection operator, and U _x,y represents the output value y for the input value x. Represents a unitary transformation U that simulates the behavior of the output pseudorandom number generation function C~, U _x,y ⁺ represents the Hermitian transposed matrix of U _x,y , I represents the identity matrix, and [L] is a set of integers. 1,…,L, and for all i∈[Lm+1], D _τ,i is defined by D _τ,i :(γ,x,y)←ELWMPRF.Sim(xk,τ,i) ELWMPRF.Sim(xk,τ,i) is a simulation function that takes as input the watermark extraction key xk, public tag τ, and i∈[Lm] and outputs (γ,x,y). , and γ is a real number representing the probability that y is output for x.
(1) The first measurement unit represents the watermark extraction key xk, the public tag τ, the parameters ε, δ, and the quantum state q and unitary transformation U of the quantum bit of the classical input/output quantum device C=(q,U). Take the information as input,

By measuring , a measured value p~ _Lm+1 is obtained and output.
(2) The first extraction unit determines whether the measured value p~ _Lm+1 satisfies p~ _Lm+1 <(1/2)+ε-4ε', and determines whether or not the measured value p~ Lm+ ₁ <(1/2)+ε-4ε', /2)+ε-4ε' is determined to be satisfied, outputs information unmarked indicating that no watermark is embedded in the classical input/output quantum device C.

This makes it possible to provide resistance to attacks such as providing a quantum computing device that imitates the operation of a pseudo-random number generation function with an embedded watermark, but from which the watermark has been removed.

FIG. 1 is a block diagram illustrating the configuration of a security system according to an embodiment. FIG. 2 is a block diagram illustrating the configuration of a pseudorandom number function generation device according to an embodiment. FIG. 3 is a block diagram illustrating the configuration of a watermark extraction device according to an embodiment. FIG. 4 is a flow diagram illustrating watermark extraction processing according to the embodiment. FIG. 5 is a block diagram illustrating the hardware configuration of the pseudorandom number function generation device according to the embodiment.

Embodiments of the present invention will be described below with reference to the drawings.
[Definition]
First, the notation and terms used in this specification will be defined.
<Notation>
x ₁ ←X ₁ : x ₁ ←X ₁ represents uniformly and randomly selecting elements from the finite set X.
y ₁ ←A(x ₁ ;r ₁ ): y ₁ ←A(x ₁ ;r ₁ ) represents that device A outputs y ₁ in response to input x ₁ and random number r ₁ . Input x ₁ and random number r ₁ are real numbers. However, if there is no need to specify the random number used by A, y ₁ ←A(x ₁ ; r ₁ ) is simply expressed as y ₁ ←A(x ₁ ).
x ₁ ||x ₂ : x ₁ ||x ₂ represents the concatenation of two bit strings x ₁ and x ₂ .
[L]: [L] represents the set of integers 1,…,L. However, L is a positive integer.

<Function>
A function is something that takes as input an element of a certain set or a set of elements of several sets, and outputs an element (function value) of a specific set according to the element. A function can be referred to as a mapping, and may be realized by an arithmetic expression, a set of arithmetic expressions, a program, a classical operation, or a quantum operation. Moreover, taking α as an input means taking as an input some information specifying α. Furthermore, outputting α means outputting some information that specifies α.

<Quantum calculation>
Classical input/output quantum device C:
A classical input/output quantum device C=(q,U) is a device that includes a quantum bit string in a quantum state q and a unitary device that performs a unitary transformation U on this quantum state q (for example, reference document 1, etc. reference). In the following, a quantum computing device that simulates the operation of a desired pseudorandom number generation function is assumed, and this is referred to as a classical input/output quantum device C.
Reference 1: Scott Aaronson, Jiahui Liu, Qipeng Liu, Mark Zhandry, andRuizhe Zhang, "New approaches for quantum copy-protection," In Tal Malkin and Chris Peikert, editors, CRYPTO 2021, Part I, volume 12825 of LNCS, pages 526 -555, Virtual Event, August 2021. Springer, Heidelberg.

Approximate projection device p←A ^ε,δ _P,D (q):
The approximate projection device A ^ε,δ _P,D (q) is a device that takes a quantum state q as an input and outputs a measured value p of this quantum state q. Approximate projection device A ^{ε, δ} _{P, D} is determined by real parameters ε, δ satisfying 0≦ε, δ<1, projective measurement device P that performs projective measurement of the quantum state, and probability distribution D (for example, refer to (See 2nd prize).
Reference 2: Mark Zhandry, "Schrodinger's pirate: How to trace a quantum decoder," In Rafael Pass and Krzysztof Pietrzak, editors, TCC 2020, Part III, volume 12552 of LNCS, pages 61-91. Springer, Heidelberg, November 2020 .

<Cryptographic calculation>
Pseudo-random number generation function PRF:
The pseudorandom number generation function PRF is a function that takes x∈{0,1} ^λ as an input and outputs y∈{0,1} ^λ+L(λ) . Note that λ is a security parameter that is a positive integer, and L(λ) is an integer that is a function value of λ. If L(λ) is positive, the output y will be L(λ) bits more expanded than the input x; if L(λ) is negative, the output y will be L(λ) bits compressed than the input x. Therefore, when L(λ) is 0, the length of the output y and the input x are the same.

Drilling pseudorandom number generation function PRF _PPRF :
The drilling pseudo-random number generation function PRF _PPRF is a function composed of the following three functions PRF.Gen(1 ^λ ), PRF.Eval _prfk (K,x), and PRF.Eval _prfk￢x⊆ (S). Note that the input space to which x belongs is {0,1} ^L1 , the output space to which y belongs is {0,1} ^L2 , and L1 and L2 are positive integers.
K←PRF.Gen(1 ^λ ): PRF.Gen(1 ^λ ) is a key generation function that takes as input the security parameter λ, which is a positive integer, and outputs a real number calculation key K.
y←PRF.Eval _prfk (K,x):PRF.Eval _prfk (K,x) takes the operation key (or the following drilling key K _￢S⊆ ) K and x∈{0,1} ^L1 as inputs. , y∈{0,1} is an arithmetic function that outputs ^L2 .
K _￢S⊆ ←PRF.Eval _prfk￢x⊆ (S): PRF.Eval _prfk￢x⊆ (S) takes as input the calculation key K and the set S⊆{0,1} ^L1 of input x, and calculates the set This is a drilling key generation function that outputs a drilling key K _￢S⊆ that can only be used for inputs that do not belong to S.

Secret key cryptography SKE:
The secret key cryptosystem SKE is composed of the following three functions SKE.Gen(1 ^λ ), SKE.Enc(k,m), and SKE.Dec(k,ct). Note that the plaintext space to which the plaintext belongs is {P _λ } _λ∈N , where N represents a set of all positive integers (natural numbers).
k←SKE.Gen(1 ^λ ): SKE.Gen(1 ^λ ) is a secret key generation function that takes the security parameter λ as an input and outputs the secret key k. k is a real number.
ct←SKE.Enc(k,m): SKE.Enc(k,m) is an encryption function that takes private key k and plaintext m∈{P _λ } _λ∈N as input and outputs ciphertext ct. be.
m' or ⊥←SKE.Dec(k,ct): SKE.Dec(k,ct) takes private key k and ciphertext ct as input, and outputs plaintext m' or error information ⊥ indicating that decryption is not possible. This is the decryption function. If the secret key k and ciphertext ct are correct, m'=m.

Limitable pseudorandom number generation function PRF _CPRF :
The limitable pseudorandom number generation function PRF _CPRF consists of the following four functions CPRF.Setup(1 ^λ ), CPRF.Constrain(m _sk ,f), CPRF.Eval(msk,x), CPRF.CEval(sk _f ,x ). Note that the input space to which x belongs is Dom, and the output space to which y belongs is Ran.
msk←CPRF.Setup(1 ^λ ): CPRF.Setup(1 ^λ ) is a setup function that takes security parameter λ as input and outputs master key msk.
sk _f ←CPRF.Constrain(msk,f): CPRF.Constrain(msk,f) is a restricted key generation function that takes the master key msk and an arbitrary function f as input and outputs the restricted key sk _f .
y←CPRF.Eval(msk,x): CPRF.Eval(msk,x) is an arithmetic function that takes the master key msk and x∈Dom as input and outputs y∈Ran.
y←CPRF.CEval(sk _f ,x): CPRF.CEval(sk _f ,x) is a restriction operation function that takes the restriction key sk _f and x∈Dom as inputs and outputs y∈Ran.

Public key cryptography PKE:
The public key cryptosystem PKE is composed of the following three functions PKE.Gen(1 ^λ ), PKE.Enc(pk,m), and PKE.Dec(sk,ct). Note that the plaintext space to which the plaintext belongs is {P _λ } _λ∈N .
(pk,sk)←PKE.Gen(1 ^λ ): PKE.Gen(1 ^λ ) is a key generation function that takes a security parameter λ as an input and outputs a public key pk and a private key sk.
ct←PKE.Enc(pk,m): PKE.Enc(pk,m) is an encryption function that takes public key pk and plaintext m∈{P _λ } _λ∈N as input and outputs ciphertext ct. be.
m' or ⊥←PKE.Dec(sk,ct): PKE.Dec(sk,ct) takes the private key sk and ciphertext ct as input, and outputs plaintext m' or error information ⊥ indicating that it cannot be decrypted. This is the decryption function. If the secret key sk and ciphertext ct are correct, m'=m.

Indiscernibility obfuscation function iO:
The indiscernibility obfuscation function iO is a function that receives as input a circuit (function) {C _λ } _λ∈N defined under the security parameter λ and outputs an obfuscated circuit (for example, refer to (See Reference 3, etc.).
Reference 3: Boaz Barak, Oded Goldreich, Russell Impagliazzo, Steven Rudich, Amit Sahai, Salil P. Vadhan, and Ke Yang, "On the (im)possibility of obfuscating programs," Journal of the ACM, 59(2): 6:1-6:48, 2012.

Punchable encryption method PE:
Punctureable encryption method PE is composed of the following four functions PE.Gen(1 ^λ ), PE.Puncture(dk,{c*}), PE.Enc(ek,m), PE.Dec(dk',c' ). Note that the plaintext space to which the plaintext belongs is {0,1} ^Lp , where Lp is a positive integer.
(ek,dk)←PE.Gen(1 ^λ ): PE.Gen(1 ^λ ) is a key generation function that takes security parameter λ as input and outputs encryption key ek and decryption key dk.
dk _≠c* ←PE.Puncture(dk,{c*}): PE.Puncture(dk,{c*}) takes the decryption key dk and the ciphertext c* as input, and extracts only the ciphertext other than the ciphertext c*. This is a drilling decryption key generation function that outputs a usable drilling decryption key dk _≠c* .
c←PE.Enc(ek,m): PE.Enc(ek,m) is an encryption function that takes encryption key ek and plaintext m∈{0,1} ^Lp as input and outputs ciphertext c. .
m' or ⊥←PE.Dec(dk',c'): PE.Dec(dk',c') takes the decryption key (or punching decryption key) dk' and ciphertext c' as input, and extracts the plaintext m ' or error information ⊥ indicating that decoding is not possible. If dk'=dk and c'=c, then m'=m (for example, see Reference 4).
Reference 4: Aloni Cohen, Justin Holmgren, Ryo Nishimaki, Vinod Vaikuntanathan, and Daniel Wichs, "Watermarking cryptographic capabilities," SIAM Journal on Computing, 47(6): 2157-2202, 2018.

[principle]
Next, the principle of this embodiment will be explained.
It is assumed that an attacker uses a quantum computing device to attack a pseudo-random number generation function in which a watermark can be embedded. In this attack, an attacker attempts to forge a quantum computing device that imitates the operation of the pseudorandom number generation function that is the target of the attack. The classical values of the input and output of the counterfeit quantum computing device are the same or indistinguishable from the input and output of the pseudorandom number generation function being attacked, but the counterfeit quantum computing device does not have a watermark embedded in it. That is, an attacker attempts an attack that provides a quantum computing device that performs the same or indistinguishable operation as the target pseudorandom number generation function (an operation that imitates the pseudorandom number generation function), but from which the watermark has been removed. The present embodiment provides a pseudorandom number generation function that cannot be subjected to attacks such as watermark removal. A pseudorandom number generation function that can embed a digital watermark and is resistant to such attacks can be defined as follows.

<Pseudo-random number generation function WMPRF that can embed digital watermarks>
The pseudorandom number generation function WMPRF that can embed digital watermarks is composed of the following five functions: WMPRF.Setup(1 ^λ ), WMPRF.Gen(pp), WMPRF.Eval(prfk,x), WMPRF.Mark(pp,prfk,m ), WMPRF.Extract(xk,τ,C',ε). Note that the watermark space to which the digital watermark belongs is {0,1} ^Lm , where Lm is a positive integer, the input space to which x belongs is Dom, and the output space to which y belongs is Ran.
(pp,xk)←WMPRF.Setup(1 ^λ ): WMPRF.Setup(1 ^λ ) is a setup function that takes the security parameter λ as input and outputs the public parameter pp and the watermark extraction key xk.
(prfk,τ)←WMPRF.Gen(pp): WMPRF.Gen(pp) is a key generation function that takes public parameter pp as input and outputs PRF key prfk and public tag τ.
y←WMPRF.Eval(prfk,x): WMPRF.Eval(prfk,x) is an arithmetic function that takes the PRF key prfk and x∈Dom as input and outputs y∈Ran.
C~←WMPRF.Mark(pp,prfk,m): WMPRF.Mark(pp,prfk,m) takes public parameter pp, PRF key prfk, and watermark m∈{0,1} ^Lm as input, and This is a watermark embedding function that outputs a pseudorandom number generation function C~ in which m is embedded. The pseudorandom number generation function C~ is a function that outputs an output value y∈Ran for an input value x∈Dom, and has a watermark m embedded therein. Note that the upper right subscript "~" of "C~" should originally be written directly above "C", but due to writing restrictions, "~" is written at the upper right corner of "C". There is.
m'←WMPRF.Extract(xk,τ,C,ε): WMPRF.Extract(xk,τ,C,ε) uses the watermark extraction key xk, public tag τ, extraction parameter ε, and classical input/output quantum device C This is a watermark extraction function that takes as input information specifying =(q,U) and outputs a watermark m'∈{0,1} ^Lm ∪{unmarked}. Note that the classical input/output quantum device C=(q,U) is a quantum computing device that imitates the operation of a pseudorandom number generation function C~ in which a watermark m is embedded. That is, the input/output of the pseudorandom number generation function C~ and the classical values of the input/output of the classical input/output quantum device C are the same or indistinguishable. In other words, the operation of the classical input/output quantum device C is indistinguishable from the operation of the pseudorandom number generation function C~. However, there are cases in which the watermark m is correctly embedded in the classical input/output quantum device C, and cases in which the watermark m is not embedded in the classical input/output quantum device C. If the watermark m is correctly embedded in the classical input/output quantum device C, m'=m. Further, unmarked is information indicating that no watermark is embedded in the classical input/output quantum device C. The information specifying the classical input/output quantum device C=(q,U) is information representing the quantum state q of the quantum bit and the unitary transformation U. The information representing the quantum state q of the quantum bit may be, for example, the quantum bit itself or some state in which the quantum state q appears. The information representing the unitary transformation U may be, for example, information such as a matrix representing the unitary transformation U itself, or information for controlling the operation represented by the unitary transformation U.

<Pseudo-random number generation function ELWMPRF that can embed Extraction-Less digital watermark>
In order to define the pseudo-random number generation function WMPRF that can embed an Extraction-Less digital watermark, the pseudo-random number generation function ELWMPRF that can embed an Extraction-Less digital watermark is used. The pseudo-random number generation function ELWMPRF that can embed an Extraction-Less digital watermark consists of five functions: ELWMPRF.Setup(1 ^λ ), ELWMPRF.Gen(pp), ELWMPRF.Eval(prfk,x), ELWMPRF.Mark(pp,prfk ,m), and ELWMPRF.Sim(xk,τ,i). Note that the watermark space to which the watermark belongs is {0,1} ^Lm , the input space to which x belongs is Dom, and the output space to which y belongs is Ran. In addition, ELWMPRF.Setup(1 ^λ ), ELWMPRF.Gen(pp), ELWMPRF.Eval(prfk,x), and ELWMPRF.Mark(pp,prfk,m) are pseudo-random number generation functions WMPRF that can embed digital watermarks. Same as WMPRF.Setup(1 ^λ ), WMPRF.Gen(pp), WMPRF.Eval(prfk,x), and WMPRF.Mark(pp,prfk,m), respectively. That is, ELWMPRF.Setup(1 ^λ )=WMPRF.Setup(1 ^λ ), ELWMPRF.Gen(pp)=WMPRF.Gen(pp), ELWMPRF.Eval(prfk,x)=WMPRF.Eval(prfk,x), ELWMPRF.Mark(pp,prfk,m)= WMPRF.Mark(pp,prfk,m). ELWMPRF.Sim(xk,τ,i) is as follows.
(γ,x,y)←ELWMPRF.Sim(xk,τ,i):
ELWMPRF.Sim(xk,τ,i) is a simulation function that takes watermark extraction key xk, public tag τ, and i∈[Lm] as input and outputs (γ,x,y). γ is 1-bit information of 0 or 1.

<Pseudo-random number generation function WMPRF that can embed a digital watermark, based on the pseudo-random number generation function ELWMPRF that can embed an Extraction-Less digital watermark>
Based on the pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark, a pseudorandom number generation function WMPRF that can embed the digital watermark of this embodiment is defined. The pseudorandom number generation function WMPRF that can embed a digital watermark in this embodiment is composed of five functions WM.Setup(1 ^λ ), WM.Gen(pp), WM.Eval(prfk,x), WM.Mark(pp, prfk,m) and WM.Extract(xk,τ,C,ε). The watermark space of the pseudorandom number generation function WMPRF that can embed a digital watermark is {0,1} ^Lm , the message space including the watermark space is {0,1} ^Lm+1 , and the input space to which x belongs is Dom, and the output space to which y belongs is Ran.

WM.Setup(1 ^λ ), WM.Gen(pp), WM.Eval(prfk,x) are pseudo-random number generation functions ELWMPRF that can embed Extraction-Less digital watermarks ^. Same as Gen(pp) and ELWMPRF.Eval(prfk,x), respectively. That is, WM.Setup(1 ^λ )=ELWMPRF.Setup(1 ^λ ), WM.Gen(pp)=ELWMPRF.Gen(pp), WM.Eval(prfk,x)=ELWMPRF.Eval(prfk,x) be.

WM.Mark(pp,prfk,m) and WM.Extract(xk,τ,C,ε) are as follows. Note that in WM.Extract(xk,τ,C,ε), ELWMPRF.Sim(xk,τ,i), which is a pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark, is used.

<C~←WM.Mark(pp,prfk,m||0)>
WM.Mark(pp,prfk,m) takes as input a public parameter pp, a PRF key prfk, and a watermark m∈{0,1} ^Lm , and returns a message m||0 which is a bit concatenation of watermark m and 0. This is a message embedding function that outputs a pseudorandom number generation function C~ in which C~ is embedded.

<WM.Extract(xk,τ,C,ε)>
Step WM.Extract-1:
First, WM.Extract(xk,τ,C,ε) calculates the watermark extraction key xk, the public tag τ, the parameter ε, the quantum state q of the qubit of the classical input/output quantum device C=(q,U), and the unitary transformation The information representing U is taken as input, and the following measured value p ~ _Lm+1 is obtained and output by measurement using the following equation (1).

Here, ε'=ε/(Lm+1), δ'=2 ^-λ . P=(P _b,x,y ,Q _b,x,y ) _b,x,y is P _b,x,y =U _x,y ⁺ |b><b|U _x,y and Q _{b, x,y} =IP _b,x,y is a set of binary projection measurement devices. b is a variable vector representing the quantum state of the measurement target, |b> represents the ket vector (vertical vector) of b, <b| represents the bra vector (horizontal vector) of b, |b><b| represents a projection operator. U _x,y represents a unitary transformation U that gives (x,y) as input to a quantum state representing a quantum program. This quantum program takes (x,y) as input and determines whether y=WMPRF.Eval(prfk,x). Moreover, U _x,y ⁺ represents the Hermitian transposed matrix (adjoint matrix) of U _x,y . The matrices representing |b><b|, U _x,y , and U _x,y ⁺ have the same size, and I is an identity matrix with the same size. For all i∈[Lm+1], D _τ,i is a probability distribution defined by D _τ,i :(γ,x,y)←ELWMPRF.Sim(xk,τ,i). Note that as shown in formula (1), the upper right subscript "~" of "p~ _Lm+1 " should originally be written directly above "p", but due to the constraints of writing notation, " ~” may be written in the upper right corner of “p”.

Step WM.Extract-2:
Next, WM.Extract(xk,τ,C,ε) determines whether the measured value p~ _Lm+1 satisfies p~ _Lm+1 <(1/2)+ε-4ε'. If it is determined that p~ _Lm+1 <(1/2)+ε-4ε' is satisfied, WM.Extract(xk,τ,C,ε) outputs unmarked information indicating that no watermark is embedded. do. Otherwise, set the quantum state of the qubit after the measurement of the classical input/output quantum device C to q ₀ and proceed to the next step WM.Extract-3.

Step WM.Extract-3:
WM.Extract(xk,τ,C,ε) executes the following steps WM.Extract-31 and WM.Extract-32 in order from i=1 to Lm.
Step WM.Extract-31: WM.Extract(xk,τ,C,ε) is the information representing the watermark extraction key xk, the public tag τ, the parameter ε, and the quantum state q _i-1 of the qubit and the unitary transformation U is taken as an input, and a measured value p~ _i is obtained and output by measurement using the following equation (2).

WM.Extract(xk,τ,C,ε) sets the quantum state of the quantum bit after measurement to q _i .
Step WM.Extract-32: WM.Extract(xk,τ,C,ε) compares the measured value p~ _i with (1/2)+ε-4ε'. If p~ _i >(1/2)+ε-4ε' is satisfied here, WM.Extract(xk,τ,C,ε) is set to m _i '=0. Furthermore, when p~ _i <1/2)+ε-4ε' is satisfied, WM.Extract(xk,τ,C,ε) is set to m _i '=1. If p~ _i =(1/2)+ε-4ε' is not satisfied for all i∈[Lm], WM.Extract(xk,τ,C,ε) returns m ₁ ', …,m _Lm ' is output and step WM.Extract-3 ends. On the other hand, if p~ _i =(1/2)+ε-4ε' for any i, WM.Extract(xk,τ,C,ε) sets m'=0 ^Lm and performs step WM. Exit Extract-3. Note that 0 ^Lm represents a value consisting of Lm digits of 0.

Step WM.Extract-4:
If p~ _i =(1/2)+ε-4ε' for all i∈[Lm] in step WM.Extract-3, then WM.Extract(xk,τ,C,ε) is m'= Output m ₁ '||…||m _Lm '. If p~ _i =(1/2)+ε-4ε' for any i, WM.Extract(xk,τ,C,ε) outputs m'=0 ^Lm .

<Pseudo-random number generation function ELWMPRF that can embed Extraction-Less digital watermark based on LWE (Learning with errors) problem>
Next, we will exemplify a pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on the LWE problem. The watermark space of this pseudo-random number generation function ELWMPRF is {0,1} ^Lm , the input space Dom is {0,1} ⁿ¹ , and the output space Ran is {0,1} ^m1 . Note that n1 and m1 are each positive integers. This example uses a limitable pseudorandom number generation function PRF _CPRF , a secret key cryptosystem SKE, and a public key cryptosystem PKE based on the difficulty of the LWE problem defined on a mathematical structure called a lattice. That is, the limitable pseudorandom number generation function PRF _CPRF , the secret key cryptosystem SKE, and the public key cryptosystem PKE are based on, for example, lattice cryptography.
As mentioned above, the limitable pseudorandom number generation function PRF _CPRF consists of four functions CPRF.Setup(1 ^λ ), CPRF.Constrain(m _sk ,f), CPRF.Eval(msk,x), CPRF.CEval(sk _f ,x). CPRF.Eval(msk,x) with fixed master key msk (hardwired) is expressed as G(x):{0,1} ⁿ¹ →{0,1} ^m1 , and CPRF with fixed limit key sk _f .CEval(sk _f ,x) is expressed as G _￢∈ν (x):{0,1} ⁿ¹ →{0,1} ^m2 . Also, G _￢∈ν (x) can only be used for input x that does not belong to the set ν. ν represents the set of x that satisfies f(x)=1 for the function f(·).

As mentioned above, the secret key cryptosystem SKE is composed of three functions SKE.Gen(1 ^λ ), SKE.Enc(k,m), and SKE.Dec(k,ct). The secret key cryptosystem SKE is, for example, a lattice cryptosystem. However, the plaintext space to which the plaintext belongs is {0,1} ^Lske , and the ciphertext space to which the ciphertext belongs is {0,1} ⁿ¹ . Here, Lske=ceil(Log ₂ Lm)+1, ceil represents a ceiling function, ceil(α) means the smallest natural number greater than or equal to α, and Lm and n1 are the above-mentioned positive integers.

As mentioned above, the public key cryptosystem PKE is composed of three functions PKE.Gen(1 ^λ ), PKE.Enc(pk,m), and PKE.Dec(sk,ct). The public key cryptosystem PKE is, for example, a lattice cryptosystem. However, let the plaintext space to which the plaintext belongs be {0,1} ^2λ .

Under the above assumptions, the pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on the LWE problem is created using the following five functions ELWMPRF.Setup(1 ^λ ), ELWMPRF.Gen(pp), ELWMPRF.Eval( prfk,x), ELWMPRF.Mark(pp,prfk,m), and ELWMPRF.Sim(xk,τ,i).

＜(pp,xk)←ELWMPRF.Setup(1 ^λ )＞
ELWMPRF.Setup(1 ^λ ) takes the security parameter λ as input, obtains (pk,sk)←PKE.Gen(1 ^λ ), and outputs (pk,sk) as (pp,xk) ((pp ,xk):=(pk,sk)).

<(prfk,τ)←ELWMPRF.Gen(pp)>
Step ELWMPRF.Gen(pp) _LWE -1: ELWMPRF.Gen(pp) takes pp:=pk as input.
Step ELWMPRF.Gen(pp) _LWE -2: ELWMPRF.Gen(pp) takes security parameter λ and parameter κ as input and obtains msk←CPRF.Setup(1 ^λ , 1 ^κ ). Here, κ represents the size of a circuit (function) D[k,m,x], which will be described later. Note that the size of D[k,m,x] represents the number of gates configuring the logic circuit required to calculate D[k,m,x]. ELWMPRF.Gen(pp) obtains and outputs G(x) with the obtained msk fixed (hardwired) to y←CPRF.Eval(msk,x) (G(x)←CPRF.Setup(1 ^λ , 1 ^κ )).
Step ELWMPRF.Gen(pp) _LWE -3: ELWMPRF.Gen(pp) uses the security parameter λ to generate k←SKE.Gen(1 ^λ ).
Step ELWMPRF.Gen(pp) _LWE -4: ELWMPRF.Gen(pp) sets a circuit (function) D _auth [k,x] to be described later in which k is fixed.
Step ELWMPRF.Gen(pp) _LWE -5: ELWMPRF.Gen(pp) uses G(x) and D _auth [k,x] and constraint key sk _f ←CPRF.Constrain(G(x),D _auth [k,x]). Next, ELWMPRF.Gen(pp) generates G _⿢∈νauth (x) where this restriction key sk _f is fixed and is CPRF.CEval(sk _f ,x). Here, ν _auth ⊂{0,1} ⁿ¹ is a set of x that satisfies D _auth [k,x]=1. Note that the subscript "νauth" in "G _￢∈νauth " should originally be written as "ν _auth ", but due to writing restrictions, it is written as "νauth".
Step ELWMPRF.Gen(pp) _LWE -6: ELWMPRF.Gen(pp) is prfk=(G(x),k) and τ←PKE.Enc(pp,(G _￢∈νauth (x),k)) Obtain and output. Note that (G _￢∈νauth (x),k) is the function value of G _￢∈νauth (x) and k, for example, (G _￢∈νauth (x),k)=G _￢∈νauth (x) ||k.

<y←ELWMPRF.Eval(prfk,x)>
ELWMPRF.Eval(prfk,x) takes prfk=(G(x),k) and x as input and outputs y←ELWMPRF.Eval(prfk,x)(=WMPRF.Eval(prfk,x)) do.

<C~←ELWMPRF.Mark(pp,prfk,m)>
Step ELWMPRF.Mark(pp,prfk,m) _LWE -1: ELWMPRF.Mark(pp,prfk,m) is described later with pp=pk and prfk=(G(x),k), and k and m are fixed. Set the circuit (function) D[k,m,x] to
Step ELWMPRF.Mark(pp,prfk,m) _LWE -2: ELWMPRF.Mark(pp,prfk,m) uses G(x) and D[k,m,x] and sets the restriction key sk _f ←CPRF. Generate Constrain(G(x),D[k,m,x]). Next, ELWMPRF.Mark(pp,prfk,m) generates G _⿢∈ν (x) where this restriction key sk _f is fixed and is CPRF.CEval(sk _f ,x). Here, ν⊂{0,1} ⁿ is a set of x that satisfies D[k,m,x]=1. ELWMPRF.Mark(pp,prfk,m) outputs this G _￢∈ν (x) as C~.

＜(γ,x,y)←ELWMPRF.Sim(xk,τ,i)＞
Step ELWMPRF.Sim(xk,τ,i) _LWE -1: ELWMPRF.Sim(xk,τ,i) sets sk to xk (sk:=xk).
Step ELWMPRF.Sim(xk,τ,i) _LWE -2: ELWMPRF.Sim(xk,τ,i) obtains (G _￢∈νauth (x),k)←PKE.Dec(sk,τ) ( calculate).
Step ELWMPRF.Sim(xk,τ,i) _LWE -3: ELWMPRF.Sim(xk,τ,i) generates γ←{0,1}. For example, ELWMPRF.Sim(xk,τ,i) randomly generates γ←{0,1}.
Step ELWMPRF.Sim(xk,τ,i) _LWE -4: ELWMPRF.Sim(xk,τ,i) has x←SKE.Enc(k,i||γ) and y←G _￢∈νauth (x) Obtain (calculate).
Step ELWMPRF.Sim(xk,τ,i) _LWE -5: ELWMPRF.Sim(xk,τ,i) outputs (γ,x,y).

Details of circuits D _auth [k,x] and D[k,m,x] are shown.
<D _auth [k,x]>
D _auth [k,x] is a circuit where k is fixed and performs the following processing.
Input: x∈{0,1} ⁿ¹
Step D _auth [k,x]-1: D _auth [k,x] calculates d←SKE.Dec(k,x).
Step D _auth [k,x]-2: D _auth [k,x] outputs 0 if d≠⊥, otherwise outputs 1.

＜D[k,m,x]＞
D[k,m,x] is a circuit where k and m are fixed and performs the following processing.
Input: x∈{0,1} ⁿ¹
Step D[k,m,x]-1: D[k,m,x] calculates d←SKE.Dec(k,x).
Step D[k,m,x]-2: If d≠⊥, D[k,m,x] performs the following (a) and (b).
(a) Let d=i||η∈{0,1} ^Lske . However, i∈[Lm] and η∈{0,1}. That is, d is interpreted as a bit concatenation of i∈[Lm] and 1-bit η∈{0,1}.
(b) Here, if η=m _i , D[k,m,x] outputs 1, otherwise D[k,m,x] outputs 0. However, m=m ₁ ||…||m _Lm ∈{0,1} ^Lm .
Step D[k,m,x]-3: If d=⊥, D[k,m,x] outputs 0.

<Pseudo-random number generation function ELWMPRF that can embed Extraction-Less digital watermark based on indiscernibility obfuscation>
A pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on indiscernibility obfuscation is illustrated. The watermark space of this pseudo-random number generation function ELWMPRF is {0,1} ^Lm , the input space Dom is {0,1} ^Lin , and the output space Ran is {0,1} ^Lout . Note that Lin and Lout are each positive integers. In this example, we will introduce the puncturing pseudo-random number generation function PRF _PPRF , the puncturing cryptography PE, the indistinguishability obfuscation function iO, and the pseudo-random number generation function that can be realized using indiscernibility obfuscation and one-way functions. Use PRF.

As mentioned above, the drilling pseudo-random number generation function PRF _PPRF is composed of three functions PRF.Gen(1 ^λ ), PRF.Eval _prfk (K,x), and PRF.Eval _prfk￢x⊆ (S). Here, the calculation function PRF.Eval _prfk (K,x) is expressed as F(x): {0,1} ^Lin →{0,1} ^Lout . Also, the punching key generation function PRF.Eval _prfk￢x⊆ (S) is expressed as F _￢x⊆ (S).

As mentioned above, the punctureable encryption scheme PE consists of four functions PE.Gen(1 ^λ ), PE.Puncture(dk,{c*}), PE.Enc(ek,m), PE.Dec(dk',c'). Here, the plaintext space and ciphertext space of the punctureable cryptosystem PE are respectively {0,1} ^Lpt and {0,1} ^Lct . However, Lpt and Lct are each positive integers and satisfy Lpt=λ+ceil(log ₂ Lm)+1, Lin=Lct, and Lct=poly(λ, log ₂ Lm). poly(λ, log ₂ Lm) represents the coefficients of a polynomial whose roots are elements of (λ, log ₂ Lm).

As mentioned above, the indiscernibility obfuscation function iO is a function that takes the circuit {C _λ } _λ∈N as input and outputs the obfuscated circuit.

As described above, the pseudorandom number generation function PRF is a function that takes x∈{0,1} ^λ as an input and outputs y∈{0,1} ^λ+L(λ) . Here, Lout=λ+L(λ) and PRF: {0,1} ^λ → {0,1} ^Lout .

Under the above assumptions, the pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on indiscernibility obfuscation is composed of the following five functions ELWMPRF.Setup(1 ^λ ), ELWMPRF.Gen(pp), Consists of ELWMPRF.Eval(prfk,x), ELWMPRF.Mark(pp,prfk,m), and ELWMPRF.Sim(xk,τ,i).

＜(pp,xk)←ELWMPRF.Setup(1 ^λ )＞
ELWMPRF.Setup(1 ^λ ) is set to (pp,xk):=(⊥,⊥).

<(prfk,τ)←ELWMPRF.Gen(pp)>
Step ELWMPRF.Gen(pp) _iO -1: ELWMPRF.Gen(pp) takes pp:=⊥ as input.
Step ELWMPRF.Gen(pp) _iO -2: ELWMPRF.Gen(pp) obtains the calculation key K←PRF.Gen(1 ^λ ) and uses PRF.Eval _prfk (K,x) with this calculation key K fixed. Calculate some F(x).
Step ELWMPRF.Gen(pp) _iO -3: ELWMPRF.Gen(pp) generates (pe.ek, pe.dk)←PE.Gen(1 ^λ ).
Step ELWMPRF.Gen(pp) _iO -4: ELWMPRF.Gen(pp) outputs prfk:=(F(x), pe.dk) and τ:=pe.ek.

<ELWMPRF.Eval(prfk,x)>
ELWMPRF.Eval(prfk,x) takes prfk:=(F(x), pe.dk) and x as input and outputs y←F(x).

<ELWMPRF.Mark(pp,prfk,m)>
ELWMPRF.Mark(pp,prfk,m) _iO -1: ELWMPRF.Mark(pp,prfk,m) takes as input pp:=⊥ and prfk:=(F(x), pe.dk).
ELWMPRF.Mark(pp,prfk,m) _iO -2: ELWMPRF.Mark(pp,prfk,m) is a circuit D[F(x), pe.dk, m].
ELWMPRF.Mark(pp,prfk,m) _iO -3: ELWMPRF.Mark(pp,prfk,m) is iO(D[F(x ), pe.dk, m]) and output it as C~.

<ELWMPRF.Sim(xk,τ,i)>
ELWMPRF.Sim(xk,τ,i) _iO -1: ELWMPRF.Sim(xk,τ,i) is set to xk:=⊥ and τ:=pe.ek.
ELWMPRF.Sim(xk,τ,i) _iO -2: ELWMPRF.Sim(xk,τ,i) generates γ←{0,1} and s←{0,1} ^λ .
ELWMPRF.Sim(xk,τ,i) _iO -3: ELWMPRF.Sim(xk,τ,i) calculates y←PRF(s).
ELWMPRF.Sim(xk,τ,i) _iO -4: ELWMPRF.Sim(xk,τ,i) calculates x←PE.Enc(pe.ek, s||i||γ).
ELWMPRF.Sim(xk,τ,i) _iO -5: ELWMPRF.Sim(xk,τ,i) outputs (γ,x,y).

＜D[F(x), pe.dk, m]＞
The details of D[F(x), pe.dk, m] are shown. D[F(x), pe.dk, m] is a circuit in which prfk, pe.dk, and m are fixed and performs the following processing.
Input: x∈{0,1} ^Lm
Step D[F(x), pe.dk, m]-1: D[F(x), pe.dk, m] calculates d←PE.Dec(pe.dk, x).
Step D[F(x), pe.dk, m]-2: If d≠⊥, D[F(x), pe.dk, m] performs the following (c) and (d).
(c) Let d=s||i||η. where s∈{0,1} ^λ , i∈[Lm], and η∈{0,1}.
(d) Here, if η=m _i , D[F(x), pe.dk, m] outputs PRF(s), otherwise outputs F(x).
Step D[F(x), pe.dk, m]-3: If d=⊥, D[F(x), pe.dk, m] outputs F(x).

[First embodiment]
<Configuration>
As illustrated in FIG. 1, the security system 1 of this embodiment includes a pseudorandom number function generation device 110, a watermark extraction device 120, and a pseudorandom number function utilization device 130, which are configured to be able to communicate through a network. There is.

<Pseudo-random number function generation device 110>
As illustrated in FIG. 2, the pseudorandom number function generation device 110 includes a setup section 111, a key generation section 112, a watermark embedding section 113, an output section 114, a memory 115, and a control section 116. and execute each process. The information input to the pseudo-random number function generation device 110 and the information obtained from each section are stored one by one in the memory 115, and read and used as necessary.

<Watermark extraction device 120>
As illustrated in FIG. 3, the watermark extraction device 120 includes measurement units 121 and 123 (first measurement unit, second measurement unit), extraction units 122 and 124 (first measurement unit, second measurement unit), and memory 125. , and a control unit 126, and executes each process based on the control unit 126.

<Pseudo-random number function generation process>
Next, pseudorandom number generation processing by the pseudorandom number function generation device 110 will be explained. The pseudorandom number function generation device 110 generates a pseudorandom number generation function C~ in which a watermark m∈{0,1} ^Lm is embedded in a pseudorandom number generation function that outputs an output value y∈Ran in response to an input value x∈Dom. generate. Dom is the input space, Ran is the output space, and Lm is a positive integer.
As illustrated in FIG. 2, 1 ^λ representing the security parameter λ is input to the setup unit 111 of the pseudo-random number function generation device 110. The setup unit 111 takes the security parameter λ as an input, obtains the public parameter pp and the watermark extraction key xk by (pp, xk)←WM.Setup(1 ^λ ), and outputs the obtained public parameter pp and the watermark extraction key xk. Note that the details of (pp,xk)←WM.Setup(1 ^λ ) are disclosed in, for example, Non-Patent Documents 1 to 5 (step S111).

The key generation unit 112 takes the public parameter pp as input, obtains the PRF key prfk and the public tag τ by (prfk,τ)←WM.Gen(pp), and outputs the obtained PRF key prfk and public tag τ. Note that the details of (prfk,τ)←WM.Gen(pp) are disclosed in, for example, Non-Patent Documents 1 to 5 (step S112).

The watermark embedding unit 113 takes the public parameter pp, the PRF key prfk, and the watermark m∈{0,1} ^Lm as input, and embeds the watermark m and 0 using C~←WM.Mark(pp,prfk,m||0). Obtain and output a pseudo-random number generation function C~ in which a message m||0, which is a bit concatenation of , is embedded. Although WM.Mark(pp,prfk,m||0) is not disclosed, details of WM.Mark(pp,prfk,m) are disclosed in, for example, Non-Patent Documents 1 to 5. (Step S113).

The pseudorandom number generation function C~, the watermark extraction key xk, and the public tag τ are sent to the output unit 114 and output from there. The pseudorandom number generation function C~ is sent to the pseudorandom number function utilization device 130 via the network, and is used for processing in the pseudorandom number function utilization device 130. The watermark extraction key xk and the public tag τ are sent to the watermark extraction device 120 via the network. In addition, public parameters such as the security parameter λ are made public via the network (step S114).

<Watermark extraction process>
Next, watermark extraction processing by the watermark extraction device 120 will be explained using FIGS. 3 and 4.
The measurement unit 121 of the watermark extraction device 120 measures the operation of the watermark extraction key xk, public tag τ, real parameters ε, δ (0≦ε, δ<1), security parameter λ, and pseudorandom number generation function C~. Taking as input the information representing the quantum state q of the qubit and the unitary transformation U of a modeled classical input/output quantum device C=(q,U), we obtain the measured value p~ _Lm+1 by measuring Equation (1). Output. As mentioned above, D _τ,Lm+1 in equation (1) is the probability defined by D _τ,Lm+1 :(γ,x,y)←ELWMPRF.Sim(xk,τ,Lm+1) The distribution is represented (step S121).

The extraction unit 122 takes as input the measured value p~ _Lm+1 and the quantum state q of the quantum bit after the measurement of the classical input/output quantum device C, and the measured value p~ _Lm+1 is p~ _Lm+1 <(1 /2)+ε-4ε' is determined (step S122a). Here, if the extraction unit 122 determines that p~ _Lm+1 <(1/2)+ε-4ε' is satisfied, the extraction unit 122 determines that no watermark is embedded in the classical input/output quantum device C. The information representing "unmarked" is output (step S122b), and the process ends. Although the details are omitted, it is mathematically provable that a watermark is not embedded in the classical input/output quantum device C when p~ _Lm+1 <(1/2)+ε-4ε' is satisfied. be.

On the other hand, if it is determined that the measured value p~ _Lm+1 does not satisfy p~ _Lm+1 <(1/2)+ε-4ε', the measured value p~ _Lm+1 is the measurement of the classical input/output quantum device C. The quantum state q of the next quantum bit is output as q ₀ (step S122c).

The measurement unit 123 sets i=1 (step S123a).

The measurement unit 123 receives as input the watermark extraction key xk, the public tag τ, the parameters ε, δ, the security parameter λ, and the information representing the quantum state q _i-1 of the quantum bit and the unitary transformation U, and calculates the equation (2). Obtain the measured value p~ _i by measuring . As mentioned above, D _τ,i in equation (2) represents the probability distribution defined by D _τ,i :(γ,x,y)←ELWMPRF.Sim(xk,τ,i) (step S123b ).

The measuring unit 123 sets the quantum state of the quantum bit of the classical input/output quantum device C after measurement to q _i , and determines whether p~ _i >(1/2)+ε-4ε' (step S123c ). Here, if the measuring unit 123 determines that p~ _i >(1/2)+ε-4ε', the measuring unit 123 sets m _i '=0 (step S123e), and proceeds to step S123g. . On the other hand, if the measuring unit 123 determines that p~ _i >(1/2)+ε-4ε' is not satisfied, the measuring unit 123 determines whether p~ _i <(1/2)+ε-4ε'. is determined (step S123d). Here, if the measuring unit 123 determines that p~ _i <(1/2)+ε-4ε', the measuring unit 123 sets m _i '=1 (step S123f), and proceeds to step S123g. . On the other hand, when the measurement unit 123 determines that p~ _i <(1/2)+ε-4ε' is not the case (that is, when p~ _i =(1/2)+ε-4ε' for any i) , the measurement unit 123 sets m'=0 ^Lm and sends it to the extraction unit 124. In this case, the extraction unit 124 outputs this watermark m'=0 ^Lm (step S124a), and ends the process. Although the details are omitted, if p~ _i = (1/2)+ε-4ε' for any i, the watermark m'=0 ^Lm is embedded in the classical input/output quantum device C. is mathematically provable.

In step S123g, the measuring unit 123 determines whether or not i=Lm (step S123g). Here, if i=Lm, the measurement unit 123 sets i+1 to a new i (i←i+1) (step S123h), and returns the process to step S123b. On the other hand, if i=Lm (if p~ _i =(1/2)+ε-4ε' is not satisfied for all i∈[Lm]), the measurement unit 123 measures all i∈[Lm]. m _i ' is sent to the extraction unit 124. The extraction unit 124 outputs the watermark m'=m ₁ '||...||m _Lm ' (step S124b), and ends the process. Although the details are omitted, if p~ _i =(1/2)+ε-4ε' is not satisfied for all i∈[Lm], a watermark m'=m ₁ ' is added to the classical input/output quantum device C. ||…||m It is mathematically provable that _Lm ' was embedded.

<Features of this embodiment>
As described above, in this embodiment, if the watermark m has been removed from the classical input/output quantum device C that simulates the operation of the pseudorandom number generation function C~ in which the watermark m is embedded, the classical input/output quantum device The information unmarked indicating that no watermark is embedded in C is output. Thereby, it is possible to detect a quantum computing device C that imitates the operation of a pseudorandom number generation function C~ in which a watermark m is embedded, but in which the watermark m has been removed. Furthermore, if the watermark m is also embedded in the classical input/output quantum device C, a correct watermark m' can be obtained in step S124a or S124b. That is, this embodiment is the first digital watermark embeddable pseudorandom number function method that is resistant to attackers using quantum computing devices. Even if an attacker who attempts to remove a digital watermark embedded in a pseudorandom number generation function converts the pseudorandom number generation function into a quantum device, the digital watermark can be correctly extracted from the quantum device.

[Second embodiment]
The second embodiment is a specific example of the first embodiment, and is an example using a pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on the LWE problem described above. Hereinafter, the explanation of matters that have already been explained will be simplified. In the second embodiment, the input space Dom is {0,1} ⁿ¹ , the output space Ran is {0,1} ^m1 , and n1 and m1 are each positive integers.

<Pseudo-random number function generation process>
The setup unit 111 takes the security parameter λ as input, obtains (pk,sk)←PKE.Gen(1 ^λ ), and outputs (pk,sk) as (pp,xk):=(pk,sk). (Step S111).

The key generation unit 112 takes pp=pk as input, takes security parameter λ and parameter κ representing the size of D[k,m,x] as input, and calculates msk←CPRF.Setup(1 ^λ , 1 ^κ ). Then, obtain G(x) with msk fixed to y←CPRF.Eval(msk,x), use the security parameter λ, generate k←SKE.Gen(1 ^λ ), and fix k with D _auth [ k,x]. Furthermore, the key generation unit 112 uses G(x) and D _auth [k,x] to generate sk _f ←CPRF.Constrain(G(x),D _auth [k,x]), and sk _f is fixed. CPRF.CEval(sk _f ,x) with G _￢∈νauth (x), prfk=( _G (x),k) and τ←PKE.Enc(pp,(G ),k)) and output it. However, ν _auth ⊂{0,1} ⁿ¹ is a set of x that satisfies D _auth [k,x]=1 (step S112).

The watermark embedding unit 113 takes as input the public parameter pp, the PRF key prfk, and the watermark m∈{0,1} ^Lm , and fixes k and m as pp=pk and prfk=(G(x),k). Set D[k,m,x]. Further, the watermark embedding unit 113 uses G(x) and D[k,m,x] to generate sk _f ←CPRF.Constrain(G(x),D[k,m,x]), and sk _f Generates G _￢∈ν (x) where CPRF.CEval(sk _f ,x) is fixed, and outputs G _￢∈ν (x) as a pseudorandom number generation function C~. However, ν⊂{0,1} ⁿ is a set of input values x that satisfy D[k,m,x]=1 (step S113).

Other details are as described in the pseudo-random number function generation process of the first embodiment.

<Watermark extraction process>
In this embodiment, D _τ,Lm+1 :(γ,x,y)←ELWMPRF.Sim(xk,τ,Lm+1) in equation (1) uses xk, τ, and Lm+1 as inputs. , sk:=xk, (G _￢∈νauth (x),k)←PKE.Dec(sk,τ), γ←{0,1}, x←SKE.Enc(k, Lm+1 ||γ) and y←G _￢∈νauth (x), which is a function that outputs (γ,x,y). D _τ,i :(γ,x,y)←ELWMPRF.Sim(xk,τ,i) in equation (2) takes xk, τ, and i∈[Lm] as input, and sets sk:=xk. , (G _￢∈νauth (x),k)←PKE.Dec(sk,τ), γ←{0,1}, x←SKE.Enc(k,i||γ) and y←G _￢ This is a function that obtains _∈νauth (x) and outputs (γ,x,y). The rest is as described in the watermark extraction process of the first embodiment.

[Third embodiment]
The third embodiment is a specific example of the first embodiment, and is an example using a pseudorandom number generation function ELWMPRF that can embed an Extraction-Less digital watermark based on indiscernibility obfuscation. In the third embodiment, the input space Dom is {0,1} ^Lin and the output space Ran is {0,1} ^Lout . Note that Lin and Lout are each positive integers.

<Pseudo-random number function generation process>
The setup unit 111 receives the security parameter λ, sets (pp, xk):=(⊥,⊥), and outputs (pp, xk) (step S111).

The key generation unit 112 takes pp:=⊥ as input, obtains the calculation key K←PRF.Gen(1 ^λ ), and generates F(x) which is PRF.Eval _prfk (K,x) with the calculation key K fixed. , generate (pe.ek, pe.dk)←PE.Gen(1 ^λ ), and output prfk:=(F(x), pe.dk) and τ:=pe.ek (step S112).

The watermark embedding unit 113 takes pp:=⊥ and prfk:=(F(x), pe.dk) as input, and generates D[F(x), pe.dk, with prfk, pe.dk and m fixed. m], obtain iO(D[F(x), pe.dk, m]) which obfuscates D[F(x), pe.dk, m], and obtain iO(D[F(x) , pe.dk, m]) as a pseudorandom number generation function C~ (step S113).

Other details are as described in the pseudo-random number function generation process of the first embodiment.

<Watermark extraction process>
In this embodiment, D _τ,Lm+1 :(γ,x,y)←ELWMPRF.Sim(xk,τ,Lm+1) in equation (1) is (pe.ek, pe.dk)←PE Let pe.ek obtained by .Gen(1 ^λ ) be τ:=pe.ek, xk:=⊥, let γ←{0,1} and s←{0,1} ^λ , and y←PRF( s), calculates x←PE.Enc(pe.ek, s||Lm+1||γ) for Lm+1, and outputs (γ,x,y). D _τ,i in equation (2): (γ,x,y)←ELWMPRF.Sim(xk,τ,i) is obtained by (pe.ek, pe.dk)←PE.Gen(1 ^λ ). pe.ek is τ:=pe.ek, xk:=⊥, γ←{0,1} and s←{0,1} ^λ , y←PRF(s), i∈[Lm] This is a function that calculates x←PE.Enc(pe.ek, s||i||γ) and outputs (γ,x,y). The rest is as described in the watermark extraction process of the first embodiment.

[Hardware configuration]
The pseudo-random number function generation device 110 in each embodiment includes, for example, a processor (hardware processor) such as a CPU (central processing unit), a memory such as a RAM (random-access memory), a ROM (read-only memory), etc. It is a device configured by a general-purpose or dedicated computer running a predetermined program. That is, the pseudorandom number function generation device 110 in each embodiment has, for example, a processing circuitry configured to implement each unit included therein. This computer may include one processor and memory, or may include multiple processors and memories. This program may be installed on the computer or may be pre-recorded in a ROM or the like. In addition, some or all of the processing units may be configured using an electronic circuit that independently realizes a processing function, rather than an electronic circuit that realizes a functional configuration by reading a program like a CPU. . Further, an electronic circuit constituting one device may include a plurality of CPUs.

FIG. 5 is a block diagram illustrating the hardware configuration of the pseudorandom number function generation device 110 in each embodiment. As illustrated in FIG. 5, the pseudorandom number function generation device 110 in this example includes a CPU (Central Processing Unit) 10a, an input section 10b, an output section 10c, a RAM (Random Access Memory) 10d, and a ROM (Read Only Memory) 10e. , an auxiliary storage device 10f, a communication section 10h, and a bus 10g. The CPU 10a in this example has a control section 10aa, a calculation section 10ab, and a register 10ac, and executes various calculation processes according to various programs read into the register 10ac. The input unit 10b is an input terminal into which data is input, a keyboard, a mouse, a touch panel, etc. Further, the output unit 10c is an output terminal, a display, etc. to which data is output. The communication unit 10h is a LAN card or the like that is controlled by the CPU 10a loaded with a predetermined program. Further, the RAM 10d is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), etc., and has a program area 10da in which a predetermined program is stored and a data area 10db in which various data are stored. The auxiliary storage device 10f is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, etc., and has a program area 10fa in which a predetermined program is stored and a data area 10fb in which various data are stored. There is. Further, the bus 10g connects the CPU 10a, the input section 10b, the output section 10c, the RAM 10d, the ROM 10e, the communication section 10h, and the auxiliary storage device 10f so that information can be exchanged. The CPU 10a writes the program stored in the program area 10fa of the auxiliary storage device 10f to the program area 10da of the RAM 10d according to the read OS (Operating System) program. Similarly, the CPU 10a writes various data stored in the data area 10fb of the auxiliary storage device 10f to the data area 10db of the RAM 10d. Then, the address on the RAM 10d where this program and data are written is stored in the register 10ac of the CPU 10a. The control unit 10aa of the CPU 10a sequentially reads these addresses stored in the register 10ac, reads programs and data from the area on the RAM 10d indicated by the read addresses, and causes the calculation unit 10ab to sequentially execute the calculations indicated by the programs. The calculation results are stored in the register 10ac. With such a configuration, the functional configuration of the pseudorandom number function generation device 110 is realized.

The above program can be recorded on a computer readable recording medium. An example of a computer readable storage medium is a non-transitory storage medium. Examples of such recording media are magnetic recording devices, optical disks, magneto-optical recording media, semiconductor memories, and the like.

This program is distributed, for example, by selling, transferring, lending, etc. portable recording media such as DVDs and CD-ROMs on which the program is recorded. Furthermore, this program may be distributed by storing the program in the storage device of the server computer and transferring the program from the server computer to another computer via a network. As described above, a computer that executes such a program, for example, first stores a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing a process, this computer reads a program stored in its own storage device and executes a process according to the read program. In addition, as another form of execution of this program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and furthermore, the program may be transferred to this computer from the server computer. The process may be executed in accordance with the received program each time. In addition, the above-mentioned processing is executed by a so-called ASP (Application Service Provider) service, which does not transfer programs from the server computer to this computer, but only realizes processing functions by issuing execution instructions and obtaining results. You can also use it as Note that the program in this embodiment includes information that is used for processing by an electronic computer and that is similar to a program (data that is not a direct command to the computer but has a property that defines the processing of the computer, etc.).

In each of the embodiments, the present apparatus is configured by executing a predetermined program on a computer, but at least a part of these processing contents may be implemented in hardware.

The watermark extraction device 120 in each embodiment may be configured with a quantum computing device, or a hybrid of a quantum computing device and a device configured by a general-purpose or dedicated classical computer running a predetermined program. It's okay.

[Other variations, etc.]
Note that the present invention is not limited to the above-described embodiments. For example, the various processes described above may not only be executed in chronological order as described, but may also be executed in parallel or individually depending on the processing capacity of the device executing the process or as necessary. It goes without saying that other changes can be made as appropriate without departing from the spirit of the present invention.

The present invention can be used in the field of cryptography, secret sharing technology, secure calculation technology, etc. that use pseudo-random number functions.

1 Security system 110 Pseudo-random number function generation device 111 Setup section 112 Key generation section 113 Watermark embedding section 120 Watermark extraction device 121, 123 Measurement section 122, 124 Extraction section

Claims (8)

1. A pseudo-random number generation device that generates a pseudo-random number generation function C~ with a watermark m∈{0,1} ^Lm embedded in the pseudo-random number generation function that outputs an output value y∈Ran for an input value x∈Dom. There it is,
   Dom is the input space, Ran is the output space, Lm is a positive integer, x ₁ ||x ₂ represents the concatenation of x ₁ and x ₂ ,
   a setup section that outputs public parameters pp and watermark extraction key xk;
   a key generation unit that takes the public parameter pp as input and outputs a PRF key prfk and a public tag τ;
   a watermark embedding unit that takes the public parameter pp, the PRF key prfk, and the watermark m as input, and outputs a pseudorandom number generation function C~ in which a message m||0 that is a bit concatenation of the watermark m and 0 is embedded; and,
   A pseudo-random number function generation device having:
2. The pseudorandom number function generation device according to claim 1,
   The input space Dom is {0,1} ⁿ¹ , the output space Ran is {0,1} ^m1 , n1 and m1 are each positive integers, and [L] is a set of integers 1,...,L represents,
   The limitable pseudorandom number generation function PRF _CPRF based on the difficulty of the LWE problem is msk←CPRF.Setup(1 ^λ ), sk _f ←CPRF.Constrain(m _sk ,f), y←CPRF.Eval(msk,x) ,y←CPRF.CEval(sk _f ,x),
   CPRF.Setup(1 ^λ ) is a setup function that takes security parameter λ as input and outputs master key msk,
   CPRF.Constrain(msk,f) is a restricted key generation function that takes the master key msk and any function f as input and outputs a restricted key sk _f ,
   CPRF.Eval(msk,x) is an arithmetic function that takes the master key msk and the input value x∈Dom as input and outputs y∈Ran,
   CPRF.CEval(sk _f ,x) is a restriction operation function that takes the restriction key sk _f and the input value x∈Dom as input and outputs the output value y∈Ran,
   CPRF.Eval(msk,x) with the fixed master key msk is expressed as G(x):{0,1} ⁿ¹ →{0,1} ^m1 ,
   CPRF.CEval(sk _f ,x) in which the restriction key sk _f is fixed is expressed as G _￢∈ν (x):{0,1} ⁿ¹ →{0,1} ^m2 ,
   ν represents a set of x that satisfies f(x)=1 for the function f(・), and G _￢∈ν (x) can only be used for x that does not belong to the set ν,
   The secret key cryptosystem SKE based on the difficulty of the LWE problem is expressed as k←SKE.Gen(1 ^λ ), ct←SKE.Enc(k,m), m' or ⊥←SKE.Dec(k,ct). contains the functions to be
   KE.Gen(1 ^λ ) is a secret key generation function that takes the security parameter λ as input and outputs the secret key k,
   SKE.Enc(k,m) is an encryption function that takes the secret key k and m∈{0,1} ^Lske as input and outputs the ciphertext ct∈{0,1} ⁿ¹ , where Lske=ceil (Log ₂ Lm)+1, and ceil(α) means the smallest natural number greater than or equal to α,
   SKE.Dec(k,ct) is a decryption function that takes the private key k and the ciphertext ct as input and outputs m' or error information ⊥ indicating that decryption is not possible,
   The public key cryptosystem PKE based on the difficulty of the LWE problem is (pk,sk)←PKE.Gen(1 ^λ ), ct←PKE.Enc(pk,m), m' or ⊥←PKE.Dec(sk, ct),
   PKE.Gen(1 ^λ ) is a key generation function that takes the security parameter λ as input and outputs a public key pk and a private key sk,
   PKE.Enc(pk,m) is an encryption function that takes the public key pk and m∈{0,1} ^2λ as input and outputs ciphertext ct,
   PKE.Dec(sk,ct) is a decryption function that takes the private key sk and the ciphertext ct as input, and outputs m' or error information ⊥ indicating that it cannot be decrypted,
   D _auth [k,x] has k fixed, takes x∈{0,1} ⁿ¹ as input, calculates d←SKE.Dec(k,x), and outputs 0 if d≠⊥ and otherwise outputs 1,
   D[k,m,x] has k and m fixed, takes x∈{0,1} ⁿ¹ as input, calculates d←SKE.Dec(k,x), and if d≠⊥ Let d=i||η∈{0,1} ^Lske , it is a function that outputs 1 if η=m _i , otherwise outputs 0, and outputs 0 if d=⊥, and i∈ [Lm] and η∈{0,1}, and m=m ₁ ||…||m _Lm ∈{0,1} ^Lm ,
   The setup section takes the security parameter λ as input, obtains (pk,sk)←PKE.Gen(1 ^λ ), and outputs (pk,sk) as (pp,xk):=(pk,sk). death,
   The key generation unit is
   Take pp=pk as input,
   Taking the security parameter λ and the parameter κ representing the size of D[k,m,x] as input, obtain msk←CPRF.Setup(1 ^λ , 1 ^κ ), and set msk as y←CPRF.Eval(msk,x ), we get G(x) fixed at
   Using the security parameter λ, generate k←SKE.Gen(1 ^λ ),
   Set D _auth [k,x] with k fixed,
   Using G(x) and D _auth [k,x], generate sk _f ←CPRF.Constrain(G(x),D _auth [k,x]), and generate _CPRF.CEval (sk generate G _￢∈νauth (x) where _f ,x),
   Obtain and output prfk=(G(x),k) and τ←PKE.Enc(pp,(G _￢∈νauth (x),k)),
   ν _auth ⊂{0,1} ⁿ¹ is a set of x that satisfies D _auth [k,x]=1,
   The watermark embedding section is
   Set D[k,m,x] with fixed k and m as pp=pk and prfk=(G(x),k),
   Using G(x) and D[k,m,x], generate sk _f ←CPRF.Constrain(G(x),D[k,m,x]), and CPRF.CEval with fixed sk _f (sk _f ,x), G _￢∈ν (x) is output as the pseudorandom number generation function C~, _and ν⊂{0,1} ⁿ is D[ k,m,x]=1 is a set of the input values x that satisfies 1.
3. The pseudorandom number function generation device according to claim 1,
   The input space Dom is {0,1} ^Lin , the output space Ran is {0,1} ^Lout , and Lin and Lout are each positive integers,
   The drilling pseudo-random number generation function PRF _PPRF is expressed as K←PRF.Gen(1 ^λ ), y←PRF.Eval _prfk (K,x), K _￢S⊆ ←PRF.Eval _prfk￢x⊆ (S) contains functions,
   PRF.Gen(1 ^λ ) is a key generation function that takes the security parameter λ as input and outputs the calculation key K,
   PRF.Eval _prfk (K ^, x) is a calculation function F ⁽ x): {0,1} ^Lin →{0,1} ^Lout ,
   PRF.Eval _prfk￢x⊆ (S) takes as input the set S⊆{0,1} ^L1 of the calculation key K and the input value x, and is a drilling key that can only be used for inputs that do not belong to the set S. A hole punching key generation function F _￢x⊆ (S) that outputs K _￢S⊆ ,
   Punctureable encryption method PE is (ek,dk)←PE.Gen(1 ^λ ),dk _≠c* ←PE.Puncture(dk,{c*}),c←PE.Enc(ek,m),m ' or ⊥←PE.Dec(dk',c'),
   PE.Gen(1 ^λ ) is a key generation function that takes the security parameter λ as input and outputs an encryption key ek and a decryption key dk,
   PE.Puncture(dk,{c*}) takes the decryption key dk and ciphertext c* as input, and performs puncture decryption that outputs a puncture decryption key dk _{≠ c*} that can only be used for ciphertexts other than the ciphertext c*. is a key generation function,
   PE.Enc(ek,m) is an encryption function that takes the encryption key ek and m∈{0,1} ^Lpt as input and outputs a ciphertext c∈{0,1} ^Lct ,
   PE.Dec(dk',c') takes the decryption key dk' and the ciphertext c'∈{0,1} ^Lct as input, and calculates m'∈{0,1} ^Lpt or an error indicating that it cannot be decrypted. It is a decoding function that outputs information ⊥,
   Lpt and Lct are positive integers, respectively, and satisfy Lpt=λ+ceil(log ₂ Lm)+1, Lin=Lct, and Lct=poly(λ, log ₂ Lm), and ceil represents the ceiling function,
   The indiscernibility obfuscation function iO is a function that receives a circuit {C _λ } _λ∈N as input and outputs an obfuscated circuit,
   The pseudorandom number generation function PRF is a function that takes x∈{0,1} ^λ as input and outputs y∈{0,1} ^Lout ,
   D[F(x), pe.dk, m] has prfk, pe.dk and m fixed, takes the input value x∈{0,1} ^Lm as input, and d←PE.Dec(pe .dk, x), and if d≠⊥, then d=s||i||η, and if η=m _i , then D[F(x), pe.dk, m] is PRF(s ), otherwise outputs F(x), and if d=⊥ then outputs F(x),
   The setup section sets (pp,xk):=(⊥,⊥),
   The key generation unit is
   Take pp:=⊥ as input,
   Obtain the calculation key K←PRF.Gen(1 ^λ ), calculate F(x) which is PRF.Eval _prfk (K,x) with the calculation key K fixed,
   Generate (pe.ek, pe.dk)←PE.Gen(1 ^λ ),
   output prfk:=(F(x), pe.dk) and τ:=pe.ek,
   The watermark embedding section is
   Take pp:=⊥ and prfk:=(F(x), pe.dk) as input,
   Set D[F(x), pe.dk, m] with prfk, pe.dk and m fixed,
   Obtain iO(D[F(x), pe.dk, m]) which obfuscates D[F(x), pe.dk, m], and obtain iO(D[F(x), pe.dk, m ]) as the pseudorandom number generation function C~.
4. A classical input/output quantum model that imitates the behavior of a pseudorandom number generation function C~ that has a watermark m∈{0,1} ^Lm embedded in the pseudorandom number generation function that outputs an output value y∈Ran for an input value x∈Dom. The device C=(q,U) is a quantum computing device including a quantum bit string in a quantum state q and a unitary device that performs a unitary transformation U on the quantum state q,
   Dom is the input space, Ran is the output space, Lm is a positive integer, x ₁ ||x ₂ represents the concatenation of x ₁ and x ₂ ,
   A ^ε,δ _P,D (q) is an approximate projection device that takes the quantum state q as input and outputs the measured value p of the quantum state q,
   The approximate projection device A ^ε,δ _P,D (q) has parameters ε, δ satisfying 0≦ε, δ<1, and a set of binary projection measurement devices P=(P _b,x,y ,Q _{b, x,y} ) _b,x,y and is determined by the probability distribution D of the measured values,
   ε'=ε/(Lm+1), λ is the security parameter, δ'=2 ^-λ , and P _b,x,y =U _x,y ⁺ |b><b|U _{x, y} , Q _b,x,y =IP _b,x,y , where b is a variable vector representing the quantum state to be measured, |b> represents the ket vector of b, and <b| _represents the bra vector of represents a modeled unitary transformation U, U _x,y ⁺ represents the Hermitian transpose of U _x,y , I represents the identity matrix, [L] represents the set of integers 1,…,L, and all i For ∈[Lm+1], D _τ,i represents the probability distribution defined by D _τ,i : (γ,x,y)←ELWMPRF.Sim(xk,τ,i), and ELWMPRF.Sim(xk ,τ,i) is a simulation function that takes as input the watermark extraction key xk, the public tag τ, and i∈[Lm] and outputs (γ,x,y), where γ is is a real number representing the probability of being output,
   Input the watermark extraction key xk, the public tag τ, the parameters ε, δ, and information representing the quantum state q of the quantum bit of the classical input/output quantum device C=(q,U) and the unitary transformation U. Take it,
   

   

   
   a first measuring section that obtains and outputs a measured value p~ _Lm+1 by measuring;
   Determine whether the measured value p~ _Lm+1 satisfies p~ _Lm+1 <(1/2)+ε-4ε', and determine whether p~ _Lm+1 <(1/2)+ε-4ε' a first extraction unit that outputs information "unmarked" indicating that a watermark is not embedded in the classical input/output quantum device C when it is determined that the following is satisfied.
5. The watermark extraction device according to claim 4,
   When the first extraction unit determines that p~ _Lm+1 <(1/2)+ε-4ε' is not satisfied, the first extraction unit extracts the quantum state of the quantum bit of the classical input/output quantum device C after the measurement by q ₀ output as,
   The watermark extraction device further sequentially extracts the watermark extraction key xk, the public tag τ, the parameters ε, δ, the quantum state q _i-1 of the quantum bit, and the unitary transformation U from i=1 to Lm. Take the information represented as input,
   

   

   
   The measured value p~ _i is _{obtained by} the measurement of Set _i '=0, set m _i '=1 if p~ _i <1/2)+ε-4ε', and set p~ _i =(1/2)+ε- a second measuring section that sets m'=0 ^Lm in the case of 4ε';
   If p~ _i =(1/2)+ε-4ε' is not satisfied for all i∈[Lm], output watermark m'=m ₁ '||…||m _Lm ', and any i a second extraction unit that outputs a watermark m'=0 ^Lm when p~ _i =(1/2)+ε-4ε' for
   A watermark extraction device having
6. The watermark extraction device according to claim 4 or 5,
   The secret key cryptosystem SKE based on the difficulty of the LWE problem is expressed as k←SKE.Gen(1 ^λ ), ct←SKE.Enc(k,m), m' or ⊥←SKE.Dec(k,ct). contains the functions to be
   KE.Gen(1 ^λ ) is a secret key generation function that takes the security parameter λ as input and outputs the secret key k,
   SKE.Enc(k,m) is an encryption function that takes the secret key k and m∈{0,1} ^Lske as input and outputs the ciphertext ct∈{0,1} ⁿ¹ , where Lske=ceil (Log ₂ Lm)+1, and ceil(α) means the smallest natural number greater than or equal to α,
   SKE.Dec(k,ct) is a decryption function that takes the private key k and the ciphertext ct as input and outputs m' or error information ⊥ indicating that decryption is not possible,
   The public key cryptosystem PKE based on the difficulty of the LWE problem is (pk,sk)←PKE.Gen(1 ^λ ), ct←PKE.Enc(pk,m), m' or ⊥←PKE.Dec(sk, ct),
   PKE.Gen(1 ^λ ) is a key generation function that takes the security parameter λ as input and outputs a public key pk and a private key sk,
   PKE.Enc(pk,m) is an encryption function that takes the public key pk and m∈{0,1} ^2λ as input and outputs ciphertext ct,
   PKE.Dec(sk,ct) is a decryption function that takes the private key sk and the ciphertext ct as input, and outputs m' or error information ⊥ indicating that decryption is not possible,
   ELWMPRF.Sim(xk,τ,Lm+1) takes xk, τ, and Lm+1 as input, sets sk:=xk, and (G _￢∈νauth (x),k)←PKE.Dec(sk ,τ), γ←{0,1}, get x←SKE.Enc(k, Lm+1||γ) and y←G _￢∈νauth (x), and (γ,x,y) It is a function that outputs
   ELWMPRF.Sim(xk,τ,i) takes xk, τ, and i∈[Lm] as input, sets sk:=xk, and (G _￢∈νauth (x),k)←PKE.Dec(sk ,τ), γ←{0,1}, obtain x←SKE.Enc(k,i||γ) and y←G _￢∈νauth (x), and output (γ,x,y). A watermark extractor that is a function.
7. The watermark extraction device according to claim 4 or 5,
   λ is a security parameter, Lout is a positive integer,
   The pseudorandom number generation function PRF is a function that takes x∈{0,1} ^λ as input and outputs y∈{0,1} ^Lout ,
   Punctureable encryption method PE is (ek,dk)←PE.Gen(1 ^λ ),dk _≠c* ←PE.Puncture(dk,{c*}),c←PE.Enc(ek,m),m ' or ⊥←PE.Dec(dk',c'),
   PE.Gen(1 ^λ ) is a key generation function that takes the security parameter λ as input and outputs an encryption key ek and a decryption key dk,
   PE.Puncture(dk,{c*}) is a puncturing decryption key generation function that takes the decryption key dk and ciphertext c* as input and outputs the puncturing decryption key dk _≠c* ,
   PE.Enc(ek,m) is an encryption function that takes the encryption key ek and m∈{0,1} ^Lpt as input and outputs a ciphertext c∈{0,1} ^Lct ,
   PE.Dec(dk',c') takes the decryption key dk' and the ciphertext c'∈{0,1} ^Lct as input, and calculates m'∈{0,1} ^Lpt or an error indicating that it cannot be decrypted. It is a decoding function that outputs information ⊥,
   Lpt and Lct are positive integers, respectively, and satisfy Lpt=λ+ceil(log ₂ Lm)+1, Lin=Lct, and Lct=poly(λ, log ₂ Lm),
   ELWMPRF.Sim(xk,τ,Lm+1) sets pe.ek obtained by (pe.ek, pe.dk)←PE.Gen(1 ^λ ) to τ:=pe.ek, and xk:= Let ⊥, γ←{0,1} and s←{0,1} ^λ , y←PRF(s), and x←PE.Enc(pe.ek, s||Lm+1| |γ) and outputs (γ,x,y),
   ELWMPRF.Sim(xk,τ,i) sets pe.ek obtained by (pe.ek, pe.dk)←PE.Gen(1 ^λ ) to τ:=pe.ek and xk:=⊥. , γ←{0,1} and s←{0,1} ^λ , y←PRF(s), and x←PE.Enc(pe.ek, s||i||γ ) and outputs (γ,x,y).
8. A program for causing a computer to function as the pseudorandom number function generation device according to any one of claims 1 to 3.

Images