This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2020-188737, filed on Nov. 12, 2020; the entire contents of which are incorporated herein by reference.
Embodiments described herein relate generally to an encryption device, a decryption device, an encryption method, a decryption method, and computer program products.
Cryptography is a technique widely used for protecting the confidentiality and authenticity of information in a networked society in which people communicate with a large amount of information such as e-mails exchanged over a network. However, even the RSA cryptography and elliptic curve cryptography, which are currently widely accepted versions of the technique, cannot be free of a potential risk of breaking by a practical quantum computer expected to appear in the near future.
An encryption device according to an embodiment includes one or more hardware processors configured to function as a public-key acquisition unit, a plaintext embedding unit, a polynomial operation unit, a polynomial generation unit, and an encryption unit. The public-key acquisition unit acquires, as a public key, n-variable indeterminate equations X(x1, . . . , xn) having, as coefficients, elements with a predetermined degree or less of a univariate polynomial ring Fp[t] on a finite field Fp. The plaintext embedding unit embeds a plaintext m into coefficients of n-variable plaintext polynomial factors mi (x1, . . . , xn) (i=1 . . . , m) having, as coefficients, elements with a predetermined degree or less of the univariate polynomial ring Fp[t], a number of the n-variable plaintext polynomial factors being one or m which is larger than one. The polynomial operation unit generates an n-variable plaintext polynomial M(x1, . . . , xn) by multiplying the n-variable plaintext polynomial factors mi(x1, . . . , xn) whose number is one or m. The polynomial generation unit randomly generates n-variable polynomials sk(x1, . . . , xn) (k=1, 2) having, as coefficients, elements with a predetermined degree or less of the univariate polynomial ring Fp[t], randomly generates n-variable polynomials rk(x1, . . . , xn) having, as coefficients, elements with a predetermined degree or less of the univariate polynomial ring Fp[t], and randomly generates noise polynomial ek(x1, . . . , xn) having, as coefficients, elements with a predetermined degree or less of the univariate polynomial ring Fp[t]. The encryption unit generates a ciphertext ck(x1, . . . , xn) by executing encryption processing of performing an operation including at least one of adding, subtracting, and multiplying the n-variable polynomials sk(x1, . . . , xn), the n-variable polynomials rk(x1, . . . , xn), the noise polynomial ek(x1, . . . , xn), and the n-variable indeterminate equations X(x1, . . . , xn) to, from, or by the n-variable plaintext polynomial M(x1, . . . , xn).
Embodiments of an encryption device, a decryption device, an encryption method, a decryption method, and computer program products will be described in detail below with reference to the accompanying drawings.
Cryptography can be roughly divided into common-key cryptographic technology and public-key cryptographic technology. Common-key cryptography is a cryptographic method based on a data scrambling algorithm. The common-key cryptography enables high-speed encryption/decryption, whereas secret communication and authentication communication can only be performed between two parties each being given a common key in advance. Public-key cryptography is a cryptographic method based on a mathematical algorithm. The public-key cryptography is not as fast as encryption/decryption as common-key cryptography, but it does not require pre-key sharing. Public-key cryptography enables authentication communication by performing secret communication using the public key disclosed by the destination and applying a digital signature using the sender's private key (to prevent impersonation).
For this reason, common-key cryptography is mainly used to encrypt information that needs to be decrypted in real time after reception, such as pay digital broadcasting, and a method is adopted to deliver the decryption key separately used by a key distribution system called a conditional access system only to subscribers. By contrast, online sites on the Internet require encryption to protect customer information (credit card numbers, addresses, and the like) from eavesdropping, but it is not always possible to issue an encryption key in advance; and therefore, public-key cryptography is often used.
Typical examples of public-key cryptography include RSA cryptography and elliptic curve cryptography. In RSA cryptography, the difficulty of the integer factorization problem serves as the basis of security, and the power residue operation is used as the encryption operation. In elliptic curve cryptography, the difficulty of the discrete logarithm problem on an elliptic curve serves as the basis of security, and the point operation on the elliptic curve is used for the encryption operation. For these methods of public-key cryptography, although an attack method for a specific public key has been proposed, a general attack method is not known. Thus, decryption methods for a serious problem regarding security have not been found so far except an attack method by a quantum computer described later.
Other examples of public-key cryptography include knapsack cryptosystem (known as NP problem) with the difficulty of the knapsack problem serving as the basis of security, and cryptosystems based on multivariate polynomials configured by using a field extension theory and with the solution problem of simultaneous equations serving as the basis of security. However, with respect to the knapsack cryptosystem, the attack method is already known in almost all instances, and it cannot be said that the security it provides is quite doubtful.
Although a powerful attack method is known for cryptosystems based on multivariate polynomials, there are also instances in which known attack methods do not work, and thus deterioration in security has become but not become decisive yet. However, the key size required to avoid known attack methods has increased, which come to be seen as a problem.
The RSA cryptography and elliptic curve cryptography, which are currently widely accepted versions of the technique, cannot be free of a potential risk of breaking by a practical quantum computer expected to appear in the near future. A quantum computer is a computer that can perform massively parallel computation (based on a principle different from the present computers) by utilizing a physical phenomenon called entanglement known in quantum mechanics. The quantum computer is a virtual computer the operation of which has been confirmed only at the experimental level so far, but research and development for its implementation are underway. In 1994, Shor showed that an algorithm for efficiently solving integer factorization and discrete logarithm problems can be constructed, using this quantum computer. That is, when the quantum computer becomes available, the RSA cryptography based on the integer factorization problem and the elliptic curve cryptography based on the discrete logarithm problem (on the elliptic curve) will be solved efficiently.
Under such circumstances, research on public-key cryptography, which has the possibility of maintaining security even if a quantum computer becomes available, has been conducted in recent years. Lattice-based cryptography is an example of public-key cryptography that is still considered feasible at present and difficult to break even with a quantum computer. Lattice-based cryptography is a type of public-key cryptography the security of which is based on the problem of finding the closest point, among the points other than an origin, to the origin (shortest vector problem) in the discrete n-dimensional vector space (linear space) called lattice.
The shortest vector problem is an NP-hard problem, but since it is a linear problem, small-sized problems can be easily solved. Therefore, the number of dimensions for achieving security is increased, the key size of a public key, a private key, or the like is increased, and there is little possibility of applying it especially to a low-end device. Furthermore, public-key cryptography requires a larger circuit scale and takes a longer processing time than common-key cryptography, so that there is a problem in that it cannot be implemented in a low power environment, such as a mobile terminal, or it takes a long processing time even if it is implemented. For this reason, there is a demand for public-key cryptography that can be realized even in a low power environment.
In general, public-key cryptography is configured to find difficult-to-calculate problems (such as the integer factorization problem and discrete logarithm problem), and break a ciphertext (without knowing the private key) in such a way that is equivalent to solving the difficult-to-calculate problems. However, conversely, even if one problem that is difficult to calculate is defined, it is not always possible to easily construct public-key cryptography that uses that problem as the basis of security. This is because when the security is based on a problem that is too difficult to calculate, the problem of generating a key will also be difficult and cannot be configured. On the other hand, when the problem is made easy enough to enable key generation, breaking the key will become easy accordingly.
Creativity is thus required to configure public-key cryptography in finding a difficult-to-calculate problems and changing it into a problem with a fine balance such that the problem is easy enough to generate a key but not easy to break (decrypt without knowing the generated private key). Since such a configuration is difficult to make, only several examples of public-key cryptography have been proposed so far. Under such circumstances, public-key cryptography (JP 2010-204466 A) is proposed, using an algebraic surface that cannot be efficiently broken even with a calculation by a quantum computer and that is expected to be processed at high speed even in a low power environment.
The public-key cryptography disclosed in JP 2010-204466 A has a private key as two sections corresponding to an algebraic surface X(x,y,t) and a public key as the algebraic surface X(x,y,t), and includes polynomial generation means and encryption means. The polynomial generation means performs processing of embedding a plaintext m in a plaintext polynomial m(x,y,t) and generating a random polynomial h(x,y,t), s1(x,y,t), s2(x,y,t), r1(x,y,t), r2(x,y,t) of three variables x, y, t. The encryption means generates two ciphertexts c1=Epk(m,s1,r1,h,X) and c2=Epk(m,s2,r2,h,X) from the plaintext polynomial m(x,y,t) through encryption processing of performing operation including at least one of addition, subtraction, and multiplication of each polynomial and a definition expression X(x,y,t). The public-key cryptography disclosed in JP 2010-204466 A was broken since there were two ciphertexts without any noise term, although the ciphertexts had nonlinearity.
Non Patent Literature (Yuichi KOMANO, Koichiro AKIYAMA, Yasuhiro GOTO, Koji NUTA, and Goichiro KAOKA, “Algebraic curved surface encryption method using approximation GCD of polynomial”, IEICE Technical Journal, 116 (130), pp. 217 to 222 (2016)) proposes a cryptographic method with noise. This cryptographic method has a private key as a single section corresponding to an algebraic surface X(x,y,t), and includes first polynomial generation means, second polynomial generation means, and encryption means. Assuming that a public key serves as the algebraic surface X(x,y,t), the first polynomial generation means performs processing of embedding a plaintext m in a plaintext polynomial m(x,y,t) and generating a random polynomial s1(x,y,t), s2(x,y,t), r1(x,y,t), r2(x,y,t) of three variables x, y, t. The second polynomial generation means generates noise polynomials e1(x,y,t) and e2(x,y,t). The encryption means generates two ciphertexts c1=Epk(m,s1,r1,e1,X), c2=Epk(m,s2,r2,e2,X) from the plaintext polynomial m(x,y,t) through encryption processing of performing operation including at least one of addition, subtraction, and multiplication of each above-described polynomial and the above-described definition expression X(x,y,t). This cryptographic method has nonlinearity with the ciphertext involving multiplication of an unknown part such as m(x,y)s1(x,y), m(x,y)s2(x,y), but these are simple products of the plaintext polynomial m(x,y) and random polynomials s1(x,y) and s2(x,y). Therefore, there has been a problem in that a decryptable and safe parameter cannot be with the security analysis as described in the present embodiment performed.
In the following, in view of such a current situation, an embodiment will explain public-key cryptography that has the possibility of ensuring security even if a practical quantum computer appears and that can eliminate vulnerability. Specifically, public-key cryptography that can eliminate vulnerability is constructed by hiding a private key in a nonlinear polynomial so that one ciphertext can have a nonlinear structure and adding noise.
First of all, the algebra used in the embodiment will be defined. To begin with, Z represents a set of integers, and Zp represents the coset of the integer Z corresponding to a natural number p. Zp is a remainder and is generally described as Zp={[0], [1], . . . , [p−1]}. With the elements of Zp, the followings hold, whereby addition, subtraction, and multiplication are defined.
[a]+[b]=[a+b]
[a]−[b]=[a−b]
[a]·[b]=[a·b]
A set is referred to as a ring, which enables the operations of addition, subtraction, and multiplication to be defined as described above and satisfies associativity. The ring includes additive identify 0 as well as an inverse element [−x]([x]+[−x]=[0] that results in 0 when added to an element x other than 0. A ring with which the commutative law ([a]+[b]=[b]+[a],[a]·[b]=[b]·[a]) is established is referred to as a commutative ring. If the ring further includes a unit element [1] for multiplication, the ring is referred to as a commutative ring with unit element.
The division operation can be defined only for [b] with an element [x] satisfying [b]·[x]=[x]·[b]·=[1]. When such an element [x] exists, the element [x] is referred to as an inverse element of [b] and is expressed as [b−1]. Thus, division [a]/[b] with [b] with an inverse element is calculated by multiplying [a] by the inverse element [b−1]([a]·[b−1]) satisfying the following.
[b]·[b−1]=[1]
The element [b] in Zp has the inverse element [b−1] under a necessary and sufficient condition GCD(b,q)=1. Specifically, the element [b] in Zp has the inverse element [b−1] only when b and p are coprime (relatively prime). For example, when p is 5 and b is 3, these numbers are coprime, and thus the inverse element is obtained as [3−1]=[2]. However, when p is 6, GCD(3,6)=3 holds, the numbers are not relatively prime, and thus the division cannot be defined due to the lack of the inverse element.
Meanwhile, [0] represents a set of numbers that can be divided by p without a remainder. It can be more explicitly expressed as the following.
[0]={. . . ,−2p,−p,0,p,2p, . . . }
All the elements of the set [0] results in the same answer in the calculation defined with Zp. Thus, for the sake of simplicity, the calculation is assumed to be performed using a single element (representative element) in the set [0]. The representative element may be any element included in this set (due to the feature described above), and is set to be 0 in the embodiment. Similarly, the smallest integers in [1] and [2] (1 and 2, respectively) are used as the representative element, and {0, 1, . . . , q−1} is used as the representative for Zp.
When p is a prime number, all representative elements other than 0 are coprime to p, whereby division can be defined. Thus, when p is a prime number, addition, subtraction, multiplication and division can be defined with Zp. Such a set that is a commutative ring with elements other than 0 having inverse elements is known as a field. In particular, a field, such as Zp where p is a prime number, including a limited number of elements is referred to as a finite field. The finite field is either a field with the number of elements therein being a prime number or a field with the number of elements being a prime power, and the former is referred to as a prime field. Note that Zp mentioned herein is a prime field.
Next, the notation and definitions related to polynomials will be described. Fp[t] represents a set of univariate polynomials, where a prime field Fp is a coefficient. It should be quite obvious that addition, subtraction, and multiplication can be defined with Fp[t]. However, division of polynomials cannot be defined, except for the polynomials including constant terms only, due to the lack of inverse element.
Next, terms and symbols for bivariate polynomials will be defined. First of all, a bivariate polynomial on the ring R is expressed by the following Formula (1).
In Formula (1), τi,j(t) represents the element of the univariate polynomial ring Fp[t]. A set Γξ is a set of exponents (i (x exponent),j (y exponent)) of non-zero monomial expressions in a polynomial ξ(x,y), and is referred to as a term set of the bivariate polynomial ξ(x,y).
For example, a term set of the polynomial on Z7 in the following Formula (2) is expressed by the following Formula (3).
ξ(x,)=5x3+3x2
+
2+4x+1 (2)
Γξ={(3,0),(2,1),(0,2),(1,0),(0,0)} (3)
The number of elements of Γξ matches the number of monomials of the bivariate polynomial ξ(x,y). In the following, ξ(x,y) being clearly a bivariate polynomial may be simply written as ξ.
In the embodiment, for the sake of simplicity, the term set of the bivariate polynomial of the degree D is defined as the maximum term set denoted by ΓD. Specifically, when D=2, the following Formula (4) holds, and when D=3, the following Formula (5) holds.
Γ2={(2,0),(1,1),(0.2),(1,0),(0,11),(0,0)} (4)
Γ3={(3,0),(2,1),(1,2),(0,3),(2.0),(1.1),(0.2),(1,0),(0,1),(0,0)} (5)
The Γ3 includes the term set Γξ of the foregoing Formula (3) as a subset.
When the term set ΓD is given, a set of bivariate polynomials on the univariate polynomial ring Fp[t] having the term set ΓD is defined by the following Formula (6).
In Formula (6), ai,j(t) is an element on Fp[t]. The left side of Formula (6) may be simply referred to as FTD. The following Formula (7) represents a case where the degree of this coefficient ai,j(t) is limited to be not larger than d, which may also be simply referred to as FTD,d.
The following Formula (8) expresses the bivariate polynomial on the univariate polynomial ring Fp[t], as a trivariate polynomial.
In the formula, μi,j,k is an element of the finite field Fp. A set Δξ is a set of exponents (i (x exponent),j (y exponent),k (t exponent)) of non-zero monomial expressions in a polynomial ξ(x,y), and is referred to as a term set of the trivariate polynomial ξ(x,y).
The following Formula (10) indicates a term set of a polynomial on F7 expressed by Formula (9).
ξ(x,)=(t2+2t+6)x2+(3t+5)
2+(4t2+1)x+4t2+t+3 (9)
Δξ={(2,0,2),(2,0,1),(2,0,0),(0,2,1),(0,2,0)(1,0,2),(1,0,0),(0,0,2),(0,0,1),(0,0,0)} (10)
The number of elements of Δξ matches the number of monomials of the trivariate polynomial ξ(x,y,t). In the following, ξ(x,y,t) that is clearly a trivariate polynomial may be simply written as ξ.
Note that the notation of the maximum term set corresponds to the notation of the bivariate polynomial. Specifically, the maximum term set with the degree of each coefficient ai,j(t) limited so as not to exceed d with the degree D related to the trivariate polynomial x,y will be referred to as ΔD,d.
For example, when D=2 and d=1 are given, the following Formula (11) is obtained.
Δ2,1={(2,0,1),(2,0,0)(1,1,1)(1,1,0),(0,2,1),(0,2,0),(1,0,1),(1,0,0),(0,1,1),(0,1,0)(0,0,1),(0,0,0)} (11)
A pair of elements (ux(t),uy(t)) on the univariate polynomial ring Fp[t] satisfying the equation X(x,y)=0 on the univariate polynomial ring Fp[t] is referred to as the solution of the equation X(x,y)=0. In a case where X(x,y) is regarded as a polynomial, the solution of the equation X(x,y)=0 is referred to as a zero point of X(x,y).
It is a well-known fact that a(t), as a Greatest Common Divisor (GCD) of polynomials f(t) and g(t) on the univariate polynomial ring Fp[t] is obtained by the Euclidean algorithm. A description will be given on approximate GCD calculation in a case where small-degree noises e1(t) and e2(t) are respectively added to these (t) and g(t) The calculation for this approximate GCD plays an important role in the decryption of the cryptographic method of the embodiment.
It has been known that GCD a(t) of the degree d can be obtained using “Algorithm 1” illustrated in
This algorithm is based on the idea of the extended Euclidean algorithm, and enables efficient processing. In the present embodiment, a(t) is referred to as approximate GCD of f(t) and g(t).
A factorization (ideal decomposition) problem using an ideal in the multivariate polynomial ring Fp[t][x,y] will be defined, and one solution algorithm therefor will be described. The ideal decomposition is a problem for obtaining hj(∈Fp[t][x,y]) (j=1, . . . , n) when two elements X and f(=Πj=1nhj+Xr) of Fp[t][x,y] are given. Here, r is also an element of Fp[t][x,y], and thus the problem can be regarded as a factorization problem of the polynomial f in the remainder ring Fp[t][x,y]/(X).
A finite set of the multivariate polynomial ring Fp[t][x,y] is referred to as G={gl, . . . , gs}. It has been known that in this case, a polynomial qi(hj(∈Fp[t][x,y]) exists for any polynomial f(∈Fp[t][x,y]), and that LM(r) is not dividable LM(gi) with r=0 or with any i in the following Formula (14).
Here, LM(r) indicates a monomial that comes in first in the monomial order defined for the multivariate polynomial ring Fp[t]. For example, when the order of x>y>t is defined, the order of monomials is prioritized in the order of x, y, and t, and in the case of monomials containing the same variables, those having higher exponents come first in this order. When the polynomial of Formula (9) is expressed as r, the monomial order of r is t2x2, 2tx2, 6x2, 4t2x, x, 3ty2, 5y2, 4t2, t, and 3, and LM(r)=t2x2 holds.
Transformation of f as in the above Formula (14) using a finite set G is referred to as normalization of f by G, and r is referred to as a normal form of G and written as NFG(f). In addition, when the set G is set to what is known as a Grebner basis for the ideal J of a polynomial, a normal form of an arbitrary element f included in the ideal J becomes 0. Thus, this has been known to be writable as in the following Formula (15).
In Formula (15), qi is an element of Fp[t][x,y].
It has been known that the following Formula (16) is obtained through calculation of a resultant of f and X.
In Formula (16), Resx(f,X) is a resultant relating to a variable x. Also for the variable y, the resultant can be similarly calculated with the following Formula (17).
Here, the ideal J is defined by the following Formula (18).
J=(X,Resx(hj,X),Res(hj,X)) (18)
Since J substantially matches (hj,X) and hj∈J holds, 0 is obtained when the Grebner basis G of the ideal J is calculated, and a normal form of hj based on G is calculated. Here, hj is simply written as h for simplicity, and h is expressed by the following Formula (19).
Here, μijk is a variable with a value Fp. The normal form of h based on G is calculated as in the following Formula (20).
A simultaneous linear equation is obtained through comparison between coefficients of xiyitk in both sides. With the solution μijk of this equation, h can be restored.
On the other hand, actually, Resx(hj,X) and Resy(hi,X) are factors of Resx(f,X) and Resy(f,X), respectively, and h, can only be restored with the correct combination of these. Based on these, it can be understood that the ideal decomposition is achieved by Algorithm2 illustrated in
An indeterminate equation can be defined as an equation with the number of variables being larger than the number of expressions (included in the equation). The indeterminate equations feature a small number of constraints and a high degree of freedom of solution, and thus in many cases yield a plurality of (in some cases, like its name, indeterminate number of) solutions if any. In fact, the indeterminate equations with an integer coefficient yield innumerable real (or complex) solutions, some of which can be easily obtained as an approximate solution. Unfortunately, this does not usually work for equations that solution of which is in a discrete set such as an integer solution of an indeterminate equation with an integer coefficient. Therefore, some theoretical means for narrowing down is required. However, it has been known that generally, whether there is a solution cannot be determined with such means for narrowing down performed for a limited number of times (unsolvable problem).
An indeterminate equation cryptosystem proposed in the embodiment has the following definitions, and is dependent on, in terms of security, a solution problem for obtaining a univariate polynomial solution of an indeterminate equation X(x,y)=0 defined on the univariate polynomial ring Fp[t], and this problem is defined as follows.
A problem of obtaining a univariate polynomial solution ux(t), uy(t) on Fp[t] when the indeterminate equation X(x,y)=0 defined on the univariate polynomial ring Fp[t] is given is referred to as a solution problem for an indeterminate equation on the univariate polynomial Fp[t] or a section finding problem In the algebraic surface X(x,y) defined on the finite field Fp.
In the following, a key generation algorithm and an encryption/decryption algorithm for the indeterminate equation cryptosystem of the embodiment will be described. In this method, the plaintext M is dispersedly embedded in a plurality of plaintext polynomial factors mi(x,y). Specifically, assuming that a plaintext polynomial in which the plaintext is directly embedded in the coefficient is M(x,y), k polynomials mi(x,y) (i=1, . . . , k), referred to as plaintext polynomial factors, are prepared for mi(x,y), and are dispersedly embedded so that the following Formula (21) can be obtained.
A specific embedding method will be described later in “Plaintext Embedding”. Meanwhile, also in the decryption, the structure only allows the plaintexts to be restored when the factor mi(x,y)(i=1, . . . , k) is obtained through factorization after Πi=1kmi(x,y) has been restored. In the following, for the sake of simplicity, the degree of x,y of mi(x,y), in terms of polynomial, is set to be 1, and an explanation is given only on a plaintext polynomial with a factor only including polynomials that can be expressed as mi(x,y)=mx,i(t)x+my,i(t)y+ml,i(t).
Furthermore, the following algorithms are provided with example numerical values of a small size. It should be noted that values of a small size are used for the sake of understanding, and the security of the encryption cannot be guaranteed with such values.
System parameters, which include parameters used in the algorithms, are for guaranteeing security and decryptability. The system parameter includes an arbitrarily settable independent parameter and a dependent parameter derived from the independent parameter. The parameters are defined as follows. The independent parameters are the following 1 to 7.
1. Prime number p indicating the size of the prime field Fp
2. Degree d of solution (ux(t),uy(t))
3. Degree DX of a (nonlinear) indeterminate equation X(x,y) expressed by the following Formula (22)
4. Degree Dm of a plaintext polynomial M(x,y) expressed by the following Formula (23)
5. Degree Dr of a random polynomial r(x,y) expressed by the following Formula (24)
6. Degree Ds of a random polynomial s(x,y) expressed by the following Formula (25)
7. Degree De of a noise polynomial e(x,y) expressed by the following Formula (26)
Here, in order to avoid a linear algebra attack described later, the condition of the following Formula (27) needs to be satisfied.
Dm+Ds=DX+Dr (27)
The dependent parameters dependent on the independent parameters described above are the following 1 to 5.
1. Degree dX of each coefficient τij(t) of the indeterminate equation X(x,y) (i=1, . . . , DX)
2. Degree dm of each coefficient of the plaintext polynomial factor mj(x,y) (j=1, . . . , Dm)
3. Degree dr of each coefficient rij(t) of the random polynomial rk(x,y) (k=1, 2)
4. Degree ds of each coefficient sij(t) of the random polynomial sk(x,y) (k=1, 2)
5. Degree de of each coefficient eij(t) of the noise polynomial ek(x,y) (k=1, 2)
Here, in order to avoid a linear algebra attack described later, the condition of the following Formula (28) needs to be satisfied
Dmdm+Dsds=DXdX+Drdr (28)
The key of the public-key cryptography includes a private key and a public key. The key of the embodiment will be described in detail below. To begin with, the private key is the solution u of the indeterminate equation X expressed by the following equation (29).
u:(x,)=(ux(t),u
(t))(∈
p[t]2) (29)
Example: The solution u is expressed by the following Formula (30) when d=9 and p=7.
ux(t),uy(t))=(5t9+2t82t7+2t5+2t4+5t3+42+5t,6t9+2t8+2t7+5t6+t5+t3+3t2+4) (30)
The public key is the indeterminate equation X(x,y) expressed by the following Formula (31).
X(x,)=Σ(i,j)∈Γ
i,j(t)xi
j (31)
Here, the solution of X(x,y)=0 includes the private key u. Specifically, X(ux(t),uy(t))=0.
The private key and the public key are generated by executing the following processing with the above-described system parameters used as inputs. The private key (polynomials ux(t), uy(t), and (∈Fp[t])) are uniformly and randomly generated under the condition degux(t)=deguy(t)=d.
Example: When d=9 and p=7, the private key is expressed by the above-described Formula (30).
Note that this private key ux(t), uy(t), and (∈Fp[t]) can be compressed to ux(t) (∈Fp[t]) only. This is because when ux(t) is known, uy(t) can be relatively easily derived by solving the univariate equation X(ux(t),y)=0 on Fp[t]. Therefore, in the embodiment, ux(t) is defined as a compressed private key.
The public key can be generated by the following methods 1 to 3.
1. Terms other than a constant term τ00(t) are uniformly and randomly generated from the term set ΓDx,dx of the indeterminate equation.
A specific generation method includes a step of setting (a) and a step of executing the following i and ii with respect to each element (i,j) of (b).
(a): X(x,y)=0
(b); ΓDx(except for (0,0))
i: Uniformly and randomly generate a polynomial τij(t) of the degree dX from Fp[t]
ii: X(x,y)=X(x,y)+τij(t)x′
2. The constant term τ00(t) is calculated with the following Formula (33)
In the case of the example of the above Formula (32), the constant term τ00(t) is expressed by the following Formula (34).
τ00(t)=4t26+3t25+3t24+t22+3t21+t19+4t18+3t17+6t16+t15+6t14+6t13+2t12+5t11+2t10+5t8+t7+4t6+3t5+2t4+5t3+4t2+5t+1 (34)
When the constant term τ00(t) of the above Formula (34) is added to the above Formula (32), X(x,y) is expressed by the following Formula (35).
X(x,)=(4t8+4t7+6t6+5t5+4t4+3t2+3t+5)x2+(5t8+4t7+4t6+4t5+3t4+3t3+4t2+4t+3)x
+(6t8+6t7+2t6+t5+3t4+t3+3t2+2t+6)
2+(6t8+4t6+3t5+5t3+4t2+5t+6)x+(3t86t7+t6+4t5+2t4+2t3+4t2+6t+3)
+4t26+3t25+3t24+t22+3t21+t19+4t18+3t17+6t16+t15+6t14+6t13+2t12+5t11+3t10+5t8+t7+4t6+3t5+2t4+5t3+4t2+5t+1 (35)
As can be seen in the formula, X(x,y) has coefficients with the degree of the coefficient of the constant term being 26, which is much higher than the order 8 of the other terms. This is because the degree being d·degX(x,y)+dX is obtained according to the calculation Formula (33) for τ00(t). In the present embodiment, in order to adjust this degree to the degree of other coefficients, adjustment is performed by the following method 3.
3. Adjustment of the Indeterminate Equation X(x y)
The indeterminate equation X(x,y) with the solution (ux(t),uy(t)) has the same solution (ux(t),uy(t)) after a deformation X(x,y)+q(t)xiyi−q(t)ux(t)iuy(t)j for arbitrary univariate polynomial q(t). Here, the following Formula (36) is obtained with i being an integer within a range of 0≤i≤degX(x,y).
Here, τ00(t)=q(t)ux(t)i+τ00′(t) and degτ00′(t)<degux(t)i hold. Thus, through the deformation X′(x,y)=X(x,y)+q(t)xi−q(t)ux(t)i the constant term can be τ00′(t), whereby the degree can be reduced.
Note that, when this method is used with dx=d−1, the degrees of all the coefficients match, and terms other than the adjusted term x2,x and the constant term will be those randomly selected in Step 1. In view of this, X(x,y) is generated in steps 1 and 2 with dx=d−1, and the deformation is applied to the terms in the order of degrees, whereby degτij(t)=d−1 can be obtained for arbitrary (i,j)(∈Γx), with the degree of the constant term τ00(t) sequentially reduced without increasing the degree of each coefficient. The detail of the algorithm is indicated by Algorithm 3 in
As a result, X(x,y) is expressed by the following Formula (37).
X(x,)=(t8+2t7+t6+t5+2t4+5t3+6t2+2t+5)x2+(5t8+4t7+4t6+4t5+3t4+3t3+4t2+4t+3)x
+(6t8+6t7+2t6+t5+3t4+t3+3t2+2t+6)
2+(2t8+3t7+6t6+4t5+2t4+5t3+4t2+6t+1)x+(3t8+6t7+t6+4t5+2t4+2t3+4t2+6t+3)
+2t8+4t7+5t6+2t5+5t4+2t3+5t2+2t+2 (32)
As is clear from the public key generation algorithm described above, the coefficients (other than x′(i=0, . . . DX)) of the terms of the indeterminate equation X(x,y) serving as the public key are randomly generated. Therefore, this portion can be generated by disclosing only the seed of the random number and using a specific pseudo random number generation function, a hash function, or the like. Therefore, only coefficients of the seed and the adjusted part need to be disclosed, and the size of the public key is compressed. In the example of the above Formula (37), only part of the following Formula (38) is disclosed as the actual coefficient, and the other terms can be generated by disclosing the seed (which usually has the bit length of the security parameter only).
X(x,)=(t8+2t7+t6+t5+2t4+5t3+6t2+2t+5)x2+(2t8+3t7+6t6+4t5+2t4+5t3+4t2+3t+1)x+2t8+4t7+5t6+2t5+5t4+2t3+5t2+2t+2 (38)
According to this, the compression can be performed to approximately ½ in the case of the degree 2, approximately ⅖ in the case of the order 3, and approximately ⅓ in the case of the order 4.
Next, the encryption processing according to the embodiment will be described.
In the embodiment, the plaintext polynomial for embedding the plaintext has the product structure as expressed in the above Formula (23), and thus direct embedding is not an option. Therefore, an encryption device of the embodiment disperses and embeds plaintext into plaintext polynomial factors mi(x,y) (i=1, . . . , Dm). The factor mj(x,y) of the plaintext polynomial can be expressed as mj(x,y)=mj,x(t)x+mj,y(t)y+mj,1(t) as described above. The degree of each of the coefficients mj,x(t), mj,y(t), and mj,3(t) is dm. The encryption device of the embodiment performs p-adic expansion on a plaintext M as expressed by the following Formula (39).
M=(ad
The plaintext M is embedded in elements of Fp[t] as in the following Formula (40).
ad
When p=7 and dm=1 are given, the encryption device of the embodiment disperses and embeds a plaintext (3,0,1,1,5)(7) as factors of a plaintext polynomial. For example, when Dm=3, the plaintext (3,0,1,1,5)(7) may be dispersed to result in m1=(2,5,5,2,3)(7), m2=(6,6,5,1,2)(7), and m3=(2,3,5,5,0)(7). The plaintext is restored by obtaining the sum m1+m2+m3=(3,0,1,1,5)(7) for each of these vector elements.
When dispersing a plaintext into a sum of a plurality of elements, for example, when dispersing a plaintext M to m1, . . . , mDm, the encryption device of the embodiment generates random data by using m1, . . . , mDm−1, with the same size as the plaintext M, and derives mDm=m−(m1+m2+. . . +mDm−1).
1. The plaintext is dispersed and embedded to the factors mj(x,y) (j=1, . . . , Dm) of the plaintext polynomial with the degree dm in the manner described above. When the plaintext (3,0,1,1,5)(7) is dispersed to result in m1=(2,5,5,2,3)(7), m2=(6,6,5,1,2)(7), and m3=(2,3,5,5)(7) as follows.
m1(x,y)=(2t+1)x+(5t+5)y+2t+3
m2(x,y)=(6t+1)x+(6t+5)y+t+2
m3(x,y)=(2t+1)x+(3t+5)y+5t
Here, the coefficient of the term x is fixed to 1 in to remove ambiguity of a constant multiple of the plaintext polynomial factor, and the plaintext is not embedded in the coefficient of the term x.
2. Generation of random polynomial rk(x,y) (k=1, 2)
A bivariate random polynomial rk(x,y) with the degree Dr having a coefficient of degree dr or lower is randomly generated from the term sets ΓDr,dr. The specific generation method is as follows.
(a) rk(x,y)=0 (initial value 0 is substituted to rk)
(b) The following is executed for each (i,j)∈Γ∈Dr.
i. Uniformly and randomly generate a polynomial rij(t) with the degree dr from Fp[t].
ii. rk=rk+rij(t)xiyi (substitute the expression on the right side into rk)
3. Generation of random polynomial sk(x,y)
A bivariate random polynomial sk(x,y) with the degree Ds having a coefficient of degree ds or lower is randomly generated from the term sets ΓDs,ds. The specific generation method is as follows.
(a) sk(x,y)=0 (initial value 0 is substituted to sk)
(b) The following is executed for each (i,j)∈ΓDs.
i. Uniformly and randomly generate a polynomial sij(t) with the degree ds from Fp[t].
ii. sk=sk+sij(t)xiyi (substitute the expression on the right side into sk)
4. Generation of noise polynomial ek(x,y)
A noise polynomial ek(x,y) with coefficients of degree dc or lower is generated from the noise polynomial form ΓDe,de. The specific generation method is as follows.
(a) ek(x,y)=0 (initial value 0 is substituted to ek)
(b) The following is executed for each (i,j)∈ΓDe.
i. Uniformly and randomly generate a polynomial eij(t) with the degree de from Fp[t].
ii. ek=ek+eij(t)xiyi (substitute the expression on the right side into ek)
5. Generation of ciphertext ck(x,y)
A ciphertext c(x,y)=Epk(M,si,ri,ei,X) is calculated with the following Formula (44).
Next, first decryption processing of the embodiment will be described.
It is to be noted that substitution u:(x,y):=(ux(t),uy(t)) into the indeterminate equation X(x,y) results in X(ux(t),uy(t))=0.
The decryption algorithm is as follows.
1. Substitution of Solution
The following Formulation (47) is calculated with the solution u substituted into ck(x,y).
In the present example, c1(ux(t),uy(t)) is expressed by the following Formula (48), and c2(ux(t),uy(t)) is expressed by the following Formula (49).
c1(uk(t),u(t))=3t39+t38+3t37+2t36+5t35+3t34+2t33+5t32+t31+4t29+5t28+4t27+6t25+5t24+3t23+5t22+5t19+t18+3t17+2t16+5t15+3t14+t12+t11+6t10+6t9+6t8+5t7+3t6+5t4+4t3+3t2+5t (48)
c2(uk(t),u(t))=t40+2t39+t38+4t37+6t35+2t34+4t32+5t31+t30+5t29+3t28+6t25+2t24+3t23+6t22+5t21+2t20+2t18+6t17+3t16+t15+5t14+2t13+t12+3t11+3t10+2t9+3t8+6t7+3t6+3t5+5t3+3t (49)
2. Calculate product M(ux(t),uy(t)(=Πi=1Dmmi(ux(t),uy(t))) of plaintext polynomial by approximate GCD calculation
This holds when the condition of Formula (13) described above is satisfied, and the condition of Formula (13) is guaranteed based on a condition (62) described later. This expressed by the following Formula (50) in this example.
m(ux(t),u(t))=t30+6t29+3t28+5t27+3t26+2t25+3t24+5t23+2t22+4t21+2t20+3t19+6t18+6t17+2t16+6t14+t12+3t12+t11+5t10+t9+6t8+t7+3t6+t5+t4+5t3+6t2+5t+2 (50)
3. Factorization of M(ux(t),uy(t))
In the case of this example, decompression as in the following Formula (51) is implemented.
(t+2)(t+3)(t2+t+4)(t8+5t6+3t5+t4+6t3+4t2+t+1)(t8+3t7+6t6+6t5+4t4+t3+4t2+6t+5)(t10+4t9+4t7+2t6+5t4+5t3+5t2+t+2) (51)
4. The plaintext polynomials are restored from combinations of factors obtained in Step 3
In this example, (2t+1)x+(5t+5)y+2t+3 can be restored from the factors (t+2)(t+3)(t8+5t6+3t5+t4+6t3+4t2+t+1). Furthermore, (5t+1)x+(4t+4)y+5t+3 can be restored from the factors (t2+t+4)(t8+3t7+6t6+6t5+4t4+t3+4t2+6t+5). Furthermore, (2t+1)x+(3t+5)y+5t is restored from the factor (t10+4t9+4t7+2t6+5t4+5t3+5t2+t+2). Details of the method of determining the combinations of the factors and the restoration of the plaintext polynomial factor will be described later in “Narrowing down plaintext polynomial factor” and “Restoration of plaintext polynomial factor”,
Next, a method for restoring the plaintext polynomial factor mi(x,y) from combinations of factors obtained in Step 4 of the decryption algorithm will be described. Here, for the sake of description, an algorithm for restoring the factor m(x,y) of the plaintext polynomial from m(ux(t),uy(t)) without subscripts will be described.
First of all, when a correct factor m(ux(t),uy(t)) (that is, one corresponding to the correct plaintext polynomial m(x,y)) is obtained, the plaintext polynomial is given with the following Formula (52).
m(x,)=mx(t)x+my(t)
+m1(t) (52)
Here, since degmx(t), degmy(t), degml(t)≤dm holds, m(x,y)) can be further expressed as in the following Formula (53).
Then, a formula obtained by substitution with the private key (x,y)=(ux(t),uy(t)) is substituted with mx,j, my,j (j=0, . . . , dm) serving as variables is compared with m(ux(t),uy(t)) (the following Formula (54)).
As described above, Formula (54) has the variable on the right side only and has no variable on the left side, whereby simultaneous equations are obtained through coefficient comparison between the right and left sides. Moreover, since the variables on the right side are not multiplied by each other, simultaneous linear equations are obtained. The plaintext polynomial can be restored by solving them.
Note that the equation derived from the above Formula (54) has a variable 3(dm+1). The equation comprises a plaintext polynomial in a form of Formula (52) described above. Considering that the overall degree is d+dm, the number of terms including the constant term is d+dm+1, and thus the same number of equations are obtained.
Considering the fact that the number of equations needs to be equal to or larger than the number of variables, the condition of the following Formula (55) needs to be satisfied to obtain a single solution.
d≥2(dm+1) (55)
The example in the above “Decryption algorithm”, where d=9 and dm=1(d+dm=10), satisfies this condition. Here, a failure to obtain such a solution indicates that the target factor mj(ux(t),uy(t)) is incorrect, so that the factor is discarded.
Next, based on the example of the embodiment, a detailed description will be given on a method of extracting candidates of the factor m(ux(t),uy(t)) corresponding to the plaintext polynomial factor from factors obtained by factorizing M(ux(t),uy(t)) and narrowing down the candidates.
To begin with, the degree of m(ux(t),uy(t)) is d+dm, and d=9 and dm=1 hold in this example, so that 10th degree is derived. When this is compared with the factorization expressed by the above Formula (51), one factor expressed by the following Formula (56) is determined.
(t10+4t9+4t7+2t6+5t4+5t3+5t2+t+2) (56)
The other two factors are either a pair expressed by the following Formula (57) or a pair expressed by the following Formula (58).
(t+2)(t+3)(t8+5t6+3t5+t4+6t3+4t2+t+1),(t2+t+4)(t8+3t7+6t6+6t5+4t4+t3+4t2+6t+5) (57)
(t+2)(t+3)(t8+3t7+6t6+6t5+4t4+t3+4t2+6t+5),(t2+t+4)(t8+5t6+3t5+t4+6t3+4t2+t+1) (58)
In fact, when the plaintext is restored for the former, the following Formula (59) can be restored. On the other hand, the latter is rejected because no equation solution is derived from the above Formula (54).
(2t+1)x+(5t+5)+2t+3,5t+1)x+(4t+4)
+5t+3 (59)
In this example, a relatively simple combination is obtained because the degrees of the factors of m(ux(t),uy(t)) are each (1,1,2,8,8,10). When the degree of the factors is (1,1,2,2,2,2,4,6,10) for example, more complex combination is obtained. In such a case, an algorithm for solving a subset sum problem is used (but will not be described in detail herein). The subset sum problem is solved to obtain a partial sequence with which a certain number N is obtained by selecting from and adding up some elements in a sequence of natural numbers a1, a2, . . . , al with the length l. In this example, N is 10, and the solution of the problem is to obtain a partial sequence with the sum being 10 with no overlapping.
Here, there are factors corresponding to the respective numbers in the sequence (1,1,2,2,2,2,4,6,10), and thus to distinguish them, the elements are numbered to be [1,2,3,4,5,6,7,8,9]. For example, [1,2,3,4,5,6] corresponds to a sequence (1,1,2,2,2,2) a sum of which is 10. Furthermore, [7,8] and [9] also results in the sum of 10. A combination of these is one candidate. Furthermore, there is a combination of [1,2,3,4,7] paired with [5,6,8], [9] corresponding to this. The subset sum problem is generally an NP-hard problem. Still, it has been known that problems of such a small size can be solved in a relatively short period of time.
In the decryption (No. 1), to satisfy the condition (13) for enabling the approximate GCD calculation executed in Step 2, the conditions of the following Formulae (60) and (61) need to be satisfied.
The conditions of the above Formulae (60) and (61) are expressed by following Formula (62) using the system parameters described above.
Dm(d+dm)≥2(Dsd+ds)
Dsd+ds>Ded+de (62)
The above conditions (27) and (28) for guaranteeing security and the above condition (55) for plainext and random element restoration are added to the condition of the above Formula (62), resulting in the resultant parameter condition expressed by the following Formula (63).
Dm+Ds=DX+Dr
Dmdm+Dsds=DXdX+Drdr
Dm(d+dm)≥2(Dsd+ds)
Dsd+ds>Ded+de
d≥2(dm+1) (63)
Next, second decryption processing of the embodiment will be described. In the above-described decryption (No. 1), Πj=1Dmmy(ux(t),uy(t)) is obtained by approximate GCD calculation with two Formulae obtained by substituting the solution (ux(t),uy(t)), serving as the private key, into the ciphertext (c1,c2). Furthermore, by factorizing this, an individual factor my(ux(t),uy(t)) is obtained, and the corresponding factor mj(x,y) is restored. However, with this method, a condition of d≥(dm+1) must be satisfied for the restoration, meaning that and if d is fixed, dm is limited, and the degree of the coefficient of each mj(x,y) needs to be reduced.
In view of this, as the decryption (No. 2), a method not using mj(ux(t),uy(t)) for restoring mj(x,y) will be described. This method is free of limitation according to the condition (55) described above, whereby parameters such as d=3 and dm=1 can also be used for example. Also in such a case, the public key and the private key can be generated with a method that is the same as the one described above.
Hereinafter, the public key X(x,y) and the private key (ux(t),uy(t)) generated based on this parameter will be described as an example.
Example: When p=7, d=3, and Dx=2, X(x,y) is expressed by the following Formula (64).
(uy(t),ux(t))=(4t3+2t+6,2t3+4t2+6t+2)
X(x,)=(3t2+t+4)x2+(3t2+t+5)x
+(3t2+5t+6
2+(5t2+6t+3)x+(2t2+6t+6)
+5t2+4t+1 (64)
Further, based on this public key, the plaintext M=(2,2,2,3,3)(7) is dispersed to (6,5,6,1,3)(7)+(3,4,3,2,0)(7), and is embedded in the plaintext polynomial factors m1(x,y) and m2(x,y) as in the following Formula (65).
Here, the coefficient of the term tx needs to be fixed to 2 in order to remove ambiguity of a constant multiple of the plaintext polynomial factor, and thus the plaintext is not embedded. The ciphertext (c1,c2) for the plaintext polynomial factor can be generated as in the following Formula (67) with the random polynomial of the following Formula (66) used and a noise polynomial set to e1=t+1 and e2=3t+6.
A decryption algorithm of decryption (No. 2) is as follows.
The following Formulation (68) is calculated with the solution u substituted into ck(x,y).
In this example, this results in the following Formula (69).
c1(ux(t),u(t))=4t12+6t11+t10+5t9+6t8+6t7+6t6+3t5+t3+5t2+t+5 (69)
c2(ux(t),u(t))=2t12+2t11+4t10+5t7+2t6+t5+6t2+t+5 (69)
This holds when the condition of Formula (13) described above is satisfied, and the condition of Formula (13) is guaranteed based on a condition (62) described above. In this example, M(ux(t),uy(t)) is expressed by the following Formula (70).
M(ux(t),u(t))=t8+3t7+3t6+2t5+4t4+4t3+6t2+4t+6 (70)
From M(ux(t),uy(t)) calculated in Step 2, ek(ux(t),uy(t)) is calculated by the following Formula (71), and ek(x,y) is restored by the restoration method described in the above decryption (No. 1).
ek(ux(t),u(t))=ck(ux(t),u
(t))mod M(ux(t),u
(t)) (71)
In the case of this example, De(=degx,ye(x,y))=0 holds, and thus the following Formula (72) corresponds to each of e1(x,y) and e2(x,y).
e1(ux(t),u(t))=t+1
e2(ux(t),u(t))=3t+6 (72)
Even when De>0 holds, restoration can be implemented if the condition d≥2(de+1) is satisfied.
This is derived by calculating ck−ek. In this example, the following Formulae (73) and (74) are used for this.
c1−c1=Πj=1Dmmj·s1+Xr1=(5t2+5t+3)x3+(t3+4t2+5t+1)x2+(5t3+4t2+2t+6)x
2+(6t3+3t2+3t+2)
3+(2t3+3t2+3t+6)x2+(4t3+t2+t+6)x
+(6t3+4t2+5t+6)
2+(5t3+t2+6t)x+(3t3+5t2+4t+4)
+t3+5 (73)
c2−c2=Πj=1Dmmj·s2+Xr2=(4t2+t2+2t)x3+(3t3+6t2+t)x2+(2t2+6t+1)x
2+(5t2+6t+3)
3+(5t3+6t2+t+3)x2+(2t3+6t2+5t)x
+(2t3+4t2+4)
2+(2t2+4t+4)x+(4t3+3t2+t+2)
+t3+t1+3t+2 (74)
Details of the method for the ideal decomposition are as in the ideal decomposition described above. In this example, c1−ei is decomposed into the following Formula (75), and c2-e2 is decomposed into the following Formula (76).
(2t+6)x+(5t+6)+t+3,(2t+3)x+(4t+3)
+2t,(2t+3)x+(5t+2)
+3t+5 (75)
(2t+6)x+(5t+6)+t+3,(2t+3)x+(4t+3)
+2t,(2t+6)x+(4t+6)
+t+2 (76)
The common part of these are m1(x,y) and m2(x,y) as in the following Formula (77), and match those generated in the above Formula (65).
(2t+6)x+(5t+6)+t+3,(2t+3)x+(4t+3)
+2t (77)
Furthermore, s1(x,y) and s2(x,y) are respectively obtained by (2t+3)x+(5t+2)y+3t+5 and (2t+6)x+(4t+6)y+t+2 other than the common part, and are also consistent with the above-described Formula (66). With the ideal decomposition, there may be a plurality of decomposition candidates.
Still, almost all these candidates other than a plaintext polynomial can be discarded in Step 6.
rk is restored with rk=(ck−ek−Πj=1Dmmj·sk)/X.
When mj, sk, rk, and ek are all restored, M(x,y) is restored from the plaintext polynomial factor mj(x,y) using the above-described Formula (21), and the plaintext M is restored from the coefficients thereof. When mj, sk, rk, and ek are all restored, the plaintext M is restored from the plaintext polynomial factor.
The decryption (No. 2) also requires satisfaction of the condition (62) for enabling the approximate GCD calculation executed in Step 2, but the condition (55) for restoring the polynomial changes to a condition d≥2(de+1) for noise polynomial restoration. When this and a condition for guaranteeing security are combined, the following Formula (78) is obtained as a condition for achieving both decryption and security.
Dm+Ds=DX+Dr
Dmdm+Dsds=DXdX+Drdr
Dm(d+dm)≥2(Dsd+ds)
Dsd+ds>Ded+de
d≥2(de+1)
When De=0, the condition d≥2(de+1) is eliminated, and the following Formula (79) is obtained.
Dm+Ds=DX+Dr
Dmdm+Dsds=DXdX+Drdr
Dm(d+dm)≥2(Dsd+ds)
Dsd+ds>de
Decryption (No. 1) and decryption (No. 2) both use approximate GCD calculation. The condition (62) for enabling the calculation is reflected in each of the parameter conditions (63) and (78).
Unfortunately, in actual decryption, degΠj=1Dmmj(ux(t),uy(t)) or degsi(ux(t),uy(t)) might be reduced (due to the coefficient of the highest degree being 0 during the calculation), and as a result, any one of two inequalities (60) and (61), on which the condition (62) is based, might fail to be established, and thus the approximate GCD calculation might fail. In view of this, the probability of the approximate GCD calculation failing needs to be set to a certain value or less, and the degree of the GCD input to the approximate GCD calculation needs to start from degΠj=1Dmmj(ux(t),uy(t)). On the other hand, when gcd(s1(ux(t),uy(t)),s2(ux(t),uy(t)))≠1, since s1(ux(t),uy(t)) and s2(ux(t),uy(t)) are not coprime, a common factor v(t) exists, and GCD is v(t)Πj=1Dmmj(ux(t),uy(t)). Therefore, it is necessary to set the degree of GCD to a point slightly higher than degΠj=1Dmmj(ux(t),uy(t)).
Next, on the assumption that the distributions of the coefficients of each of degΠj=1Dmmj(ux(t),uy(t)) and degsi(ux(t),uy(t)) are independent uniform distribution, the probability that the conditions (60) and (61) fail to be satisfied is obtained.
The following Formula (80) indicates a probability Probmfail that the inequality (60) does not hold. The following Formula (81) indicates a probability Probmfail that the inequality (61) does not hold. The larger one of probabilities indicated by the following Formulae (80) and (81) is the decryption failure probability.
Probmfail=p2(D
Probsfail=p(D
In the following, some variations (modified examples) of the present embodiment will be described.
While the ciphertext of the present embodiment is defined by Formula (44), the encryption method and the decryption method of the embodiment, as well as the security verification described later can be similarly implemented, with the ciphertext defined with the following Formula (82).
In the above-described embodiment, coefficients of the indeterminate equation X(x,y), serving as a public key, are uniformly and randomly obtained except for constant term, and only some of the terms (in the above embodiment, term x′(i=0, . . . , Dx)) are adjusted. Although the information of the private key is required for the adjustment, the term that is not adjusted remains to be random. Therefore, if the seed used for the generation is disclosed, the terms can be generated with a specific pseudo random number generation function, a hash function, or the like designated. Therefore, only coefficients of the seed and the adjusted part need to be disclosed, and the size of the public key is compressed. In this manner, in the above embodiment, only part of the following Formula (83) is disclosed as the actual coefficient, and the other terms can be compressed to approximately ½ with degree 2, to approximately ⅖ with degree 3, and to approximately ⅓ with degree 4, by disclosing the seed (which usually has the bit length of the security parameter only).
X(x,)=(t8+2t7+t6+t5+2t4+5t3+6t2+2t+5)x2+(2t8+3t7+6t6+4t5+2t4+5t3+4t2+6t+1)x+2t8+4t7+5t6+2t5+5t4+2t3+5t2+2t+2 (83)
This variation enables expansion of application to cover to low-end devices with a small memory capacity.
In the present embodiment, coefficients of the indeterminate equation X(x,y) serving as a public key are uniformly and randomly obtained except for constant term, and only part of the terms (in the above embodiment, term x′(i=0, . . . , Dx)) is adjusted. Here, each coefficient is an element of Fp[t], and not all the coefficients are necessarily non-zero coefficient. If there is a non-zero coefficient, there is a possibility that the coefficients of some terms are always zero in X(x,y)rk(x,y) of the ciphertext. In that case, there part of the information of the random polynomial constituting the ciphertext might leak (while not all the information may leak), and part of the information of the plaintext might leak therefrom, due to a linear algebra attack or a coefficient comparison attack. In view of this, in this variation, a method of making the coefficient of the coefficient τij(t) of each term of the public key X(x,y) non-zero will be described.
In order to realize this, first of all, a range for uniformly and randomly obtaining the coefficient τij(t) is set as a range from 1 to p. As for the coefficients to be further adjusted, when some of the coefficients become zero as a result of the adjustment, the coefficients can be non-zero with the private key ux(t),uy(t) reset, or the seed used for uniform random selection changed and reset.
In the above-described embodiment, the term set is limited to the maximum term set for the sake of simplicity. This sufficiently works for effectively hiding the plaintext using the polynomial having the unknown coefficient, but may not be because it requires a condition that the plaintext term Πj=1Dmmj(x,y)sk(x,y) in the ciphertext ck(x,y) and the public key term X(x,y)r(x,y) to be of the same type of formula, and thus might not quite be an essential feature. Thus, to specify the type of these formulae, Δξ can be designated instead of the parameters Dξ and dξ (where, s, r, e, and X are included in ξ). With this setting, a term set smaller than the maximum term set can be obtained, whereby the public key, the ciphertext, and the like can be downsized.
In the decryption (No. 1), sk, rk, and ek are not obtained as in the decryption (No. 2). Still, sk and ek can be restored using the method that is the same as that for obtaining the plaintext polynomial factor mj. Furthermore, the method for the decryption (No. 2) can be used for rk. However, in this case, a condition of the following Formula (84) is required in addition to the condition (63) for restoring the former.
d≥2(de+1)
d≥2(de+1)
With this configuration, when there are plurality of decryption candidates, those candidates can be narrowed down as to whether or not the corresponding sk, rk, and ek are restorable. Thus, the decryption can be prevented from failing because there are plurality of candidates.
When the variation of restoring sk,rk,ek described above is used, the plaintext information or part of the plaintext information can be embedded in these. As a result, a cryptographic method can be obtained that not only features a long bit length that can be encrypted at once, but also featuring resistance against an attack of falsifying the ciphertext, due to information serving as an authenticator added. Note that, in a case where the plaintext is embedded, including a case where it is embedded in a plaintext polynomial, an embedded area can be determined in advance. In this case, by embedding a random value or information decryption of which would no impose a huge impact in a non-plaintext embedded portion, consistency of the ciphertext can be maintained. Furthermore, the variation can be achieved with no plaintext embedded in a part where information leakage might occur, under a situation where the information partially leaks due to vulnerability caused by implementation of side channel attack, or the like.
In the present embodiment, since the plaintext term has the product structure, the order of the plaintext embedded by encryption is unrecognizable from the decryption result. The reason for dispersing the plaintext in the present embodiment is to improve security and to obtain a correct decryption result regardless of the order in which the plaintext is defined. Considering this, information indicating the order may be added to part of the plaintext polynomial factor. For example, when such information is added to the constant term of the plaintext polynomial factor shown in the above-described Formula (65), the following Formula (85) is obtained.
In the above (85), the constant terms are 0 and 1 respectively indicating orders in which the plaintext is formed. In this example, 65613432(7) is obtained based on the fact that the term of tx is fixed to 2 in order to address ambiguity of a constant multiple and the order of the plaintext of this example, resulting in a large size of plaintext that can be encrypted.
Note that numerical values indicating the order can be randomly arranged in a specific order and do not need to be provided as 0, 1, 2, . . . , as long as the numerical values fall within the range of 0 to p−1. For example, in the case of p=7, the values may be 3 and 5. With such a configuration, a certain coefficient can be prevented from being fixed, encryption with high security can be provided without disclosing information effective for encryption analysis.
In the present embodiment, the plaintext is dispersed and embedded in the plaintext polynomial factors. Alternatively, when decryption (No. 2) is performed, a similar configuration can be achieved with the following Formula (86) with the plaintext polynomial being n(x,y) instead of being based on the plaintext polynomial factor.
ck(x,)=m(x,
)sk(x,
)±X(x,
)rk(x,
)±ek(x,
) (k=1,2) (86)
Here, since the approximate GCD calculation for c1(ux(t),uy(t)) and c2(ux(t),uy(t)) is performed, the condition (60) is required, meaning that the degree of m(x,y) is substantially 2 or more. This is difficult to decrypt with decryption (No. 1), but can be decomposed with ideal decomposition used in decryption (No. 2). With this configuration, since the number of factors involved in ideal decomposition for decryption is small, the processing speed can be increased.
As described in “Notes on decryption” above, the degree dG of the approximate GCD to be an input in the approximate GCD calculation is dG=Dm(d+dm) in most cases. Still, there are cases where the degree dG is smaller or larger than that. In the present variation, an embodiment taking this into consideration will be described. In order to implement this, in both the decryption (No. 1) and the decryption (No. 2), in the step of the approximate GCD calculation, the degree dG is set from a value smaller than Dm(d+dm) for the execution. Then, dG is gradually increased unless the plaintext is not restored. In the end, the dG is set to be a value exceeding Dm(d+dm) for the execution. In this way, it is possible to decrypt the ciphertext that has failed to be decrypted through execution with dG=Dm(d+dm).
Throughout the embodiment, the explanation has been given on the bivariate polynomial on Fp[t]. The encryption algorithm, the decryption algorithm, and the key generation algorithm as in the present embodiment can also be obtained with other general n variables. Even when the variables increase to be more than three, an indeterminate equation that solution problem for which is difficult to calculate is obtained as long as there is one indeterminate equation X(x1, . . . , xn). Generally, an increase in variables leads to a problem harder to solve, resulting in higher security. Thus, the increase enables the key size to be reduced, and also enables plaintext with a larger size to be embedded due to the large number of variables. Still, since there will be more coefficients to be restored, the system parameter needs to be changed to ds=n(dm+1).
In the present embodiment, the description has been simplified with the limitation De=0. When restoring e(x,y) with De>0 by decryption (No. 2), linear simultaneous equations are established based on the above-described Formula (54) from e(ux(t),uy(t)), and an algorithm for solving this is applied. In order to derive a unique solution in this case, the number of equations needs to be equal to or more than the number of variables. The number of equations matches the degree of the univariate polynomial e(ux(t),uy(t)). On the other hand, when De=3, the number of high-degree terms (terms with higher degree) of e(x,y) is x3, x2y, xy2, y3, or the like, and thus is larger than the number of a lower degree terms. Therefore, by lowering the degree of the coefficient of the high-degree term and increasing the degree of the coefficient of the low-degree term in e(x,y), the number of equations can be increased while suppressing the number of variables. Furthermore, with such a configuration, there is also an advantage that it is easier to satisfy the decryption condition (61) than in a case where De is evenly fixed.
In the present embodiment, the plaintext polynomial has a product structure, but the noise polynomial does not have a product structure. This is due to, for example, De=0. When De>0, it is necessary to establish linear simultaneous equations from e(ux(t),uy(t)) and solve the same in order to restore e(x,y) as described in “Variation in changing degree of coefficient eij(t) of noise polynomial for each term” described above. Here, when the product structure is introduced, the noise polynomial is a product of a plurality of noise polynomial factors, and the ciphertext is expressed by the following Formula (87).
In the above equation (87), the noise polynomial factor ekj(x,y) is assumed to be a linear equation. For decryption, when a noise polynomial is restored with decryption (No. 2), e(ux(t),uy(t)) may be factorized and simultaneous equations may be provided for each factor as described in “Restoration of plaintext polynomial factor” described above. As a result, a noise polynomial having a univariate polynomial with a higher degree coefficient can be configured, leading to improvement of security.
In the present embodiment, the plaintext is dispersed and embedded in the plaintext polynomial factor, but the roles of the plaintext polynomial and the noise polynomial can be changed based on the above-described “Variation of introducing product structure into coefficient e(x,y) of noise polynomial”. Specifically, the ciphertext is expressed by the following Formula (88).
In this way, the plaintext M can be divided into M1 and M2, and can be embedded respectively in m1(x,y)=Πj=1Dmmk,1(x,y) and m2(x,y)=Πj=1Dmmk,2(x,y).
Part of or all the variations described above may be used in combination and applied to the embodiment. For example, “Variation of introducing product structure into coefficient e(x,y) of noise polynomial” and “Variations of changing roles of the noise polynomial and the plaintext polynomial” may be combined. That is, the roles of the noise polynomial and the plaintext polynomial may be swapped, and the product structure may be introduced into the noise polynomial.
Next, specific configurations and operating methods of an encryption device, a decryption device, and a key generation device using public-key cryptography according to the present embodiment will be described.
First, the configuration and the flow of processing of the encryption device of the present embodiment will be described along the flowchart illustrated in
An encryption device 10 of the embodiment includes a plaintext acquisition unit 1, a public-key acquisition unit 2, a plaintext embedding unit 3, a memory unit 4, an encryption unit 5, a polynomial generation unit 6, a random value generation unit 7, a polynomial operation unit 8, and a ciphertext output unit 9.
To begin with, the plaintext acquisition unit 1 acquires a plaintext m (Step S1). The plaintext acquisition unit 1 acquires, as the plaintext m, encryption target data acquired from another application or another device, for example. The plaintext acquisition unit 1 inputs the plaintext m into the plaintext embedding unit 3.
Next, the plaintext embedding unit 3 acquires system parameters p, Dm, and dm from the memory unit 4 (Step S2).
Next, the public-key acquisition unit 2 acquires a bivariate indeterminate equation X(x,y) as a public key (Step S3). The public-key acquisition unit 2 acquires the public key from another device such as a key generation device described later for example.
Subsequently, the plaintext embedding unit 3 divides the plaintext m given by the plaintext acquisition unit 1 into 3(dm+1) sub-blocks of |p| bits (|p| is the bit length of p). Then, the plaintext embedding unit 3 subdivides each sub-block into Dm plaintext fragments (Step S4).
It should be noted that any division method may be used as long as it allows restoration when Dm plaintext fragments are complete, and examples thereof include a method using the above described sum.
The plaintext embedding unit 3 sequentially embeds the plaintext fragments in Dm plaintext polynomial factors (Step S5). In the present embodiment, the plaintext polynomial factors are a linear expression, so that mj(x,y)=mj,x(t)x+mj,y(t)y+mj,1(t) (j=1, . . . , Dm), where the degree of each coefficient mj,x(t), mj,y(t), and mj,1(t) is dm, and the coefficients of these polynomials are elements of Fp. The plaintext embedding unit 3 embeds the plaintext fragments in each of the plaintext polynomial factors of the linear expression to generate plaintext polynomial factors m1(x,y), . . . , mtDm(x,y).
As described above, the block size of the cryptographic method of the present embodiment is 3(|p|)(dm+1). If a plaintext larger than this size is input, it is divided into this block size and then each block is encrypted.
The plaintext embedding unit 3 inputs the generated Dm plaintext polynomial factors to the encryption unit 5.
Upon receiving the public key from the public-key acquisition unit 2, the encryption unit 5 acquires, from the memory unit 4, system parameters p, Ds, Dl, de, dx, dr, and de that match the public key.
In addition, the encryption unit 5 inputs the system parameters p, Ds, and ds to the polynomial generation unit 6 and instructs the polynomial generation unit 6 to generate a two random polynomials having, as coefficients, a polynomial s1(x,y) and s2(x,y) of the degree ds according to the maximum term set (hereinafter, simply referred to as a term set) Γs generated from these. The polynomial generation unit 6 instructs the random value generation unit 7 to generate integers from 0 to p−1 which is a coefficient of the coefficient sij(t) by a required number (2d,#Γ, in this case), and generates s1(x,y) and s2(x,y) based on these integers (Step S6). Note that #Γs represents the number of elements of the set Γs.
Next, the encryption unit 5 continues to generate the random polynomials r1(x,y) and r2(x,y) by the same method as the method of generating the random polynomials s1(x,y) and s2(x,y) by inputting the system parameters p, Dl, and dr to the polynomial generation unit 6 (Step S7).
Next, the encryption unit 5 continues to generate the random polynomials e1(x,y) and e2(x,y) by the same method as the method of generating the random polynomials s1(x,y) and s2(x,y) by inputting the system parameters p, De, and de to the polynomial generation unit 6 (Step S8).
Finally, the encryption unit 5 generates, by using the following Formula (89), a ciphertext ck(x,y) (k=1, 2) from the random polynomial sk(x,y), rk(x,y), and ek(x,y) (k=1, 2) the public key X(x,y), and the Dm plaintext polynomial factors m1(x,y), . . . , mDm(x,y) (Step S9). Here, the polynomial operation unit 8 executes multiplication of the Dm plaintext polynomial factors mi(x,y), . . . , MDm(x,y). The encryption unit 5 inputs the ciphertext ck(x,y) (k=1, 2) to the ciphertext output unit 9.
The ciphertext output unit 9 outputs the ciphertext ck(x,y) (k=1, 2) as an output of the encryption device 10 (if necessary, after transforming it according to a predetermined format)(Step S10).
Next, the configuration and the flow of processing of the decryption device of the present embodiment for executing decryption (No. 1) will be described along the flowchart illustrated in
The decryption device 20 of the embodiment includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero-point substitution unit 24, an approximate GCD calculation unit 25, a factorization unit 26, a memory unit 27, a combination calculation unit 28, a plaintext polynomial factor restoration unit 29, and a plaintext output unit 30.
To begin with, the ciphertext acquisition unit 21 acquires the ciphertext ck(x,y) (k=1, 2) (Step S21). The ciphertext acquisition unit 21 acquires the ciphertext ck(x,y) from another device over a network, for example.
Next, the key acquisition unit 22 acquires the public key (X(x,y) and a private key (zero point u: (ux(t), uy(t))) (Step S22). The key acquisition unit 22 acquires a public key (X(x,y)) from another device or the like over a network, and acquires the private key (zero point u: (ux(t),uy(t))) from the memory unit 27 in the decryption device.
Next, the decryption unit 23 receives the ciphertext ck(x,y) (k=1, 2) from the ciphertext acquisition unit 21 and receives the public key (X(x,y)) and the private key (zero point u: (ux(t), uy(t))) from the key acquisition unit 22. Then decryption processing is started.
First of all, the decryption unit 23 inputs the ciphertext ck(x,y) (k=1, 2) and the zero point u to the zero-point substitution unit 24. The zero-point substitution unit 24 substitutes the zero point u into ck(x,y) and calculates hk(t) (k=1, 2) (Step S23). The zero-point substitution unit 24 inputs hk(t) to the decryption unit 23.
Next, upon receiving hk(t) from the zero-point substitution unit 24, the decryption unit 23 inputs hk(t) (k=1, 2) and the degree dM of Πj=1Dmmj(ux(t),uy(t)) to the approximate GCD calculation unit 25. Upon receiving hk(t) (k=1, 2) and the degree dM of Πj=1Dmmj(ux(t),uy(t)) from the decryption unit 23, the approximate GCD calculation unit 25 calculates the approximate GCD with the degree dM of hk(t) (k=1, 2), and inputs the approximate GCD (M(ux(t),uy(t))) to the decryption unit 23 (Step S24). Here, dM is assumed to be Dm(d+dm).
Next, upon receiving the approximate GCD (M(ux(t),uy(t))) from the approximate GCD calculation unit 25, the decryption unit 23 inputs the approximation GCD to the factorization unit 26. Upon receiving the approximate GCD (M(ux(t),uy(t))) from the decryption unit 23, the factorization unit 26 executes the factorization of the approximate GCD (Step S25), and inputs the result of the factorization to the decryption unit 23 as an ordered factor array of factors.
Next, the decryption unit 23 extracts system parameters d and dm from the memory unit 27, extracts the degree of each factor from the factor array input from the factorization unit 26, and generates a corresponding degree array. Furthermore, the decryption unit 23 inputs the degree array and N(=dm+d) corresponding to the degree of the plaintext polynomial factors to the combination calculation unit 28. The combination calculation unit 28 extracts all combinations of factors (factor series), each of whose degree is exactly N (Step S26), and inputs a list of the factor series to the decryption unit 23.
Upon receiving the list of the factor series from the combination calculation unit 28, the decryption unit 23 extracts the factor series from the list and inputs it to the plaintext polynomial factor restoration unit 29, together with the zero point u and the system parameters d and dm. The plaintext polynomial factor restoration unit 29 restores plaintext polynomial factors m1(x,y), . . . , mDm(x,y) from the factor series input from the decryption unit 23, the zero point u, and the system parameter dm by the above method (Step S27), and inputs the plaintext polynomial factors to the decryption unit 23.
Next, the plaintext polynomial factor restoration unit 29 determines whether or not all the plaintext polynomial factors have been restored (Step S28).
In response to determining that all the plaintext polynomial factors have been successfully restored (Step S28, OK), and upon receiving the plaintext polynomial factors m1(x,y), . . . , mDm(x,y) from the plaintext polynomial factor restoration unit 29, the decryption unit 23 extracts the plaintext divided from the coefficients of the plaintext polynomial factors and restores the plaintext m (Step S29). Next, the plaintext output unit outputs the plaintext m as the decryption result (Step S32), and the decryption processing ends.
On the other hand, in response to determining that all the plaintext polynomial factors have not been successfully restored (Step S28, NG), the decryption unit 23 determines whether or not there is a next plaintext polynomial factor candidate (Step S30).
In response to determining that there is a next plaintext polynomial factor candidate (Step S30, Yes), the decryption unit 23 extracts the next plaintext polynomial factor candidate (Step S31), and returns to the process in Step S27. Specifically, when all the plaintext polynomial factors have not been successfully restored, the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23. Upon receiving the error signal from the plaintext polynomial factor restoration unit 29, the decryption unit 23 refers to the list of factor series and transmits a next candidate factor series together with the zero point u and the system parameters d and dm to the plaintext polynomial factor restoration unit 29.
When there is no next plaintext polynomial factor candidate (Step S30, No), the decryption unit 23 notifies the plaintext output unit 30 of the decryption error, and the plaintext output unit 30 outputs an error signal indicating a decryption failure and empty decryption result (Step S33), and the decryption processing ends.
Examples of a cause of the decryption failure include situations where the ciphertext has been broken or illegally altered on the communication path. Of course, there may be an unavoidable case as described in the above “Decryption failure probability”. Still, with the decryption failure probability sufficiently reduced (to 2−64 or less for example), the probability of occurrence of such a case may be reduced to a negligible level.
Next, the configuration and the flow of processing of the decryption device of the present embodiment for executing decryption(No. 2) will be described along the flowchart illustrated in
The decryption device 20-2 of the embodiment includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero-point substitution unit 24, an approximate GCD calculation unit 25, a memory unit 27, a plaintext output unit 30, a remainder calculation unit 31, a noise polynomial restoration unit 32, a polynomial subtraction unit 33, and an ideal decomposition unit 34.
The processing in Steps S41 to S44 is the same as that in Steps S21 to S24 (see
Upon receiving the approximate GCD a(t) from the approximate GCD calculation unit 25, the decryption unit 23 calculates hk(t) mod a(t) using the remainder calculation unit 31 to obtain ek(ux(t), uy(t)) (Step S45). The decryption unit 23 inputs ek(ux(t),uy(t)) together with the zero point u and the system parameters d and d, to the noise polynomial restoration unit 32.
Next, the noise polynomial restoration unit 32 restores the noise polynomials e1(x,y) and e2(x,y) from the factor series, the zero point u, and the system parameter de through the above-described method (Step S46), and inputs e1(x,y) and e2(x,y) to the decryption unit 23.
Next, the decryption unit 23 calculates ck(x,y)−ek(x,y) from ek(x,y) by using the polynomial subtraction unit 33, and inputs ck(x,y)−ek(x,y) to the ideal decomposition unit 34. The ideal decomposition unit 34 performs ideal decomposition on each ck(x,y)−ek(x,y) to obtain m1(x,y), . . . , mDm(x,y), s1(x,y) and m1(x,y), . . . , mDm(x,y), s2(x,y) (Step S47) and inputs these factors and polynomials to the decryption unit 23.
From the factors and polynomials, the decryption unit 23 identifies plaintext polynomial factors m1(x,y), . . . , mDm(x,y) as common parts, and identifies a set of random polynomials s1(x,y) and s2(x,y) as other parts. Note that, in a case where a plurality of candidates are obtained, the ideal decomposition unit 34 outputs a factor series including a set of plaintext polynomial factors and a set of random polynomials as a single set.
When the factor series having a set of the plaintext polynomial factors and a set of the random polynomials as a single set is calculated, the decryption unit 23 calculates the following Formula (90) using ek(x,y) (k=1, 2) calculated by the processing of Step S46, and restores rk(x,y) (k=1, 2) by dividing the following Formula (90) by X(x,y) (Step 48).
Next, the decryption unit 23 determines whether or not all rk(x,y) (k=1, 2) have been restored (Step S49). Specifically, in a case where the remainder obtained as a result of the division by X(x,y) is not 0, it means that rk(x,y) (k=1, 2) have failed to be successfully restored.
In response to determining that all rk(x,y) (k=1, 2) have not been successfully restored (Step S49, NG), the decryption unit 23 determines whether or not there is a next candidate factor series (set of plaintext polynomial factors m1(x,y), . . . , mDm(x,y) and set of random polynomials sk(x,y) (k=1, 2))(Step S50).
In response to determining that there is the next candidate factor series (Step S50, Yes), the decryption unit 23 extracts the next candidate factor series (Step S51), and the processing returns to Step S47.
In response to determining that there is no next candidate factor series (Step S50, No), the decryption unit 23 notifies the plaintext output unit 30 of the decryption error, and the plaintext output unit 30 outputs an error signal indicating a decryption failure and empty decryption result (Step S53), and the decryption processing ends.
In response to determining that rk(x,y) (k=1, 2) have been all successfully restored (Step S49, OK), the decryption unit 23 restores the plaintext m, and the plaintext output unit 30 outputs the plaintext m as a decoding result (Step S52), and terminates the decryption processing.
Next, the configuration and the flow of processing of the key generation device of the present embodiment will be described along the flowchart illustrated in
A key generation device 40 of the embodiment includes a system parameter acquisition unit 41, a control unit 42, a polynomial generation unit 43, a random value generation unit 44, an indeterminate equation generation unit 45, a polynomial operation unit 46, and a key output unit 47.
To begin with, the system parameter acquisition unit 41 acquires the system parameters p, d, Dx, and dx (Step S61). The system parameters p, d, Dx, and dx are acquired by, for example, receiving an input from the user. Alternatively, for example, the system parameters p, d, Dx, and dx are acquired by reading setting data, or the like including the system parameters p, d, Dx, and dx.
The system parameter acquisition unit 41 inputs the system parameters to the control unit 42. The control unit 42 performs the following processing in cooperation with other processing units based on the system parameters input from the system parameter acquisition unit 41.
First, the control unit 42 inputs, to the polynomial generation unit 43, p and d among the system parameters input from the system parameter acquisition unit 41, and instructs the generation of two polynomials ux(t), uy(t) included in Fp[t]. Next, the polynomial generation unit 43 instructs the random value generation unit 44 to generate 2(d+1) integers from 0 to p−1. The random value generation unit 44 generates 2(d+1) random numbers from 0 to p−1 using a pseudo random number generator or the like, and inputs the random numbers to the polynomial generation unit 43. The polynomial generation unit 43 generates polynomials ux(t) and uy(t) having 2(d+1) random numbers input from the random value generation unit 44 as coefficients (Step S62), and inputs the polynomials ux(t) and uy(t) to the control unit 42.
The control unit 42 holds (stores), as a private key, the polynomials ux(t) and uy(t) received from the polynomial generation unit 43.
The control unit 42 also generates a public key (indeterminate equation X(x,y) represented by the following Formula (91)).
X(x,)=Σ(i,j)∈Γ
ij(t)xi
i (91)
The control unit 42 extracts a coefficient τij(t) other than the constant term of X(x,y) from Fp|t| in order to generate the public key. Specifically, the control unit 42 inputs the parameters p and d to the polynomial generation unit 43, as in the case of generating the above-described polynomials ux(t) and uy(t), and instructs the generation of #Γx−1 polynomials τij(t) included in Fp[t]. The polynomial generation unit 43 generates a polynomial τij(t) using the random value generation unit 44 and generates #Γx−1 polynomials τij(t). The polynomial generation unit 43 inputs #Γx−1 polynomials τij(t) to the control unit 42.
The control unit 42 inputs the polynomials τij(t) generated by the polynomial generation unit 43, the system parameters p, d, Γx, dx, and the private key ux(t), uy(t) to the indeterminate equation generation unit 45.
The indeterminate equation generation unit 45 generates, by using the polynomial operation unit 46, an indeterminate equation X′(x,y) having no constant term (Step S63). The indeterminate equation generation unit 45 calculates a constant term τ00(t)=−X′(ux(t),ux(t)) by substituting the private key (polynomials ux(t) and uy(t)) into the variables x and y of X′(x,y) (Step S64).
Next, the indeterminate equation generation unit 45 performs processing of reducing the degree of the constant term τ00(t) (Step S65).
An example of this processing of reducing the degree will be described in detail with reference to
The basic principle is to use the private key (zero point) for replacement with an indeterminate equation with a smaller degree of a constant term having the same zero point, and the theoretical background is as described above.
For simplicity, it is assumed in the following description that X(x,y) includes all terms of x′ (i=1, . . . , degX). To begin with, the indeterminate equation generation unit 45 sets i=degX(x,y) (Step S71), calculates τ00(t) mod ux(t)i, replaces τ00(t), and calculates τi0′(t)=τ00(t)/ux(t)i (Step S72), and replaces X′(x,y) with X′(x,y)+τi0′(t)xi (Step S73). This processing is continued while decrementing i by 1 (Step S74) until i becomes 1 (Step S75).
Now, returning to
Next, the indeterminate equation generation unit 45 generates an indeterminate equation by X(x,y)=X′(x,y)+τ00(t)(Step S66).
It is shown that the generated X(x,y) has the same zero point (ux(t), uy(t)) as the original indeterminate equation X′(x,y)+τ00(t). To this end, it is necessary to show that the indeterminate equation obtained in each step has the zero point (ux(t), uy(t)). The indeterminate equation obtained in each step is X′(x,y)+τi0′(t)xi+(τ00(t) mod ux(t)i). Substituting the zero point (ux(t), uy(t)) into this equation gives the following Formula (92), which shows that the zero point is obtained.
X′(ux(t),u(t))+τi0′(t)ux(t)i+
00(t)=X(ux(t),u
(t))+τ00(t)=0 (92)
The indeterminate equation X(x,y) thus generated is output from the indeterminate equation generation unit 45 to the control unit 42. Upon confirming the series of processes described above is completed, the control unit 42 inputs the generated public key (X(x,y), f(t)) and private key (ux(t), uy(t)) to the key output unit 47. The key output unit 47 outputs the public key (X(x,y)) and the private key (ux(t), uy(t)) input from the control unit 42 to the outside of the key generation device 40 (Step S67).
Next, a specific configuration related to the above-described variations (modifications) will be described.
The variation of the ciphertext can be realized by calculating the variation by the above Formula (82) in the step of creating the ciphertext in the encryption unit 5 of the encryption device 10 and performing an obvious modification in consideration of this in the decryption device 20.
The variation related to the public key compression can be realized by adding a random number seed to an input to the random value generation unit 44 in the key generation device 40, or adding a random number seed used for generation in the random value generation unit 44 to an output from the random value generation unit 44, and finally outputting, instead of the public key X(x,y), the adjusted coefficient and the random number seed from the key output unit 47. Note that, upon receiving the public key, the encryption device 10 and the decryption device 20 can restore the original public key X(x,y) by restoring a coefficient that is not adjusted using the random number seed and adding an adjusted coefficient included in the public key.
In the variation related to the public key coefficient, the range of random numbers is set to 1 to p−1 for the random value generation unit 44 of the key generation device 40 to generate the coefficient of the coefficient τij(t) of the public key X(x,y). In the step (step of reducing the degree of the constant term τ00(t) of the indeterminate equation using the zero point (ux(t), uy(t)) of adjusting the coefficient, when the adjusted coefficient τi0(t) (i=0, . . . , DX) includes a non-zero coefficient, the adjustment is realized by redoing the processing from the stage of randomly generating the coefficient other than the constant term of the indeterminate equation X(x,y).
The variation for obtaining the term set is realized by changing the system parameters Dξ and dξ to the designated term set Γξ and generating a public key, a random polynomial, and a noise polynomial based on Γξ in each of the key generation device 40 and the encryption device 10. Here, ξ is X, s, r, or e.
The variation for obtaining sk, rk, and ek in the decryption (No. 1) is realized as in a flowchart illustrated in
Specifically, the plaintext polynomial factor restoration unit 29 restores plaintext polynomial factors m1(x,y), . . . , mDm(x,y) from the factor series input from the decryption unit 23, the zero point u, and the system parameter dm by the above method (Step S81).
Next, the plaintext polynomial factor restoration unit 29 determines whether or not all the plaintext polynomial factors have been restored (Step S82).
In response to determining that there is a plaintext polynomial factor that cannot be restored (Step S82, No), the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23. In this case, the decryption unit 23 determines whether or not there is a next candidate factor series (Step S83). In response to determining that there is no next candidate factor series (Step S83, No), the decryption unit 23 notifies the plaintext output unit 30 of the decryption error. The plaintext output unit 30 outputs a decryption error and empty decryption result (Step S85), and the decryption processing ends.
In response to determining that there is the next candidate factor series (Step S83, Yes), the decryption unit 23 extracts the next candidate factor series with reference to the list of factor series (Step S84). Then, the decryption unit 23 inputs the next candidate factor series together with the zero point u and the system parameters d and dm to the plaintext polynomial factor restoration unit 29, and the processing returns to Step S81.
On the other hand, in response to determining that there is no plaintext polynomial factor that cannot be restored (Step S82, Yes), the plaintext polynomial factor restoration unit 29 inputs the restored plaintext polynomial factor to the decryption unit 23. The decryption unit 23 calculates sk(ux(t), uy(t)) from hk(t)/M(ux(t), uy(t)) (k=1, 2) and inputs a result of the calculation together with the zero point u and the system parameters d and ds to the plaintext polynomial factor restoration unit 29. The plaintext polynomial factor restoration unit 29 restores sk(x,y) (Step S86), and inputs sk(x,y) to the decryption unit 23. If the restoration in step S86 fails (Step S87, No), the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23, and the processing proceeds to Step S83 described above.
When the random polynomial sk(x,y) is successfully restored (Step S87, Yes), the decryption unit 23 calculates ek(ux(t), uy(t)) from hk(t) mod M(ux(t),uy(t)) (k=1, 2) and inputs this together with the zero point u and the system parameters d and de to the plaintext polynomial factor restoration unit 29. The plaintext polynomial factor restoration unit 29 restores ek(x,y) (Step S88), and inputs ek(x,y) to the decryption unit 23. If the restoration in step S88 fails (Step S89, No), the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23, and the processing proceeds to Step S83 described above.
When the noise polynomial ek(x,y) is successfully restored (Step S89, Yes), the decryption unit 23 restores rk(x,y) from the following Formula (93) (Step S90), and confirms the restoration of rk(x,y) based on the fact that the remainder (remainder) of the division using the following Formula (93) is 0.
If the restoration in step S90 fails (Step S91, No), the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23, and the processing proceeds to Step S83 described above.
When mj, sk, ek, and rk are all successfully restored (Step S91, Yes), the processing proceeds to Step S92. The description on Steps S92 and S93 is the same as the description on Steps S29 and S32 (see
In the variation for embedding the plaintext information also in sk, rk, and ek, instead of randomly generating s1(x,y), s2(x,y), e1(x,y), e2(x,y), r1(x,y), r2(x,y) in the encryption unit 5, (part of) the plaintext is embedded in a manner that is the same as that for embedding the plaintext in the polynomial. In the decryption device 20, (part of) the plaintext is restored as described above for decryption (No. 2), and (part of) the plaintext is restored in a manner as described in the above variation for decryption (No. 1). Then, the plaintext output unit 30 outputs (part of) the plaintext together with the plaintext m output from the plaintext polynomial factor.
Note that, when the plaintext including the plaintext polynomial mj(x,y) is embedded in part of these, after the decryption, the decryption unit 23 extracts information on the part where the plaintext is embedded alter all the terms and factors including the plaintext information have been decrypted. Then, only the extracted information is output to the plaintext output unit 30. The variation in which the plaintext is not dispersed can be realized by making a change, so as to embed the order information in the plaintext polynomial factor in the plaintext embedding unit 3 in the encryption device 10, and referring to the order information and arranging the plaintext polynomial factors in the instructed order when the decryption device 20 restores the plaintext polynomial factor.
In the variation using no plaintext polynomial factor, it is only necessary to simply embed the plaintext into the plaintext polynomial in the plaintext embedding unit 3 of the encryption device 10. Furthermore, the plaintext can be restored only through extraction of coefficient information from the plaintext polynomial output, in the decryption device 20-2 illustrated in
Regarding the variation of changing the degree of the approximate GCD in the approximate GCD calculation, a flowchart of decryption (No. 2) will be described with reference to, for example,
The processing in Steps S101 and S102 is the same as that in Steps S41 to S42 (see
The zero-point substitution unit 24 calculates hk(t) by substituting the zero point (ux(t), uy(t)) in the decryption (No. 2) into the ciphertext ck(x,y) (Step S103), and then sets dG to Dm(d+dm)−L1 which is the minimum value thereof(Step S104).
The approximate GCD calculation unit 25 performs approximate GCD calculation with this dG (Step S105).
When the approximate GCD cannot be derived (Step S106. No), the zero-point substitution unit 24 increments dG by one (Step S107), and checks whether or not dG is equal to or less than the upper limit value Dm(d+dm)+L2 (Step S108). When the dG is equal to or less than the upper limit value Dm(d+dm)+L2 (Step S108, Yes), the approximate GCD calculation unit 25 performs the approximate GCD calculation again (Step S105).
When the dG exceeds the upper limit value Dm(d+dm)+L2 (Step S108, No), the plaintext output unit 30 outputs an error signal indicating a decryption failure and an empty decryption result (Step S109), and the decryption processing ends.
When the approximate GCD is successfully derived (Step S106, Yes), the decryption is continued with a method similar to the decryption (No. 2) (Steps S110 to S117). Here, Step S115 is different from the embodiment of the decryption (No. 2) illustrated in
In response to determining in Step S115 that there is no next candidate factor series, an error signal is not output as in the embodiment of the decryption (No. 2) illustrated in
Regarding the variation regarding variables, only the number of variables in the encryption algorithm, the decryption algorithm, and the key generation algorithm is needed to change from the present embodiment. That is, this can be implemented simply by obvious changes such as changes in the variables x and y to variables x1, . . . , xl and changes in the private key to be substituted into these variables to (ux1(t), . . . , uxl(t)).
Regarding the variation for changing the degree of the coefficient eij(t) of the noise polynomial for each term, the part of the present embodiment changed is as follows. First of all, in the encryption, when the encryption unit 5 generates the noise polynomials e1(x,y) and e2(x,y), instead of inputting the system parameters p, De, and de to the polynomial generation unit 6, each degree is designated to be p, de,De, de,De−1, . . . , de,1, de,0, and an instruction is issued to the polynomial generation unit 6. Here, de,i represents the degree of the i-th degree coefficient of ek(x,y).
Regarding the decryption, in the decryption (No. 2), when the random polynomial sk(x,y) is successfully restored, the decryption unit 23 calculates ek(ux(t), and uy(t)) from hk(t) mod M(ux(t),uy(t)) (k=1, 2) and inputs this together with the zero point u and the system parameters d, de,De, de,De−1, . . . , de,1, de,0, to the plaintext polynomial factor restoration unit 29. The plaintext polynomial factor restoration unit 29 restores this, and inputs ek(x,y) to the decryption unit 23. When ek(x,y) fails to be restored, the plaintext polynomial factor restoration unit 29 inputs an error signal to the decryption unit 23.
Regarding the variation of introducing the product structure to the coefficient e(x,y) of the noise polynomial, the part of the present embodiment to be changed is the encryption algorithm and the decryption algorithm. The encryption algorithm with which the encryption unit 5 inputs the system parameters p, de, and De to the polynomial generation unit 6 and generates the two De degree random polynomials e1(x,y) and e2(x,y) having the de polynomial as coefficient, may be changed to an algorithm in which De polynomials e1,0(x,y), e1,1(x,y) having the de polynomial as coefficient, . . . , e1,De(x,y) are generated and are multiplied to generate e1(x,y), and also similarly, De polynomials e2,0(x,y), e2,1(x,y), . . . , e2,De(x,y) having the de polynomial as coefficient are generated and are multiplied to generate e2(x,y).
Regarding the decryption, in the decryption (No. 2), when the random polynomial sk(x,y) is successfully restored, the decryption unit 23 calculates ek(ux(t),ux(t)) from hk(t) mod M(ux(t),uy(t)) (k=1, 2) to restore the noise polynomial ek(x,y). This processing will be described with reference to a flowchart illustrated in
The factorization unit 26 factorizes ek(ux(t),uy(t)) (Step S121), and inputs the result of the factorization to the decryption unit 23 based on an array of the order of factors. The decryption unit 23 extracts d and de from the memory unit 27, extracts the degree of each factor from the factor array input from the factorization unit 26, and generates a corresponding degree array.
Furthermore, the decryption unit 23 inputs the degree array and N(=de+d) corresponding to the degree of the noise polynomial factor to the combination calculation unit 28, and the combination calculation unit 28 extracts all combinations (factor series) of the factors with the degree being exactly N (Step S122) and inputs a list of the factor series to the decryption unit 23.
The decryption unit 23 extracts the factor series from the list and inputs it to the plaintext polynomial factor restoration unit 29, together with the zero point u and the system parameters d and dm. The plaintext polynomial factor restoration unit 29 restores noise polynomial factors ek,1(x,y), . . . , ek,De(x,y) from the factor series input, the zero point u, and the system parameter d, by the method described in the present embodiment (Step S123).
When all the noise polynomial factors have been successfully restored (Step S124, Yes), the noise polynomial e(x,y) is restored by the product of the noise polynomial factors (Step S127).
If there is a noise polynomial factor that cannot be restored in step S123 (Step S124, No), the plaintext polynomial factor restoration unit 29 transmits an error signal to the decryption unit 23, and the decryption unit 23 determines whether or not there is a next candidate factor series, based on the list of factor series (Step S125). In response to determining that there is the next candidate factor series (Step S125, Yes), the decryption unit 23 extracts the next candidate factor series (Step S126), and inputs the next candidate factor series together with the zero point u and the system parameters d and de to the plaintext polynomial factor restoration unit 29, and the processing returns to Step S123.
When there is no next candidate factor series (Step S125, No), the decryption unit 23 notifies the plaintext output unit 30 of the decryption error, and the plaintext output unit outputs a decryption error and empty decryption result (Step S128). As a cause of the decryption failure, it is conceivable that the ciphertext was broken or falsified with on the communication path. There may be an unavoidable case as indicated by the above “Decryption failure probability”. Still, with the decryption failure probability sufficiently reduced (to 2−64 or less for example), the probability of occurrence of such a case may be reduced to a negligible level.
Regarding the variation of changing the roles of the noise polynomial and the plaintext polynomial, the roles of the plaintext polynomial and the noise polynomial of the variations may be simply changed. With this configuration, there will be an option of first restoring the noise polynomial and not restoring the plaintext polynomial factor in the present embodiment. As a result, the processing time can be significantly reduced.
The description of the specific configurations of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the present embodiment ends here.
The security of the public-key cryptography of the present embodiment implemented will be considered below. Note that the key recovery attack of restoring the private key from the public key is a solution problem of an indeterminate equation without a general solution algorithm. Thus, the considered is made only in the context of a brute-force attack.
The coefficient comparison attack is an attack scheme in which unknown parts of a plaintext polynomial, a random polynomial, and a noise polynomial in a ciphertext are calculated with variables, and simultaneous equations generated by coefficient comparison with an actual ciphertext are solved to derive the plaintext polynomial together with other unknown parts. According to this scheme, the known part is only the following Formula (94).
The unknown part is expressed by the following Formula (95).=Σ(i,j,k)∈Δ
xi
jtk (1≤
≤Dm)
rb=Σ(i,j,k)∈Δjtk (b=1,2)
sb=Σ(i,j,k)∈Δjtk (b=1,2)
eb=Σ(i,j,k)∈Δjtk (b=1,2)
When a ciphertext is created based on the foregoing Formula (44) by using Formula (94) and Formula (95), the following Formula (96) is obtained for each of b=1 and 2.
cb(x,)=
(Σ(i,j,k)∈Δ
xi
itk)(Σ(i,j,k)∈Δ
jtk)+(Σ(i,j,k)∈Δ
jtk)(Σ(i,j,k)∈Δ
jtk)+Σ(i,j,k)∈Δ
jtk (96)
Coefficient comparison is performed between the above Formula (96) and the actual ciphertext expressed by the following Formula (97). In the formula, μijk and c(l)ijk are known.
For the sake of simplicity, a description is given assuming that the public key X and a polynomial c1(=Πl=1Dmm1s1+Xr1+e1) on Fp[t] corresponding to the public key X are given under the following condition. An attack of analyzing only one of c1 and c2 in this manner is referred to as a one-sided attack. Here, for the sake of simplicity, the discussion will proceed assuming the following Formula (98).
Dm=Ds=DX=Dr=1,De=0
dX=dm=ds=dr=de=0 (98)
Then, m, r1, s1, and e1, can be described as in the following Formula (99), and mijk, s(1)ijk, r(1)ijk and e(1)ijkk are variables that take values on Fp.
m(x,)=m100x+m010
+m000
s1(x,)=s100(1)x+s010(1)
+s000(1)
r1(x,)=r100(1)x+r010(1)
+r000(1)
e1(x,)=e000(1) (99)
In addition, X and c1 can each be described as in the following Formula (100), and τijk and (1)ijk are constants having values on Fp.
X(x,)=
100x+
010
+
000
c1(x,)=c200(1)x2+c110(1)x
+c020(1)
2+c100(1)x+c010(1)
+c000(1) (100)
Through comparison between the terms of x2, xy, y2, x, and y and the constant term, the simultaneous equations of the following Formula (101) can be obtained.
m100s100+100r100=c200
m100s010+m010s100+100r010+
010r100=c110
m010s010+010r010=c020
m100s000+m000s100+100r000+
000r100=c100
m010s000+m000s010+010r000+
000r010=c010
m000s000+000r000+c000
This simultaneous equation is a nonlinear indeterminate equation because the number of variable is 10 and the number of equations is 6. In general, the number of variables is #ΔDm,Dmdm+#ΔDr,dr+#ΓDs,ds+ΓDe,de, and the number of equations is #ΓDx+Dr,dx+dr. When dX and dy are large, the equations will no longer be indeterminate equation, and will be a solution problem of a nonlinear multivariate simultaneous equation known to be NP-hard. The same applies to a case where both c1 and c2 are taken into consideration.
The linear algebraic attack is an attack scheme of linearizing a nonlinear portion in the coefficient comparison attack and deriving a linear simultaneous equation instead of a nonlinear simultaneous equation. This enables the amount of attack calculation to be reduced. Linearizing the nonlinear portion means setting an unknown part, with the nonlinear portion (that is, a portion corresponding to a product) regarded as a polynomial of a single chunk. In this scheme, since the term (plaintext term) in which the plaintext is embedded is a nonlinear term such as Πj=1Dmmj(x,y)sk(x,y), this portion is collectively regarded as a single polynomial M(x,y), that is, the ciphertext is expressed by the following Formula (102).
ck(x,)=M(x,
)+X(x,
)rk(x,
)rk(x,
)+ek(x,
) (k=1,2) (102)
The unknown part defined as M, rk, sk, and ek, and is applied to c1(x,y) by using the parameters expressed in the above expression (98) to obtain the following Formula (103). With the known part X and c1 defined as in the following Formula (104), the following simultaneous equations (105) are derived through a consideration similar to that for the coefficient comparison attack.
M1(x,)=M200(1)x2+M110(1)x
+M020(1)
2+M100(1)x+M010(1)
+M000(1)
r1(x,)=r100(1)x+r010(1)
+r000(1)
e1(x,)=e000(1) (103)
X(x,)=
100x+
010
+
000
c1(x,)=c200(1)x2+c110(1)x
+c020(1)
2+c100(1)x+c010(1)
+c000(1) (104)
M200+100r100=c200
M110+100r010+
010r100=c110
M020+010r010=c020
M100+100r000+
000r100=c100
M010+010r000+
000r010=c010
M000+000r000+e000=c000 (105)
This simultaneous equation is a linear indeterminate equation since the number of variable is 10 and the number of equations is 6. In general, the number of variables is #ΔDx+Dr,dx+dr+#ΔDr,dr+#ΓDe,de, and the number of equations is #ΓDx+Dr,dx+dr. Thus, a solution space of #ΔDr,dr+#ΓDe,de dimensions is obtained. In fact, when an element of any Fp is substituted into the variables rijk and eijk, corresponding Mijk is obtained. However, there is only one Mijk as a correct decryption result, which can only be determined by confirming that Πj=1Dmmj(x,y)sk(x,y) is obtained by the factorization of M(x,y) obtained. Only manner (other than by coefficient comparison attack) known so far for achieving this is a brute-force attack on the solution space (other than by coefficient comparison attack). Thus, defense against the brute-force attack can be achieved if a solution space large enough to be free of the attack can be obtained.
Note that, the linear algebra attack also includes a two-sided attack, but the one-sided attack is more effective in terms of brute-force attack on the solution space.
The resistance to the various attacks described above is basically evaluated by the complexity of computation for solving simultaneous equations. In this section, such factors are reconsidered in the context of brute-force attack. In a case of one-sided coefficient comparison attack, Πj=1mj(x,y) can be obtained by the ideal decomposition as in the case of decryption, through brute-force attack on ei(x,y). In this case, the number of brute-force attacks ei(x,y) is pde+1 (the characteristic of the finite field to the power of the number of variables), the calculation amount of which also exponentially increases. The same applies to the linear algebra attack.
Also in the key restoration attack, both (ux(t), uy(t)) need to be obtained for solving multivariate simultaneous equations. This can be achieved through brute-force attack on one of them (for example, ux(t)) and obtaining the corresponding (uy(t) in this case) by solving X(ux(t),y)=0. Considering these, it is necessary to consider the brute-force attack on ux(t). Then, the number of brute-force attacks is pde+1, the calculation amount of which also exponentially increases.
From the above consideration, it can be understood that any existing attack involves a calculation amount exponentially increasing.
Finally, an example of the hardware configuration of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment will be described.
The encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment include a control device 301, a main memory device 302, an auxiliary memory device 303, a display device 304, an input device 305, and a communication device 306. The control device 301, the main memory device 302, the auxiliary memory device 303, the display device 304, the input device 305, and the communication device 306 are connected to each other via a bus 310.
The control device 301 (an example of the hardware processor) executes a program loaded on to the main memory device 302 from the auxiliary memory device 303. The main memory device 302 is a memory such as a Read Only Memory (ROM) and a Random Access Memory (RAM). The auxiliary memory device 303 is a Hard Disk Drive (HDD), a Solid State Drive (SSD), a memory card, or the like.
The display device 304 displays display information. The display device 304 is, for example, a liquid crystal display or the like. The input device 305 is an interface for operating a computer. The input device 305 is, for example, a keyboard or a mouse. When the computer is a smart device such as a smartphone or a tablet terminal, the display device 304 and the input device 305 are, for example, touch panels. The communication device 306 is an interface for communicating with other devices.
A program executed by a computer may be recorded as a file in an installable format or an executable format, in a computer-readable memory medium such as a CD-ROM, a memory card, a CD-R, and a Digital Versatile Disc (DVD).
Furthermore, the program executed by the computer may be provided while being stored on a computer connected to a network such as the Internet and downloaded via the network. Furthermore, the program executed by the computer may be configured to be provided or distributed over a network such as the Internet, without being downloaded.
Furthermore, the program executed by the computer may be configured to be provided by being embedded in advance in a ROM or the like.
The program executed by the computer has a module configuration including functional blocks that can also be implemented by a program, among the functional configurations (functional blocks) of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment. As the actual hardware, each functional block is loaded onto the main memory device 302, with the control device 301 reading a program from a memory medium and executing the program. Thus, the above functional blocks are generated on the main memory device 302.
Note that some of or all the functional blocks described above may be implemented by hardware such as an Integrated Circuit (IC) instead of being implemented by software.
When implementing the functions using a plurality of processors, each processor may implement one of the functions, or may implement two or more of the functions.
Furthermore, the computer implementing the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment may operate in any appropriate mode. For example, the encryption device 10 (the decryption devices 20 and 20-2, the key generation device 40) may be implemented by a single computer. Furthermore, for example, the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 may be operated as a cloud system on the network.
While certain embodiments have been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.
Number | Date | Country | Kind |
---|---|---|---|
2020-188737 | Nov 2020 | JP | national |
Number | Name | Date | Kind |
---|---|---|---|
5740250 | Moh | Apr 1998 | A |
20020001383 | Kasahara | Jan 2002 | A1 |
20040151307 | Wang | Aug 2004 | A1 |
20100226496 | Akiyama | Sep 2010 | A1 |
20130177151 | Sella | Jul 2013 | A1 |
20160119120 | Wang | Apr 2016 | A1 |
20180034630 | Rietman | Feb 2018 | A1 |
Number | Date | Country |
---|---|---|
2010-204466 | Sep 2010 | JP |
Entry |
---|
Gentry,“Fully Homomorphic Encryption Using Ideal Lattices”, Jun. 2, 2009, ACM, pp. 169-178 (Year: 2009). |
Aly, “Design of Symmetric-Key Primitives for Advances Cryptographic Protocols”, 2020, IACR, vol. 2020, pp. 1-45 (Year: 2020). |
Komano et al., “Algebraic Surface Cryptosystems using Polynomial Approximate GCD”, Technical Report of IEICE, 116 (130), 2016, 24 pages (with Machine generated translation). |
Number | Date | Country | |
---|---|---|---|
20220150064 A1 | May 2022 | US |