Communication system, method, and program

Abstract

To materialize a public key cryptograph based on isogeny in which data sizes and calculation costs are suppressed.SOLUTION: Provided is a communication system for materializing cryptographic communication using isogeny-based cryptography that adopts, as system parameters, integers a' and b' determined from a security parameter λ, integers dA=2a'+k*3b' and d1=2a'-k*3b' (k=natural number) which are larger than 22λ and are not smooth numbers, integers a=2a', b=2b', d2=3b, primes p=2a*3f-1 (f=natural number), and generation source P0, Q0 of E0[2a]. The communication system includes a key generation unit for selecting a random regular diagonal matrix A of 2×2 on Z / 2aZ and generating dA-isogeniesφA:E0→EA and PA=φA(P0) and QA=φA(Q0) from dA and P0, Q0 by RandIsogImages, thereby generating a public key pk=(EA, RA, SA)(where, RA and SA satisfy (RA, SA)T=A(PA, QA)T) and a secret key sk=A.SELECTED DRAWING: Figure 8

Description

[Technical Field]

[0001] The present disclosure relates to a communication system, method, and program. [Background technology]

[0002] Cryptographic methods that are considered to be quantum-resistant are called quantum-safe cryptography. Isogeny mapping cryptography is known as one of the candidates for quantum-safe cryptography. Representative public key cryptography methods based on isogeny mapping include SIDH, SIKE, and CSIDH. However, attacks that break the security of SIDH and SIKE have been discovered, making these methods no longer secure.

[0003] After the discovery of an attack method to break the security of SIDH and SIKE (hereinafter referred to as SIDH attack), a new encryption method called FESTA, which is resistant to SIDH attacks, was proposed (Non-Patent Document 1). FESTA is a public key encryption method that uses SIDH attacks for decryption, and is resistant to SIDH attacks. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Andrea Basso, Luciano Maino, and Giacomo Pope. "FESTA: Fast Encryption from Supersingular Torsion Attacks." Cryptology ePrint Archive, 2023. https: / / eprint.iacr.org / 2023 / 660 Summary of the Invention [Problem to be solved by the invention]

[0005] However, while FESTA is expected to be resistant to SIDH attacks, it has the drawback that the size of data such as public keys and ciphertexts is significantly larger than that of SIDH, and the computational time required for encryption and decryption is also long.

[0006] The present disclosure has been made in consideration of the above points, and aims to realize public key cryptography based on isogeny mapping with reduced data size and calculation costs. [Means for solving the problem]

[0007] A communication system according to one aspect of the present disclosure includes integers a′ and b′ determined from a security parameter λ, and 2λ A larger integer d that is not a smooth number A =2 a' +k·3 b' and d1=2 a' -k·3 b' (where k is a natural number) and integers a=2a', b=2b', d2=3 b and prime number p=2 a 3f-1 (where f is a natural number) and the finite field F p^2 The torsion subgroup E0[2 a ] is a communication system that realizes encrypted communication using isogenous mapping encryption with generators P0 and Q0 of ] as system parameters, and selects a random 2 × 2 regular diagonal matrix A on Z / 2aZ, and A and P0, Q0 are used to generate random d A -homogeneous map φ A :E0→E A and P A =φ A (P0) and Q A =φ A By generating (Q0), the public key pk=(E A ,R A ,S A ) (However, R A and S A is (R A ,S A ) Τ =A(PA ,Q A ) Τ and a key generation unit that generates a secret key sk=A used to decrypt a ciphertext encrypted with the public key pk. [Effects of the Invention]

[0008] It is possible to realize public key cryptography based on isogeny mapping with reduced data size and computational cost. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing an example of a commutative diagram of an isogeny. [Figure 2] FIG. 1 is a diagram illustrating an example of the relationship between elliptic curves and isogenous mappings in FESTA. [Figure 3] FIG. 10 is a diagram illustrating an example of the relationship between an endomorphism obtained by FullRepInt and an isogeny obtained by a SIDH attack. [Figure 4] FIG. 10 is a diagram illustrating an example of the relationship between an elliptic curve and an isogenous mapping in the proposed method. [Figure 5] 1 is a diagram illustrating an example of the overall configuration of an encrypted communication system according to an embodiment of the present invention. [Figure 6] FIG. 2 is a diagram illustrating an example of a functional configuration of a receiver device according to the present embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a functional configuration of a transmitter device according to the present embodiment. [Figure 8] FIG. 10 is a sequence diagram illustrating an example of an encrypted communication process according to the present embodiment. [Figure 9] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0011] <Prior art> Public key cryptography is a cryptography method that uses different keys for encryption and decryption, and the encryption key is made public. Public key cryptography includes three algorithms: a key generation algorithm, an encryption algorithm, and a decryption algorithm. The key generation algorithm outputs two keys, called a public key and a private key. Of these, the public key is the information needed to encrypt a message, and the private key is the information needed to decrypt the ciphertext. Message sender A creates a ciphertext from the public key and message m using the encryption algorithm, and sends it to recipient B, the other party. Recipient B then decrypts the ciphertext using the private key using the decryption algorithm, and obtains message m.

[0012] Currently widely used public key cryptosystems include RSA cryptosystem and ECDH, which is a Diffie-Hellman key exchange method. However, it is known that the security of these systems can be broken by using quantum computers, and there is an urgent need to establish quantum-safe public key cryptosystems.

[0013] Isogeny mapping cryptography is known as one of the candidates for quantum-safe cryptography. This is a general term for methods that base their security on the difficulty of a mathematical problem called the isogeny mapping problem. Representative public key cryptography methods based on isogeny mapping include SIDH (Reference 1), SIKE (Reference 2), and CSIDH (Reference 3). SIKE in particular has attracted attention, having remained in Round 4 of the NIST standardization competition.

[0014] However, in 2022, an attack method to break the security of SIDH and SIKE was discovered (References 4 and 5), making these methods no longer secure. The essence of the SIDH attack, which is an attack method to break the security of SIDH and SIKE, is that it is possible to restore an isogenous mapping by using information on the point image of the secret isogenous mapping. An overview of the SIDH attack is provided below.

[0015] <Overview of SIDH attacks> First, let N1, N2, and D be positive integers that satisfy D=N1+N2 and are relatively prime to each other. Let E0, E1, E2, and E3 be elliptic curves connected by isogenies ψ1, ψ2, ψ1', and ψ2' that satisfy the commutative diagram shown in Figure 1. Here, the degrees of each isogeny are deg(ψ1)=deg(ψ1')=N1 and deg(ψ2)=deg(ψ2')=N2. In the following, an isogeny of degree d will be referred to as a "d-isogeny", etc. Furthermore, if the dimension is 2, it will be referred to as a "(d,d)-isogeny", etc.

[0016] Then the following mapping Φ is a (D,D)-isogeneous mapping, and its kernel is KerΦ={([N2]P,f(P))|P∈E1[D]}.

[0017]

number

[0018] Here, if the point image f(P) for any P∈E1[D] is given, then KerΦ can be obtained, from which the mapping Φ can be found in polynomial time, and thus the isogenous mappings ψ1,ψ2 can be obtained.

[0019] In particular, for some integer b, D=2 b When the mapping Φ can be expressed as follows, the mapping Φ can be obtained by repeatedly calculating the (2,2)-isogeneous mapping. It is known that the (2,2)-isogeneous mapping can be calculated efficiently by Richelot's method. For simplicity, the algorithm for SIDH attack will be represented as Atk. That is, the algorithm for SIDH attack is b Twisted subgroup E1[2 b ] and the point images P2=f(P1), Q2=f(Q1) by the following N1N2-isogeneous map f are given. N_1,N_2(E1,E2,P1,Q1,P2,Q2) outputs an isogeny (ψ1,ψ2) and its domain E0. Note that "N_1" and "N_2" represent "N1" and "N2", respectively. Similarly, subscripts of subscripts will be represented by "_" below.

[0020]

number

[0021] Below, E1, E2, P1, Q1, P2, Q2 are input, and Atk N_1,N_2 By (E1,E2,P1,Q1,P2,Q2), outputting (ψ1,ψ2,E0) is called "(ψ1,ψ2,E0)←Atk N_1,N_2 (E1,E2,P1,Q1,P2,Q2)".

[0022] After the discovery of the SIDH attack, a new encryption method called FESTA was proposed (Non-Patent Document 1). This is a public key encryption method that uses the SIDH attack for decryption, and is resistant to SIDH attacks. An overview of FESTA is given below.

[0023] <FESTA Overview> First, define the system parameters. Let λ be the security parameter, and d A ,d1,d2 to 2 2λ Let m1, m2, and b be smooth natural numbers that are larger than m1, m2, and b. Let m1, m2, and b be the smallest possible natural numbers that satisfy the following conditions. A smooth natural number is a natural number that does not contain large prime factors.

[0024] m1 2 d A,1 d1+m2 2 d A,2 d2=2 b ,∃d A,1 ,d A,2 (However, d A,1 ,dA,2 is a natural number) st d A,1 d A,2 =d A

[0025] Furthermore, p = 2 b d1d2(d A ) sf f-1 is a prime number that can be expressed as a small natural number (d A ) sf d A The prime factors of d are multiplied exactly once. For example, d A =3 5 2 7 3 If (d A ) sf = 3 5 7. Finally, M n Let be the set of all 2x2 regular diagonal matrices on Z / nZ (where Z represents the set of integers).

[0026] The FESTA key generation algorithm, encryption algorithm, and decryption algorithm are shown below. The key generation algorithm, encryption algorithm, and decryption algorithm also take system parameters as input, but the system parameters are omitted below. The algorithm for setting system parameters is called a setup algorithm, and is executed by a system administrator, for example.

[0027] Key generation algorithm The FESTA key generation algorithm outputs a public key pk and a private key sk according to the following steps a-1 to a-6.

[0028] Step a-1: Let the elliptic curve E0 be as follows.

[0029]

number

[0030] Step a-2: E0[2 b ] is taken as the generator (P0,Q0).

[0031] Step a-3: Random d A -homogeneous map φ A :E0→E A Take.

[0032] Step a-4: Random matrix A∈M n Take.

[0033] Step a-5: (R A ,S A ) Τ =A(φ A (P0),φ A (Q0)) Τ where T represents transposition.

[0034] Step a-6: (E A ,R A ,S A ) as the public key pk and A as the private key sk.

[0035] Encryption algorithm The FESTA encryption algorithm takes a public key pk and plaintext m as input, and outputs ciphertext ct according to the following steps b-1 to b-6.

[0036] Step b-1: Take a random d1-isogenous mapping φ1:E0→E1.

[0037] Step b-2: Random d2-isogeneous mapping φ2:E A →Take E2.

[0038] Step b-3: Matrix B∈M n is uniquely determined from the plaintext m.

[0039] Step b-4: (R1, S1) Τ =B(φ1(P0),φ1(Q0)) Τ Far away.

[0040] Step b-5: (R2,S2) Τ=B(φ2(R A ),φ2(S A )) Τ Far away.

[0041] Step b-6: (E1, R1, S1, E A ,R A ,S A ) is the ciphertext ct.

[0042] Decryption algorithm The FESTA encryption algorithm takes a secret key sk and ciphertext ct as input, and outputs plaintext m through the following steps c-1 to c-9.

[0043] Step c-1:d A,1 -homogeneous map φ A,1 and d A,2 -homogeneous map φ A,2 Using and, φ A is expressed as follows:

[0044]

number

[0045] Step c-2: Let ψ1 and ψ2 be as follows:

[0046]

number

[0047] Step c-3:f is as follows.

[0048]

number

[0049] Step c-4: (f(R1), f(S1)) Τ =m1m2d1A -1 (R2,S2) Τ Ask for.

[0050] Step c-5: Obtain isogenous mappings ψ1 and ψ2 using a SIDH attack.

[0051] Step c-6: E0[d1]∩Kerψ1 and E A [d2] ∩Kerψ2 to find φ1 and φ2.

[0052] Step c-7: (R1, S1) Τ =B(φ1(P0),φ1(Q0)) Τ Find B that satisfies the above.

[0053] Step c-8: (R2,S2) Τ =B(φ2(R A ),φ2(S A )) Τ Verify that the following holds true.

[0054] Step c-9: Obtain plaintext m from B.

[0055] However, in step c-8 above (R2, S2) Τ =B(φ2(R A ),φ2(S A )) Τ If it is confirmed that does not hold, a symbol indicating a decoding failure is output.

[0056] FESTA is based on the relationship shown in Figure 2, and when decrypting, it performs a SIDH attack where N1, N2, ψ1, and ψ2 are as follows:

[0057]

number

[0058] Finally, an example of the system parameters for FESTA at λ=128 is shown below.

[0059] p=2 632 d1 d2 (d A ) sf 107-1 d1=(3 3·19·29·37·83·139·167·251·419·421·701·839·1009·1259·3061·3779) 2 d2 = 7·(5 2 ·7·11·13·17·41·43·71·89·127·211·281·503·631·2309·2521·2647·2729) 2 d A,1 =(59·6299·6719·9181) 2 d A,2 =(3023·3359·\(4409\)·5039·19531·22679·41161) 2 m1 = 1492184945093476592520242083925044182103921 m2 = 25617331336429939300166693069[[ID=,21]]

[0060] Note that the size of p is ❶❷❾❷ bits.

[0061] <Problems of FESTA> While the above FESTA is expected to be resistant to the SIDH attack, the size of data such as public keys and ciphertexts is considerably larger compared to SIDH, and the computational time required for encryption and decryption is also large. This is considered to be due to the fact that the constraints that the system parameters of FESTA must satisfy are strong, and as a result, huge parameters are being used. In particular, it is considered difficult to satisfy the constraint that the degree of the isogeny handled in FESTA is smooth (does not contain huge prime factors). Therefore, it is necessary to establish a new method that can operate even if the degree of the isogeny is not smooth.

[0062] Therefore, below, as a public key cryptosystem based on an isogeny that suppresses the data size and computational cost (computational time), FESTA that can operate even if the degree of the isogeny is not smooth is proposed. Hereinafter, FESTA that can operate even if the degree of the isogeny is not smooth will be referred to as the "proposed method" or "FESTA according to the proposed method". Note: There seems to be a small error in the English translation of the number in ID=15 where '4409' was not in the original Japanese text as '❶❷❾❷' in the English translation of ID=24. It should be '4409' in both cases for a proper translation. This might be a misinterpretation in the translation process. The above translation adheres to the rules as closely as possible while keeping the text as accurate as the original allows.

[0063] <Proposed method> The proposed method, FESTA, uses an isogenous mapping with non-smooth degree. However, algorithms based on Velu's formula, which are commonly used to calculate isogenous mappings, require exponential computation time if the degree of the isogenous mapping is not smooth. Therefore, an alternative method is required to calculate isogenous mappings. Therefore, the proposed method, FESTA, achieves the computation of isogenous mappings by applying a trick based on quaternion algebra and the SIDH attack. This makes it possible to efficiently compute isogenous mappings with non-smooth degree. This significantly relaxes the constraints that system parameters must satisfy, resulting in reduced data size and computational costs.

[0064] <Calculation method for isogenies with non-smooth degrees> Below, we will explain an algorithm called RandIsogImages as a calculation of an isogenous mapping with a non-smooth degree. Below, we will first explain FullRepInt, a sub-algorithm used in RandIsogImages, and then explain RandIsogImages.

[0065] FullRepInt is an algorithm used in a digital signature scheme called SQISign (Reference 6), which returns a quaternion γ∈O0 whose norm is M for a maximal ring O0 of a quaternion algebra and a positive integer M>p, where O0 is as follows:

[0066]

number

[0067] FullRepInt O_0 (M)→γ∈O0 FullRepInt receives a positive integer M>p as input and outputs γ∈O0 according to the following steps a-1 to a-6.

[0068] Step a-1: Let m' be as follows, and z'∈[-m',m'] be chosen uniformly at random.

[0069]

number

[0070] Step a-2: Let m'' be as follows, and let t'∈[-m'',m''] be uniformly random.

[0071]

number

[0072] Step a-4: (x') 2 +(y') 2 Find an integer (x', y') that satisfies =M'. If there is no such integer (x', y'), return to step a-1 above.

[0073] Step a-5: If the following is true, return to step a-1 above.

[0074]

number

[0075] Step a-6: Return γ=(x'+y'i+z'j+t'k) / 2.

[0076] When p=3 mod 4, it is known that the endomorphism ring End(E0) of the following elliptic curve E0 is isomorphic to the above ring O0.

[0077]

number

[0078] At this stage, we have obtained an isogeny γ with any degree M, including cases where it is not smooth. However, as mentioned above, this γ is an endomorphism, so its codomain (i.e., the public key in FESTA) can only be E0, making it unsuitable for cryptographic purposes. Therefore, we solve this problem using a SIDH attack.

[0079] In the following, let a be a natural number that satisfies the following. Also, let D be a non-smooth 2 a A natural number less than .

[0080]

number

[0081] In this case, we find the isogenous mapping of degree D using the following policy. First, FullRepInt O_0 (D(2 a -D)) so the degree is D(2 a -D), we obtain an endomorphism α:E0→E0 of E0 such that E0[2 a For the generators P0 and Q0 of , we calculate P0'=α(P0), Q0'=α(Q0). Finally, we apply the SIDH attack Atk D,2^a-D By (E0,E0,P0,Q0,P0',Q0'), we can see that the D-isogeneous maps τ(and (2 a -D)-isogeneity map ρ). These endomorphisms α and D-isogeneity map τ and (2 a -D)-The relationship with the isogenous mapping ρ is shown in Figure 3. a ". Similarly, below, a superscript of a subscript will be represented by "^".

[0082] Next, we will explain RandIsogImages as an algorithm that combines the above ideas. In addition to the specified order D, RandIsogImages also takes any finite number of points X = (P1, P2, , P n ) as input, the codomain E of D-isogeny τ A and the point image of X by τ is τ(X)=(τ(P1),τ(P2),···,τ(P n )) is output.

[0083] RandIsogImages(D,X) → (E A ,τ(X)) RandIsogImages is a set of images of any finite number of points X = (P1, P2, , P n ) and the codomain E of D-isogeny τ is obtained by the following steps b-1 to b-5. A and the point image of X by τ, τ(X)=(τ(P1),τ(P2), ,τ(P n )) is output.

[0084] Step b-1: α←FullRepInt O_0 (D(2 a -D))

[0085] Step b-2: E0[2 a ] are taken as generators P0,Q0.

[0086] Step b-3: (ψ1, ψ2, E A )←Atk D,2^a-D (E0,E0,P0,Q0,α(P0),α(Q0))

[0087] Step b-4:τ:E0→E A Let us assume the following.

[0088]

number

[0089] Step b-5: (E A ,τ(X)).

[0090] <FESTA configuration related to the proposed method> Below, we will use the above RandIsogImages to construct FESTA, which is the proposed method. FESTA, which is the proposed method, is a public key cryptosystem that applies the above RandIsogImages to make FESTA more efficient. The main difference from FESTA is that A ,d1 is not smooth, d2=3 b and d A -homogeneous map φ A The following points should be considered: do not split into two isogenous maps. Note that components not specifically mentioned can be treated as the same as those in FESTA.

[0091] - System parameter settings First, we will explain how to set the system parameters used in the proposed method. Let a' and b' be integers that satisfy the following:

[0092]

number

[0093] Also, d A ,d1 to d A =2 a' +k·3 b' ,d1=2 a' -k·3 b' A large number (2 2λ Let a = 2a', b = 2b', and p = 2. a · A prime number expressed as 3f-1, d2=3 b where f is a small natural number. Finally, let E0 be the elliptic curve, and let E0[2 a ] are generated by P0 and Q0.

[0094]

number

[0095] Below, we will refer to the system parameters (set) as param λ The following key generation algorithm KeyGen, encryption algorithm Enc, and decryption algorithm Dec are λ In the following, the system parameters param λ The system parameter param λ Setup algorithm Setup(1 λ )→param λ is executed by, for example, a system administrator.

[0096] ·Key generation algorithm: KeyGen → (pk, sk) The key generation algorithm KeyGen of the proposed method outputs a public key pk and a private key sk according to the following steps 1-1 to 1-4.

[0097] Step 1-1: Random matrix A∈M 2^a Take.

[0098] Step 1-2: (E A ,P A ,Q A )←RandIsogImages(d A ,P0,Q0). Note that this RandIsogImages(d A ,P0,Q0) A -Isogeneity mapping is φ A That is, φ A :E0→E A , P A =φ A (P0), Q A =φ A (Q0).

[0099] Step 1-3: (R A ,S A ) Τ =A(P A ,Q A ) Τ Far away.

[0100] Step 1-4: pk=(E A ,RA ,S A ) and sk=A.

[0101] Encryption algorithm: Enc(pk,m∈{0,1} a-2 ) → ct The encryption algorithm Enc of the proposed method receives a public key pk and plaintext m as input, and outputs ciphertext ct according to the following steps 2-1 to 2-6.

[0102] Step 2-1:s B =2m+1∈(Z / 2 a Z) * Then, B=diag(s B ,s B -1 )∈M 2^a Far away.

[0103] Step 2-2: Let (E1,P1,Q1)←RandIsogImages(d1,P0,Q0). Let φ1 be the d1-isogenous mapping corresponding to this RandIsogImages(d1,P0,Q0). That is, φ1:E0→E1, P1=φ1(P0), Q1=φ1(Q0).

[0104] Step 2-3: (R1, S1) Τ =B(P1,Q1) Τ Far away.

[0105] Step 2-4: Random d2-isogeneous mapping φ2:E A →Take E2.

[0106] Step 2-5: (R2, S2) Τ =B(φ2(R A ),φ2(S A )) Τ Far away.

[0107] Step 2-6: Output ct = (E1, R1, S1, E2, R2, S2).

[0108] Decoding algorithm: Dec(sk,ct)→m The decryption algorithm Dec of the proposed method receives a secret key sk and ciphertext m as input, and outputs plaintext m through the following steps 3-1 to 3-6.

[0109] Step 3-1: (R2', S2') Τ =kd1A -1 (R2,S2) Τ Let's say.

[0110] Step 3-2: N1=d A d1,N2=k 2 d2=k 2 3 b Far away.

[0111] Step 3-3: (ψ1,ψ2,E A ')←Atk N_1,N_2 Let (E1,E2,R1,S1,R2',S2').

[0112] Step 3-4: B=diag(s B ,s B -1 )∈M 2^a and k(R2,S2) Τ =B(ψ2(R A ),ψ2(S A )) Τ Find B such that:

[0113] Steps 3-5: B =min{s B ,2 a -s B}Far away.

[0114] Step 3-6: m = (s B Outputs -1) / 2.

[0115] FESTA, the proposed method, is based on the relationship shown in Figure 4, and during decryption, a SIDH attack is performed with N1, N2, ψ1, and ψ2 set as follows:

[0116]

number

[0117] The following describes an encrypted communication system 1 that realizes encrypted communication using the above proposed method.

[0118] <Overall configuration example> An example of the overall configuration of the encrypted communication system 1 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the overall configuration of the encrypted communication system 1 according to this embodiment.

[0119] 5, the encrypted communication system 1 according to this embodiment includes a receiver device 10 and a sender device 20. The receiver device 10 and the sender device 20 are communicably connected via a communication network 30 including, for example, the Internet.

[0120] The receiver device 10 is any of various devices, equipment, terminals, etc. that serve as receivers of encrypted communications. The sender device 20 is any of various devices, equipment, terminals, etc. that serve as senders of encrypted communications.

[0121] The receiver device 10 and the sender device 20 can be realized by various devices, equipment, terminals, etc., such as a PC (personal computer), a smartphone, a tablet terminal, a wearable device, a general-purpose server, an IoT device, an industrial device, etc.

[0122] Also, for example, an administrator device that serves as a system administrator and executes the setup algorithm Setup may be included in the encrypted communication system 1. For simplicity, it is assumed below that the receiver device 10 also serves as the system administrator.

[0123] <Example of functional configuration> <Recipient device 10> An example of the functional configuration of the receiver device 10 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the receiver device 10 according to this embodiment.

[0124] 6, the receiver device 10 according to this embodiment includes a communication unit 101, a system parameter setting unit 102, a key generation unit 103, and a decryption unit 104. These units are realized, for example, by one or more programs installed in the receiver device 10, which are executed by a processor such as a CPU (Central Processing Unit). The receiver device 10 according to this embodiment also includes a storage unit 105. The storage unit 105 is realized, for example, by a storage area of ​​various storage devices such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.

[0125] The communication unit 101 transmits a public key pk to the sender device 20 and receives a ciphertext ct from the sender device 20 .

[0126] The system parameter setting unit 102 executes the setup algorithm Setup of the non-smooth-FESTA according to the proposed method, and sets the system parameters param λ The system parameter param λ is public information and is set in the receiver device 10 and the sender device 20.

[0127] The key generation unit 103 executes the FESTA key generation algorithm KeyGen according to the proposed method to generate a key pair (pk, sk) of a public key pk and a private key sk.

[0128] The decryption unit 104 executes the FESTA decryption algorithm Dec according to the proposed method, and generates plaintext m by decrypting the ciphertext ct.

[0129] The storage unit 105 stores various data (for example, a key pair (pk, sk) and the like).

[0130] <<Sender device 20>> An example of the functional configuration of the sender device 20 according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a diagram showing an example of the functional configuration of the sender device 20 according to this embodiment.

[0131] 7, the sender device 20 according to this embodiment includes a communication unit 201 and an encryption unit 202. These units are realized, for example, by a processor such as a CPU executing one or more programs installed in the sender device 20. The sender device 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by a storage area of ​​various storage devices such as an HDD, an SSD, or a flash memory.

[0132] The communication unit 201 receives a public key pk from the receiver device 10 and transmits a ciphertext ct to the receiver device 10 .

[0133] The encryption unit 202 executes the encryption algorithm Enc of FESTA according to the proposed method, and generates ciphertext ct by encrypting plaintext m.

[0134] The storage unit 203 stores various data (for example, a public key pk, a plaintext m, etc.).

[0135] <Encrypted communication processing> The encrypted communication process according to this embodiment will be described with reference to Fig. 8. Fig. 8 is a sequence diagram showing an example of the encrypted communication process according to this embodiment. In the following, it is assumed that the system parameters of FESTA according to the proposed method have already been set. Note that steps S101 to S103 are performed in advance before encrypted communication. Meanwhile, steps S104 to S107 are performed whenever the need for encrypted communication arises.

[0136] The key generation unit 103 of the receiver device 10 executes the FESTA key generation algorithm KeyGen according to the proposed method to generate a key pair (pk, sk) of a public key pk and a private key sk (step S101). That is, the key generation unit 103 outputs the public key pk and the private key sk according to the above steps 1-1 to 1-4. The public key pk and the private key sk are stored in the storage unit 105.

[0137] The communication unit 101 of the receiver device 10 transmits the public key pk generated in the above step S101 to the sender device 20 (step S102).

[0138] The communication unit 201 of the sender device 20 receives the public key pk from the receiver device 10 (step S103). The public key pk is stored in the storage unit 203.

[0139] The encryption unit 202 of the sender device 20 executes the FESTA encryption algorithm Enc according to the proposed method to generate ciphertext ct from plaintext m (step S104). That is, the encryption unit 202 receives the public key pk and the plaintext m as input, and outputs the ciphertext ct according to the above steps 2-1 to 2-6.

[0140] The communication unit 201 of the sender device 20 transmits the ciphertext ct generated in the above step S104 to the receiver device 10 (step S105).

[0141] The communication unit 101 of the receiver device 10 receives the ciphertext ct from the sender device 20 (step S106).

[0142] The decryption unit 104 of the receiver device 10 executes the FESTA decryption algorithm Dec according to the proposed method to generate plaintext m by decrypting the ciphertext received in the above step S106 (step S107). That is, the decryption unit 104 receives the private key sk and the ciphertext m as input, and outputs the plaintext m according to the above steps 3-1 to 3-6.

[0143] <Hardware configuration example> The receiver device 10 and the sender device 20 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 9. Fig. 9 is a diagram showing an example of the hardware configuration of the computer 500.

[0144] 9 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0145] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0146] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0147] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0148] 9 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0149] <Summary> As described above, the encrypted communication system 1 according to this embodiment can efficiently calculate isogenous mappings whose degree is not smooth, thereby enabling encrypted communication with reduced data size and computational costs compared to conventional FESTA.

[0150] For example, if the security parameter is set to λ=128, the system parameters of FESTA according to the proposed method are as follows:

[0151] p=2 272 3 169-1 a=272 b=162 k=131 d A =7·4146202281703185540486171127346289453649 d1=19·7642166099557799711044452690191647267891

[0152] In particular, the size of p is 281 bits, which is one-fourth of the size of the conventional FESTA.

[0153] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0154] [References] Reference 1: David Jao and Luca De Feo. "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies." Post-Quantum Cryptography: 4th International Workshop, 2011. Reference 2: Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Amir Jalali, David Jao, Brian Koziel, Brian LaMacchia, Patrick Longa, et al. "Supersingular isogeny key encapsulation." Submission to the NIST Post-Quantum Standardization project, 2017. Reference 3: Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz Panny, Joost Renes. "CSIDH: an efficient post-quantum commutative group action." Advances in Cryptology-ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security 2018. Reference 4: Wouter Castryck and Thomas Decru. "An efficient key recovery attack on SIDH." Cryptology ePrint Archive, 2022. https: / / eprint.iacr.org / 2022 / 975 Reference 5: Damien Robert. "Breaking SIDH in polynomial time." Cryptology ePrint Archive, 2022. https: / / eprint.iacr.org / 2022 / 1038 Reference 6: Luca De Feo, David Kohel, Antonin Leroux, Christophe Petit, Benjamin Wesolowski. "SQISign: compact post-quantum signatures from quaternions and isogenies." Advances in Cryptology-ASIACRYPT 2020: 26th International Conference on the Theory and Application of Cryptology and Information Security, 2020. [Explanation of symbols]

[0155] 1. Encrypted communication system 10 Receiver Device 20 Sender Device 30 Communication Network 101 Communications Department 102 System parameter setting section 103 Key generation section 104 Decoding unit 105 Storage section 201 Communications Department 202 Encryption section 203 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. Integers a' and b' determined from the security parameter λ, and 2 ２λ a larger integer d that is not a smooth number Ａ =2 ａ' +k・3 ｂ' and d １ =2 ａ' -k.3 ｂ' (where k is a natural number) and integers a = 2a', b = 2b', d ２ =3 ｂ and prime number p=2 ａ ・3f-1 (where f is a natural number) and the finite field F ｐ＾２ A given elliptic curve E on ０ Twisted subgroup E of ０ [2 ａ ] generator P ０ , Q ０ A communication system that realizes encrypted communication using isogenous mapping cryptography with the following system parameters: Choose a random 2x2 regular diagonal matrix A on Z / 2aZ, and Ａ and P ０ , Q ０ Random d is generated from the RandIsogImages algorithm Ａ - homogeneous map φ Ａ : E ０ →E Ａ and P Ａ =φ Ａ (P ０ ) and Q Ａ =φ Ａ (Q ０ ) to generate a public key pk=(E Ａ , R Ａ , S Ａ ) (However, R Ａ and S Ａ is (R Ａ , S Ａ ) Τ = A(P Ａ , Q Ａ ) Τ a key generation unit that generates a value satisfying the above formula (a value satisfying the above formula) and a secret key sk=A that is used to decrypt a ciphertext encrypted with the public key pk; A communication system having:

2. Plain text m and the public key pk=(E Ａ , R Ａ , S Ａ ) and based on s Ｂ =2m+1∈(Z / 2 ａ Z) ＊ Select and press d １ and P ０ , Q ０ A random d is generated from the RandIsogImages algorithm. １ - homogeneous map φ １ : E ０ →E １ and P １ =φ １ (P ０ ) and Q １ =φ １ (Q ０ ) and generate a random d ２ - homogeneous map φ ２ : E Ａ →E ２ By selecting １ , R １ , S １ , E ２ , R ２ , S ２ ) (However, R １ and S １ (R １ , S １ ) Τ = B(P １ , Q １ ) Τ The value that satisfies ２ and S ２ (R ２ , S ２ ) Τ = B (φ ２ (R Ａ ), φ ２ (S Ａ )) Τ B is a 2x2 regular diagonal matrix B = diag(s Ｂ , s Ｂ －１ an encryption unit for generating 2. The communication system of claim 1, comprising:

3. The secret key sk=A and the ciphertext ct=(E １ , R １ , S １ , E ２ , R ２ , S ２ ) and Atk, an algorithm for executing a SIDH attack based on Ｎ_１,Ｎ_２ (E １ , E ２ , R １ , S １ , R ２ ', S ２ ') (However, R ２ ' and S ２ ' is (R ２ ', S ２ ') Τ = kd １ A －１ (R ２ , S ２ ) Τ A value that satisfies １ = d Ａ d １ , N ２ = k ２ d ２ ) by (ψ １ , ψ ２ , E Ａ ') and B = diag(s Ｂ , s Ｂ －１ ) and k(R ２ , S ２ ) Τ = B(ψ ２ (R Ａ ), ψ ２ (S Ａ )) Τ A regular 2 × 2 diagonal matrix B is calculated, and the plaintext m = (s Ｂ -1) / 2 (where s Ｂ =min{s Ｂ , 2 ａ -s Ｂ }), 3. The communication system of claim 2, comprising:

4. The RandIsogImages algorithm uses the degree D and the elliptic curve E ０ Given a set of any finite number of points X on the ０ →E Ａ and an image τ(X) of the set X with respect to the isogeny τ.

5. Integers a' and b' determined from the security parameter λ, and 2 ２λ a larger integer d that is not a smooth number Ａ =2 ａ' +k・3 ｂ' and d １ =2 ａ' -k.3 ｂ' (where k is a natural number) and integers a = 2a', b = 2b', d ２ =3 ｂ and prime number p=2 ａ ・3f-1 (where f is a natural number) and the finite field F ｐ＾２ A given elliptic curve E on ０ Twisted subgroup E of ０ [2 ａ ] generator P ０ , Q ０ A method used in a communication system that realizes encrypted communication using isogenous mapping cryptography with the following system parameters: a first device that is a recipient of the encrypted communication, Choose a random 2x2 regular diagonal matrix A on Z / 2aZ, and Ａ and P ０ , Q ０ Random d is generated from the RandIsogImages algorithm Ａ - homogeneous map φ Ａ : E ０ →E Ａ and P Ａ =φ Ａ (P ０ ) and Q Ａ =φ Ａ (Q ０ ) to generate a public key pk=(E Ａ , R Ａ , S Ａ ) (However, R Ａ and S Ａ is (R Ａ , S Ａ ) Τ = A(P Ａ , Q Ａ ) Τ a key generation procedure for generating a secret key sk=A used to decrypt a ciphertext encrypted with the public key pk; How to do it.

6. a second device that is a sender of the encrypted communication, Plain text m and the public key pk=(E Ａ , R Ａ , S Ａ ) and based on s Ｂ =2m+1∈(Z / 2 ａ Z) ＊ Select and press d １ and P ０ , Q ０ A random d is generated from the RandIsogImages algorithm. １ - homogeneous map φ １ : E ０ →E １ and P １ =φ １ (P ０ ) and Q １ =φ １ (Q ０ ) and generate a random d ２ - homogeneous map φ ２ : E Ａ →E ２ By selecting １ , R １ , S １ , E ２ , R ２ , S ２ ) (However, R １ and S １ (R １ , S １ ) Τ = B(P １ , Q １ ) Τ The value that satisfies ２ and S ２ (R ２ , S ２ ) Τ = B (φ ２ (R Ａ ), φ ２ (S Ａ )) Τ B is a 2x2 regular diagonal matrix B = diag(s Ｂ , s Ｂ －１ )) encryption procedure, The method of claim 5, wherein the

7. The first device comprises: The secret key sk=A and the ciphertext ct=(E １ , R １ , S １ , E ２ , R ２ , S ２ ) and Atk, an algorithm for executing a SIDH attack based on Ｎ_１,Ｎ_２ (E １ , E ２ , R １ , S １ , R ２ ', S ２ ') (However, R ２ ' and S ２ ' is (R ２ ', S ２ ') Τ = kd １ A －１ (R ２ , S ２ ) Τ A value that satisfies １ = d Ａ d １ , N ２ = k ２ d ２ ) by (ψ １ , ψ ２ , E Ａ ') and B = diag(s Ｂ , s Ｂ －１ ) and k(R ２ , S ２ ) Τ = B(ψ ２ (R Ａ ), ψ ２ (S Ａ )) Τ A regular 2 × 2 diagonal matrix B is calculated, and the plaintext m = (s Ｂ -1) / 2 (where s Ｂ =min{s Ｂ , 2 ａ -s Ｂ }), The method of claim 6, wherein the

8. A program for causing a computer to execute the method according to any one of claims 5 to 7.

Images