Secret square root calculation system, secret normalization system, method thereof, secret calculation device, and program

Abstract

High-speed calculation of square root in secret computation. A secret square root calculation system (100) sets [a] as an input, and calculates [√a]. A flag string generating section (12) generates {x0},..., {x λ‑1} representing the leftmost bits of a. A bit string generating section (13) calculates {y i}: = {x 2i} XOR {x 2i+1} to generate {y0},..., {y λ'‑1}. A flag calculating section (14) calculates {r} for each odd number j, which is calculated by "XOR" of all {x j}. A public value multiplier setting section (16) sets r' as √2 if λ is odd, and 1 if λ is even. An inverse normalization multiplier generating section (17) generates [c'] by combining {y0},..., {y λ'‑1}. A normalization multiplier generating section (18) generates [c] by combining {x λ‑1},..., {x0}. A normalization section (19) calculates [b]: = [a][c]. A square root calculating section (20) calculates [w]: = [√b]*(r' / √2) if r = 1, and [w']: = [√b]*r' if r = 0. An inverse normalization section (21) calculates [w][c'], and right shifts by λ' bits.

Description

TECHNICAL FIELD

[0001] The present application relates to a technique of calculating a square root in secret computation. BACKGROUND

[0002] Secret computation is an encryption technique of calculating an arbitrary function while hiding data. A method of using data by a data user without leaking data to a system operator is expected by using this feature. It is known that there are several methods in secret computation, among which secret computation in which a secret is divided into elements, the processing unit of data is small, and high-speed processing can be performed.

[0003] Secret division refers to a method of converting secret information into several pieces called shares. For example, there is a secret division called a (k, n) threshold method in which n shares are generated from secret information, and the secret can be recovered from k or more shares, but the secret information is not leaked from less than k shares. Specific methods of secret division are known as Shamir secret division, replicated secret division, and the like. In this specification, one piece of a value divided by secret division is referred to as a "share". In addition, the entire set of all shares is referred to as a "divided value".

[0004] In recent years, research on high-level statistics or machine learning based on secret computation is popular. However, these operations mostly include calculations such as reciprocal, square root, exponential, logarithm, and the like, which are more than addition, subtraction, multiplication, and division operations that secret computation is good at. The calculation of the square root is one of the basic operations in a computer or the like, and is used in various situations. In general, it is known that, in the calculation of the square root, a method of calculating by setting the reciprocal of the square root as √x = x / √x is efficient. A method of calculating the square root using the reciprocal of the square root in secret computation is disclosed in Non-Patent Literature 1. In addition, in various function calculations including the square root, it is sometimes necessary to perform a normalization process so that the numerical value converges within a certain range. In secret computation, normalization of the numerical value is performed by shifting the most significant bit (msb).

[0005] PRIOR ART DOCUMENTS

[0006] NON-PATENT LITERATURE

[0007] Non-Patent Literature 1: Okiharayama, D., "Design and Implementation of Secret Real Number Operation Group for Secret Computation AI Implementation - O(|p|) Bit Communication Amount O(1) Round Real Number Oriented Right Shift -", CSS2019, 2019 Summary of the Invention

[0008] The problem that the invention aims to solve

[0009] However, the method disclosed in Non-Patent Document 1 has the problem of high computational cost because it involves multiplying after finding the reciprocal of the square root.

[0010] In view of the aforementioned technical issues, the object of the present invention is to provide a secret calculation technique capable of calculating square roots at high speed.

[0011] To solve the aforementioned problem, the first aspect of the present invention provides a secret square root calculation system comprising multiple secret calculation devices. This system calculates the dispersion value [√a] of the square root of value a, taking the dispersion value [a] of value a as input. λ represents the decimal point position of value a, and λ' is the smallest integer greater than or equal to λ / 2. Each secret calculation device includes: a flag string generation unit that generates a flag string X0,…,X representing the leftmost bit of value a. λ-1 The string of scattered values ​​{X0},…,{X λ-1 The bit string generation unit calculates the dispersion value {X} for each integer i that is greater than or equal to 0 and less than λ'. 2i} and dispersion value {X 2i+1 The bit Y of the "XOR" operation of} i The dispersion value {Y i}, generate bit string Y0,…,Y λ'-1 The string of scattered values ​​{Y0},…,{Y λ'-1}; The flag calculation unit calculates the dispersion value {X} for each odd number j that is greater than or equal to 0 and less than λ. j The XOR division flag r of} represents the dispersion value {r}; the public value multiplier setting unit sets the public value multiplier r' to be √2 when λ is odd and 1 when λ is even; the inverse normalization multiplier generation unit generates the string {Y0},…,{Y} of the dispersion value. λ'-1 The dispersion value [c'] of the inverse normalized multiplier c' after the bits are combined in the forward order; the normalized multiplier generator generates the string {X0},…,{X... λ-1 The normalized multiplier c after reverse bit combination has a dispersion value [c]; a normalization part calculates the dispersion value [b] after multiplying the dispersion value [a] and the dispersion value [c]; a square root calculation part calculates the dispersion value [w'] using the dispersion value [b], the dispersion value {r} and the public value multiplier r', which calculates [√b]*(r' / √2) when r=1 and [√b]*r' when r=0; and an inverse normalization part calculates the dispersion value [√a] after right-shifting the result of multiplying the dispersion value [w'] and the dispersion value [c'] by λ' bits.

[0012] The second aspect of the secret normalization system of the present invention comprises multiple secret computing devices. This system normalizes the dispersion value [√a] of value a in order to calculate the dispersion value [a] of the square root of value a. λ is the decimal point position of value a, and λ' is the smallest integer greater than or equal to λ / 2. The secret computing devices include: a flag string generation unit that generates a flag string X0,…,X representing the leftmost bit of value a. λ-1 The string of scattered values ​​{X0},…,{X λ-1};Bit string generation unit, for each integer i greater than or equal to 0 and less than λ', calculates the dispersion value {X} 2i} and dispersion value {X 2i+1 The bits Y calculated by the "XOR" operation of} i The dispersion value {Y i}, generate bit string Y0,…,Y λ'-1 The string of scattered values ​​{Y0},…,{Y λ'-1}; The flag calculation unit calculates the dispersion value {X} for all odd numbers j that are greater than or equal to 0 and less than λ. j The division operation flag r, calculated by the "XOR" operation of}, has a dispersion value {r}; the public value multiplier setting unit sets the public value multiplier r' to be √2 when λ is odd and 1 when λ is even; the inverse normalization multiplier generation unit generates a string {Y0},…,{Y} of the dispersion value. λ'-1 The dispersion value [c'] of the inverse normalized multiplier c' after the bits are combined in the forward order; the normalized multiplier generator generates the string {X0},…,{X... λ-1 The dispersion value [c] of the normalized multiplier c after reverse bit combination; and the normalization part, which calculates the dispersion value [b] after multiplying the dispersion value [a] and the dispersion value [c].

[0013] Invention Effects

[0014] According to the present invention, it is possible to calculate the square root at high speed in secret calculation. Attached Figure Description

[0015] Figure 1 This is a diagram illustrating the functional structure of a secret square root calculation system.

[0016] Figure 2 This is a diagram illustrating the functional structure of a secret computing device.

[0017] Figure 3 This is a diagram illustrating the functional structure of the square root calculation unit.

[0018] Figure 4 This is a diagram illustrating the process of calculating the secret square root.

[0019] Figure 5is a diagram illustrating a process of a square root calculation section.

[0020] Figure 6 is a diagram illustrating a functional structure of a computer. DETAILED DESCRIPTION

[0021] Hereinafter, an embodiment of the present application will be described in detail. In addition, the same reference numerals are added to structural sections having the same function in the drawings, and repeated description is omitted.

[0022] In this specification, the following notation is used.

[0023] [·] is data in which a value is hidden. For example, a value can be used by using a Shamir secret sharing, a replicated secret sharing, or the like.

[0024] {·} is data in which a bit is hidden. For example, a value can be used by using a replicated secret sharing on Z2, or the like.

[0025] λ indicates a decimal point position. It is assumed that a half or the like of the number of bits |p| of a ring or a field used in secret calculation.

[0026] [a? b : c] is, if a = 1, b is indicated, and if a = 0, c is indicated.

[0027] [Math. 1]

[0028] Λ, V

[0029] respectively indicate "NOT", "AND", "OR", and "XOR".

[0030] By deciding a public decimal point position in an integer on a ring, a real number in which a decimal point is fixed can be considered. In the present application, a real number in which a decimal point is fixed which is thus processed and represented on a ring is simply described as a real number.

[0031] [Embodiment: Secret Square Root Calculation System]

[0032] An embodiment of the present application is a secret square root calculation system and a method in which a value a is set as an input, and a secret square root of a value a is calculated in a case where the value a is hidden. Hereinafter, an outline of a square root protocol executed by the secret square root calculation system of the embodiment will be described.

[0033] In the past, in secret computation, an elementary function group exceeding addition, subtraction, multiplication, an inverse, or a square root, an exponential function, a logarithmic function, and the like, has not been implemented because of a large processing cost. In the present application, in order to solve these problems, an algorithm capable of efficiently and uniformly approximating an elementary function group on secret computation is used, and a square root can be efficiently calculated. This approximation method can approximate a main elementary function including a square root by changing a parameter in a single method. Further, this approximation method is theoretically the most efficient in that the communication amount / round number is equivalent to three times of real number multiplication in single precision (23 bits).

[0034] In square root calculation on a plaintext, in order to efficiently perform calculation, normalization is sometimes performed as follows. The position of a bit of 1 (that is, 2 0 ) in the decimal point position of input a is set as e from the most significant bit (msb) of input a, and the following transformation is performed. That is, 2 e is multiplied, and normalization to the interval [1, 2) is performed, 1 / √2 e is multiplied after the square root √(2 e a) is found, and the like.

[0035] [Math. 2]

[0036]

[0037] In Non-Patent Literature 1, a method using the relationship of 1 / √a x a = √a is used. In the present application, in order to more efficiently perform calculation, √a is directly found. In this case, the inverse operation of normalization after approximation becomes a division operation. Therefore, in order to divide √2 e , √2 λ-e is multiplied, and the like. λ

[0038] The following shows an algorithm for approximating an elementary function group on secret computation by an 8th degree polynomial.

[0039] [Algorithm 1: Function approximation protocol based on an 8th degree polynomial]

[0040] Input: [x] ∈ [L, R)

[0041] Parameters: A, B, C, D, F, G, H, I, J, k, l, m, n, o, p, q, a, b, g, d, z

[0042] Output: [func(x)] corresponding to a function func of interest

[0043] 1: Calculate [y'] := [x (d x + a - i) - j] by product-sum, and lower the decimal point position by right shift. ​

[0044] 2: Calculate [y] := [y' + (Ix + J)].

[0045] 3: Calculate [z'] := [y(ζy + B - k) + (C - I)x - m] by multiplication and by right shift to lower the decimal point position.

[0046] 4: Calculate [z] := [z' + (ky + lx + m)].

[0047] 5: Calculate [w' / γ] := [z(αz + D - n / γ) + (βx + F - o / γ)y + (G - p)x + (H - q) / γ] by multiplication and by γ-based multiplication and lowering of the decimal point position to obtain [w'].

[0048] 6: Output [w] := [w' + (nz + oy + px + q)].

[0049] The lowering of the decimal point position performed in steps 1 and 3 of Algorithm 1 can be efficiently performed, for example, by using the divisor open division operation disclosed in Non-Patent Literature 1.

[0050] The simultaneous performance of the open value multiplication operation and the lowering of the decimal point position performed in step 5 of Algorithm 1 can be efficiently performed, for example, by using the following algorithm.

[0051] [Algorithm 2: Simultaneous performance of open value multiplication operation without increase in processing cost from right shift]

[0052] Input: [x], multiplier m, shift amount σ

[0053] Output: Shifted [mx]

[0054] 1: Calculate open value 2 σ / m.

[0055] 2: Calculate the following by open value division operation. Here, [mx] is regarded as a representation in which the decimal point position is lowered by σ from [x].

[0056] [Equation 3]

[0057]

[0058] The parameters L, R, A, B, C, D, F, G, H, I, J, k, 1, m, n, o, p, q, α, β, γ, δ, ζ used in Algorithm 1 are set in accordance with the function func to be approximated. In the case where the square root function is to be approximated as an object in the present application, the parameters are set as in the following table, for example. In addition, e x ,e y ,e z ,ew is the decimal point position of x, y, z, w, e y , e z , e w is the decimal point position of y', z', w'. These are parameters that determine the amount of right shift in the 8th degree polynomial approximation. For example, the amount of right shift in the calculation of y from y' is e y - e y .

[0059] [Table 1]

[0060]

[0061] The following shows an algorithm for calculating a square root on a secret computation using Algorithm 1. Here, the explanation is given by dividing into an algorithm for normalizing an input to be the calculation object to a square root calculation (Algorithm 3) and an algorithm for calculating a square root using this algorithm (Algorithm 4).

[0062] [Algorithm 3: Normalization protocol for square root]

[0063] Input: [a]

[0064] Output: [b], [r], [c'] (where b is a value obtained by moving the leftmost bit of a to the decimal point position λ (i.e., a value obtained by normalizing a to [1, 2)). R is a true value indicating whether to divide the calculation result by V2. c' is a number of a power of 2 used in the inverse operation of the normalization.)

[0065] 1: Obtain the bit representation of [a] by bit decomposition {a0},..., {a λ-1}.

[0066] 2: Obtain a bit string {X0},..., {X λ-1} in which only the position of the leftmost bit of a becomes 1.

[0067] 3: Set λ' by the following formula. That is, set the smallest integer of λ / 2 or more as λ'.

[0068] [Formula 4]

[0069]

[0070] 4: Set {Y i} for each i < λ' by the following formula. That is, calculate the "exclusive OR" of {X 2i} and {X 2i+1}.

[0071] [Formula 5]

[0072]

[0073] wherein, when λ is odd, {Y λ'-1} is set by the following equation.

[0074] [Math. 6]

[0075] {Y λ′-1} := {X 2i}

[0076] 5: {r} is set by the following equation. That is, for each odd number j that is greater than or equal to 0 and less than λ, the "exclusive OR" of all {X j} is calculated. R indicates whether or not division by √2 is required.

[0077] [Math. 7]

[0078]

[0079] 6: In the mod p transformation, {r} is set to [r].

[0080] 7: In the bit combination, {Y0},..., {Y λ'-1} are combined and set to [c'].

[0081] 8: In the bit combination, {X λ-1},..., {X0} are combined and set to [c].

[0082] 9: [b] is calculated as [a] [c], and [b], [r], [c'] are output.

[0083] [Algorithm 4: Square root protocol]

[0084] Input: [a]

[0085] Output: [V a]

[0086] 1: By Algorithm 3, [b], [r], [c'], which are the values of [a] normalized to [1, 2), the [c'] required for the inverse operation of the normalization, and [r], are obtained.

[0087] 2: λ' is set by the following equation. That is, the smallest integer that is λ / 2 or greater is set to λ'.

[0088] [Math. 8]

[0089]

[0090] 3: r' is set to √2 if λ is odd, and r' is set to 1 if λ is even.

[0091] 4: Perform Algorithm 1 on [b] to calculate the square root of [b]. At this time, the multiplication operation of the public value γ performed in Step 5 of Algorithm 1 sets the condition to [r] and performs the selective public multiplication operation to calculate [w' / γ] * γ * [r?1 / √2:1] * r' with the options of r'γ and (r' / √2)γ, respectively. Set the result to [w].

[0092] 5: Calculate [w] [c']. At this time, shift right by λ' bits more than usual.

[0093] The generation of the flag string representing the leftmost bit performed in Step 2 of Algorithm 3 can be efficiently performed, for example, by using the following algorithm.

[0094] [Algorithm 5: msb flag string acquisition protocol]

[0095] Input: Integer represented by bits {a0},..., {an-1} λ-1}

[0096] Output: Bit string {X0},..., {Xn-1} in which only the msb position of a is set to 1 λ-1}

[0097] 1: Set {f0},..., {fn-1} := {a0},..., {an-1}. At this time, {f0},..., {fn-1} become bit strings in which 0, 1, 0, 1,..., 1 are arranged in order of the msb. i i+1 . i .

[0098] 2: Set {f0},..., {fn-1} := {a0},..., {an-1}. At this time, {f0},..., {fn-1} become bit strings in which 0, 0, 0, 1, 1, 1,..., 1 are arranged in order of the msb. λ-1 λ-1 . λ-1 .

[0099] 3: Set {X0},..., {Xn-1} := {f0},..., {fn-1} XOR {f0},..., {fn-1}. At this time, {X0},..., {Xn-1} become bit strings in which 0, 0, 0, 1, 0, 0,..., 0 are arranged in order of the msb. i i . i+1 .

[0100] 4: Set {X0},..., {Xn-1} := {a0},..., {an-1}. At this time, {X0},..., {Xn-1} become bit strings in which only the msb position is set to 1. λ-1 λ-1 . λ-1 .

[0101] The selective public multiplication operation performed in Step 4 of Algorithm 4 can be efficiently performed, for example, by using the following algorithm.

[0102] [Algorithm 6: Multiplication operation on a selective public multiplier to be right-shifted value]

[0103] ​​​​Input: [a], multiplier m0, m1, condition [c]

[0104] Output: [m1a] if c = 1, [m0a] if c = 0

[0105] 1: Calculate [m1a], [m0a].

[0106] 2: Output [c? m1a : m0a] by if-then-else gate.

[0107] The public value multiplication operation performed in Step 1 of Algorithm 6 can be efficiently performed, for example, by combining Algorithm 2 and the following algorithm.

[0108] 〔Algorithm 7: Right shift / division public division operation with multiple divisors〕

[0109] Input: [a], divisors d0, d1,..., d n-1

[0110] Output: [a / d0], [a / d1],..., [a / d n-1 ]

[0111] 1: Calculate the quotient [q] of [a].

[0112] 2: Calculate and output [a / di] for each i by right shift / division public division operation using the quotient [q]. i

[0113] The quotient calculated in Step 1 of Algorithm 7 can be efficiently calculated by quotient transfer (see Reference 1).

[0114] Reference 1> Ryo Kikuchi, Dai Ikarashi, Takahiro Matsuda, Koki Hamada, and Koji Chida, "Efficient bit-decomposition and modulus-conversion protocols with an honest majority," Proceedings of Information Security and Privacy - 23rd Australasian Conference (ACISP 2018), pp. 64-82, July 11-13, 2018.

[0115] <Secret square root calculation system 100>

[0116] The secret square root calculation system 100 of the embodiment is an information processing system that executes the square root protocol described above. As shown in Fig. 1, the secret square root calculation system 100 includes a server 101 and a client 102.​Figure 1 As shown, the secret square root calculation system 100 includes N (≥3) secret computing devices 11,…,1 N In this embodiment, the secret computing devices 11,...,1 N Each device is connected to communication network 9. Communication network 9 is a line-switched or packet-switched communication network that enables the connected devices to communicate with each other; for example, it can use the Internet, LAN (Local Area Network), WAN (Wide Area Network), etc. Furthermore, the devices do not necessarily need to be able to communicate online via communication network 9. For example, it can also be configured to send input to secret computing device 1. n Information (n = 1, ..., N) is stored on a removable recording medium such as magnetic tape or USB memory, and is input offline from the removable recording medium to the secret computing device 1. n .

[0117] Secret calculation device 1 included in the secret square root calculation system 100 of the embodiment n For example, Figure 2 The unit shown includes: a bit decomposition unit 11, a flag string generation unit 12, a bit string generation unit 13, a flag calculation unit 14, a flag transformation unit 15, a public value multiplier setting unit 16, an inverse normalization multiplier generation unit 17, a normalization multiplier generation unit 18, a normalization unit 19, a square root calculation unit 20, an inverse normalization unit 21, and a right shift unit 22. The square root calculation unit 20, for example... Figure 3 The device shown includes a parameter storage unit 200, a first product summation unit 201, a first addition unit 202, a second product summation unit 203, a second addition unit 204, a third product summation unit 205, a product calculation unit 206, and a third addition unit 207. This secret computing device 1 n By connecting with other secret computing devices 1 n' (n'=1,…,N, where n≠n') Coordinate the processing of each step described later to realize the secret square root calculation method of the implementation method.

[0118] Secret Computing Device 1 n For example, a special device is constructed by loading special programs into a known or specialized computer equipped with a central processing unit (CPU) and main storage (RAM). Secret Computing Device 1 n For example, each process is executed under the control of the central processing unit. The data is input into the secret computing device 1. nData, or data obtained in various processes, is stored, for example, in the main storage device. Data stored in the main storage device is read out as needed and used by other processes. Secret Computing Device 1 n Each processing unit can also be at least partially composed of hardware such as integrated circuits. Secret Computing Device 1 n The various storage units can be composed of main storage devices such as RAM (Random Access Memory), auxiliary storage devices composed of semiconductor memory elements such as hard disks, optical disks, or flash memory, or middleware such as relational databases or key-value stores.

[0119] refer to Figure 4 This describes the processing procedure of the secret square root calculation method executed by the secret square root calculation system 100 of the implementation method.

[0120] In step S11, each secret computing device 1 n The bit decomposition unit 11 performs bit decomposition on the dispersion value [a] of the value a input to the secret square root calculation system 100 to obtain the bit representation a0,…,a of the value a. λ-1 The string of scattered values ​​{a0},…,{a λ-1 The bit decomposition unit 11 will decompose the string of scattered values ​​{a0},…,{a0}. λ-1 Input to flag string generation section 12.

[0121] In step S12, each secret computing device 1 n The flag string generation section 12 uses the scattered value string {a0},…,{a λ-1 Generate a string X0,…,X representing the leftmost bit of the value a. λ-1 The string of scattered values ​​{X0},…,{X λ-1 The flag string representing the leftmost bit is, for example, a flag string where the position of the leftmost bit is 1, obtained by using only the algorithm 5 described above. The flag string generation unit 12 generates the string of scattered values ​​{X0},…,{X... λ-1 The output is sent to the bit string generation unit 13, the flag calculation unit 14, and the normalized multiplier generation unit 18.

[0122] In step S13, each secret computing device 1 n The bit string generation unit 13 uses the scattered value string {X0},…,{X λ-1}, generating {Y} when i < λ'. i}:={X 2i}XOR{X 2i+1 The bit string Y0,…,Y} λ'-1 The string of scattered values ​​{Y0},…,{Yλ'-1}. Here, λ' is the smallest integer greater than or equal to λ / 2. That is, for each integer i greater than or equal to 0 and less than λ', the scatter value {X} is calculated. 2i} and dispersion value {X 2i+1 The bit y of the "XOR" operation of} i The dispersion value {Y i Furthermore, when λ is odd, let it be {Y}. λ'-1}:={X 2i The bit string generation unit 13 generates a string of scattered values ​​{Y0},…,{Y}. λ'-1 Output to the inverse normalized multiplier generator 17.

[0123] In step S14, each secret computing device 1 n The flag calculation unit 14 uses the string of scattered values ​​{X0},…,{X λ-1}, calculate the dispersion value {r} of the flag r (hereinafter also referred to as the "division flag") indicating whether to divide the result by √2. Specifically, for each odd number j greater than or equal to 0 and less than λ, calculate all dispersion values ​​{X}. j The "XOR" operation is performed on the scatter value {r}. The flag calculation unit 14 outputs the scatter value {r} to the flag transformation unit 15.

[0124] In step S15, each secret computing device 1 n The flag transformation unit 15 transforms the dispersion value {r} of the division operation flag r into the dispersion value [r] through mod p transformation. The flag transformation unit 15 outputs the dispersion value [r] to the square root calculation unit 20.

[0125] In step S16, each secret computing device 1 n The public value multiplier setting unit 16 sets r' = √2 when λ is odd and r' = 1 when λ is even, and sets the public value r' (hereinafter also referred to as "public value multiplier") to be multiplied by the calculation result. The public value multiplier setting unit 16 outputs the public value multiplier r' to the square root calculation unit 20.

[0126] In step S17, each secret computing device 1 n The inverse normalization multiplier generator 17 generates the series of dispersed values ​​{Y0},…,{Y0} by passing them through the string of dispersed values. λ'-1 The bits are combined in the forward order to generate a scatter value [c'] of the multiplier c' (hereinafter also called "inverse normalization multiplier"), which is multiplied by the calculation result for the inverse normalization operation. The inverse normalization multiplier generation unit 17 outputs the scatter value [c'] to the inverse normalization unit 21.

[0127] In step S18, each secret computing device 1 n The normalized multiplier generator 18 generates the series of dispersed values ​​{X0},…,{X...λ-1 The bit-concatenation is performed in reverse order to generate a dispersion value [c] of a multiplier c (hereinafter, also referred to as "normalization multiplier") which is multiplied to the input for normalization. The normalization multiplier generation section 18 outputs the dispersion value [c] to the normalization section 19.

[0128] In step S19, the normalization section 19 of each secret computation device 1 n calculates a dispersion value [b] of a value b which is normalized from the value a by multiplying the dispersion value [a] of the value a by the dispersion value [c] of the normalization multiplier c. The normalization section 19 outputs the dispersion value [b] to the square root calculation section 20.

[0129] In step S20, the square root calculation section 20 of each secret computation device 1 n calculates a square root of the value b by executing the algorithm 1 using parameters for approximating the square root function by an 8th degree polynomial. At this time, the multiplication operation of the public value γ performed in step 5 of the algorithm 1 is performed by executing the algorithm 6 with the condition set to the dispersion value [r] of the division operation flag r and the options set to r'γ, (r' / V2)γ, respectively. That is, the square root calculation section 20 uses the dispersion value [b] of the value b and the dispersion value [r] of the division operation flag r and the public value multiplier r' to calculate [Vb]*(r' / V2) when r = 1 and [Vb]*r' when r = 0, generates a dispersion value [w] of a calculation result w. The square root calculation section 20 outputs the dispersion value [w] to the inverse normalization section 21.

[0130] In step S21, the inverse normalization section 21 of each secret computation device 1 n multiplies the dispersion value [w] of the calculation result w by the dispersion value [c'] of the inverse normalization multiplier c'. The inverse normalization section 21 outputs the multiplication operation result [w][c'] to the right shift section 22.

[0131] In step S22, the right shift section 22 of each secret computation device 1 n outputs the multiplication operation result [w][c'] as a dispersion value [Va] of a square root of the value a by right shifting the multiplication operation result [w][c'] by λ' bits.

[0132] The process performed by the square root calculation section 20 will be described in detail with reference to Figure 5

[0133] In the parameter storage section 200, parameters A, B, C, D, F, G, H, I, J, k, 1, m, n, o, p, q, α, β, γ, δ, ζ for approximating the square root function by an 8th degree polynomial are stored. Each parameter is determined in advance according to the function to be approximated, and in the case of approximating the square root function, the values exemplified in Table 1 can be set.

[0134] ​In step S201, the first product-sum section 201 of the square root calculating section 20 calculates [y'] := [x(δx + A - I) - J] by a product-sum operation, and reduces the decimal point position by right shift. Here, x is the value B normalized by the value A. That is, [x] := [B]. The first product-sum section 201 outputs [y'] to the first adding section 202.

[0135] In step S202, the first adding section 202 of the square root calculating section 20 calculates [y] := [y' + (Ix + J)]. The first adding section 202 outputs [y] to the second product-sum section 203.

[0136] In step S203, the second product-sum section 203 of the square root calculating section 20 calculates [z'] := [y(ζy + B - k) + (C - I)x - m] by a product-sum operation, and reduces the decimal point position by right shift. The second product-sum section 203 outputs [z'] to the second adding section 204.

[0137] In step S204, the second adding section 204 of the square root calculating section 20 calculates [z] := [z' + (ky + lx + m)]. The second adding section 204 outputs [z] to the third product-sum section 205.

[0138] In step S205, the third product-sum section 205 of the square root calculating section 20 calculates [w' / γ] := [z(αz + D - n / γ) + (βx + F - o / γ)y + (G - p)x + (H - q) / γ] by a product-sum operation. The third product-sum section 205 outputs [w' / γ] to the selected product calculating section 206.

[0139] In step S206, the selected product calculating section 206 of the square root calculating section 20 sets the condition as [r], and sets the options as r'γ, (r' / √2)γ, respectively, and executes Algorithm 6. That is, using the dispersion value [r] of the division operation flag r, [w'] is calculated as [w' / γ]*(r' / √2)γ when r = 1, and [w'] is calculated as [w' / γ]*r'γ when r = 0. The selected product calculating section 206 outputs [w'] to the third adding section 207.

[0140] In step S207, the third adding section 207 of the square root calculating section 20 calculates [w] := [w' + (nz + oy + px + q)].

[0141] [Modified example: secret normalization system]

[0142] The secret square root calculation system 100 of the embodiment is configured to execute both the normalization for square root calculation (algorithm 3) and the square root calculation (algorithm 4). The secret normalization system of the modification example is configured to execute only the part of performing the normalization for square root calculation (algorithm 3) in the secret square root calculation system 100. That is, the secret normalization system outputs the dispersion value [b] of the value b that normalizes the value a to [1, 2), the dispersion value [c'] of the inverse normalization multiplier c', and the dispersion value [r] of the division operation flag r, with the dispersion value [a] of the value a as input. Specifically, the secret calculation device 1 included in the secret normalization system of the modification example n has a bit resolution section 11, a flag string generation section 12, a bit string generation section 13, a flag calculation section 14, a flag transformation section 15, an inverse normalization multiplier generation section 17, a normalization multiplier generation section 18, and a normalization section 19.

[0143] The above describes the embodiments of the present application, but the specific structure is not limited to these embodiments, and it is needless to say that even if there is a proper design change or the like within a range not departing from the gist of the present application, it is included in the application. The various processes described in the embodiments can be executed not only in the order of time as described, but also in parallel or individually according to the processing capacity of the device that executes the process or as needed.

[0144] [Program, recording medium]

[0145] In the case where the various processing functions in each device described in the above-described embodiments are implemented by a computer, the processing content of the function proper to each device is described by a program. Then, the program is read into the storage section 1020 of the computer shown in Fig. 10, and the various processing functions in each device described above are implemented on the computer by causing the control section 1010, the input section 1030, the output section 1040, and the like to act. Figure 6 The program that describes the processing content can be recorded in a recording medium that is readable by a computer. As the recording medium that is readable by a computer, for example, any medium such as a magnetic recording device, an optical disk, an optical magnetic recording medium, a semiconductor memory, or the like can be used.

[0146] The program that describes the processing content can be recorded in a recording medium that is readable by a computer. As the recording medium that is readable by a computer, for example, any medium such as a magnetic recording device, an optical disk, an optical magnetic recording medium, a semiconductor memory, or the like can be used.

[0147] Furthermore, the distribution of the program is performed, for example, by a detachable recording medium such as a DVD, a CD-ROM, or the like on which the program is recorded, by sale, transfer, rental, or the like. Further, it can be configured that the program is stored in a storage device of a server computer, and the program is distributed by forwarding the program from the server computer to another computer via a network.

[0148] A computer that executes such a program temporarily stores, for example, a program recorded in a detachable recording medium or a program transferred from a server computer in its own storage device first. Then, at the time of execution processing, the computer reads the program stored in its own storage device and executes processing according to the read program. Also, as another execution method of the program, the computer can directly read the program from the detachable recording medium, execute processing according to the program, and further, can sequentially execute processing according to the accepted program each time a program is transferred from the server computer to the computer. Also, a structure that executes the above processing can be provided as a so-called ASP (Application Service Provider) type service that realizes a processing function by not performing transfer of a program from the server computer to the computer, but by only the execution instruction and the result acquisition. Also, in the program in the present mode, information for processing of an electronic computer, that is, information based on a program (although not a direct instruction for the computer, data and the like that have the nature of specifying processing of the computer) is included.

[0149] Also, in the present mode, the present device is provided by executing a prescribed program on a computer, but at least a part of the processing contents can be realized in hardware.

Claims

1. A secret square root calculation system including a plurality of secret calculation devices, which is given a dispersion value [a] of a value a as input, and calculates a dispersion value [V a] of a square root of the value a, λ is a decimal point position of the value a, λ' is a smallest integer greater than or equal to λ / 2, A, B, C, D, F, G, H, I, J, k, 1, m, n, o, p, q, a, β, γ, δ, ζ are parameters for approximating a square root function as an 8th degree polynomial, [x]:=[B] is given, the secret calculation devices include: The flag string generating section generates a flag string X0,..., X λ-1 representing the leftmost bit of the value a, and a string {X0},..., {X λ-1} of the dispersion values. The bit string generation unit calculates the dispersion value {X} for each integer i that is greater than or equal to 0 and less than λ'. 2i } and the dispersion value {X 2i+1 The bit y of the "XOR" operation of} i The dispersion value {Y i }, generate bit string Y0,…,Y λ'-1 The string of scattered values ​​{Y0},…,{Y λ'-1 When λ is odd, let {Y} λ'-1 } is {X 2i }; The flag calculating section calculates a dispersion value {r} of a division operation flag r, which is an "exclusive OR" of all the dispersion values {X j} of the divided values Xj for each odd number j that is equal to or larger than 0 and smaller than λ. a public value multiplier setting section which sets a public value multiplier r' which becomes V2 when λ is odd and 1 when λ is even; The inverse normalization multiplier generating section generates a dispersion value [c'] of the inverse normalization multiplier c' after the bit-joining in the normal order of the strings {Y0},..., {Y λ'-1} The normalization multiplier generating section generates a dispersion value [c] of the normalization multiplier c after bit-joining in reverse order of the dispersion value of the string {X0},..., {X λ-1} of the dispersion value [c] of the normalization multiplier c after bit-joining in reverse order of the dispersion value of the string {X0},..., {X a normalization section which calculates a dispersion value [b] obtained by multiplying the dispersion value [a] and the dispersion value [c]; a square root calculation section which calculates a dispersion value [w] obtained by calculating [V b] * (r' / V2) when r=l and [V b] * r' when r=0 using the dispersion value [b] and the dispersion value {r} and the public value multiplier r'; an inverse normalization section which calculates the dispersion value [V a] obtained by right shifting the multiplication result of the dispersion value [w] and the dispersion value [c'] by λ' bits, the square root calculation section includes: a first product-sum section which calculates [y'] := [x(δx+A-I)-J]; a first addition section which calculates [y]:=[y'+(Ix+J)]; a second product-sum section which calculates [z'] := [y(ζy+B-k)+(C-I)x-m]; a second addition section which calculates [z]:=[z'+(ky+lx+m)]; a third product-sum section which calculates [w' / γ]:=[z(αz+D-n / γ)+(βx+F-o / γ)y+(G-p)x+(H-q) / γ]; a selection product calculation section which calculates [w' / γ] * (r' / V2)γ when r=l and [w' / γ] * r'γ when r=0 using the dispersion value {r}, and sets the calculation result as [w']; a third addition section which calculates [w]:=[w'+(nz+op+px+q)].

2. A secret square root calculation method which is executed by a secret square root calculation system including a plurality of secret calculation devices, which is given a dispersion value [a] of a value a as input, and calculates a dispersion value [V a] of a square root of the value a, λ is a decimal point position of the value a, λ' is a smallest integer greater than or equal to λ / 2, A, B, C, D, F, G, H, I, J, k, 1, m, n, o, p, q, a, β, γ, δ, ζ are parameters for approximating a square root function as an 8th degree polynomial, [x]:=[B] is given, The flag string generating section of each secret computing device generates a flag string X0,..., X λ-1 representing the leftmost bit of the value a, and a string {X0},..., {X λ-1} of the dispersion values of the flag string For each integer i that is greater than or equal to 0 and less than λ', the bit string generation unit of each secret computing device calculates the dispersion value {X}. 2i } and the dispersion value {X 2i+1 The bit Y after XORing} i The dispersion value {Y i }, generate bit string Y0,…,Y λ'-1 The string of scattered values ​​{Y0},…,{Y λ'-1 When λ is odd, let {Y} λ'-1 } is {X 2i }, The flag calculating section of each secret calculating device calculates a dispersion value {r} of a division operation flag r after "exclusive OR" of all the dispersion values {X j} for each odd number j that is greater than or equal to 0 and less than λ, a public value multiplier setting section of each secret calculation device sets a public value multiplier r' which becomes V2 when λ is odd and 1 when λ is even, The inverse normalization multiplier generating section of each secret computation device generates a distributed value [c'] of the inverse normalization multiplier c' after the bit-joining of the distributed values {Y0},..., {Y λ'-1} in the normal order. The normalization multiplier generating section of each secret computation device generates a dispersion value [c] of the normalization multiplier c after bit-joining of the string {X0},..., {X λ-1} of the dispersion values in reverse order. a normalization section of each secret calculation device calculates a dispersion value [b] obtained by multiplying the dispersion value [a] and the dispersion value [c], a square root calculation section of each secret calculation device calculates a dispersion value [w] obtained by calculating [V b] * (r' / V2) when r=l and [V b] * r' when r=0 using the dispersion value [b] and the dispersion value {r} and the public value multiplier r', The square root calculating section of each secret calculating device calculates a dispersion value [w] of [√b]*(r' / √2) when r=1 and [√b]*r' when r=0 using the dispersion value [b] and the dispersion value {r} and the public value multiplier r', The inverse normalizing section of each secret calculating device calculates the dispersion value [√a] of the multiplication result of the dispersion value [w] and the dispersion value [c'] which is right shifted by λ' bits, The first product adding section of each square root calculating section calculates [y'] := [x(δx+A-I)-J]; The first adding section of each square root calculating section calculates [y] := [y'+(Ix+J)]; The second product adding section of each square root calculating section calculates [z'] := [y(ζy+B-k)+(C-I)x-m]; The second adding section of each square root calculating section calculates [z] := [z'+(ky+lx+m)]; The third product adding section of each square root calculating section calculates [w' / γ] := [z(αz+D-n / γ)+(βx+F-o / γ)y+(G-p)x+(H-q) / γ]; The selection product calculating section of each square root calculating section calculates [w' / γ]*(r' / √2)γ when r=1 and [w' / γ]*r'γ when r=0 using the dispersion value {r}, and sets the calculation result to [w']; The third adding section of each square root calculating section calculates [w] := [w'+(nz+op+px+q)].

3. The secret calculating device used in the secret square root calculating system of claim 1.

4. A computer program product containing a computer program which, when executed by a computer, implements the steps of the secret square root calculating method of claim 2.

Images