Encryption device, decryption device, decryption-possible verification device, cryptosystem, encryption method and encryption program

Abstract

Encryption device (400), comprising: an encryption unit (403) that is set up when a user secret SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ according to a decryption-possible condition L, to generate a key K and a ciphertext P corresponding to key K by encrypting the decryption-possible condition L using attribute-based encryption, where a key PK is used as an encryption key of the attribute-based encryption, consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography, to consider a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value as PD and to consider a part of the ciphertext P in which the secret value being shared is encrypted as P-SS, K' and P'-D are generated by randomizing the key K and the PD using a random number R, and to generate a ciphertext C by encrypting data consisting of the PD and the random number R using post-quantum cryptography with the public key PQCPK, wherein The P-SS, P'-D and K' decryption-possible verification parameters correspond to the secret user key SKΓ.

Description

TECHNICAL AREA

[0001] The present disclosure relates to an encryption device, a decryption device, a decryption-possible verification device, a cryptosystem, an encryption method and an encryption program. STATE OF THE ART

[0002] Attribute-based encryption (ABE) is a type of public-key cryptography. In attribute-based encryption, a decryption-possible condition, in which an access right is expressed through a logical expression or similar, is input at the time of encryption, and a ciphertext that meets the condition is decrypted using a secret user key generated based on a set of attributes that satisfy the condition.

[0003] Encryption that is resistant to decryption by a quantum computer is called post-quantum cryptography (PQC), and an attribute-based encryption is being developed that is intended to become post-quantum cryptography.

[0004] The non-patent literature 1 reveals an attribute-based encryption that is a post-quantum cryptography.

[0005] Patent literature 1 also discloses a configuration of a cipher, for example an attribute-based cipher, which is also effective in the construction of a quantum computer. A cipher system uses a plurality of groups connected by an isogeny ϕt with respect to an integer t of t ∈ [d], and a pairing computation et with respect to an integer t of t ∈ [0, d]. The encryption system is equipped with an encryption device that generates a ciphertext containing a secret element from a specific group of the plurality of groups, and a decoding device that decodes the ciphertext generated by the encryption device using a decoding key containing a key element from a group that differs from the specific group of the plurality of groups. REFERENCE LIST NON-PATENT LITERATURE

[0006] Non-Patent Literature 1: Gorbunov, S., et al., “Attribute-Based Encryption for Circuits.” Journal of the ACM (JACM) 62.6 (2015), pp. 1-33. PATENT LITERATURE

[0007] Patent literature 1: WO 2017 / 203 743 A1 SUMMARY OF THE INVENTIONAL PROBLEM

[0008] Since attribute-based encryption, the post-quantum cryptography disclosed in non-patent literature 1 and the like, is often configured based on lattice cryptography technology, various problems arise regarding functionality, efficiency, and the like. In particular, a key policy type is often proposed, i.e., attribute-based encryption that specifies a decryption-possible condition for a secret user key and a set of attributes for a ciphertext, where checking only the decryption-possible condition is not possible because the correspondence confirmation between the decryption-possible condition and a set of attributes is built into the decryption, where the data size of the ciphertext depends on a maximum value determined by a master key, i.e.,The data size of the ciphertext and the processing time of the encryption method are inefficient, and similar issues can be cited as problems. Attribute-based encryption, the conventional post-quantum cryptography, is therefore unable to guarantee both the flexibility and efficiency of access control of attribute-based encryption and the security against quantum computers.

[0009] The present disclosure aims to provide a public-key cryptosystem technology that offers both the flexibility and efficiency of access control of attribute-based encryption and security against a quantum computer. SOLUTION TO THE PROBLEM

[0010] An encryption device according to the present disclosure comprises: an encryption unit if a secret user key SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ according to a decryption-possible condition L, to generate a key K and a ciphertext P corresponding to key K by encrypting the decryption-possible condition L using attribute-based encryption, where a key PK is used as an encryption key of the attribute-based encryption, consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography, to consider a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value as PD and to consider a part of the ciphertext P in which the secret value being shared is encrypted as P-SS, K' and P'-D are generated by randomizing the key K and the PD using a random number R, and to generate a ciphertext C by encrypting data consisting of the PD and the random number R using post-quantum cryptography with the public key PQCPK, wherein The P-SS, P'-D and K' decryption-possible verification parameters correspond to the secret user key SKΓ. ADVANTAGEOUS EFFECTS OF THE INVENTION

[0011] According to the present disclosure, encryption using attribute-based encryption generates a key K and a ciphertext P corresponding to the key K, using a key PK consisting of a public key MPK of attribute-based encryption and a public key PQCPK of post-quantum cryptography as the cipherkey of attribute-based encryption. A portion of the ciphertext P in which the decryption-possibility condition L is encrypted based on a secret value is called PD, and a portion of the ciphertext P in which the shared secret value is encrypted is called P-SS. K' and P'-D are generated by randomizing K and PD using a random number R.A ciphertext C is generated by encrypting data consisting of PD and the random number R using post-quantum cryptography with the public key PQCPK. The P-SS, P'-D, and K' are decryption-possible verification parameters corresponding to the private user key SKΓ.

[0012] Thus, according to the present disclosure, a public-key cryptosystem technology can be provided that offers both the flexibility and efficiency of access control of an attribute-based encryption as well as security against a quantum computer. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a representation showing an example of a configuration of a cryptosystem 100 according to embodiment 1. Fig. Figure 2 is a representation that describes an overview of a process of the cryptosystem 100 according to embodiment 1. Fig. Figure 3 is a representation that describes an overview of a process of the cryptosystem 100 according to embodiment 1. Fig. Figure 4 is a representation showing an example of a configuration of a parameter generation device 200 according to embodiment 1. Fig. Figure 5 is a representation showing an example of a configuration of a secret user key generation device 300 according to embodiment 1. Fig. Figure 6 is a representation showing an example of a configuration of an encryption device 400 according to embodiment 1. Fig. Figure 7 is a representation showing an example of a configuration of a decryption-possible verification device 500 according to embodiment 1. Fig. Figure 8 is a representation showing an example of a configuration of a decryption device 600 according to embodiment 1. Fig. Figure 9 is a representation showing an example of a hardware configuration of each device according to embodiment 1. Fig. Figure 10 is a flowchart illustrating the operation of the parameter generation device 200 according to embodiment 1. Fig. Figure 11 is a flowchart illustrating the operation of the Secret User Key Generating Device 300 according to embodiment 1. Fig. Figure 12 is a flowchart illustrating the operation of the encryption device 400 according to embodiment 1. Fig. Figure 13 is a flowchart illustrating the operation of the decryption-possible verification device 500 according to embodiment 1. Fig. Figure 14 is a flowchart illustrating the operation of the decryption device 600 according to embodiment 1. Fig. 15 is a representation describing the effects of the cryptosystem 100 according to embodiment 1, (a) is a representation describing the conventional state of the art, and (b) is a representation describing embodiment 1. Fig. 16 is a representation describing the effects of the cryptosystem 100 according to embodiment 1, (a) is a representation giving an overview of the prior art, and (b) is a representation giving an overview of embodiment 1. Fig. Figure 17 is a representation showing an example of a hardware configuration of each device according to a variant of embodiment 1. DESCRIPTION OF THE EXAMPLES OF EXECUTION

[0013] In the description of the embodiment and in the drawings, the same elements or corresponding elements are designated with the same reference numerals. Descriptions of elements to which the same reference numerals have been added are omitted or simplified as appropriate. The arrows in the illustrations mainly indicate data flows, signal input and output, or process flows. "Unit" may be replaced as appropriate by "circuit," "device," "equipment," "step," "method," "process," or "circuit." The functions of the individual units may be implemented by firmware, software, hardware, or a combination of these elements. Design 1.

[0014] The present embodiment is described in detail below with reference to the drawings. *** Configuration Description ***

[0015] Fig. Figure 1 is a block diagram showing an example of a configuration of a cryptosystem 100 according to the present embodiment. As shown in Fig. As shown in Figure 1, Cryptosystem 100 comprises a parameter generation device 200, a plurality of secret user key generation devices 300, a plurality of encryption devices 400, a decryption-possible verification device 500, and a decryption device 600. Cryptosystem 100 is also referred to as a "post-quantum attribute-based cryptosystem." Each device that configures Cryptosystem 100 is communicatively connected via the Internet 101 in a suitable manner. Each device that configures Cryptosystem 100 can be configured as a whole in a suitable manner.

[0016] Cryptosystem 100 offers a public-key cryptosystem technology that is resistant to decryption by a quantum computer and has a feature that allows access control similar to attribute-based encryption.

[0017] Fig. Figure 2 shows an overview of a process of the Cryptosystem 100. As in Fig. As shown in Figure 2, in the Cryptosystem 100 a double encryption is carried out by performing encryption by functional encryption (FE) after encryption by post-quantum cryptography.

[0018] However, a method for naively implementing double encryption has the advantage that plaintext leakage is not a concern, since the plaintext is encrypted by post-quantum cryptography even if the functional encryption is decrypted by the quantum computer. This method, however, has the problem that, in addition to a key for the functional encryption, a shared key for the post-quantum cryptography must be distributed, and that a cipher key (key) generated by the functional encryption must be used to decrypt the post-quantum encryption. FE ) is completely at the mercy of an attacker who possesses a quantum computer.

[0019] Therefore, in the present embodiment, a method for carrying out encryption by functional encryption is modified such that the key FEthat it cannot be decrypted even by an attacker who has a quantum computer, and that a decryption-possible condition can be verified even without using a secret key of PQC (Post-Quantum Cryptography).

[0020] Fig. Figure 3 is a representation that describes the change in the encryption procedure through functional encryption. As in Fig. As shown in Figure 3, in a procedure for checking a decryption-possibility condition of the functional encryption (FE), the procedure for performing the encryption using functional encryption is modified so that the FE does not need to be decrypted, i.e., the PQC key does not need to be used. A separate parameter is created for this purpose.

[0021] The procedure for performing encryption using functional encryption is modified so that the FE cannot be decrypted even by an attacker who has a quantum computer, by re-encrypting a parameter for decrypting the FE using the PQC.

[0022] The Internet 101 is a communication channel that appropriately connects the parameter generation device 200, the multiple secret user key generation devices 300, the multiple encryption devices 400, the decryption-possible verification device 500, and the decryption device 600. The Internet 101 is an example of a network. Instead of the Internet 101, other types of networks, such as LANs (Local Area Networks) and similar systems installed in the same facility, can also be used.

[0023] The parameter generation device 200 is a computer that generates a common parameter and transmits the generated common parameter appropriately to each secret user key generation device 300, each encryption device 400, the decryption-possible verification device 500, and the decryption device 600 via the Internet 101. The computer, as a specific example, is a PC (personal computer). The common parameter is a parameter commonly used in the cryptosystem 100, such as a key. The generated common parameter can be transmitted directly by sending a storage medium on which the common parameter is recorded, without being transmitted via the Internet 101.

[0024] Each Secret User Key Generation Device 300 generates a secret user key and is a computer that transmits the generated secret user key to the Decryption-Possible Verification Device 500 and the Decryption Device 600.

[0025] The encryption device 400 is a computer that functions as a device for encrypting data. The decryption device 400 receives a public key from the parameter generation device 200 and, with a decryption-possible condition L as input, outputs a verification parameter CCHECK, a ciphertext C, and a shared secret key KEY.

[0026] The Decryption-Possible Verification Device 500 is a computer that checks whether the ciphertext C can be decrypted using the user's secret key. The Decryption-Possible Verification Device 500 receives the public key from the Parameter Generation Device 200, receives the verification parameter CCHECK and the ciphertext C from the Encryption Device 400, and checks whether the ciphertext C can be decrypted using the entered secret key. The Decryption-Possible Verification Device 500 then outputs 0 if the ciphertext C can be decrypted using the secret key, and 1 otherwise.

[0027] The decryption device 600 is a computer that receives the verification parameter CCHECK and the ciphertext C from the encryption device 400, receives the secret user key from the secret user key generation device 300, and outputs a result of the decryption of the ciphertext C.

[0028] The following is an example of a configuration for each device that configures the Cryptosystem 100.

[0029] Fig. Figure 4 is a block diagram showing an example configuration of the parameter generation device 200. As shown in Fig. As shown in Figure 4, the parameter generation device 200 comprises an input unit 201, a common parameter generation unit 202, and a transmission unit 203. Although not shown, the parameter generation device 200 includes a recording medium that stores data used in each unit of the parameter generation device 200.

[0030] The input unit 201 accepts a bit length K of the key used in the cryptosystem 100 as input.

[0031] The Common Parameter Generation Unit 202 generates a public key MPK and a secret master key MSK, and then a public key PQCPK and a secret key PQCSK. The public key MPK and the secret master key MSK are each attribute-based encryption keys intended to serve as the basis for computation in Cryptosystem 100. The secret master key MSK is also referred to as the attribute-based encryption secret key, and the public key MPK is also referred to as the attribute-based public key. The MPK is equivalent to the MSK. The public key PQCPK and the secret key PQCSK are each post-quantum cryptography keys. The public key PQCPK is also referred to as the post-quantum cryptography public key, and the secret key PQCSK is also referred to as the post-quantum cryptography secret key.The PQCSK is equivalent to the PQCPK. Although not shown, the Common Parameter Generator 202 may contain a function for generating random numbers and the like to generate each of the MPK, MSK, PQCPK, and PQCSK.

[0032] The transmission unit 203 transmits the public key MPK and the public key PQCPK, generated by the common parameter generation unit 202, to each of the secret user key generation device 300, the cipher generation device 400, the decryption-possible verification device 500, and the decryption device 600. The transmission unit 203 transmits the secret master key MSK and the secret post-quantum cryptography key PQCSK, generated by the common parameter generation unit 202, to each secret user key generation device 300.

[0033] Fig. Figure 5 is a block diagram showing an example configuration of the Secret User Key Generation Device 300. As shown in Fig. As shown in Figure 5, the Secret User Key Generating Device 300 comprises an input unit 301, a key receiving unit 302, a key generating unit 303, and a key transmission unit 304. Although not shown, the Secret User Key Generating Device 300 includes a recording medium that stores data used in each unit of the Secret User Key Generating Device 300.

[0034] The input unit 301 accepts a set of attributes Γ as input. Γ is a parameter and corresponds to the decryption-possible condition L.

[0035] The key receiver unit 302 receives the MSK and the PQCSK.

[0036] Key generation unit 303 generates a user secret SKΓ using the MSK and Γ. The user secret SKΓ is also known as the attribute-based encryption secret key. Although not shown, key generation unit 303 may include a function for generating random numbers and the like to create SKΓ.

[0037] The key transmission unit 304 transmits each of the PQCSK received by the key receiving unit 302 and the SKΓ generated by the key generating unit 303 to the decryption device 600.

[0038] Fig. Figure 6 is a block diagram showing an example configuration of the Encryption Device 400. As shown in Fig. As shown in Figure 6, the encryption device 400 comprises an input unit 401, a key receiving unit 402, an encryption unit 403, a ciphertext transmission unit 404, and a key output unit 405. Although not shown, the encryption device 400 includes a recording medium that stores data used in each unit of the encryption device 400.

[0039] The input unit 401 accepts the decryption-possible condition L as input.

[0040] The key receiving unit 402 receives the MPK and the PQCPK.

[0041] The 403 encryption unit generates the verification parameter CCHECK, the ciphertext C, and the shared key secret KEY using the L, the MPK, and the PQCPK. The verification parameter CCHECK is also known as the decryption-possible verification parameter. Specifically, the 403 encryption unit first generates a key K and a ciphertext P corresponding to key K by encrypting L using attribute-based encryption with a key PK as the attribute-based encryption cipher key. Here, the PK consists of the MPK and the PQCPK. A portion of the ciphertext P in which L is encrypted based on a secret value is known as PD, and a portion of the ciphertext P in which the shared secret value is encrypted is known as P-SS. The shared secret value is also called the secret-sharing value.The encryption unit 403 then generates K' and P'-D by randomizing the key K and PD respectively using a random number R, and generates the ciphertext C by encrypting data consisting of the PD and the random number R using post-quantum cryptography with PQCPK. Here, P-SS, P'-D, and K' are decryption-possible verification parameters corresponding to SKΓ. Although not shown, the encryption unit 403 may contain a function for generating random numbers to produce each of the verification parameters CCHECK and the ciphertext C.

[0042] The ciphertext transmission unit 404 transmits both the CCHECK and the C generated by the encryption unit 403 to the decryption-possible verification device 500 and the decryption device 600.

[0043] The key output unit 405 outputs the KEY.

[0044] Fig. Figure 7 is a block diagram showing an example of a configuration for the Decryption-Affective Verification Device 500. As shown in Fig. As shown in Figure 7, the decryption-possible verification device 500 comprises a ciphertext receiving unit 501, a key receiving unit 502, a verification unit 503 and a result output unit 504.

[0045] The ciphertext receiver 501 receives the CCHECK (= P-SS, P'-D, K') and the C from the encryption device 400.

[0046] The key receiving unit 502 receives the SKΓ from the secret user key generation device 300.

[0047] Verification Unit 503 performs a verification process. Specifically, Verification Unit 503 decrypts the decryption-possible verification parameter using attribute-based encryption with the SKΓ and determines that the SKΓ can be decrypted if K' and a decryption result match.

[0048] The result output unit 504, for example, outputs 0 or 1 as a value indicating a verification result.

[0049] Fig. Figure 8 is a block diagram showing an example configuration of the Decryption Device 600. As shown in Fig. As shown in Figure 8, the decryption device 600 comprises a ciphertext receiving unit 601, a key receiving unit 602, a decryption unit 603 and a result output unit 604.

[0050] The ciphertext receiving unit 601 receives the CCHECK (= P-SS, P'-D, K') and the C from the encryption device 400.

[0051] The key receiving unit 602 receives both the SKΓ and the PQCSK from the secret user key generation device 300.

[0052] The decryption unit 603 computes a common key-secret key KEY, which is decrypted by performing a decryption operation. Specifically, the decryption unit 603 decrypts the ciphertext C by post-quantum cryptography using PQCSK, computes PD based on P'-D using the random number R, and, in a case where PD indicating a decryption result and the computed PD match, decrypts the data consisting of P-SS and PD by attribute-based encryption using SKΓ.

[0053] The result output unit 604 outputs the common key-secret key KEY.

[0054] Fig. Figure 9 is a diagram showing an example of the hardware resources of each parameter generation device 200, each secret user key generation device 300, each encryption device 400, the decryption-possible verification device 500, and the decryption device 600. As shown in Fig. As shown in Figure 9, each device is a computer. Each device can consist of a multitude of computers.

[0055] The computer contains a CPU 11 (Central Processing Unit). The CPU 11 is a specific example of a processor. The computer can contain a variety of CPUs 11. The CPU 11 is connected via a bus 12 to and controls hardware devices such as a ROM (Read Only Memory) 13, a RAM (Random Access Memory) 14, a communication board 15, a display 16, a keyboard 17, a mouse 18, a drive 19, a magnetic disk device 20, and the like. The display 16 is a display device. The drive 19 is a device that reads data from and writes data to a storage medium such as an FD (Flexible Disk Drive), a CD (Compact Disc), a DVD (Digital Versatile Disc), or similar.

[0056] The ROM 13, the RAM 14, the magnetic disk device 20, and the drive 19 are examples of a storage device. The keyboard 17, the mouse 18, and the communication board 15 are examples of an input device. The display 16 and the communication board 15 are examples of an output device.

[0057] The communication board 15 is connected either wired or wirelessly to a communication network such as a LAN, the Internet, a telephone line or similar.

[0058] An operating system (OS) 21, a program group 22 and a file group 23 are stored on the magnetic disk device 20.

[0059] A program that performs a function, referred to in the present embodiment as a "unit," is contained in program group 22. Each program is read and executed by CPU 11. That is, the program ensures that the computer functions as a "unit" and that the computer executes a process or procedure of the "unit." Each program can be stored on a computer-readable non-volatile recording medium. The non-volatile recording medium is, as a concrete example, an optical disk or flash memory. Each program can be provided as a program product.

[0060] File group 23 contains various types of data (input, output, a determination result, a calculation result, a process result, and the like) that are used in the “unit” described in the present embodiment.

[0061] Processes of the present embodiment, which are described by means of flowcharts and the like, are carried out using at least one piece of hardware such as the CPU 11, the storage device, the input device, the output device and the like. *** Description of Functioning ***

[0062] An operating procedure for each device of Cryptosystem 100 corresponds to a procedure that has a name for each device. A program that enables the operation of each device of Cryptosystem 100 is equivalent to a program that bears the name of each device. A specific example: An operating procedure of Encryption Device 400 corresponds to an Encryption Procedure, and a program that enables the operation of Encryption Device 400 corresponds to an Encryption Program.

[0063] Before describing the operation of Cryptosystem 100, the basic encryption technology and notation used in the present embodiment are described. Attribute-based encryption of the ciphertext policy type is an encryption that can only be decrypted by a user who possesses a secret user key generated from a set of attributes Γ that satisfy a decryption condition specified in the decryption-possible condition L. The attribute-based encryption of the ciphertext is configured using an algorithm such as the following.

[0064] A setup command ABESETUP outputs the secret master key MSK and the public key MPK with a key length and the like as input.

[0065] Generation of secret user keys in attribute-based encryption: ABEKEYGEN generates the secret user key SKΓ for a user who is used as input for the Γ with the MSK and the set of attributes Γ.

[0066] Encryption ABEENC generates a key K for encryption with a shared key and the ciphertext P corresponding to the key K, with the public key MPK and the decryption-possible condition L as input.

[0067] Decryption ABEDEC, with the secret user key SKΓ and the ciphertext P as input, outputs a key K which encrypts the P if the Γ and the decryption-possible condition L of the generation of the P match. [Reference 1]

[0068] Okamoto, T., et al., „Fully Secure Functional Encryption with General Relations from the Decisional Linear Assumption“, Annual Cryptology Conference. Springer, Berlin, Heidelberg, 2010.

[0069] Reference 1 and the like disclose a method for using secret-sharing computation as a procedure for encrypting the decryption-possible condition L for the ciphertext P. The method for using secret-sharing computation is a procedure for performing secret sharing according to a logical expression in which a secret value S required for decryption is described as the decryption-possible condition L. As a specific example, consider a case in which decryption is set to succeed only with a user secret key that has A AND B, i.e., attributes of both A and B. In this case, a ciphertext is first generated by encrypting a plaintext with a value that can compute an encryption target through or based on S. Next, S is considered to be S = S1 + S2, and S1 is embedded in A and S2 in B.Subsequently, S1 is extracted using the secret user key in which A is embedded, S2 is extracted using the secret user key in which B is embedded, and the resulting ciphertext is decrypted by performing the final computation by recovering S or a value that can be computed based on S. Reference 1 proposes an efficient attribute-based encryption, but it is known that attribute-based encryption is not resistant to decryption by a quantum computer.

[0070] Here, in the ciphertext P, the part in which the secret-sharing value is encrypted is called P-SS, and the part in which the encryption target, encrypted with the secret value S, or a value that can be calculated based on S, is called PD. During decryption ABEDEC, the part in which the secret-sharing value is to be recovered is called the recovery calculation ABEDEC-SS, and the part in which the final decryption is to be performed is described as the final decryption calculation ABEDEC-D.

[0071] Post-quantum public-key cryptography (PQC) consists of an algorithm such as the following.

[0072] The key generation of the post-quantum cryptography PQCKG outputs the secret key PQCSK and the public key PQCPK with a key length and the like as input.

[0073] The post-quantum cryptography encryption PQCENC outputs a ciphertext PQCC with the PQCPK and a plaintext M as input.

[0074] Post-quantum cryptography decryption (PQCDEC) outputs a decryption result using the PQCSK and the ciphertext PQCC as input.

[0075] The following describes the functioning of the cryptosystem 100, which corresponds to a calculation method of each device according to the present embodiment.

[0076] Fig. Figure 10 is a flowchart illustrating an example of a parameter generation process using the parameter generation device 200. The parameter generation process is shown using… Fig. 10 described. (Step S201: Information input step)

[0077] The input unit 201 accepts the bit length K of the key as input.

[0078] (Step S202: Step to generate an attribute-based encryption key)

[0079] The Common Parameter Generation Unit 202 generates the MSK and the MPK respectively by executing the setup SETUP of attribute-based encryption using the bit length K.

[0080] (Step S203: Post-quantum cryptography key generation step)

[0081] The Common Parameter Generation Unit 202 generates the PQCSK and the PQCPK respectively by executing the PQCKG. (Step S204: Distribution step)

[0082] The transmission unit 203 transmits SK = (MSK, PQCSK) and PK = (MPK, PQCPK) to each device.

[0083] Fig. Figure 11 is a flowchart illustrating an example of the process for generating a secret user key using the Secret User Key Generation Device 300. The secret user key generation process is shown using… Fig. 11 described. (Step S301: Attribute input step)

[0084] The input unit 301 accepts the set of attributes Γ as input. (Step S302: Key entry step)

[0085] The key receiving unit 302 accepts SK = (MSK, PQCSK). (Step S303: Step to generate the secret user key)

[0086] The key generation unit 303 generates the SKΓ by executing the ABEKEYGEN using the MSK and the Γ. (Step S304: Transfer step)

[0087] The key transmission unit 304 sends the USK to each device using the PQCSK and the SKΓ as the secret user key USK = (PQCSK, SKΓ).

[0088] Fig. Figure 12 is a flowchart illustrating an example of an encryption procedure using the Encryption Device 400. The encryption procedure is explained using… Fig. 12 described. (Step S401: Attribute Input Step)

[0089] The key receiving unit 402 receives PK = (MPK, PQCPK). (Step S402: Step to enter the decryption-possible condition)

[0090] The input unit 401 accepts the decryption-possible condition L. (Step S403: attribute-based encryption)

[0091] The encryption unit 403 generates P = (P-SS, PD) and K by performing ABEENC with PK and L. (Step S404: Randomization step)

[0092] The encryption unit 403 generates K' and P'-D by randomizing K and PD using the random number R. It is assumed that K' is generated by correctly decrypting P' = (P-SS, P'-D). The procedure of the present step is executable using the technology disclosed in Reference 1. (Step S405: Post-quantum encryption step)

[0093] The encryption unit 403 generates a ciphertext C = PQCC-DR by inputting the PQCPK and the plaintext M = (PD, R) into the PQCENC. (Step S406: Transfer step)

[0094] The ciphertext transmission unit 404 transmits the verification parameter CCHECK = (P-SS, P'-D, K') and the ciphertext C = PQCC-DR to each device.

[0095] Fig. Figure 13 is a flowchart illustrating an example of a decryption-possible verification process by the decryption-possible verification device 500. The decryption and possible verification process is shown using… Fig. 13 described. (Step S501: Ciphertext reception step)

[0096] The ciphertext receiver 501 receives the verification parameter CCHECK = (P-SS, P'-D, K'). (Step S502: Key Receipt Step)

[0097] The key receiving unit 502 receives the secret user key USK = (PQCSK, SKΓ). (Step S503: Verification step)

[0098] Verification unit 503 obtains a decryption result K'' by performing ABEDEC with SKΓ as input and (P-SS, P'-D) as ciphertext of attribute-based encryption. (Step S504: Output step)

[0099] The result output unit 504 outputs 0 if K'' and K' match, and 1 in all other cases.

[0100] Fig. Figure 14 is a flowchart illustrating an example of a decryption process performed by the 600 decryption device. The decryption process is described using… Fig. 14 described. (Step S601: Key Receipt Step)

[0101] The key receiving unit 602 receives PK = (MPK, PQCPK) and USK = (PQCSK, SKΓ). (Step S602: Ciphertext reception step)

[0102] The ciphertext receiver 601 receives the verification parameter CCHECK= (P-SS, P'-D, K') and the ciphertext C = PQCC-DR. (Step S603: Decryption step)

[0103] First, the decryption unit 603 receives M = (PD, R) by executing PQCDEC with the secret key PQCSK and the ciphertext C = PQCC-DR as input.

[0104] The decryption unit 603 then calculates the PD based on the P'-D using the obtained random number R. If the calculated PD does not match the PD that indicates an execution result of PQCDEC, the decryption unit 603 outputs 0. If these P-Ds match, the decryption unit 603 obtains the KEY by executing ABEDEC with the user's secret key SKΓ and the (P-SS, PD) as the ciphertext of the attribute-based encryption as input. (Step S604: Output step)

[0105] The result output unit 604 outputs the KEY. *** Description of the effect of embodiment 1. ***

[0106] As described above, according to the present embodiment, a double encryption technology can be provided that is resistant to quantum computers and can verify whether decryption of the attribute-based encryption is possible without performing decryption and extracting the plaintext. According to the present embodiment, the data size of the ciphertext, the processing time of the decryption, or similar factors do not depend on a maximum value set by the system. Consequently, according to the present embodiment, a post-quantum attribute-based encryption can be achieved that is more secure and efficient.

[0107] Regarding the decryption-possible condition and the set of attributes, according to the present embodiment, both the decryption-possible condition and the set of attributes can be configured as attribute-based encryption, which is not post-quantum cryptography, and the verification of the match between the decryption-possible condition and the set of attributes can be performed separately from the decryption procedure. Consequently, the double encryption technology according to the present embodiment can be efficiently operated as attribute-based encryption that is resistant to quantum computing.

[0108] The effects of the present embodiment are demonstrated by means of Fig. 15 described. “Quantum resistance” means that there is a quantum computer resistance. As in (a) of Fig. As shown in Figure 15, the prior art presents a problem because the functional encryption, which is resistant to quantum computers, is configured directly using lattice cryptography technology. While this offers the advantage of quantum computer resistance, the configuration becomes complex due to the intricate nature of the functional encryption features. In contrast, the present embodiment, although the quantum computer resistance is lower in some areas compared to the prior art, simplifies the configuration because it combines post-quantum cryptography and functional encryption, which are part of the prior art.

[0109] The effects of the present embodiment are demonstrated by means of Fig. 16 described. Here, C0 is a component that is integrated as a whole and encodes a KEM key, and C i is a component of which an attribute is encoded in L. As in (a) of Fig. As shown in Figure 16, there is a problem with the conventional technique where the key FE It must be decrypted to check the decryption-possible condition, and if the key FE When decryption occurs, an element ζ of the KEM key is released. On the other hand, as in (b) of Fig. Figure 16 shows that, according to the present embodiment, a component of the KEM key is protected by the PQC. The match determination for a parameter used to check the decryption-possible condition can be performed independently of the PQC. Furthermore, since the conformance determination can be performed independently of element ζ of the KEM key, there is no risk of element ζ of the KEM key leaking during the conformance determination. *** Other configurations ***<Variante 1>

[0110] Fig. Figure 17 shows an example of a hardware configuration for each device according to the present variant.

[0111] Each device contains a processing circuit 31 in place of the CPU 11, the CPU 11 and the RAM 14, the CPU 11 and the ROM 13 or the CPU 11, the RAM 14 and the ROM 13.

[0112] The processing circuit 31 is a piece of hardware that enables at least some of the units contained in each device.

[0113] The processing circuit 31 may be a special piece of hardware that executes a program stored in RAM 14.

[0114] In a case where the processing circuit 31 is dedicated hardware, the processing circuit 31, as a concrete example, is a single circuit, a compound circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

[0115] Each device can contain a variety of processing circuits that replace processing circuit 31. The variety of processing circuits share the functions of processing circuit 31.

[0116] In any device, some functions can be activated by special hardware and the remaining functions by software or firmware.

[0117] In a specific example, the processing circuit 31 is enabled by hardware, software, firmware or a combination thereof.

[0118] The CPU 11, the RAM 14, the ROM 13, and the processing circuit 31 are collectively referred to as "processing circuits." This means that the functions of the individual functional elements of each device are activated by the processing circuit. *** Other versions ***

[0119] Embodiment 1 has been described, but in the present embodiment, several parts can be combined and implemented. Alternatively, the present embodiment can also be implemented partially. Furthermore, various modifications can be made to the present embodiment as needed, and the present embodiment can be arranged and implemented in any way, whether completely or partially.

[0120] The embodiment described above is a substantially preferred example and is not intended to limit the present disclosure, its application, or its scope. The methods described in the flowcharts and the like may be modified appropriately. REFERENCE MARK LIST

[0121] 11: CPU; 12: Bus; 13: ROM; 14: RAM; 15: Communication board; 16: Display; 17: Keyboard; 18: Mouse; 19: Drive; 20: Magnetic disk device; 21: OS; 22: Program group; 23: File group; 31: Processing circuit; 100: Cryptosystem; 101: Internet; 200: Parameter generation device; 201: Input unit; 202: Common parameter generation unit; 203: Transmission unit; 300: Secret user key generation device; 301: Input unit; 302: Key receiving unit; 303: Key generation unit; 304: Key transmission unit; 400: Encryption device; 401: Input unit; 402: Key receiving unit; 403: Encryption unit; 404: Ciphertext transmission unit; 405: Key output unit; 500: Decryption-possible verification unit; 501: Ciphertext receiving unit; 502: Key receiving unit; 503: Verification unit; 504: Result output unit; 600: Decryption unit; 601: Ciphertext receiving unit;602: Key receiving unit; 603: Decryption unit; 604: Result output unit.

Claims

[1] Encryption device (400), comprising: an encryption unit (403) that is set up when a user secret SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ according to a decryption-possible condition L, to generate a key K and a ciphertext P corresponding to key K by encrypting the decryption-possible condition L using attribute-based encryption, where a key PK is used as an encryption key of the attribute-based encryption, consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography, to consider a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value as PD and to consider a part of the ciphertext P in which the secret value being shared is encrypted as P-SS, K' and P'-D are generated by randomizing the key K and the PD using a random number R, and to generate a ciphertext C by encrypting data consisting of the PD and the random number R using post-quantum cryptography with the public key PQCPK, wherein The P-SS, P'-D and K' decryption-possible verification parameters correspond to the secret user key SKΓ. [2] Decryption device (600), comprising: a ciphertext receiving unit (601) that is set up when a secret user key SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ corresponding to a decryption-possible condition L, a key K and a ciphertext P corresponding to the key K are generated by encryption of the decryption-possible condition L by attribute-based encryption using a key PK consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography as the cipherkey of attribute-based encryption, a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value is considered PD, a part of the ciphertext P in which the secret value being shared is encrypted,is considered as P-SS, K' and P'-D are generated by randomizing both the key K and PD using a random number R, and a ciphertext C is generated by encrypting data consisting of PD and the random number R using post-quantum cryptography with the public key PQCPK, to obtain the ciphertext C, the P-SS and the P'-D respectively; a key receiving unit to receive one secret key PQCSK corresponding to the public key PQCPK and the user secret key SKΓ; and a decryption unit for decrypting the ciphertext C by post-quantum cryptography using the secret key PQCSK, for calculating PD based on P'-D using the random number R, and in a case where PD indicating a result of the decryption and the calculated PD match, for decrypting data consisting of P-SS and PD by attribute-based encryption using the secret user key SKΓ. [3] Decryption-possible verification device (500), comprising: a ciphertext receiving unit (501) that is set up when a secret user key SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ corresponding to a decryption-possible condition L, a key K and a ciphertext P corresponding to the key K are generated by encryption of the decryption-possible condition L by attribute-based encryption using a key PK consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography as the cipherkey of attribute-based encryption, a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value is considered PD, a part of the ciphertext P in which the secret value being shared is encrypted,is considered as P-SS, K' and P'-D are generated by randomizing both the key K and PD using a random number R, and the P-SS, P'-D and K' are decryption-possible verification parameters corresponding to the secret user key SKΓ, to receive the decryption-possible verification parameter; a key receiving unit (502) for receiving the secret user key SKΓ; and a verification unit (503) to decrypt the decryption-possible verification parameter by attribute-based encryption using the user secret SKΓ and, in a case where K' and a result of the decryption match, to determine that the user secret SKΓ can be decrypted. [4] Cryptosystem, comprehensive: the encryption device (400) according to claim 1; the decryption device (600) according to claim 2; and the decryption-possible verification device (500) according to claim 3. [5] Encryption methods, comprehensive: Generating, when a secret user key SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ corresponding to a decryption-possible condition L, a key K and a ciphertext P corresponding to the key K, by encrypting the decryption-possible condition L by attribute-based encryption using a key PK consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography as the cipherkey of attribute-based encryption, considering a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value as PD, and considering a part of the ciphertext P in which the secret value being shared is encrypted as P-SS, by a computer; Generating K' and P'-D by randomly generating the key K and the PD using a random number R, by the computer; and Generating a ciphertext C by encrypting data consisting of the PD and the random number R, using post-quantum cryptography with the public key PQCPK, by the computer, wherein The P-SS, P'-D and K' decryption-possible verification parameters correspond to the secret user key SKΓ. [6] Encryption program that causes an encryption device (400), which is a computer, to execute: an encryption method if a secret user key SKΓ is generated using a secret key MSK of attribute-based encryption and a set of attributes Γ according to a decryption-possible condition L, to generate a key K and a ciphertext P corresponding to key K by encrypting the decryption-possible condition L using attribute-based encryption, where a key PK is used as an encryption key of the attribute-based encryption, consisting of a public key MPK corresponding to the secret key MSK and a public key PQCPK of post-quantum cryptography, to consider a part of the ciphertext P in which the decryption-possible condition L is encrypted on the basis of a secret value as PD and to consider a part of the ciphertext P in which the secret value being shared is encrypted as P-SS, K' and P'-D are generated by randomizing the key K and the PD using a random number R, and to generate a ciphertext C by encrypting data consisting of the PD and the random number R using post-quantum cryptography with the public key PQCPK, wherein The P-SS, P'-D and K' decryption-possible verification parameters correspond to the secret user key SKΓ.

Images