Ciphertext conversion system, ciphertext conversion method and ciphertext conversion program

Abstract

Ciphertext conversion system (600) comprising a conversion unit (604). The conversion unit (604) performs an encryption of a public-key encryption procedure using a public key and a decryption release condition to produce a converted public-key ciphertext and a key corresponding to the converted symmetric-key ciphertext, and computes, as at least a part of a converted symmetric-key ciphertext, an exclusive OR of a first ciphertext, a value computed by performing an encryption of a symmetric encryption procedure using a secondary secret key and second auxiliary information, and a value computed by performing an encryption of the symmetric encryption procedure using the key corresponding to the converted symmetric-key ciphertext and third auxiliary information.where the first ciphertext is an exclusive OR of a value calculated by encryption using the symmetric encryption method with first auxiliary information and a master key, a value calculated by encryption using the symmetric encryption method with second auxiliary information and the secondary key, and a plaintext.

Description

Technical area

[0001] The present disclosure relates to a ciphertext conversion system, a ciphertext conversion method, and a ciphertext conversion program. State of the art

[0002] A proxy re-encryption (PRE) system is a system that delegates the authority to decrypt a ciphertext to another person without decrypting the ciphertext. Non-Patent Literature 1 discloses a PRE method in any attribute-based encryption scheme (attribute-based PRE, ABPRE). The technique described in Non-Patent Literature 1 can realize proxy encryption between different attribute-based encryption schemes. Non-Patent Literature 2 describes a technique that allows a key to be changed without decrypting the ciphertext of a symmetric encryption. Reference listNon-patent literature Non-Patent Literature 1: Z. Yu, MH Au, R. Yang, J. Lai, Q. Xu, “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption,” ASI-ACCS' 18, June 2018 Non-Patent Literature 2: A. Syalim, T. Nishide, and K. Sakurai, “Realizing Proxy Re-encryption in the Symmetric World,” Communications in Computer and Information Science 251, November 2011 Summary of the inventionTechnical problem

[0003] A typical proxy re-encryption method such as the method disclosed in Non-Patent Literature 1 is a technique that converts a ciphertext of a certain public-key encryption scheme into a ciphertext of a different public-key encryption scheme. The technique disclosed in Non-Patent Literature 2 is a technique that converts a ciphertext of a symmetric encryption scheme into a ciphertext of the symmetric encryption scheme. That is, to convert a ciphertext of a symmetric encryption scheme into a ciphertext of a public-key encryption scheme using existing techniques, it is necessary to decrypt the ciphertext of the symmetric encryption scheme once and then encrypt the decrypted plaintext with the public-key encryption scheme.Therefore, a problem with existing schemes is that plaintext is revealed when the ciphertext of the symmetric encryption scheme is converted into the ciphertext of the public key encryption scheme, so the security is low.

[0004] The objective of the present disclosure is to convert a ciphertext encrypted with a symmetric encryption scheme into a ciphertext of a public key encryption scheme without decryption. Solution to the problem

[0005] A ciphertext conversion system according to the present disclosure comprises a conversion device with a conversion unit for performing encryption of a public-key encryption scheme using a public key and a decryption enabling condition to generate a converted public-key ciphertext and a key corresponding to the converted public-key ciphertext, and calculated, as at least part of a converted ciphertext, an exclusive OR of a first ciphertext, a value calculated by performing encryption of a symmetric encryption scheme using a secondary secret key which is a random number and second auxiliary information, and a value calculated by performing encryption of the symmetric encryption scheme using the key corresponding to the converted public key ciphertext and third auxiliary information, wherein the first ciphertext is an exclusive OR of a value calculated by performing encryption of the symmetric encryption scheme using first auxiliary information and a primary secret key which is a random number, a value,which is calculated by performing an encryption of the symmetric encryption scheme using the second auxiliary information and the secondary secret key, and a plaintext. Advantageous effects of the invention

[0006] According to the present disclosure, a first ciphertext, which is a ciphertext encrypted by a symmetric encryption scheme, is converted using a value calculated by encrypting the symmetric encryption scheme using a sub-secret key and second auxiliary information, and a value calculated by encrypting the symmetric encryption scheme using a key corresponding to a converted public-key ciphertext and third auxiliary information. The key corresponding to the converted public-key ciphertext is a key generated by encrypting with a public-key encryption scheme.Therefore, according to the present disclosure, a ciphertext encrypted with the symmetric encryption scheme can be converted into a ciphertext of the public key encryption scheme without decryption. Short description of the drawings Fig. 1 is a diagram showing an example of a configuration of a ciphertext conversion system 100 according to Embodiment 1; Fig. 2 is a diagram showing an example of a configuration of a symmetric secret key generating apparatus 200 according to Embodiment 1; Fig. 3 is a diagram showing an example of a configuration of a common parameter generating device 300 according to Embodiment 1; Fig. 4 is a diagram showing an example of a configuration of a user secret key generation device 400 according to Embodiment 1; Fig. 5 is a diagram showing an example of a configuration of a symmetric key ciphertext generating apparatus 500 according to Embodiment 1; Fig. 6 is a diagram showing an example of a configuration of a conversion device 600 according to Embodiment 1; Fig. is a diagram showing an example of a configuration of a decryption device 700 according to Embodiment 1; Fig. 8 is a diagram showing an example of a hardware configuration of each of the devices according to Embodiment 1; Fig. 9 is a flowchart illustrating the operation of the symmetric secret key generating apparatus 200 according to Embodiment 1; Fig. 10 is a flowchart illustrating the operation of the common parameter generating device 300 according to Embodiment 1; Fig. 11 is a flowchart illustrating the operation of the user secret key generation device 400 according to Embodiment 1; Fig. 12 is a flowchart illustrating the operation of the symmetric key ciphertext generating apparatus 500 according to Embodiment 1; Fig. 13 is a flowchart illustrating the operation of the conversion device 600 according to Embodiment 1; Fig. 14 is a flowchart illustrating the operation of the decryption device 700 according to Embodiment 1; and Fig. 15 is a diagram showing an example of a hardware configuration of each of the devices according to a variant of Embodiment 1. Description of embodiments

[0007] In the description and drawings of the embodiments, the same and corresponding elements are designated by the same reference numerals. The description of elements designated by the same reference numeral is omitted or simplified where appropriate. The arrows in the figures primarily indicate data or signal flows or processing flows. "Device" or "unit" may be appropriately interpreted as "apparatus," "circuit," "equipment," "step," "method," "process," or "circuitry." Embodiment 1.*** Description of the configuration ***

[0008] In this embodiment, a ciphertext conversion system 100 is disclosed. An overview of this embodiment will be described below with reference to the drawings.

[0009] Fig. is a block diagram showing a configuration of the ciphertext conversion system 100 according to this embodiment. As shown in Fig. 1, the ciphertext conversion system 100 includes a plurality of symmetric secret key generating devices 200, a common parameter generating device 300, a plurality of user secret key generating devices 400, a ciphertext generating device 500, a converting device 600, and a decrypting device 700.

[0010] The devices constituting the ciphertext conversion system 100 may be installed in a local area network (LAN) or the like installed within the same company, rather than being interconnected via the Internet 101 to enable communication. At least two of the devices constituting the ciphertext conversion system 100 may be configured integrally as needed.

[0011] The Internet 101 is a communication channel that connects the plurality of symmetric secret key generation devices 200, the common parameter generation device 300, the plurality of user secret key generation devices 400, the ciphertext generation device 500, the conversion device 600, and the decryption device 700 to enable communication. The Internet 101 is a specific example of a network. Other types of networks may be used instead of the Internet 101.

[0012] The symmetric secret key generation device 200 is, for example, a personal computer (PC), also referred to as a secret key generation device for symmetric encryption. The symmetric secret key generation device 200 is a computer that generates a master secret key sk1 and a sub-secret key sk2, transmits the generated master secret key sk1 to the user secret key generation device 400, and transmits the generated sub-secret key sk2 to the conversion device 600 via the Internet 101. The master secret key sk1 is also referred to as the master secret key for symmetric encryption. The sub-secret key sk2 is also referred to as the sub-secret key for symmetric encryption.

[0013] The common parameter generation device 300 is, for example, a PC that generates common parameters used in the ciphertext conversion system 100 and transmits information indicating the generated common parameters to the plurality of user secret key generation devices 400 and the conversion device 600 via the Internet 101. The common parameters include a general secret key msk and a public key pk. The information including the common parameters may be sent directly to each device by mail or the like instead of being transmitted via the Internet 101. The term "data" and the term "information" may have substantially the same meaning.

[0014] The user secret key generation device 400 is, for example, a PC. The user secret key generation device 400 receives the master secret key sk1 from the symmetric secret key generation device 200, receives the general secret key msk from the common parameter generation device 300, and accepts, as input, information indicating an attribute parameter Γ. The user secret key generation device 400 is a computer that generates a user secret key sku based on the received general secret key msk and the master secret key sk1, as well as the attribute parameter Γ, and transmits the generated user secret key sku to the decryption device 700.

[0015] The ciphertext generation device 500 is a device that functions as a data encryption device, such as a personal computer, and is also referred to as a symmetric key ciphertext generation device. The ciphertext generation device 500 receives the master secret key sk1 and the sub-secret key sk2 from the symmetric secret key generation device 200 and also accepts, as input, information indicating a plaintext M. The ciphertext generation device 500 is a computer that generates a symmetric key ciphertext Csk using the received master secret key sk1 and sub-secret key sk2 and the plaintext M, and transmits the generated symmetric key ciphertext Csk to the conversion device 600.

[0016] The conversion device 600 is, as a specific example, a PC. The conversion device 600 receives the sub-secret key sk2 from the symmetric secret key generation device 200, receives the public key pk from the common parameter generation device 300, receives the symmetric key ciphertext Csk from the ciphertext generation device 500, and accepts as input information indicating a decryption enabling condition L. The conversion device 600 is a computer that generates a converted symmetric key ciphertext Csk' and a converted public key ciphertext Cpk using the received data and the decryption enabling condition L, and transmits the generated converted symmetric key ciphertext Csk' and the converted public key ciphertext Cpk to the decryption device 700.

[0017] The decryption device 700 is, as a specific example, a PC. The decryption device 700 is a computer that receives the converted symmetric key ciphertext Csk' and the converted public key ciphertext Cpk from the conversion device 600, also receives the user secret key sku from the user secret key generation device 400, decrypts a ciphertext based on the received data, and outputs a decryption result.

[0018] Fig. 2 is a block diagram showing an example of a configuration of the symmetric secret key generating device 200. As shown in Fig. 2, the symmetric secret key generating device 200 includes an input unit 201, a symmetric key encryption generating device 202, and a transmission unit 203. Although not shown, the symmetric secret key generating device 200 includes a recording medium for storing data used in each symmetric secret key generating device 200.

[0019] The input unit 201 accepts input of information indicating a key bit length k to be used in the ciphertext conversion system 100.

[0020] The symmetric key encryption generation device 202 generates the master secret key sk1 and the sub-secret key sk2. The master secret key sk1 and the sub-secret key sk2 are random numbers and are used as the basis for operations in the ciphertext conversion system 100. Although not shown, the symmetric key encryption generation device 202 may include a random number generation function or the like to generate the master secret key sk1 and the sub-secret key sk2.

[0021] The transmission unit 203 transmits the master secret key sk1 generated by the symmetric key encryption generating device 202 to the user secret key generating device 400 and the ciphertext generating device 500. The transmission unit 203 transmits the sub-secret key sk2 generated by the symmetric key encryption generating device 202 to the ciphertext generating device 500 and the conversion device 600.

[0022] Fig. 3 is a block diagram showing an example of a configuration of the common parameter generating device 300. As shown in Fig. 3, the common parameter generating device 300 includes an input unit 301, a common parameter generating device 302, and a transmission unit 303. Although not shown, the common parameter generating device 300 includes a recording medium for storing data used in each unit of the common parameter generating device 300.

[0023] The input unit 301 accepts the input of information indicating the key bit length k to be used in the ciphertext conversion system 100.

[0024] The common parameter generation unit 302 generates the public key pk and the general secret key msk. The public key pk and the general secret key msk are used as the basis for operations in the ciphertext conversion system 100. Although not shown, the common parameter generation unit 302 may include a random number generation function or the like to generate the public key pk and the general secret key msk.

[0025] The transmission unit 303 transmits the public key pk generated by the common parameter generation unit 302 to the conversion device 600. The transmission unit 303 transmits the general secret key msk generated by the common parameter generation unit 302 to each of the plurality of user secret key generation devices 400.

[0026] Fig. 4 is a block diagram showing an example of a configuration of the user secret key generation device 400. As shown in Fig. 4, the user secret key generating device 400 includes an input unit 401, a key receiving unit 402, a key generating unit 403, and a transmitting unit 404. Although not shown, the user secret key generating device 400 includes a recording medium for storing data used in each unit of the user secret key generating device 400.

[0027] The input unit 401 accepts the input of information specifying the attribute parameter Γ.

[0028] The key receiving unit 402 receives the general secret key msk and the master secret key sk1.

[0029] The key generation unit 403 generates the user secret key sku = (sk Γ, sk1). Although not shown, the key generation unit 403 may include a random number generation function or the like to generate the user secret key sku.

[0030] The transmission unit 404 transmits the user secret key sku generated by the key generation unit 403 to the decryption device 700.

[0031] Fig. 5 is a block diagram showing an example of a configuration of the ciphertext generating device 500. As shown in Fig. 5, the ciphertext generating device 500 includes an input unit 501, a key receiving unit 502, an encryption unit 503, and a transmission unit 504. Although not shown, the ciphertext generating device 500 includes a recording medium for storing data used in each unit of the ciphertext generating device 500.

[0032] The input unit 501 accepts the input of information indicating the plaintext M.

[0033] The key receiving unit 502 receives the master secret key sk1 and the sub secret key sk2.

[0034] The encryption unit 503 generates the symmetric ciphertext Csk. Although not shown, the encryption unit 503 may include a random number generation function or the like to generate the symmetric key ciphertext Csk.

[0035] The transmission unit 504 transmits the symmetric key ciphertext Csk to the conversion device 600.

[0036] Fig. 6 is a block diagram showing an example of a configuration of the conversion device 600.

[0037] As in Fig. 6, the conversion device 600 includes a key receiving unit 601, an input unit 602, a ciphertext receiving unit 603, a conversion unit 604, and a transmission unit 605. Although not shown, the conversion device 600 includes a recording medium for storing data used in each unit of the conversion device 600.

[0038] The key receiving unit 601 receives the public key pk and the secondary secret key sk2.

[0039] The input unit 602 accepts the input of information indicating the decryption enable condition L from an external source.

[0040] The ciphertext receiving unit 603 receives the symmetric key ciphertext Csk.

[0041] First, the conversion unit 604 generates the converted public key ciphertext Cpk using the decryption enabling condition L and the public key pk. At this time, the conversion unit 604 performs encryption of a public key encryption scheme using the public key pk and the decryption enabling condition L to generate a converted public key ciphertext P and a key K corresponding to the converted public key ciphertext P.

[0042] Next, the conversion unit 604 transforms the symmetric ciphertext Csk using the sub-secret key sk2 to generate the converted symmetric key ciphertext Csk'. At this time, the conversion unit 604 calculates, as at least a part of the converted symmetric key ciphertext Csk', an exclusive OR of a first ciphertext, a value calculated by encrypting a sub-secret key using the sub-secret key sk2 and second auxiliary information, and a value calculated by encrypting the symmetric encryption scheme using the key K corresponding to the converted public key ciphertext P and third auxiliary information.The first ciphertext is an exclusive OR of a value calculated by performing encryption of the symmetric encryption scheme using the first auxiliary information and the master secret key sk1, a value calculated by performing encryption of the symmetric encryption scheme using the second auxiliary information and the secondary secret key sk2, and the plaintext M. The converted symmetric key ciphertext Csk' may be composed of at least a portion of the converted symmetric key ciphertext Csk', the first auxiliary information, and the third auxiliary information. The public key encryption scheme is, for example, a functional encryption scheme or an attribute-based encryption scheme in which an access scope can be specified.

[0043] The transmission unit 605 transmits the converted public key ciphertext Cpk and the converted symmetric key ciphertext Csk' to the decryption device 700.

[0044] Fig. 7 is a block diagram showing an example of a configuration of the decryption device 700.

[0045] The decryption device 700 includes a ciphertext receiving unit 701, a key receiving unit 702, a decryption unit 703, and a result output unit 704.

[0046] The ciphertext receiving unit 701 receives the converted public key ciphertext Cpk and the converted symmetric key ciphertext Csk'.

[0047] The key receiving unit 702 receives the user secret key sku.

[0048] The decryption unit 703 performs a decryption process to decrypt the plaintext M.

[0049] In particular, the decryption unit 703 first performs the decryption of the attribute-based encryption scheme using the user secret key sk Γ according to the decryption release condition L and the transformed public key ciphertext Cpk to decrypt the key K according to the transformed public key ciphertext Cpk.

[0050] Next, the decryption unit 703 calculates, as plaintext M, an exclusive OR of at least a part of the converted symmetric key ciphertext Csk', a value calculated by performing encryption of the symmetric encryption scheme using the decrypted key K corresponding to the converted public key ciphertext Cpk and the third auxiliary information, and a value calculated by performing encryption of the symmetric encryption scheme using the master secret key sk1 and the first auxiliary information.

[0051] The result output unit 704 outputs the plaintext M decrypted by the decryption unit 703.

[0052] Fig. Fig. 8 is a diagram showing an example of the hardware resources of each of the devices according to this embodiment. As shown in Fig. As shown in Figure 8, each of the devices is a general purpose computer including a processor 11 (CPU - central processing unit).

[0053] As a concrete example, the processor 11 is a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The processor 11 is connected to and controls hardware devices such as a read-only memory (ROM) 13, a random access memory (RAM) 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20 via a bus 12. The drive 34 is a device that reads from and writes to a storage medium such as a flexible disk drive (FD), a compact disc (CD), and a digital versatile disc (DVD).

[0054] The ROM 13, the RAM 14, the magnetic disk device 20 and the drive 34 are examples of a storage device.

[0055] The keyboard 32, the mouse 33 and the communication board 15 are examples of an input device.

[0056] The display 31 and the communication board 15 are examples of an output device.

[0057] The communication board 15 is connected to a communication network such as a LAN, the Internet or a telephone line in a wired or wireless manner.

[0058] The magnetic disk device 20 stores an operating system (OS) 21, programs 22 and files 23.

[0059] The programs 22 include programs that perform functions referred to as "units" in this embodiment. The programs are read and executed by the processor 11. That is, the programs cause a computer to function as each "unit" and cause the computer to execute a process or method of each "unit."

[0060] The files 23 contain various data (inputs, outputs, determination results, processing results, etc.) used in each “unit” described in this embodiment.

[0061] Processes of this embodiment, which are described using flowcharts or the like, are executed using hardware such as the processor 11, the storage device, the input device, and the output device.

[0062] What is referred to as a “unit” can be implemented by firmware, software, hardware, or a combination of these elements.

[0063] Any program described in this specification may be recorded on a computer-readable, non-volatile recording medium. The non-volatile recording medium is, as a concrete example, an optical disk or flash memory. Any program described in this specification may be provided as a program product. *** Description of operation ***

[0064] A method for operating each of the devices constituting ciphertext conversion system 100 corresponds to a ciphertext conversion method. The ciphertext conversion method is also a generic term for methods executed in each of the devices. A program that implements the operation of each of the devices constituting ciphertext conversion system 100 corresponds to a ciphertext conversion program. The ciphertext conversion program is also a generic term for programs executed in each of the devices.

[0065] Before describing the operation of the ciphertext conversion system 100, the basic cryptographic techniques and notation used in this embodiment are explained below.

[0066] Attribute-based encryption is an encryption that can only be decrypted by a user who has a user secret key generated with a set of attributes Γ that satisfy a decryption condition specified by the decryption release condition L.

[0067] Method 1: Method that receives as input the setup ABESETUP, a key length, etc. and outputs a general secret key msk and a public key pk.

[0068] Method 2: Method that receives as input the generation of the user secret key ABEKEYGEN, the general secret key msk and the set of attributes Γ and generates a user secret key sk Γ which corresponds to the set of attributes Γ.

[0069] Method 3: Method which receives as input the encryption ABEENC, the public key pk and the decryption release condition L and generates a key K for symmetric encryption and a ciphertext P corresponding to the key K.

[0070] Method 4: Method that takes as input the decryption ABEDEC, the user secret key sk Γ receives the ciphertext P and outputs the key K encrypted as ciphertext P if the set of attributes Γ matches the decryption condition L used to generate the ciphertext P.

[0071] In common-key encryption, a plaintext M is encrypted with a secret symmetric key sk, and a ciphertext is decrypted with the secret symmetric key sk. The secret key for symmetric encryption sk is a random value, and the encryption SKEENC takes the secret symmetric key sk and the plaintext M as input and outputs the ciphertext. Decryption SKEDEC takes the secret symmetric key sk and the ciphertext as input and outputs the plaintext M.

[0072] For symmetric encryption, this embodiment uses a counter-mode encryption method using a block cipher. In counter mode, encryption is performed using an encryption function SENC of the symmetric encryption scheme and the auxiliary information auxC, as given in [Formula 1], and decryption is performed using the encryption function SENC and the auxiliary information auxC, as given in [Formula 2]. Note that the + operator represents an exclusive OR operation. The auxiliary information is a count value. C=SENC(sk, auxC)+M M=SENC(sk, auxC)+C

[0073] Fig. Figure 9 shows an example of generating a secret key. Fig. 9 describes the process of generating a secret key. (Step S201: Information input step)

[0074] The input unit 201 accepts as input information indicating the key bit length k. (Step S202: Secret key generation step)

[0075] The symmetric key encryption generating device 202 for symmetric encryption generates two k-bit random numbers and sets one of the generated random numbers as the master secret key sk1 and the other of the generated random numbers as the sub secret key sk2. (Step S203: Transfer step)

[0076] The transmission unit 203 transmits the master secret key sk1 and the sub secret key sk2 to each device as needed.

[0077] Fig. Figure 10 shows an example of a parameter generation procedure. Fig. 10 describes the procedure for parameter generation. (Step S301: Information input step)

[0078] The input unit 301 receives as input information indicating the key bit length k. (Step S302: Key generation step)

[0079] The common parameter generating device 302 performs the attribute-based encryption setup to generate the general secret key msk and the public key pk. (Step S303: Transfer step)

[0080] The transmission unit 303 transmits the generated general secret key msk and the public key pk to each device as needed.

[0081] Fig. Figure 11 shows an example of generating a user secret key. Fig. 11 describes the procedure for generating the user secret key. (Step S401: Attribute input step)

[0082] The input unit 401 receives information indicating the attribute parameter Γ. (Step S402: Key input step)

[0083] The key receiving unit 402 receives the general secret key msk and the master secret key sk1. (Step S403: User secret key generation step)

[0084] The key generation unit 403 executes the user key generation ABEKEYGEN of the attribute-based encryption using the attribute parameter Γ and the general secret key msk to generate the user secret key skΓ. (Step S404: Transfer step)

[0085] The transmission unit 404 transmits the user secret key sku = (sk Γ , sk1) including the generated user secret key sk Γ to any device, as needed.

[0086] Fig. Figure 12 shows an example of the generation of a ciphertext. Fig. 12 describes the ciphertext generation process. (Step S501: Key receiving step)

[0087] The key receiving unit 502 receives the master secret key sk1 and the sub secret key sk2. (Step S502: Plain text input step)

[0088] The input unit 501 receives information about the plaintext M. (Step S503: Encryption step)

[0089] The encryption device 503 encrypts the plaintext M as given in [Formula 3]. At this time, the encryption device 503 generates auxiliary information auxC1 and auxiliary information auxC2, each as data with an appropriate bit length. The encryption device 503 sets the symmetric key ciphertext Csk to (C, auxC1, auxC2). The auxiliary information auxC1 is also referred to as first auxiliary information. The auxiliary information auxC2 is also referred to as second auxiliary information. C is the first ciphertext and is a ciphertext of the symmetric encryption scheme. SENC(sk1, auxC1) is a value calculated by encrypting the symmetric encryption scheme using the first auxiliary information and the master secret key sk1.SENC (sk2, auxC2) is a value calculated by encrypting the symmetric encryption method using the second auxiliary information and the secondary secret key sk2, a random number. C=SENC(sk1, auxC1)+SENC(sk2, auxC2)+M (Step S504: Transfer step)

[0090] The transmission unit 504 transmits the symmetric key ciphertext Csk (= (C, auxC1, auxC2)) to each device as needed.

[0091] Fig. Figure 13 shows an example of a conversion process. Fig. 13 describes the conversion process. (Step S601: Key receiving step)

[0092] The key receiving unit 601 receives the public key pk and the secondary secret key sk2. (Step 602: Input step)

[0093] The input unit 602 accepts as input information indicating the decryption enable condition L. (Step 603: Conversion Target Generation Step)

[0094] The conversion unit 604 performs the encryption ABEENC of the attribute-based encryption using the public key pk and the decryption enabling condition L, as indicated [Formula 4]. Note that P is a converted public-key ciphertext, and K is a key corresponding to the converted public-key ciphertext generated by decrypting P. (K,P)=ABEENC(pk,L) (Step 604: Conversion step for encryption with a common key)

[0095] The ciphertext receiving unit 603 receives the symmetric key ciphertext Csk (= (C, auxC1, auxC2)).

[0096] The conversion unit 604 generates the auxiliary information auxC', performs the calculation specified in [Formula 5] using C, the sub-secret key sk2, the auxiliary information auxC2, the key K, and the generated auxiliary information auxC' to calculate C', and sets the converted ciphertext with symmetric key Csk' to (C', auxC1, auxC'). Note that the right side of [Formula 5] can be converted as specified in [Formula 6]. The auxiliary information auxC' is the third auxiliary information. SENC(sk2, auxC2) is a value calculated by encrypting the symmetric encryption scheme using the sub-secret key sk2 and the second auxiliary information. SENC (K, auxC') is a value calculated by encrypting the symmetric encryption scheme using the key K corresponding to the converted public key ciphertext and the third auxiliary information.C' is at least a part of the converted symmetric key ciphertext Csk'. C'=C+SENC(sk2, auxC2)+SENC(K,auxC') C+SENC(sk2, auxC2)+SENC(K,auxC')=SENC(sk1, auxC1)+SENC(K,auxC')+M (Step 605: Transfer step)

[0097] The transmission unit 605 sets the converted public key ciphertext Cpk to P and transmits the converted public key ciphertext Cpk and the converted symmetric key ciphertext Csk' to each device as needed.

[0098] Fig. Figure 14 shows an example of a decryption process. Fig. 14 describes the decryption process. (Step S701: Ciphertext reception step)

[0099] The ciphertext receiving unit 701 receives the transformed public key ciphertext Cpk (= P) and the transformed symmetric key ciphertext Csk'. (Step S702: Key input step)

[0100] The key receiving unit 702 receives the secret user key sku (= (sk Γ , sk1)). (Step 703: Decryption process step)

[0101] The decryption unit 703 performs the calculation specified in [Formula 7] as the decryption method of attribute-based encryption. The key K corresponds to the converted public key ciphertext Cpk. SENC(K, auxC') is a value calculated by encrypting the symmetric encryption scheme using the key K and the third auxiliary information. SENC(sk1, auxC1) is a value calculated by encrypting the symmetric encryption scheme using the secret master key sk1 and the first auxiliary information. K=ABEDEC(skΓ,P)M=C'+SENC(K,auxC')+SENC(sk1,auxC1) (Step704: Output step)

[0102] The result output unit 704 outputs data indicating the plaintext M obtained by the decryption process. *** Description of the effects of embodiment 1 ***

[0103] As described above, according to this embodiment, a ciphertext of the symmetric encryption scheme can be converted into a ciphertext of the symmetric encryption scheme without being decrypted.

[0104] Furthermore, in this embodiment, it is not necessary to generate a conversion key for each ciphertext for converting a ciphertext of the symmetric encryption scheme into a ciphertext of the public key encryption scheme. Therefore, according to this embodiment, the cost of generating a conversion key can be reduced, and the number of calls to a secret key for generating a conversion key can also be reduced, thus achieving improved security. *** Other configurations ***<Variante 1>

[0105] Fig. 15 shows an example of a hardware configuration for each of the devices according to this variant.

[0106] Each of the devices includes a processing circuit 18 instead of the processor 11, instead of the processor 11 and the ROM 13, instead of the processor 11 and the RAM 14, or instead of the processor 11, the ROM 13, and the RAM 14.

[0107] The processing circuit 18 is a hardware that implements at least part of the units included in each of the devices.

[0108] The processing circuit 18 may be dedicated hardware or a processor that executes the programs stored in the RAM 14.

[0109] When the processing circuit 18 is dedicated hardware, a specific example of the processing circuit 18 is a single circuit, a composite circuit, a programmed processor, a parallel-programmed processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a combination thereof.

[0110] Each of the devices may include a plurality of processing circuits as an alternative to processing circuit 18. The plurality of processing circuits share the role of processing circuit 18.

[0111] In each of the devices, some functions can be realized by special hardware and the remaining functions by software or firmware.

[0112] In a concrete example, the processing circuit 18 is implemented by hardware, software, firmware or a combination thereof.

[0113] The processor 11, the ROM 13, the RAM 14, and the processing circuit 18 are collectively referred to as the "processing circuit." That is, the functions of the functional components of the individual devices are realized by the processing circuits. *** Further examples ***

[0114] Embodiment 1 has been described, and parts of this embodiment may be implemented in combination. Alternatively, this embodiment may be implemented in part. Alternatively, this embodiment may be modified in various ways as needed and may be implemented in whole or in part in any combination.

[0115] The embodiment described above is essentially a preferred example and is not intended to limit the present disclosure, nor the applications and scope of use of the present disclosure. The methods described in the flowcharts, etc., may be modified as needed. List of reference symbols

[0116] 11: Processor; 12: Bus; 13: ROM; 14: RAM; 15: Communication board; 18: Processing circuit; 20: Magnetic disk device; 21: Operating system; 22: Programs; 23: Files; 31: Display; 32: Keyboard; 33: Mouse; 34: Disk drive; 100: Ciphertext conversion system; 101: Internet; 200: Symmetric secret key generating device; 201: Input unit; 202: Symmetric key encryption generating device; 203: Transmission unit; 300: Common parameter generating device; 301: Input unit; 302: Common parameter generating device; 303: Transmission unit; 400: User secret key generating device; 401: Input unit; 402: Key receiving unit; 403: Key generating unit; 404: Transmission unit; 500: Ciphertext generating device; 501: Input unit; 502: Key receiving unit; 503: Encryption unit; 504: Transmission unit; 600: Conversion device; 601: Key receiving unit; 602: Input unit;603: Ciphertext receiving unit; 604: Conversion unit; 605: Transmission unit; 700: Decryption device; 701: Ciphertext receiving unit; 702: Key receiving unit; 703: Decryption unit; 704: Result output unit; auxC1, auxC2, auxC': Auxiliary information, Csk: Symmetric key ciphertext; Csk': Converted symmetric key ciphertext; Cpk: Converted public key ciphertext; L: Condition for decryption; M: Plaintext; msk: General secret key; pk: Public key; sk1: Master secret key; sk2: Subsidiary secret key; sku: User secret key; skΓ: User secret key. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited non-patent literature

[0000] Z. Yu, MH Au, R. Yang, J. Lai, Q. Xu, “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption,” ASI-ACCS' 18, June

[0002] A. Syalim, T. Nishide, and K. Sakurai, “Realizing Proxy Re-encryption in the Symmetric World,” Communications in Computer and Information Science 251, November 2011

[0002]

Claims

[1] Ciphertext conversion system comprising: a conversion device with a conversion unit for performing encryption of a public-key encryption method using a public key and a decryption enabling condition to generate a converted public-key ciphertext and a key corresponding to the converted public-key ciphertext, and a calculation, as at least a part of a converted symmetric key ciphertext, an exclusive OR of a first ciphertext, a value calculated by performing encryption of a symmetric encryption method using a secondary secret key that is a random number and second auxiliary information, and a value calculated by performing encryption of the symmetric encryption method using the key corresponding to the converted public key ciphertext and third auxiliary information, wherein the first ciphertext is an exclusive OR of a value calculated by performing encryption of the symmetric encryption method using first auxiliary information and a primary secret key that is a random number, a value,which is calculated by performing an encryption of the main secret key using the second auxiliary information and the secondary secret key, and a plaintext. [2] The ciphertext conversion system according to claim 1, wherein the converted symmetric key ciphertext is composed of at least a part of the converted symmetric key ciphertext, the first auxiliary information and the third auxiliary information. [3] The ciphertext conversion system according to claim 1 or 2, wherein the public key encryption method is an attribute-based encryption method. [4] Ciphertext conversion system according to claim 3, wherein the ciphertext conversion system further performs decryption of the attribute-based encryption scheme using a user secret key that satisfies the decryption release condition and the converted public key ciphertext to decrypt the key that corresponds to the converted public key ciphertext, and calculates, as plaintext, an exclusive OR of at least a part of the converted symmetric key ciphertext, a value calculated by performing the encryption of the symmetric encryption method using the decrypted key corresponding to the converted public key ciphertext and the third auxiliary information, and a value calculated by performing the encryption of the symmetric encryption method using the master secret key and the first auxiliary information. [5] Ciphertext conversion method comprising performing encryption of a public-key encryption method using a public key and a decryption enabling condition to generate a converted public-key ciphertext and a key corresponding to the converted public-key ciphertext, and Calculating, as at least a part of a converted symmetric key ciphertext, an exclusive OR of a first ciphertext, a value calculated by performing encryption of a symmetric encryption method using a secondary secret key that is a random number and second auxiliary information, and a value calculated by performing encryption of the symmetric encryption method using the key corresponding to the converted public key ciphertext and third auxiliary information, wherein the first ciphertext is an exclusive OR of a value calculated by performing encryption of the symmetric encryption method using first auxiliary information and a primary secret key that is a random number, a value,which is calculated by performing an encryption of the main secret key using the second auxiliary information and the secondary secret key, and a plaintext is calculated, by a computer ., [6] Ciphertext conversion program that causes a conversion device, which is a computer, to execute: a conversion method for performing encryption of a public-key encryption method using a public key and a decryption enabling condition to generate a converted public-key ciphertext and a key corresponding to the converted public-key ciphertext, and a calculation, as at least a part of a converted symmetric key ciphertext, an exclusive OR of a first ciphertext, a value calculated by performing encryption of a symmetric encryption method using a secondary secret key which is a random number and second auxiliary information, and a value calculated by performing encryption of the symmetric encryption method using the key corresponding to the converted public key ciphertext and third auxiliary information, wherein the first ciphertext is an exclusive OR of a value calculated by performing encryption of the symmetric encryption method using first auxiliary information and a primary secret key which is a random number, a value,which is calculated by performing an encryption of the main secret key using the second auxiliary information and the secondary secret key, and a plaintext.

Images