Distributed re-encryption device, encryption device, distributed re-encryption method, and distributed re-encryption program

Abstract

To contribute to preventing leakage of a user's decryption key from a re-encryption key for re-encryption to enable ciphertext to be decrypted by a recipient's key.SOLUTION: A distributed re-encryption device comprises: a distributed re-encryption key preservation unit for securely distributing a re-encryption key for re-encrypting a ciphertext into a ciphertext encrypted by another encryption key, without decrypting the ciphertext; and a distributed re-encryption unit for re-encrypting the ciphertext into a ciphertext encrypted by another encryption key, without decrypting the ciphertext by using a share of the re-encryption key.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a distributed re-encryption device, a cryptosystem, a distributed re-encryption method, and a distributed re-encryption program. [Background technology]

[0002] Homomorphic encryption is known as a method that can manipulate the value of plaintext by applying operations to the ciphertext without decrypting it. A method that can perform operations on the two operations of addition and multiplication in particular is called fully homomorphic encryption (FHE). However, while general homomorphic encryption can perform operations on ciphertext encrypted with the same key without decrypting it, it cannot perform operations on ciphertext encrypted with different keys without decrypting it. In response to this, multi-key fully homomorphic encryption (multi-key FHE), which allows operations to be performed on ciphertexts encrypted with different keys, has also been developed. [Prior art documents] [Patent documents]

[0003] [Non-Patent Document 1] YASUDA, Satoshi, et al. Multi-key homomorphic proxy re-encryption. In: International Conference on Information Security. Springer, Cham, 2018. p. 328-346. Summary of the Invention [Problem to be solved by the invention]

[0004] The disclosures of the above-mentioned prior art documents are incorporated herein by reference. The following analysis was conducted by the present inventors.

[0005] Incidentally, although multi-key fully homomorphic encryption (multi-key FHE) allows calculations between ciphertexts encrypted with different keys, there is a problem in that the owner of the decryption key corresponding to the key involved in the calculation must be online when decrypting. To address this problem, Non-Patent Document 1 proposes a method of re-encrypting a ciphertext encrypted with the recipient's encryption key without decrypting the ciphertext.

[0006] However, the method described in Non-Patent Document 1 has a problem that if the re-encryption key is leaked or if the calculation server colludes with the receiver, the user decryption key before re-encryption is leaked. For example, the decryption key of user i is leaked from the re-encryption key that re-encrypts the ciphertext encrypted with the key of user i to the key of receiver R.

[0007] In consideration of the above-mentioned problems, an object of the present invention is to provide a distributed re-encryption device, a cryptographic system, a distributed re-encryption method, and a distributed re-encryption program that contribute to preventing leakage of a user's decryption key from a re-encryption key that re-encrypts a ciphertext so that it can be decrypted with a recipient's key. [Means for solving the problem]

[0008] In a first aspect of the present invention, there is provided a distributed re-encryption device comprising: a distributed re-encryption key storage unit that secretly shares a re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext, and stores a share; and a distributed re-encryption unit that uses a share of the re-encryption key to re-encrypt the ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext.

[0009] In a second aspect of the present invention, there is provided an encryption system in which the above-described multiple distributed re-encryption devices, multiple key generation devices including an encryption key generation unit that generates an encryption key in multi-key fully homomorphic encryption, a decryption key generation unit that generates a decryption key in the multi-key fully homomorphic encryption, an evaluation key generation unit that generates an evaluation key in the multi-key fully homomorphic encryption, a re-encryption key generation unit that generates the re-encryption key, an encryption key storage unit that stores the encryption key, and a decryption key storage unit that stores the decryption key, multiple encryption devices including a ciphertext generation unit that generates a ciphertext in the multi-key fully homomorphic encryption using the encryption key, an encrypted data calculation device including a ciphertext storage unit that stores the ciphertext, an evaluation key storage unit that stores an evaluation key used in an operation between the ciphertexts, and a calculation unit that performs a homomorphic operation between the ciphertexts, and a decryption device that decrypts the ciphertext encrypted with the other encryption key are connected via a network.

[0010] In a third aspect of the present invention, there is provided a distributed re-encryption method, which obtains a secret shared share of a re-encryption key for re-encrypting a ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext, and uses the share of the re-encryption key to re-encrypt the ciphertext into a ciphertext encrypted with the other encryption key without decrypting the ciphertext.

[0011] In a fourth aspect of the present invention, there is provided a distributed re-encryption program that causes an information processing device to execute a process of secretly distributing a re-encryption key for re-encrypting a ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext, to obtain a share, and using the share of the re-encryption key to re-encrypt the ciphertext into a ciphertext encrypted with the other encryption key without decrypting the ciphertext. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0012] According to each aspect of the present invention, it is possible to provide a distributed re-encryption device, a cryptographic system, a distributed re-encryption method, and a distributed re-encryption program that contribute to preventing a user's decryption key from being leaked from a re-encryption key that re-encrypts a ciphertext so that it can be decrypted with a recipient's key. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of a cryptographic system according to the present disclosure. [Diagram 2] FIG. 2 is a flowchart showing an example of a procedure of the distributed re-encryption method according to the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a hardware configuration of the distributed re-encryption device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. However, the present invention is not limited to the embodiment described below. In addition, in each drawing, the same or corresponding elements are appropriately assigned the same reference numerals. Furthermore, it should be noted that the drawings are schematic, and the dimensional relationship of each element, the ratio of each element, etc. may differ from the actual ones. There may also be parts in which the dimensional relationship and ratio differ between the drawings.

[0015] FIG. 1 is a diagram showing an example of a cryptosystem according to the present disclosure. As shown in FIG. 1, the cryptosystem 100 includes a plurality of key generating devices 100_1,...,100_k, a plurality of encryption devices 101_1,...,101_k, a decryption device 102, an encrypted data calculation device 103, and a plurality of distributed re-encryption devices 104_1,...,104_N, which are connected via a network. Here, the plurality of key generating devices 100_1,...,100_k and the plurality of encryption devices 101_1,...,101_k are the same k units, where k is the number of ciphertexts involved in the multi-key fully homomorphic encryption executed by the encrypted data calculation device 103. Note that, in terms of applications, k is preferably 2 or more, but even if k=1, the present invention can be appropriately implemented and its effects can be enjoyed in applications in which a ciphertext is re-encrypted with an encryption key different from the encryption key used for encryption. On the other hand, the number of the multiple distributed re-encryption devices 104_1,...,104_N is the number that can perform secret calculation in the secret sharing scheme, and should be at least two or more. As will be exemplified later, secret sharing secure calculation is a calculation method in which a calculation target is divided into small pieces called shares, and each share is distributed and held by multiple devices. Furthermore, the distributed and held shares can perform the intended calculation without being restored during the secure calculation. Since the distributed and held shares cannot restore the original calculation target by themselves, security against information leakage is high.

[0016] The key generating device 100_1 includes an encryption key generating unit 100_1_1 for generating an encryption key in the multi-key fully homomorphic encryption, a decryption key generating unit 100_1_2 for generating a decryption key in the multi-key fully homomorphic encryption, an evaluation key generating unit 100_1_3 for generating an evaluation key in the multi-key fully homomorphic encryption, a re-encryption key generating unit 100_1_4 for generating a re-encryption key, an encryption key storage unit 100_1_5 for storing the encryption key, and a decryption key storage unit 100_1_6 for storing the decryption key. Although not shown in the figure, it is assumed that all of the multiple key generating devices 100_1,...,100_k have the same configuration as the key generating device 100_1.

[0017] The encryption device 101_1 includes a ciphertext generation unit 101_1_1 that generates a ciphertext in multi-key fully homomorphic encryption by using an encryption key. Here, when generating a ciphertext, the ciphertext generation unit 101_1_1 receives an encryption key stored in an encryption key storage unit 100_1_5 of the key generation device 100_1, and generates the ciphertext by using the encryption key. Therefore, the encryption device 101_1 is paired with the key generation device 100_1. Although not shown in the figure, it is assumed that all of the multiple encryption devices 101_1, ..., 101_k have the same configuration as the encryption device 101_1.

[0018] The encrypted data calculation device 103 includes a ciphertext storage unit 103_2 for storing ciphertexts, an evaluation key storage unit 103_3 for storing an evaluation key used in calculations between ciphertexts, and a calculation unit 103_1 for performing homomorphic calculations between ciphertexts. The ciphertext storage unit 103_2 stores ciphertexts generated by a plurality of encryption devices 101_1,...,101_k, and the evaluation key storage unit 103_3 stores evaluation keys generated by a plurality of key generation devices 100_1,...,100_k. The ciphertexts generated by the plurality of encryption devices 101_1,...,101_k are encrypted using different encryption keys, and the calculation unit 103_1 performs homomorphic calculations between ciphertexts encrypted using different encryption keys by utilizing a mechanism of multi-key fully homomorphic encryption.

[0019] The shared re-encryption device 104_1 includes a shared re-encryption key storage unit 104_1_2 that secretly shares a re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext and stores the shares, and a shared re-encryption unit 104_1_1 that re-encrypts a ciphertext encrypted with another encryption key without decrypting the ciphertext using the shares of the re-encryption key. The shared re-encryption key storage unit 104_1_2 stores shares obtained by secretly sharing the re-encryption key generated by the multiple key generating devices 100_1,...,100_k. Although not shown in the figure, it is assumed that all of the multiple shared re-encryption devices 104_1,...,104_N have the same configuration as the shared re-encryption device 104_1.

[0020] The re-encryption key is composed of a part of a decryption key for a ciphertext encrypted with another encryption key and a decryption key for the original ciphertext, but since the shared re-encryption key storage unit 104_1_2 stores a share obtained by secretly sharing the re-encryption key, rather than the re-encryption key itself, even if the share obtained by secretly sharing the re-encryption key is leaked from the shared re-encryption key storage unit 104_1_2, the re-encryption key itself is not leaked, and the decryption key for the original ciphertext is not leaked either. Furthermore, when the shared re-encryption unit 104_1_1 re-encrypts a ciphertext encrypted with another encryption key without decrypting the ciphertext using the share of the re-encryption key, it performs a calculation within the range of the secret calculation of the secret sharing method, so that even if data during the re-encryption is leaked, the decryption key for the original ciphertext is not leaked. Since the re-encrypted ciphertext is obtained in the form of a secretly shared share, the re-encrypted ciphertext is obtained by decrypting it.

[0021] The decryption device 102 decrypts the ciphertext re-encrypted by the multiple distributed re-encryption devices 104_1,...,104_N. The multiple distributed re-encryption devices 104_1,...,104_N re-encrypt the ciphertext to be decrypted with a decryption key held by the decryption device 102, so the decryption device 102 only needs to decrypt the ciphertext using the decryption key held by the decryption device 102.

[0022] (Example using MK-BFV) Here, an embodiment of the present invention will be described using multi-key BFV as an example of multiple-key fully homomorphic encryption. Note that, although an example using multi-key BFV will be described here, this is for the purpose of explaining the technical features of the present invention, and the implementation of the present invention is not limited to the use of multi-key BFV.

[0023] 〔notation〕 The set of users of Multi-key BFV is denoted as follows. i denotes the i-th user, each of which operates a plurality of key generating apparatuses 100_1, ..., 100_k and a plurality of encrypting apparatuses 101_1, ..., 101_k in the above description.

number

number

number

[0024] The secret sharing method used is n-out-of-n additive secret sharing. That is, the share of x, [x], is defined as follows. Note that although n-out-of-n additive secret sharing is used here, the more general t-out-of-n replica secret sharing can also be used.

number

[0025] Constant addition, constant multiplication, and addition between shares in n-out-of-n additive secret sharing are defined as follows:

number

[0026] [Notes about Multi-key BFV] In normal BFV, the ciphertext is as follows, but when homomorphic operations are performed, it becomes the extended ciphertext. That is, for a set of users T={id 1 ,...,id kIf the ciphertext involves |T|, the ciphertext header will increase as follows. If homomorphic operations are performed on ciphertexts related to T and T' with different user sets, zero padding is performed to match the larger of |T| and |T'|.

number

[0027] Each participant i has a private key s i ∈R 3 , user set T={id 1 ,...,id k}, the decryption of the extended ciphertext is performed as follows. In practice, each participant partially decrypts each element, and then the decryption is performed by merging them.

number

[0028] [Syntax]

number

[0029] [Re-encryption key creation] Decryptor U j is a random number r that will later become part of the decryption key (i→j) ∈R q Create a user U i (i=1,...). Here, we assume that we are creating re-encryption keys for all users. However, if we are creating re-encryption keys for only a subset of users U′ ⊂ U, we can send the keys to each user included in U′. (i→j) is not a public key, so user U i (and the decryptor U j ) is known only to the random number r (i→j) Send.

[0030] Each user U i is the re-encryption key rk (i→j) =s i -r (i→j)(mod q) and calculate the secret sharing share [rk (i→j) ] is sent to the proxy servers. i ∈R 3 is user U i In this way, the re-encryption key rk (i→j) =s i -r (i→j) (mod q) is the user U i Decryption key s i and the decoder U j Part of the decryption key for (i→j) Contains the re-encryption key rk (i→j) If leaked, user U i Decryption key s i and the decoder U j Part of the decryption key for (i→j) However, in this configuration, the re-encryption key rk (i→j) Instead, re-encrypt the key rk (i→j) Share of [rk (i→j) ] is sent to the proxy servers, so the share [rk (i→j) Even if the information is leaked, that alone will not be enough to i Decryption key s i and the decoder U j Part of the decryption key for (i→j) This ensures high security as there is no risk of data leakage.

[0031] [Re-encryption and decryption] For the extended MK-BFV ciphertext, the decryptor U j Consider re-encrypting the data so that it can be decrypted without communicating with other users. Here, (id1→j) ],…,[rk (idk→j) ] is shared by the set of proxy servers, which share the MK-BFV ciphertext.

number

[0032] The proxy server set computes the following:

number

[0033] The proxy server set then recovers the above value by adding smudging noise and sends it to the decryptor U j Ni 0 '. In addition, the smudging noise may be added by a calculation server or the like. Furthermore, the proxy server set is j Ni id1 ,...,c idk Send.

[0034] On the other hand, the decryptor U j is the re-encrypted ciphertext (c 0 ′,c id1 ,...,c idk ) and a random number {r (idi’→j)} k i’=1 Calculate the following using

number

[0035] In this case, the following term is the error noise e 0 , e i ', e i Note that if is small enough, it can be ignored. This correctly returns the plaintext m (mod t).

[0036] (Distributed re-encryption method) Fig. 2 is a flowchart showing an example of the procedure of the distributed re-encryption method according to the present disclosure. As shown in Fig. 2, the distributed re-encryption method includes a process (step S1) of acquiring a share obtained by secretly sharing a re-encryption key, and a process (step S2) of re-encrypting a ciphertext using the re-encryption key. Note that these processes are assumed to be executed by the above-mentioned multiple distributed re-encryption devices 104_1,...,104_N.

[0037] The process of obtaining a share obtained by secretly sharing the re-encryption key (step S1) is a process of obtaining a share obtained by secretly sharing the re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext. This re-encryption key is obtained by receiving the re-encryption key generated by the re-encryption key generation units 100_1_4, ..., 100_1_k of the key generation devices 100_1, ..., 100_k.

[0038] The process of re-encrypting the ciphertext using the re-encryption key (step S2) re-encrypts the ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext using a share of the re-encryption key. This re-encryption process is a secret calculation of the secret sharing scheme using a share of the re-encryption key. That is, as described above, even if data during re-encryption is leaked, the decryption key for the original ciphertext will not be leaked.

[0039] (Hardware configuration example) Fig. 3 is a diagram showing an example of a hardware configuration of a distributed re-encryption device. That is, the multiple distributed re-encryption devices 104_1, ..., 104_N can realize each function of the multiple distributed re-encryption devices 104_1, ..., 104_N by executing the above-described distributed re-encryption method as a program in an information processing device (computer) 30 employing the hardware configuration shown in Fig. 3. However, the hardware configuration example shown in Fig. 3 is an example of a hardware configuration that realizes each function of the multiple distributed re-encryption devices 104_1, ..., 104_N, and is not intended to limit the hardware configuration of the multiple distributed re-encryption devices 104_1, ..., 104_N. The multiple distributed re-encryption devices 104_1, ..., 104_N may include hardware not shown in Fig. 3.

[0040] As shown in FIG. 3, the hardware configuration that can be adopted by multiple distributed re-encryption devices 104_1, ..., 104_N includes a CPU (Central Processing Unit) 31, a main memory device 32, an auxiliary memory device 33, and an IF (Interface) unit 34, which are interconnected by, for example, an internal bus.

[0041] The CPU 31 executes each command included in the distributed re-encryption program executed by the information processing device (computer) 30. The main storage device 32 is, for example, a RAM (Random Access Memory), and temporarily stores various programs such as the distributed re-encryption program executed by the information processing device (computer) 30 for processing by the CPU 31.

[0042] The auxiliary storage device 33 is, for example, an HDD (Hard Disk Drive), and is capable of storing various programs, such as the distributed re-encryption program, executed by the information processing device (computer) 30, for a medium to long term. Various programs, such as the distributed re-encryption program, can be provided as a program product recorded on a non-transitory computer-readable storage medium.

[0043] The IF unit 34 provides an interface related to input / output of, for example, a plurality of distributed re-encryption devices 104_1, . . . , 104_N.

[0044] An information processing device (computer) 30 employing the above-mentioned hardware configuration implements each function of a plurality of distributed re-encryption devices 104_1, . . . , 104_N by executing the above-mentioned distributed re-encryption method as a program.

[0045] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. [Appendix 1] a shared re-encryption key storage unit that secretly shares a re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext, and stores the shares; a shared re-encryption unit that re-encrypts the ciphertext by using a share of the re-encryption key without decrypting the ciphertext, into a ciphertext encrypted with another encryption key; A distributed re-encryption device comprising: [Appendix 2] 2. The distributed re-encryption device according to claim 1, wherein the ciphertext is a result of a homomorphic operation between ciphertexts encrypted with different keys. [Appendix 3] 3. The distributed re-encryption device according to claim 1 or 2, wherein the re-encryption key is constructed by combining a part of a decryption key for a ciphertext encrypted with the other encryption key and a decryption key for the ciphertext. [Appendix 4] The distributed re-encryption device according to any one of appendices 1 to 3, wherein the ciphertext encrypted with the other encryption key is obtained by decrypting a value calculated in the form of a secret shared share. [Appendix 5] A plurality of distributed re-encryption devices according to any one of Supplementary Note 1 to 4; a plurality of key generation devices including an encryption key generation unit that generates an encryption key in a multi-key fully homomorphic encryption, a decryption key generation unit that generates a decryption key in the multi-key fully homomorphic encryption, an evaluation key generation unit that generates an evaluation key in the multi-key fully homomorphic encryption, a re-encryption key generation unit that generates the re-encryption key, an encryption key storage unit that stores the encryption key, and a decryption key storage unit that stores the decryption key; a plurality of encryption devices each including a ciphertext generation unit configured to generate a ciphertext in the multi-key fully homomorphic encryption by using the encryption key; an encrypted data calculation device including a ciphertext storage unit that stores ciphertexts, an evaluation key storage unit that stores an evaluation key used in an operation between the ciphertexts, and a calculation unit that performs a homomorphic operation between the ciphertexts; a decryption device that decrypts a ciphertext encrypted with the other encryption key; A networked cryptosystem. [Appendix 6] 6. The encryption system according to claim 5, wherein the re-encryption key is constructed by combining a part of a decryption key for a ciphertext encrypted with the other encryption key and a decryption key for the ciphertext. [Appendix 7] A re-encryption key is obtained by secretly sharing a share of the re-encryption key for re-encrypting the ciphertext encrypted with another encryption key without decrypting the ciphertext, a shared re-encryption method, in which the re-encryption key share is used to re-encrypt the ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext; [Appendix 8] 8. The shared re-encryption method according to claim 7, wherein the ciphertext encrypted with the other encryption key is obtained by decrypting the ciphertext calculated in the form of a secret shared share. [Appendix 9] A re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext is secretly shared to obtain shares. a shared re-encryption program that causes an information processing device to execute a process of re-encrypting the ciphertext into a ciphertext encrypted with another encryption key, without decrypting the ciphertext, by using a share of the re-encryption key; [Appendix 10] 10. The distributed re-encryption program according to claim 9, which causes an information processing device to execute a process of obtaining a ciphertext encrypted with the other encryption key by decrypting the ciphertext calculated in the form of a secret shared share.

[0046] The disclosures of the above cited patent documents are incorporated herein by reference. Within the scope of the entire disclosure of the present invention (including the scope of claims), modifications and adjustments of the embodiments and examples are possible based on the basic technical ideas. Furthermore, within the scope of the entire disclosure of the present invention, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make in accordance with the entire disclosure including the scope of claims and the technical ideas. In particular, with regard to the numerical ranges described in this specification, any numerical value or small range included in the range should be construed as being specifically described even if not otherwise specified. Furthermore, the disclosures of the above cited documents, if necessary, in accordance with the spirit of the present invention, may be used in part or in whole in combination with the disclosures of this specification as part of the disclosure of the present invention, and are deemed to be included in the disclosures of this application. [Explanation of symbols]

[0047] 100 Cryptosystem 100_1,...,100_k Key generator 100_1_1 Encryption key generation unit 100_1_2 Decryption key generation part 100_1_3 Evaluation key generation unit 100_1_4 Re-encryption key generation unit 100_1_5 Encryption key storage section 100_1_6 Decryption key storage section 101_1,...,101_k Encryption device 101_1_1 Ciphertext generation section 102 Decoding device 103 Encrypted Data Calculation Device 103_1 Arithmetic unit 103_2 Ciphertext storage section 103_3 Evaluation key storage unit 104_1,...,104_N Distributed re-encryption device 104_1_1 Distributed re-encryption unit 104_1_2 Distributed re-encryption key storage unit 30 Information processing device 31 CPU 32 Main storage 33 Auxiliary storage device 34 IF Section

Claims

1. a shared re-encryption key storage unit that secretly shares a re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext, and stores the shares; a shared re-encryption unit that re-encrypts the ciphertext by using a share of the re-encryption key without decrypting the ciphertext, into a ciphertext encrypted with another encryption key; A distributed re-encryption device comprising:

2. The distributed re-encryption device according to claim 1 , wherein the ciphertext is a result of a homomorphic operation between ciphertexts encrypted with different keys.

3. 2. The distributed re-encryption device according to claim 1, wherein the re-encryption key is formed by combining a part of a decryption key for ciphertext encrypted with the other encryption key and the decryption key for the ciphertext.

4. 2. The distributed re-encryption device according to claim 1, wherein the ciphertext encrypted with the other encryption key is obtained by decrypting a ciphertext calculated in the form of a secret shared share.

5. A plurality of distributed re-encryption devices according to claim 1; a plurality of key generation devices including an encryption key generation unit that generates an encryption key in a multi-key fully homomorphic encryption, a decryption key generation unit that generates a decryption key in the multi-key fully homomorphic encryption, an evaluation key generation unit that generates an evaluation key in the multi-key fully homomorphic encryption, a re-encryption key generation unit that generates the re-encryption key, an encryption key storage unit that stores the encryption key, and a decryption key storage unit that stores the decryption key; a plurality of encryption devices each including a ciphertext generation unit configured to generate a ciphertext in the multi-key fully homomorphic encryption by using the encryption key; an encrypted data calculation device including a ciphertext storage unit that stores ciphertexts, an evaluation key storage unit that stores an evaluation key used in an operation between the ciphertexts, and a calculation unit that performs a homomorphic operation between the ciphertexts; a decryption device that decrypts a ciphertext encrypted with the other encryption key; A networked cryptosystem.

6. 6. The encryption system according to claim 5, wherein the re-encryption key is formed by combining a part of a decryption key for ciphertext encrypted with the other encryption key and the decryption key for the ciphertext.

7. A re-encryption key is obtained by secretly sharing a share of the re-encryption key for re-encrypting the ciphertext encrypted with another encryption key without decrypting the ciphertext, a shared re-encryption method, in which the re-encryption key share is used to re-encrypt the ciphertext into a ciphertext encrypted with another encryption key without decrypting the ciphertext;

8. 8. The shared re-encryption method according to claim 7, wherein the ciphertext encrypted with the other encryption key is obtained by decrypting a ciphertext calculated in the form of a secret shared share.

9. A re-encryption key for re-encrypting a ciphertext encrypted with another encryption key without decrypting the ciphertext is secretly shared to obtain shares. a shared re-encryption program that causes an information processing device to execute a process of re-encrypting the ciphertext into a ciphertext encrypted with another encryption key, without decrypting the ciphertext, by using a share of the re-encryption key;

10. 10. The distributed re-encryption program according to claim 9, which causes an information processing device to execute a process of obtaining a ciphertext encrypted with the other encryption key by decrypting a ciphertext calculated in the form of a secret shared share.

Images