Communication system, method, and program
The non-smooth-FESTA method improves the security of quantum-resistant cryptography by adjusting isogeny degrees and parameters, ensuring secure and efficient data transmission.
Patent Information
- Application Number
- JP2024046715
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2024-03-22
- Publication Date
- 2025-10-03
AI Technical Summary
Existing quantum-resistant public key cryptography methods based on isogeny mapping, such as SIDH and SIKE, have been compromised by attacks, and while FESTA reduces ciphertext and public key size, its security remains weak.
A communication system utilizing isogenous mappings with specific system parameters and key generation, encryption, and decryption algorithms that enhance security while maintaining a smaller data size, employing a modified FESTA method called non-smooth-FESTA, which adjusts isogeny degrees and parameters to improve security.
The proposed method achieves highly secure public key cryptography with reduced data size, addressing the vulnerabilities of previous methods by enhancing security without increasing data size.
Smart Images
Figure 2025146109000001_ABST
Abstract
Description
[Technical Field]
[0001] The present disclosure relates to a communication system, method, and program. [Background technology]
[0002] Cryptographic methods that are considered to be quantum-resistant are called quantum-safe cryptography. Isogeny mapping cryptography is known as one of the candidates for quantum-safe cryptography. Representative public key cryptography methods based on isogeny mapping include SIDH, SIKE, and CSIDH. However, attacks that break the security of SIDH and SIKE have been discovered, making these methods no longer secure.
[0003] After the discovery of an attack method to break the security of SIDH and SIKE (hereinafter referred to as SIDH attack), a new encryption method called FESTA, which is resistant to SIDH attacks, was proposed. Also, to reduce the parameters of FESTA, an algorithm called RandIsogImages was proposed, which calculates isogenous maps with non-smooth degrees (Non-Patent Document 1). [Prior art documents] [Non-patent literature]
[0004] [Non-Patent Document 1] Kohei Nakagawa and Hiroshi Onuki. "QFESTA: Efficient Algorithms and Parameters for FESTA using Quaternion Algebras." Cryptology ePrint Archive, 2023. https: / / eprint.iacr.org / 2023 / 1468 Summary of the Invention [Problem to be solved by the invention]
[0005] However, while FESTA using RandIsogImages can reduce the size of the ciphertext and the public key compared to FESTA, it has the problem of weak security.
[0006] The present disclosure has been made in consideration of the above points, and aims to realize public key cryptography based on isogenous mapping that is highly secure while suppressing data size. [Means for solving the problem]
[0007] A communication system according to one aspect of the present disclosure includes a security parameter λ and integers a′ and b′ determined from the security parameter λ, and a parameter d A,1 =2 a' -3 b' , d A,2 =3 b' , d1=2 2a' +2 a' 3 b' +3 2b' , d2=3 2b' , a=3a' and prime number p=2 a 3f-1 (where f is a natural number) and the finite field F p^2 The torsion subgroup E0[2 a ] is a communication system that realizes encrypted communication using isogenous mapping encryption with generators P0 and Q0 of ] as system parameters, and selects a random 2 × 2 regular diagonal matrix A on Z / 2aZ, and A,1 and P0, Q0 are used to generate random d A,1 -homogeneous map φ A,1 :E0→E A ' and P A '=φ A,1 (P0) and Q A '=φ A,1 (Q0) and randomly generate d A,2 -homogeneous map φ A,2 :E A '→E A By selecting the public key pk=(E A ,R A ,S A ) (However, R Aand S A is (R A ,S A ) Τ =A(P A =φ A,2 (P A '),Q A =φ A,2 (Q A ')) Τ A value that satisfies the above condition) and a private key sk=(A,E) used to decrypt the ciphertext encrypted with the public key pk. A ',P A ',Q A and a key generation unit that generates a key '). [Effects of the Invention]
[0008] It is possible to realize public key cryptography based on isogenous mappings that is highly secure while suppressing data size. [Brief explanation of the drawings]
[0009] [Figure 1] FIG. 1 is a diagram showing an example of a commutative diagram of an isogeny. [Figure 2] FIG. 1 is a diagram illustrating an example of the relationship between elliptic curves and isogenous mappings in FESTA. [Figure 3] FIG. 10 is a diagram illustrating an example of the relationship between an elliptic curve and an isogenous mapping in the proposed method. [Figure 4] 1 is a diagram illustrating an example of the overall configuration of an encrypted communication system according to an embodiment of the present invention. [Figure 5] FIG. 2 is a diagram illustrating an example of a functional configuration of a receiver device according to the present embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a functional configuration of a transmitter device according to the present embodiment. [Figure 7] FIG. 10 is a sequence diagram illustrating an example of an encrypted communication process according to the present embodiment. [Figure 8] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION
[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
[0011] <Prior art> Public key cryptography is a cryptography method that uses different keys for encryption and decryption, and the encryption key is made public. Public key cryptography includes three algorithms: a key generation algorithm, an encryption algorithm, and a decryption algorithm. The key generation algorithm outputs two keys, called a public key and a private key. Of these, the public key is the information needed to encrypt a message, and the private key is the information needed to decrypt the ciphertext. Message sender A creates a ciphertext from the public key and message m using the encryption algorithm, and sends it to recipient B, the other party. Recipient B then decrypts the ciphertext using the private key using the decryption algorithm, and obtains message m.
[0012] Currently widely used public key cryptosystems include RSA cryptosystem and ECDH, which is a Diffie-Hellman key exchange method. However, it is known that the security of these systems can be broken by using quantum computers, and there is an urgent need to establish quantum-safe public key cryptosystems.
[0013] Isogeny mapping cryptography is known as one of the candidates for quantum-safe cryptography. This is a general term for methods that base their security on the difficulty of a mathematical problem called the isogeny mapping problem. Representative public key cryptography methods based on isogeny mapping include SIDH (Reference 1), SIKE (Reference 2), and CSIDH (Reference 3). SIKE in particular has attracted attention, having remained in Round 4 of the NIST standardization competition.
[0014] However, in 2022, an attack method to break the security of SIDH and SIKE was discovered (References 4 and 5), making these methods no longer secure. The essence of the SIDH attack, which is an attack method to break the security of SIDH and SIKE, is that it is possible to restore an isogenous mapping by using information on the point image of the secret isogenous mapping. An overview of the SIDH attack is provided below.
[0015] <Overview of SIDH attacks> First, let N1, N2, and D be positive integers that satisfy D=N1+N2 and are relatively prime to each other. Let E0, E1, E2, and E3 be elliptic curves connected by isogenies ψ1, ψ2, ψ1', and ψ2' that satisfy the commutative diagram shown in Figure 1. Here, the degrees of each isogeny are deg(ψ1)=deg(ψ1')=N1 and deg(ψ2)=deg(ψ2')=N2. In the following, an isogeny of degree d will be referred to as a "d-isogeny", etc. Furthermore, if the dimension is 2, it will be referred to as a "(d,d)-isogeny", etc.
[0016] Then the following mapping Φ is a (D,D)-isogeneous mapping, and its kernel is KerΦ={([N2]P,f(P))|P∈E1[D]}.
[0017]
number
[0018] Here, if the point image f(P) for any P∈E1[D] is given, then KerΦ can be obtained, from which the mapping Φ can be found in polynomial time, and thus the isogenous mappings ψ1,ψ2 can be obtained.
[0019] In particular, for some integer b, D=2 bWhen the mapping Φ can be expressed as follows, the mapping Φ can be obtained by repeatedly calculating the (2,2)-isogeneous mapping. It is known that the (2,2)-isogeneous mapping can be calculated efficiently by Richelot's method. For simplicity, the algorithm for SIDH attack will be represented as Atk. That is, the algorithm for SIDH attack is b Twisted subgroup E1[2 b ] and the point images P2=f(P1), Q2=f(Q1) by the following N1N2-isogeneous map f are given. N_1,N_2 (E1,E2,P1,Q1,P2,Q2) outputs an isogeny (ψ1,ψ2) and its domain E0. Note that "N_1" and "N_2" represent "N1" and "N2", respectively.
[0020]
number
[0021] Below, E1, E2, P1, Q1, P2, Q2 are input, and Atk N_1,N_2 By (E1,E2,P1,Q1,P2,Q2), outputting (ψ1,ψ2,E0) is called "(ψ1,ψ2,E0)←Atk N_1,N_2 (E1,E2,P1,Q1,P2,Q2)".
[0022] After the discovery of the SIDH attack, a new encryption method called FESTA (Reference 6) was proposed. This is a public key encryption method that uses the SIDH attack for decryption, and is resistant to SIDH attacks. Below is an overview of FESTA.
[0023] <FESTA Overview> First, we define the system parameters. Let λ be the security parameter, and then d A ,d1,d2 to 2 2λLet m1, m2, and b be smooth natural numbers that are larger than m1, m2, and b. Let m1, m2, and b be the smallest possible natural numbers that satisfy the following conditions. A smooth natural number is a natural number that does not contain large prime factors.
[0024] m1 2 d A,1 d1+m2 2 d A,2 d2=2 b ,∃d A,1 ,d A,2 (However, d A,1 ,d A,2 is a natural number) st d A,1 d A,2 =d A
[0025] Furthermore, p = 2 b d1d2(d A ) sf f-1 is a prime number that can be expressed as a small natural number (d A ) sf d A The prime factors of d are multiplied exactly once. For example, d A =3 5 2 7 3 If (d A ) sf = 3 5 7. Finally, M n Let be the set of all 2x2 regular diagonal matrices on Z / nZ (where Z represents the set of integers).
[0026] The FESTA key generation algorithm, encryption algorithm, and decryption algorithm are shown below. The key generation algorithm, encryption algorithm, and decryption algorithm also take system parameters as input, but the system parameters are omitted below. The algorithm for setting system parameters is called a setup algorithm, and is executed by a system administrator, for example.
[0027] Key generation algorithm The FESTA key generation algorithm outputs a public key pk and a private key sk according to the following steps a-1 to a-6.
[0028] Step a-1: Let the elliptic curve E0 be as follows.
[0029]
number
[0030] Step a-2: E0[2 b ] is taken as the generator (P0,Q0).
[0031] Step a-3: Random d A -homogeneous map φ A :E0→E A Take.
[0032] Step a-4: Random matrix A∈M n Take.
[0033] Step a-5: (R A ,S A ) Τ =A(φ A (P0),φ A (Q0)) Τ where T represents transposition.
[0034] Step a-6: (E A ,R A ,S A ) as the public key pk and A as the private key sk.
[0035] Encryption algorithm The FESTA encryption algorithm takes a public key pk and plaintext m as input, and outputs ciphertext ct according to the following steps b-1 to b-6.
[0036] Step b-1: Take a random d1-isogenous mapping φ1:E0→E1.
[0037] Step b-2: Random d2-isogeneous mapping φ2:E A →Take E2.
[0038] Step b-3: Matrix B∈M n is uniquely determined from the plaintext m.
[0039] Step b-4: (R1, S1) Τ =B(φ1(P0),φ1(Q0)) Τ Far away.
[0040] Step b-5: (R2,S2) Τ =B(φ2(R A ),φ2(S A )) Τ Far away.
[0041] Step b-6: (E1, R1, S1, E A ,R A ,S A ) is the ciphertext ct.
[0042] Decryption algorithm The FESTA encryption algorithm takes a secret key sk and ciphertext ct as input, and outputs plaintext m through the following steps c-1 to c-9.
[0043] Step c-1:d A,1 -homogeneous map φ A,1 and d A,2 -homogeneous map φ A,2 Using and, φ A is expressed as follows:
[0044]
number
[0045] Step c-2: Let ψ1 and ψ2 be as follows:
[0046]
number
[0047] Step c-3:f is as follows.
[0048]
number
[0049] Step c-4: (f(R1), f(S1)) Τ =m1m2d1A -1 (R2,S2) Τ Ask for.
[0050] Step c-5: Obtain isogenous mappings ψ1 and ψ2 using a SIDH attack.
[0051] Step c-6: E0[d1]∩Kerψ1 and E A [d2] ∩Kerψ2 to find φ1 and φ2.
[0052] Step c-7: (R1, S1) Τ =B(φ1(P0),φ1(Q0)) Τ Find B that satisfies the above.
[0053] Step c-8: (R2,S2) Τ =B(φ2(R A ),φ2(S A )) Τ Verify that the following holds true.
[0054] Step c-9: Obtain plaintext m from B.
[0055] However, in step c-8 above (R2, S2) Τ =B(φ2(R A ),φ2(S A )) Τ If it is confirmed that does not hold, a symbol indicating a decoding failure is output.
[0056] FESTA is based on the relationship shown in Figure 2, and when decrypting, it performs a SIDH attack where N1, N2, ψ1, and ψ2 are as follows:
[0057]
number
[0058] <<non-smooth-FESTA>> In order to reduce the parameters of the above FESTA, an algorithm called RandIsogImages has been proposed that calculates an isogenous map with a non-smooth degree (Non-Patent Document 1). Non-Patent Document 1 also proposes FESTA using this RandIsogImages (hereinafter, FESTA using RandIsogImages will be referred to as "non-smooth-FESTA"). RandIsogImages takes as input a natural number d and two points P0 and Q0 on the following elliptic curve E0, and calculates a random d-isogenous map φ:E0 → E A For (E A ,φ(P0),φ(Q0)).
[0059]
number
[0060] Below, let us take a natural number d and two points P0 and Q0 on the elliptic curve E0 as input and use RandIsogImages to calculate (E A ,φ(P0),φ(Q0)) is output as "(E A ,φ(P0),φ(Q0))←RandIsogImages(d,P0,Q0)". In this case, φ is also called the isogenous mapping corresponding to RandIsogImages(d,P0,Q0).
[0061] Next, we will explain the parameters used in non-smooth-FESTA. Let a' and b' be integers that satisfy the following:
[0062]
number
[0063] Also, let d A , d1 be d A = 2 a' + k·3 b' , d1 = 2 a' - k·3 b' be a non - smooth large number expressed as such. Here, k is a small natural number. Let a = 2a', b = 2b', and let p be a prime number expressed as p = 2 a ·3f - 1, and d2 = 3 b . Here, f is a small natural number. In non - smooth - FESTA, by using RandIsogImages, the calculation of d A - isogeny and d1 - isogeny is realized.
[0064] <Problems of non - smooth - FESTA> The above non - smooth - FESTA can reduce the size of the ciphertext and the size of the public key compared to FESTA, but its security is vulnerable (λ / 2 - bit security). This is because the degrees d A , d1 of the isogenies φ A , d1 are only about 2 λ . As a simple way to improve security, doubling the security parameter λ can be considered, but in this method, the original advantage of the small size of the ciphertext and the public key is lost.
[0065] Therefore, below, a highly secure non - smooth - FESTA while suppressing the data size is proposed (hereinafter, this non - smooth - FESTA is referred to as the "proposed method" or "non - smooth - FESTA according to the proposed method").
[0066] <Proposed method> In the non - smooth - FESTA according to the proposed method, the degrees of the isogenies φ A , φ1 are made twice as large, and accordingly, the values of some parameters are adjusted. This makes it possible to improve security while suppressing the data size.
[0067] - System parameter settings First, we will explain how to set the system parameters used in the proposed method. Let a' and b' be integers that satisfy the following:
[0068]
number
[0069] Also, d A,1 ,d A,2 , d1, and d2 are respectively d A,1 =2 a' -3 b' ,d A,2 =3 b' ,d1=2 2a' +2 a' 3 b' +3 2b' ,d2=3 2b' Let a = 3a' and set p to p = 2 a Let E0 be a prime number expressed as 3f-1, where f is a small natural number. Finally, let E0 be the elliptic curve E0[2 a ] are generated by P0 and Q0.
[0070]
number
[0071] Below, we will refer to the system parameters (set) as param λ The following key generation algorithm KeyGen, encryption algorithm Enc, and decryption algorithm Dec are λ In the following, the system parameters param λ The system parameter param λ Setup algorithm Setup(1 λ )→param λ is executed by, for example, a system administrator.
[0072] ·Key generation algorithm: KeyGen → (pk, sk) The key generation algorithm KeyGen of the proposed method outputs a public key pk and a private key sk according to the following steps 1-1 to 1-6.
[0073] Step 1-1: Random matrix A∈M 2^a (However, "2^a" is "2 a ").
[0074] Step 1-2: (E A ',P A ',Q A ')←RandIsogImages(d A,1 ,P0,Q0). Note that this RandIsogImages(d A,1 ,P0,Q0) A,1 -Isogeneity mapping is φ A,1 Let's say.
[0075] Steps 1-3: Random d A,2 -homogeneous map φ A,2 :E A '→E A Take.
[0076] Step 1-4:P A =φ A,2 (P A '), Q A =φ A,2 (Q A ') far away.
[0077] Step 1-5: (R A ,S A ) Τ =A(P A ,Q A ) Τ Far away.
[0078] Step 1-6: pk=(E A ,R A ,S A ) and sk=(A,E A ',P A ',Q A ').
[0079] Encryption algorithm: Enc(pk,m∈{0,1}a-2 ) → ct The encryption algorithm Enc of the proposed method receives a public key pk and plaintext m as input, and outputs ciphertext ct according to the following steps 2-1 to 2-6.
[0080] Step 2-1:s B =2m+1∈(Z / 2 a Z) * Then, B=diag(s B ,s B -1 )∈M 2^a Far away.
[0081] Step 2-2: (E1, P1, Q1) ← RandIsogImages(d1, P0, Q0). Let φ1 be the d1-isogenous mapping corresponding to this RandIsogImages(d1, P0, Q0).
[0082] Step 2-3: (R1, S1) Τ =B(P1,Q1) Τ Far away.
[0083] Step 2-4: Random d2-isogeneous mapping φ2:E A →Take E2.
[0084] Step 2-5: (R2, S2) Τ =B(φ2(R A ),φ2(S A )) Τ Far away.
[0085] Step 2-6: Output ct = (E1, R1, S1, E2, R2, S2).
[0086] Decoding algorithm: Dec(sk,ct)→m The decryption algorithm Dec of the proposed method receives a secret key sk and ciphertext m as input, and outputs plaintext m through the following steps 3-1 to 3-7.
[0087] Step 3-1: (R2', S2') Τ =d1A -1 (R2,S2)Τ Let's say.
[0088] Step 3-2: N1=d A,1 d1,N2=d A,2 d2 and far away.
[0089] Step 3-3: (ψ1,ψ2,E A ')←Atk N_1,N_2 Let (E1,E2,R1,S1,R2',S2').
[0090] Step 3-4: B=diag(s B ,s B -1 )∈M 2^a and d A,1 (R1,S1) Τ =B(ψ1(P A '),ψ1(Q A ')) Τ Find B such that:
[0091] Step 3-5: (R2, S2) Τ =B(ψ2(P A '),ψ2(Q A ')) Τ Verify that the following holds true.
[0092] Steps 3-6:s B =min{s B ,2 a -s B}Far away.
[0093] Step 3-7: m = (s B Outputs -1) / 2.
[0094] However, in steps 3-5 above (R2, S2) Τ =B(ψ2(P A '),ψ2(Q A ')) Τ If it is confirmed that does not hold, a symbol indicating a decoding failure is output.
[0095] The non-smooth-FESTA of the proposed method is based on the relationship shown in Figure 3, and during decryption, a SIDH attack is performed with N1, N2, ψ1, and ψ2 set as follows:
[0096]
number
[0097] The following describes an encrypted communication system 1 that realizes encrypted communication using the above proposed method.
[0098] <Overall configuration example> An example of the overall configuration of the encrypted communication system 1 according to this embodiment will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the overall configuration of the encrypted communication system 1 according to this embodiment.
[0099] 4, the encrypted communication system 1 according to this embodiment includes a receiver device 10 and a sender device 20. The receiver device 10 and the sender device 20 are communicably connected via a communication network 30 including, for example, the Internet.
[0100] The receiver device 10 is any of various devices, equipment, terminals, etc. that serve as receivers of encrypted communications. The sender device 20 is any of various devices, equipment, terminals, etc. that serve as senders of encrypted communications.
[0101] The receiver device 10 and the sender device 20 can be realized by various devices, equipment, terminals, etc., such as a PC (personal computer), a smartphone, a tablet terminal, a wearable device, a general-purpose server, an IoT device, an industrial device, etc.
[0102] Also, for example, an administrator device that acts as a system administrator or the like that executes the setup algorithm Setup may be included in the encrypted communication system 1. For simplicity, it is assumed below that the receiver device 10 also acts as a system administrator or the like.
[0103] <Example of functional configuration> <Recipient device 10> An example of the functional configuration of the receiver device 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of the functional configuration of the receiver device 10 according to this embodiment.
[0104] 5, the receiver device 10 according to this embodiment includes a communication unit 101, a system parameter setting unit 102, a key generation unit 103, and a decryption unit 104. These units are realized, for example, by one or more programs installed in the receiver device 10, which are executed by a processor such as a CPU (Central Processing Unit). The receiver device 10 according to this embodiment also includes a storage unit 105. The storage unit 105 is realized, for example, by a storage area of various storage devices such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.
[0105] The communication unit 101 transmits a public key pk to the sender device 20 and receives a ciphertext ct from the sender device 20 .
[0106] The system parameter setting unit 102 executes the setup algorithm Setup of the non-smooth-FESTA according to the proposed method, and sets the system parameters param λ The system parameter param λ is public information and is set in the receiver device 10 and the sender device 20.
[0107] The key generation unit 103 executes the key generation algorithm KeyGen of non-smooth-FESTA according to the proposed method to generate a key pair (pk, sk) of a public key pk and a private key sk.
[0108] The decryption unit 104 executes the decryption algorithm Dec of non-smooth-FESTA according to the proposed method, and generates plaintext m by decrypting the ciphertext ct.
[0109] The storage unit 105 stores various data (for example, a key pair (pk, sk) and the like).
[0110] <<Sender device 20>> An example of the functional configuration of the sender device 20 according to this embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the functional configuration of the sender device 20 according to this embodiment.
[0111] 6, the sender device 20 according to this embodiment includes a communication unit 201 and an encryption unit 202. These units are realized, for example, by a processor such as a CPU executing one or more programs installed in the sender device 20. The sender device 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by a storage area of various storage devices such as an HDD, an SSD, or a flash memory.
[0112] The communication unit 201 receives a public key pk from the receiver device 10 and transmits a ciphertext ct to the receiver device 10 .
[0113] The encryption unit 202 executes the encryption algorithm Enc of non-smooth-FESTA according to the proposed method, and generates ciphertext ct by encrypting plaintext m.
[0114] The storage unit 203 stores various data (for example, a public key pk, a plaintext m, etc.).
[0115] <Encrypted communication processing> The encrypted communication process according to this embodiment will be described with reference to Fig. 7. Fig. 7 is a sequence diagram showing an example of the encrypted communication process according to this embodiment. In the following, it is assumed that the system parameters of non-smooth-FESTA according to the proposed method have already been set. Note that steps S101 to S103 are performed in advance before encrypted communication. Meanwhile, steps S104 to S107 are performed whenever the need for encrypted communication arises.
[0116] The key generation unit 103 of the receiver device 10 executes the key generation algorithm KeyGen of non-smooth-FESTA according to the proposed method to generate a key pair (pk, sk) of a public key pk and a private key sk (step S101). That is, the key generation unit 103 outputs the public key pk and the private key sk according to the above steps 1-1 to 1-6. The public key pk and the private key sk are stored in the storage unit 105.
[0117] The communication unit 101 of the receiver device 10 transmits the public key pk generated in the above step S101 to the sender device 20 (step S102).
[0118] The communication unit 201 of the sender device 20 receives the public key pk from the receiver device 10 (step S103). The public key pk is stored in the storage unit 203.
[0119] The encryption unit 202 of the sender device 20 executes the encryption algorithm Enc of non-smooth-FESTA according to the proposed method to generate ciphertext ct from plaintext m (step S104). That is, the encryption unit 202 receives the public key pk and the plaintext m as input, and outputs the ciphertext ct according to the above steps 2-1 to 2-6.
[0120] The communication unit 201 of the sender device 20 transmits the ciphertext ct generated in the above step S104 to the receiver device 10 (step S105).
[0121] The communication unit 101 of the receiver device 10 receives the ciphertext ct from the sender device 20 (step S106).
[0122] The decryption unit 104 of the receiver device 10 executes the non-smooth-FESTA decryption algorithm Dec according to the proposed method to generate plaintext m by decrypting the ciphertext received in step S106 (step S107). That is, the decryption unit 104 receives the private key sk and the ciphertext m as input, and outputs the plaintext m according to steps 3-1 to 3-7 above.
[0123] <Hardware configuration example> The receiver device 10 and the sender device 20 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 8. Fig. 8 is a diagram showing an example of the hardware configuration of the computer 500.
[0124] 8 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.
[0125] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.
[0126] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.
[0127] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.
[0128] 8 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.
[0129] <Summary> As described above, the encrypted communication system 1 according to this embodiment can achieve encrypted communication using highly secure non-smooth-FESTA while maintaining a smaller data size than conventional FESTA.
[0130] For example, if the security parameter is set to λ=128, the system parameter of the non-smooth-FESTA proposed method is p=2 390 3·55-1, a'=130, b'=81. Therefore, the size of p is 398 bits, which is less than one-third of that of FESTA.
[0131] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.
[0132] [References] Reference 1: David Jao and Luca De Feo. "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies." Post-Quantum Cryptography: 4th International Workshop, 2011. Reference 2: Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Amir Jalali, David Jao, Brian Koziel, Brian LaMacchia, Patrick Longa, et al. "Supersingular isogeny key encapsulation." Submission to the NIST Post-Quantum Standardization project, 2017. Reference 3: Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz Panny, Joost Renes. "CSIDH: an efficient post-quantum commutative group action." Advances in Cryptology-ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security 2018. Reference 4: Wouter Castryck and Thomas Decru. "An efficient key recovery attack on SIDH." Cryptology ePrint Archive, 2022. https: / / eprint.iacr.org / 2022 / 975 Reference 5: Damien Robert. "Breaking SIDH in polynomial time." Cryptology ePrint Archive, 2022. https: / / eprint.iacr.org / 2022 / 1038 Reference 6: Andrea Basso, Luciano Maino, and Giacomo Pope. "FESTA: Fast Encryption from Supersingular Torsion Attacks." Cryptology ePrint Archive, 2023. https: / / eprint.iacr.org / 2023 / 660 [Explanation of symbols]
[0133] 1. Encrypted communication system 10 Receiver Device 20 Sender Device 30 Communication Network 101 Communications Department 102 System parameter setting section 103 Key generation section 104 Decoding unit 105 Storage section 201 Communications Department 202 Encryption section 203 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus
Claims
1. Integers a' and b' determined from the security parameter λ and parameter d Ａ，１ =2 ａ' -3 ｂ' , d Ａ，２ =3 ｂ' , d １ =2 ２ａ' +2 ａ' 3 ｂ' +3 ２ｂ' , d ２ =3 ２ｂ' , a=3a' and prime number p=2 ａ ・3f-1 (where f is a natural number) and the finite field F ｐ＾２ A given elliptic curve E on ０ Twisted subgroup E of ０ [2 ａ ] generator P ０ , Q ０ A communication system that realizes encrypted communication using isogenous mapping cryptography with the following system parameters: Choose a random 2x2 regular diagonal matrix A on Z / 2aZ, and Ａ，１ and P ０ , Q ０ Random d is generated from the RandIsogImages algorithm Ａ，１ - homogeneous map φ Ａ，１ : E ０ →E Ａ ' and P Ａ '=φ Ａ，１ (P ０ ) and Q Ａ '=φ Ａ，１ (Q ０ ) and generate a random d Ａ，２ - homogeneous map φ Ａ，２ : E Ａ '→E Ａ By selecting the public key pk=(E Ａ , R Ａ , S Ａ ) (However, R Ａ and S Ａ is (R Ａ , S Ａ ) Τ = A(P Ａ =φ Ａ，２ (P Ａ '), Q Ａ =φ Ａ，２ (Q Ａ ')) Τ A value that satisfies the above condition) and a secret key sk=(A, E) used to decrypt the ciphertext encrypted by the public key pk. Ａ ', P Ａ ', Q Ａ ') and a key generation unit that generates A communication system having:
2. Plain text m and the public key pk=(E Ａ , R Ａ , S Ａ ) and based on s Ｂ =2m+1∈(Z / 2 ａ Z) ＊ Select and press d １ and P ０ , Q ０ A random d is generated from the RandIsogImages algorithm. １ - homogeneous map φ １ : E ０ →E １ and P １ =φ １ (P ０ ) and Q １ =φ １ (Q ０ ) and generate a random d ２ - homogeneous map φ ２ : E Ａ →E ２ By selecting １ , R １ , S １ , E ２ , R ２ , S ２ ) (However, R １ and S １ (R １ , S １ ) Τ = B(P １ , Q １ ) Τ The value that satisfies ２ and S ２ (R ２ , S ２ ) Τ = B (φ ２ (R Ａ ), φ ２ (S Ａ )) Τ B is a 2x2 regular diagonal matrix B = diag(s Ｂ , s Ｂ －１ an encryption unit for generating 2. The communication system of claim 1, comprising:
3. The secret key sk=(A, E Ａ ', P Ａ ', Q Ａ ') and the ciphertext ct=(E １ , R １ , S １ , E ２ , R ２ , S ２ ) and Atk, an algorithm for executing a SIDH attack based on Ｎ_１,Ｎ_２ (E １ , E ２ , R １ , S １ , R ２ ', S ２ ') (However, R ２ ' and S ２ ' is (R ２ ', S ２ ') Τ = d １ A －１ (R ２ , S ２ ) Τ A value that satisfies １ = d Ａ，１ d １ , N ２ = d Ａ，２ d ２ ) by (ψ １ , ψ ２ , E Ａ ') and B = diag(s Ｂ , s Ｂ －１ ) and d Ａ，１ (R １ , S １ ) Τ = B(ψ １ (P Ａ '), ψ １ (Q Ａ ')) Τ A 2 × 2 regular diagonal matrix B is calculated, and (R ２ , S ２ ) Τ = B(ψ ２ (P Ａ '), ψ ２ (Q Ａ ')) Τ If this is true, then the plaintext m = (s Ｂ -1) / 2 (where s Ｂ =min{s Ｂ , 2 ａ -s Ｂ }), 3. The communication system of claim 2, comprising:
4. Integers a' and b' determined from the security parameter λ and parameter d Ａ，１ =2 ａ' -3 ｂ' , d Ａ，２ =3 ｂ' , d １ =2 ２ａ' +2 ａ' 3 ｂ' +3 ２ｂ' , d ２ =3 ２ｂ' , a=3a' and prime number p=2 ａ ・3f-1 (where f is a natural number) and the finite field F ｐ＾２ A given elliptic curve E on ０ Twisted subgroup E of ０ [2 ａ ] generator P ０ , Q ０ A method used in a communication system that realizes encrypted communication using isogenous mapping cryptography with the following system parameters: a first device that is a recipient of the encrypted communication, Choose a random 2x2 regular diagonal matrix A on Z / 2aZ, and Ａ，１ and P ０ , Q ０ Random d is generated from the RandIsogImages algorithm Ａ，１ - homogeneous map φ Ａ，１ : E ０ →E Ａ ' and P Ａ '=φ Ａ，１ (P ０ ) and Q Ａ '=φ Ａ，１ (Q ０ ) and generate a random d Ａ，２ - homogeneous map φ Ａ，２ : E Ａ '→E Ａ By selecting the public key pk=(E Ａ , R Ａ , S Ａ ) (However, R Ａ and S Ａ is (R Ａ , S Ａ ) Τ = A(P Ａ =φ Ａ，２ (P Ａ '), Q Ａ =φ Ａ，２ (Q Ａ ')) Τ A value that satisfies the above condition) and a secret key sk=(A, E) used to decrypt the ciphertext encrypted by the public key pk. Ａ ', P Ａ ', Q Ａ ') and a key generation procedure to generate How to do it.
5. a second device that is a sender of the encrypted communication, Plain text m and the public key pk=(E Ａ , R Ａ , S Ａ ) and based on s Ｂ =2m+1∈(Z / 2 ａ Z) ＊ Select and press d １ and P ０ , Q ０ A random d is generated from the RandIsogImages algorithm. １ - homogeneous map φ １ : E ０ →E １ and P １ =φ １ (P ０ ) and Q １ =φ １ (Q ０ ) and generate a random d ２ - homogeneous map φ ２ : E Ａ →E ２ By selecting １ , R １ , S １ , E ２ , R ２ , S ２ ) (However, R １ and S １ is B(P １ , Q １ ) Τ The value that satisfies ２ and S ２ (R ２ , S ２ ) Τ = B (φ ２ (R Ａ ), φ ２ (S Ａ )) Τ B is a 2x2 regular diagonal matrix B = diag(s Ｂ , s Ｂ －１ )) encryption procedure, The method of claim 4, wherein the
6. The first device comprises: The secret key sk=(A, E Ａ ', P Ａ ', Q Ａ ') and the ciphertext ct=(E １ , R １ , S １ , E ２ , R ２ , S ２ ) and Atk, an algorithm for executing a SIDH attack based on Ｎ_１,Ｎ_２ (E １ , E ２ , R １ , S １ , R ２ ', S ２ ') (However, R ２ ' and S ２ ' is (R ２ ', S ２ ') Τ = d １ A －１ (R ２ , S ２ ) Τ A value that satisfies １ = d Ａ，１ d １ , N ２ = d Ａ，２ d ２ ) by (ψ １ , ψ ２ , E Ａ ') and B = diag(s Ｂ , s Ｂ －１ ) and d Ａ，１ (R １ , S １ ) Τ = B(ψ １ (P Ａ '), ψ １ (Q Ａ ')) Τ A 2 × 2 regular diagonal matrix B is calculated, and (R ２ , S ２ ) Τ = B(ψ ２ (P Ａ '), ψ ２ (Q Ａ ')) Τ If this is true, then the plaintext m = (s Ｂ -1) / 2 (where s Ｂ =min{s Ｂ , 2 ａ -s Ｂ }), The method of claim 5, wherein the
7. A program for causing a computer to execute the method according to any one of claims 4 to 6.