Secure element, encryption key generation method, computer program, encryption key management system, and encryption key management method

Abstract

To easily implement CRYSTALS Dilithium, which is one quantum-resistant encryption, even in a secure element with a poor capacity of a storage memory.SOLUTION: A secure element 1 comprises: a storage memory 11 for storing a secret seed ζ, and a cryptographic key generation unit 10 for generating a secret key sk based on the secret seed ζ stored in the storage memory 11, according to a key generation algorithm that generates the secret key sk for quantum-safe encryption (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present application is an invention relating to post-quantum cryptography. [Background technology]

[0002] The race to develop quantum computers is intensifying around the world. Quantum computers utilize quantum mechanical phenomena such as quantum superposition and quantum entanglement to perform complex calculations that conventional computers cannot solve.

[0003] However, it is said that once quantum computers become widespread, it will be possible to decrypt currently used public key cryptosystems at a reasonable cost. For example, if quantum computers capable of applying Shor's algorithm become practical, RSA cryptosystem and elliptic curve cryptosystem, which are general-purpose public key cryptosystems, will be decrypted in a short time.

[0004] To address this issue, efforts are underway to develop and standardize cryptography that is tamper-resistant against decryption using quantum computers. Cryptography that is tamper-resistant against decryption using quantum computers is called post-quantum cryptography (PQC).

[0005] As for quantum-resistant cryptography, the invention disclosed in Patent Document 1 targets NTRU. Meanwhile, the US National Institute of Standards and Technology (NIST) has adopted CRYSTALS Dilithium, the specifications of which are set out in Non-Patent Document 1, as the standard for next-generation cryptography. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2019-200382 [Non-patent literature]

[0007] [Non-Patent Document 1] CRYSTALS-Dilithium Algorithm Specifications and Supporting Documentation (round3) October 1,2020 Summary of the Invention [Problem to be solved by the invention]

[0008] Devices that require high security are primarily equipped with secure elements, which are integrated circuits for performing cryptographic calculations in hardware. Following the adoption of CRYSTALS Dilithium by the National Institute of Standards and Technology as the standard for next-generation encryption, it has become necessary to implement CRYSTALS Dilithium in secure elements.

[0009] One problem with implementing CRYSTALS Dilithium in a secure element is the large size of the cryptographic keys used in CRYSTALS Dilithium. CRYSTALS Dilithium is a public-key cryptosystem. When implementing CRYSTALS Dilithium in a secure element, at least the CRYSTALS Dilithium private key must be stored in the storage memory of the secure element.

[0010] The size of the private key for CRYSTALS Dilithium varies depending on the security level, but is approximately several kilobytes. This makes it difficult to implement CRYSTALS Dilithium, whose private key size is several kilobytes, in secure elements with limited storage memory capacity.

[0011] Therefore, the present application aims to make it easier to implement CRYSTALS Dilithium, which is one type of post-quantum cryptography, even in secure elements with limited storage memory capacity. [Means for solving the problem]

[0012] A first invention for solving the problems of the present application is a secure element comprising: a storage memory for storing a secret seed ζ; and an encryption key generation unit for generating a private key sk for post-quantum cryptography (CRYSTALS Dilithium) based on the secret seed ζ stored in the storage memory, in accordance with a key generation algorithm for generating the private key sk from a polynomial ring matrix A based on the secret seed ζ. In the secure element according to the first invention, information related to the encryption key for the post-quantum cryptography can be stored in the storage memory of the secure element in as small a size as possible, making it easy to implement the post-quantum cryptography even in a secure element with a limited storage memory capacity. In the secure element according to the first aspect of the present invention, it is desirable that the storage memory stores, in addition to the private seed ζ, a check code of the private key sk based on the private seed ζ stored in the storage memory, and the cryptographic key generation unit uses the check code stored in the storage memory to verify the integrity of the private key sk generated by the cryptographic key generation unit. Furthermore, it is desirable that the secure element according to the first aspect of the present invention comprises a digital signature generation unit that generates a digital signature σ for a message M using the private key sk generated by the cryptographic key generation unit in accordance with a signature generation algorithm specified in the post-quantum cryptography.

[0013] A second invention for solving the problem of the present application relates to a computer program, and is a computer program for operating a secure element as the encryption key generation unit of the secure element according to the first invention.

[0014] A third invention for solving the problem of the present application is a method-related invention, and is a cryptographic key generation method characterized by including: a step a in which a secure element, having stored a secret seed ζ in a storage memory, retrieves the secret seed ζ from the storage memory; and a step b in which the secure element generates a secret key sk based on the secret seed ζ stored in the storage memory, in accordance with a key generation algorithm that generates a secret key sk for post-quantum cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ. In the cryptographic key generation method according to the third aspect of the present invention, it is preferable that the method further includes a step c in which, in addition to the private seed ζ, a check code of the private key sk based on the private seed ζ stored in the storage memory is stored in the storage memory, and the secure element verifies the integrity of the private key sk generated in the step b by using the check code stored in the storage memory.

[0015] A fourth invention for solving the problem of the present application relates to a system, and is a cryptographic key management system including a key management center and a secure element. The key management center according to the third invention includes a cryptographic key management unit that generates a secret seed ζ and transmits it to the secure element. The secure element according to the fourth invention includes a storage memory for storing at least the secret seed ζ, a key information registration unit that stores the secret seed ζ transmitted by the key management center in the storage memory, and a cryptographic key generation unit that generates a secret key sk based on the secret seed ζ stored in the storage memory in accordance with a key generation algorithm that generates a secret key sk for post-quantum cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ. In a fourth invention that solves the problem of the present application, it is desirable that the encryption key management unit provided in the key management center generates the private key sk and a check code for the private key sk based on the private seed ζ generated by the encryption key management unit, according to the same key generation algorithm as that of the secure element, and transmits the private seed ζ and the check code to the secure element, the key information registration unit provided in the secure element stores the private seed ζ and the check code received from the key management center in the storage memory, and the encryption key generation unit verifies the integrity of the private key sk generated by the encryption key generation unit using the check code stored in the storage memory. Furthermore, in a fourth invention that solves the problem of the present application, it is desirable that the encryption key management unit provided in the key management center generates, in addition to the private key sk based on the private seed ζ generated by the encryption key management unit, a public key pk that pairs with the private key sk, and upon transmitting the private seed ζ to the secure element, erases the private key sk and stores the public key pk.

[0016] A fifth invention for solving the problems of the present application relates to a method, and is an encryption key management method executed by a key management center and a secure element. The encryption key management method according to the fourth invention includes the steps of: (a) the key management center generating a secret seed ζ and transmitting it to the secure element; (b) the secure element storing the secret seed ζ transmitted by the key management center in a storage memory; and (c) the secure element generating a secret key sk based on the secret seed ζ stored in the storage memory, in accordance with a key generation algorithm that generates a secret key sk for post-quantum cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ. In the encryption key generation method according to the fifth aspect of the present invention, it is desirable that in step a, when the key management center generates the secret seed ζ, the key management center generates the private key sk and a check code for the private key sk based on the private seed ζ generated by the key management center according to the same key generation algorithm as that of the secure element, and transmits the private seed ζ and the check code to the secure element, and in step b, the secure element stores the private seed ζ and the check code received from the key management center in the storage memory, and in step c, when the secure element generates the private key sk based on the private seed ζ, the secure element uses the check code stored in the storage memory to verify the integrity of the private key sk generated by the secure element. Furthermore, in the encryption key generation method according to the fifth aspect of the present invention, it is preferable that in the step a, the key management center generates, in addition to the private key sk based on the private seed ζ generated by the key management center, a public key pk that pairs with the private key sk, and the key management center erases the private key sk and stores the public key pk. [Effects of the Invention]

[0017] In the invention disclosed in this application, only the secret seed ζ, which is the source of the private key sk of quantum-safe cryptography (CRYSTALS Dilithium), is stored in the storage memory of the secure element. Compared to the private key sk, the size of the secret seed ζ, which is the source of the private key sk, is significantly smaller, making it easy to implement quantum-safe cryptography even in secure elements with limited storage memory capacity. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 2 is a diagram illustrating functions of a secure element. [Figure 2] FIG. 2 is a diagram illustrating hardware included in a secure element. [Figure 3] FIG. 1 is a diagram for explaining a key generation algorithm. [Figure 4] FIG. 10 is a diagram showing an example of security levels and the size of a private key sk. [Figure 5] FIG. 10 is a diagram showing the operation of a secure element when generating a digital signature σ. [Figure 6] FIG. 1 is a diagram illustrating an encryption key management system. [Figure 7] FIG. 2 is a diagram illustrating the operation of the encryption key management system. DETAILED DESCRIPTION OF THE INVENTION

[0019] From here, an embodiment of the invention (present invention) disclosed in this application will be described. This embodiment is intended to facilitate understanding of the present invention. The present invention is not limited to this embodiment. Furthermore, unless otherwise specified, the drawings are schematic diagrams drawn to facilitate understanding of the present invention.

[0020] Fig. 1 is a diagram illustrating the functions of the secure element 1 according to this embodiment. Fig. 2 is a diagram illustrating the hardware of the secure element 1 according to this embodiment.

[0021] The secure element 1 according to this embodiment is an integrated circuit implemented in a device such as an IC card or a smartphone. The secure element 1 has a cryptographic calculation function. The secure element 1 according to this embodiment supports CRYSTALS Dilithium, a type of quantum-resistant cryptography, as the cryptography used in the cryptographic calculation. CRYSTALS Dilithium is a next-generation cryptography adopted by the National Institute of Standards and Technology as the standard for next-generation cryptography. Hereinafter, quantum-resistant cryptography in this embodiment refers to CRYSTALS Dilithium. Furthermore, in this application, to enable comparison with the mathematical formulas described in Non-Patent Document 1, words corresponding to symbols in the mathematical formulas described in Non-Patent Document 1 are supplemented with symbols corresponding to these words. For example, since ζ in the mathematical formulas described in Non-Patent Document 1 is a symbol indicating a secret seed, the symbol "ζ" is supplemented to the word "secret seed" in this application.

[0022] The secure element 1 according to this embodiment generally includes the hardware shown in Fig. 2. Note that the secure element 1 also includes hardware necessary for the operation of the secure element 1, such as a circuit that supplies operating power to the secure element 1, which is not shown in Fig. 2.

[0023] The secure element 1 includes, as memories, a ROM 1b (Read Only Memory), a RAM 1c (Random Access Memory), and a storage memory 11. The ROM 1b is a non-rewritable memory that can permanently store data. In this embodiment, the ROM 1b stores program code that executes processes related to post-quantum cryptography. The RAM 1c is a volatile memory that temporarily stores data when the CPU 1a executes a computer program. The storage memory 11 is a rewritable memory that can permanently store data. In a secure element 1 implemented in an IC card, an EEPROM of several kilobytes to several tens of kilobytes is mainly used as the storage memory 11.

[0024] The random number generator 1g (RNG: Random Number Generator) is a circuit that generates random numbers. The timer module 1e is a circuit that measures time. The timer module 1e is used for interrupt processing, etc. The UART1h (Universal Asynchronous Receiver-Transmitter) is a circuit for communicating with an external reader / writer. In the case of a secure element 1 implemented in an IC card, the UART1h is a serial interface that complies with ISO / IEC 7816 part 3. The clock generation circuit 1d is a circuit that generates a clock signal used by the secure element 1.

[0025] The cryptographic engine 1f is a circuit dedicated to performing a specific cryptographic operation. In this embodiment, the cryptographic engine 1f includes a circuit specialized for a SHA (Secure Hash Algorithm) such as SHA-2 for calculating a hash value of data.

[0026] The CPU 1a is an integrated circuit that performs complex calculations. The ROM 1b of the secure element 1 stores computer programs that make the CPU 1a function.

[0027] As shown in FIG. 1, the secure element 1 according to this embodiment includes an encryption key generation unit 10, an electronic signature generation unit 12, and a key information registration unit 13 as functions realized by using a computer program that operates a CPU 1a.

[0028] 2, the storage memory 11 stores a secret seed ζ (zeta) that is the basis of the secret key sk. In addition to the secret seed ζ, the storage memory 11 according to this embodiment stores a check code of the secret key sk that is based on the secret seed ζ. This information stored in the storage memory 11 is generated by a system that manages information related to the secure element 1, and is written to the storage memory 11 of the secure element 1 by this system.

[0029] The encryption key generation unit 10 according to this embodiment has a function of generating a private key sk based on the private seed ζ stored in the storage memory 11, in accordance with a key generation algorithm that generates a private key sk for quantum-safe cryptography from a polynomial ring matrix A based on the private seed ζ. Furthermore, the encryption key generation unit 10 according to this embodiment has a function of verifying the integrity of the private key sk generated from the private seed ζ, using a check code stored in the storage memory 11.

[0030] The digital signature generation unit 12 according to this embodiment has a function of generating a digital signature σ for a message M using the private key sk generated by the encryption key generation unit 10 in accordance with a signature generation algorithm defined in post-quantum cryptography.

[0031] The key information registration unit 13 according to this embodiment has a function of writing the secret seed ζ and the like transmitted from a system that manages information related to the secure element 1 into the storage memory 11 of the secure element 1 .

[0032] To facilitate understanding of the present invention, a key generation algorithm for post-quantum cryptography according to this embodiment will be briefly described first. Fig. 3 is a diagram for explaining the key generation algorithm.

[0033] The key generation algorithm shown in Figure 3 is an algorithm for generating a quantum-safe secret key sk from a polynomial ring matrix A based on a secret seed ζ. Details of this key generation algorithm are described in Chapter 3, Signature, of Non-Patent Document 1. In Figure 3, the numbers (e.g., "01") written to the left of the formulas indicate the procedure numbers. Also in Figure 3, ρ(roh), z, K(Kappa), s1, s2, t, t1, t0, and tr are the names of elements used in the key generation algorithm. Also in Figure 3, {0, 1}^256 means a 256-bit bit string consisting of two elements, 0 and 1. Furthermore, in Figure 3, the letter "R" with superscript and subscript means polynomial ring.

[0034] In Figure 3, the use of the symbol "z" differs from that in the post-quantum cryptography specification. In the post-quantum cryptography specification, the Greek letter corresponding to sigma is used instead of "z" in the mathematical formula explaining the key generation algorithm. However, since the Greek letter for sigma used in the post-quantum cryptography specification may not be displayed correctly, in this embodiment, "z" is used instead of the Greek letter for sigma used in the post-quantum cryptography specification.

[0035] In the key generation algorithm shown in Figure 3, the first step is step 01, which prepares a secret seed ζ, which is the basis for the private key sk and the public key pk. The size of the secret seed ζ is 32 bytes (256 bits). The next step is step 02, which applies SHAKE256 or similar to the secret seed ζ to generate ρ, z, and K. The next step is step 03, which applies SHAKE256 or similar to the z generated in step 02 to generate s1 and s2. The next step is step 04, which generates a polynomial ring matrix A from ρ. This step uses the Number Theoretic Transform (NTT), a type of discrete Fourier transform. Note that a polynomial ring matrix is ​​a matrix whose components are polynomials in the ring Rq. The next step is step 05, which generates t using the polynomial ring matrices A, s1, and s2. The next step is step 06, which applies the Power2Round function to t to generate t1 and t0. The next step 07 is to apply a Collision Resistant Hash (CRH) function to each of ρ and t1 to generate tr. The next step is step 08 to generate a public key pk and a private key sk. The public key pk includes ρ and t1. The private key sk includes ρ, K, tr, s1, s2, and t0.

[0036] As described above, in the key generation algorithm shown in Figure 3, the encryption key (private key sk and public key pk) is generated by extracting the polynomial ring matrix A from ρ, which is generated by applying SHAKE256 or the like to the secret seed ζ. As a result, in the key generation algorithm shown in Figure 3, the size of the encryption key (private key sk and public key pk) generated according to the key generation algorithm can be changed by at least changing the size of the polynomial ring matrix A extracted from ρ. The larger the size of the encryption key, the higher the security level of quantum-safe cryptography. Note that in the key generation algorithm described above, if parameters such as the size of the polynomial ring matrix A are the same, the private key sk based on the secret seed ζ will be the same.

[0037] FIG. 4 shows an example of the security level and the size of the private key sk. As shown in FIG. 4, the higher the security level, the larger the size of the private key sk. According to FIG. 4, the size of the private key sk at security level 2 is 2544 bytes, while the size of the private key sk at security level 5 is 4880 bytes. As such, although it differs depending on the security level, the size of the private key sk for quantum-post cryptography can reach several kilobytes. For this reason, it is difficult to store the private key sk for quantum-post cryptography, which is several kilobytes in size, in the secure element 1, which has a limited capacity for the storage memory 11.

[0038] Therefore, in the secure element 1 according to this embodiment, only the 32-byte secret seed ζ, which is the basis of the secret key sk, is stored in the storage memory 11. The encryption key generation unit 10 included in the secure element 1 generates the secret key sk based on the secret seed ζ included in the key information stored in the storage memory 11, in accordance with the above-mentioned key generation algorithm. In this way, information related to the encryption key for post-quantum cryptography can be stored in the storage memory 11 of the secure element 1 in the smallest possible size (32 bytes), making it easy to implement post-quantum cryptography even in a secure element 1 with a storage memory 11 with a limited capacity.

[0039] In order to verify the integrity of data stored in the storage memory 11 of the secure element 1, it has been common practice to add a check code to the data to be stored in the storage memory 11. When the private key sk itself is stored in the storage memory 11 of the secure element 1, the check code of the private key sk is added to the private key sk stored in the storage memory 11. As described above, in this embodiment, the private seed ζ, which is the basis of the private key sk, is stored in the storage memory 11, rather than the private key sk itself. For this reason, in this embodiment, the check code of the private key sk generated based on the private seed ζ is added to the private seed ζ. When the encryption key generation unit 10 included in the secure element 1 according to this embodiment generates a private key sk based on the private seed ζ stored in the storage memory 11, the encryption key generation unit 10 calculates a check code of the private key sk generated by the encryption key generation unit 10 and compares it with the check code added to the private seed ζ stored in the storage memory 11, thereby verifying the integrity of the private key sk generated by the encryption key generation unit 10. Any method for calculating the check code may be used, but a hash function such as SHA-2 can be used to calculate the check code.

[0040] The digital signature generation unit 12 included in the secure element 1 according to this embodiment has a function of generating a digital signature σ for a message M received from an external device, using the private key sk generated by the encryption key generation unit 10. Details of the processes related to digital signature generation and digital signature verification are described in Chapter 3, Signature, of Non-Patent Document 1.

[0041] Next, the operation of the secure element 1 will be described. Fig. 5 is a diagram for explaining the operation of the secure element 1. Fig. 5 shows the operation of the secure element 1 when generating a digital signature σ. The explanation of Fig. 5 also includes an explanation of the encryption key generation method according to the present application.

[0042] When generating a digital signature σ, the secure element 1 receives a message M to be generated for the digital signature σ from an external device (step S1). This message M is included in a command for generating the digital signature σ. Upon receiving the message M to be generated for the digital signature σ, the cryptographic key generation unit 10 of the secure element 1 is first started, and acquires a secret seed ζ from the storage memory 11 (step S2). Next, the cryptographic key generation unit 10 of the secure element 1 generates a secret key sk based on the secret seed ζ acquired from the storage memory 11 (step S3). The procedure for generating the secret key sk based on the secret seed ζ has been described with reference to FIG. 3.

[0043] When the private key sk is generated, the encryption key generation unit 10 of the secure element 1 calculates a check code of the private key sk generated by the encryption key generation unit 10 (step S4). Next, the encryption key generation unit 10 of the secure element 1 performs integrity verification of the private key sk generated by the encryption key generation unit 10 (step S5). When performing integrity verification of the private key sk generated by the encryption key generation unit 10, the encryption key generation unit 10 compares the check code calculated by the encryption key generation unit 10 with the check code stored in the storage memory 11. If the check codes do not match, the encryption key generation unit 10 determines that the integrity verification of the private key sk generated by the encryption key generation unit 10 has failed. If the integrity verification of the private key sk generated by the encryption key generation unit 10 has failed, the encryption key generation unit 10 of the secure element 1 ends the procedure of FIG. 5 without performing any further procedures. If the check codes match, the encryption key generation unit 10 determines that the integrity of the private key sk generated by the encryption key generation unit 10 has been successfully verified.

[0044] If the integrity verification of the private key sk generated by the encryption key generation unit 10 is successful, the encryption key generation unit 10 of the secure element 1 passes the private key sk generated by the encryption key generation unit 10 to the digital signature generation unit 12, and the digital signature generation unit 12 uses the private key sk generated by the encryption key generation unit 10 to generate a digital signature σ for the message M received in step S1 of Fig. 5 in accordance with a signature generation algorithm defined in post-quantum cryptography (step S6). The digital signature generation unit 12 included in the secure element 1 outputs the digital signature σ generated in step S6 of Fig. 5 to an external device, and the procedure of Fig. 5 ends.

[0045] As explained above, in the secure element 1 according to this embodiment, the private seed ζ that is the basis of the private key sk, rather than the private key sk itself, is stored in the storage memory 11. For this reason, the secure element 1 according to this embodiment requires encryption key management unique to this application.

[0046] Fig. 6 is a diagram illustrating an encryption key management system 2 according to this embodiment. The encryption key management system 2 shown in Fig. 6 includes a secure element 1 according to this embodiment and a key management center 3 having a function of generating a secret seed ζ to be stored in the storage memory 11 of the secure element 1.

[0047] The key management center 3 is composed of one or more servers. The key management center 3 shown in Fig. 6 includes a processor 3a, which is an integrated circuit that performs complex calculations and data processing, and a storage 31 that permanently stores data.

[0048] The key management center 3 of this embodiment has a cryptographic key management unit 30 that generates a 32-byte secret seed ζ and stores at least the secret seed ζ in the storage memory 11 of the secure element 1 as a function realized using a computer program that operates the processor 3a.

[0049] Furthermore, the encryption key management unit 30 provided in the key management center 3 according to this embodiment has a function of writing, in addition to the secret seed ζ, a check code of the private key sk based on the private seed ζ to the storage memory 11 of the secure element 1. When the encryption key management unit 30 provided in the key management center 3 generates the private seed ζ to be stored in the storage memory 11 of the secure element 1, it generates the private key sk based on the private seed ζ according to the same key generation algorithm as the encryption key generation unit 10 of the secure element 1, and then calculates a check code (e.g., a hash value) of this private key sk.

[0050] In addition, the encryption key management unit 30 provided in the key management center 3 according to this embodiment has a function of generating a public key pk based on the private seed ζ in addition to the private key sk, and storing this public key pk in the storage 31. Note that the encryption key management unit 30 provided in the key management center 3 does not store the private key sk in the storage 31, but erases the private key sk.

[0051] FIG. 7 is a diagram illustrating the operation of the encryption key management system 2. The explanation of FIG. 7 also includes an explanation of the encryption key management method according to the present application. The encryption key management unit 30 included in the key management center 3 generates a secret seed ζ (step S10). The secret seed ζ generated by the encryption key management unit 30 is 32-byte data. Next, the encryption key management unit 30 included in the key management center 3 generates a private key sk and a public key pk based on the private seed ζ according to the same key generation algorithm as that used by the secure element 1 (step S11). Next, the encryption key management unit 30 included in the key management center 3 calculates a check code for the private key sk generated in step S11 (step S12). The check code for the private key sk can be, for example, a hash value of the private key sk. Next, the encryption key management unit 30 included in the key management center 3 erases the private key sk generated in step S11 and stores the public key pk generated in step S11 in the storage 31 (step S13). The public key pk is desirably stored in the storage 31 in the form of a digital certificate. Next, the encryption key management unit 30 provided in the key management center 3 transmits the secret seed ζ generated in step S10 and the check code generated in step S12 to the secure element 1 (step S14). Because at least the secret seed ζ is secure information, a secure channel is established between the key management center 3 and the secure device when the secret seed ζ is transmitted to the secure element 1. Next, the key information registration unit 13 of the secure element 1 stores the secret seed ζ and check code received from the key management center 3 in the storage memory 11 (step S15), and the procedure in FIG. 7 ends.

[0052] In this way, the encryption key management system 2 according to this embodiment is configured so that the key management center 3 writes the secret seed ζ, rather than the secret key sk itself, into the secure device, and the secure element 1 generates the quantum-safe secret key sk from the secret seed ζ stored in the secure element 1. [Explanation of symbols]

[0053] 1 Secure Element 10 Encryption key generation section 11. Storage Memory 12 Electronic signature generation section 13 Key information registration section 2. Cryptographic Key Management System 3 Key Management Center 30 Encryption key management section 31 Storage

Claims

1. a storage memory for storing the secret seed ζ; an encryption key generation unit that generates a private key sk based on the secret seed ζ stored in the storage memory in accordance with a key generation algorithm that generates a private key sk of post-quantum cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ; A secure element comprising:

2. 2. The secure element according to claim 1, wherein the storage memory stores, in addition to the secret seed ζ, a check code of the secret key sk based on the secret seed ζ stored in the storage memory, and the encryption key generation unit uses the check code stored in the storage memory to verify the integrity of the secret key sk generated by the encryption key generation unit.

3. 3. The secure element according to claim 1, further comprising an electronic signature generation unit that generates an electronic signature σ for a message M using the private key sk generated by the encryption key generation unit in accordance with a signature generation algorithm specified in the post-quantum cryptography.

4. 3. A computer program for causing a secure element to operate as the encryption key generation unit of the secure element according to claim 1.

5. a step a) of a secure element storing a secret seed ζ in a storage memory retrieving the secret seed ζ from the storage memory; a step b in which the secure element generates a private key sk based on the secret seed ζ stored in the storage memory according to a key generation algorithm for generating a private key sk of quantum-resistant cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ; 1. A cryptographic key generation method comprising:

6. storing, in the storage memory, in addition to the secret seed ζ, a check code of the secret key sk based on the secret seed ζ stored in the storage memory; 6. The cryptographic key generation method according to claim 5, further comprising a step c) of the secure element verifying the integrity of the secret key sk generated in step b) using the check code stored in the storage memory.

7. A system including a key management center and a secure element, the key management center includes an encryption key management unit that generates a secret seed ζ and transmits it to the secure element; the secure element includes a storage memory for storing at least the secret seed ζ, a key information registration unit for storing the secret seed ζ transmitted by the key management center in the storage memory, and a cryptographic key generation unit for generating the secret key sk based on the secret seed ζ stored in the storage memory in accordance with a key generation algorithm for generating the secret key sk of quantum-safe cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ.

1. A cryptographic key management system comprising:

8. the encryption key management unit of the key management center generates the private key sk and a check code of the private key sk based on the private seed ζ generated by the encryption key management unit, in accordance with the same key generation algorithm as that of the secure element, and transmits the private seed ζ and the check code to the secure element; the key information registration unit included in the secure element stores the secret seed ζ and the check code received from the key management center in the storage memory, and the encryption key generation unit verifies the integrity of the secret key sk generated by the encryption key generation unit using the check code stored in the storage memory; 8. The encryption key management system according to claim 7,

9. 9. The encryption key management system according to claim 7, wherein the encryption key management unit provided in the key management center generates a public key pk that pairs with the private key sk in addition to the private key sk based on the private seed ζ generated by the encryption key management unit, and upon transmitting the private seed ζ to the secure element, erases the private key sk and stores the public key pk.

10. 1. A method performed by a key management center and a secure element, comprising: a step a in which the key management center generates a secret seed ζ and sends it to the secure element; a step in which the secure element stores the secret seed ζ sent by the key management center in a storage memory; a step c in which the secure element generates a private key sk based on the secret seed ζ stored in the storage memory according to a key generation algorithm for generating a private key sk of quantum-resistant cryptography (CRYSTALS Dilithium) from a polynomial ring matrix A based on the secret seed ζ; 1. A method for managing an encryption key, comprising:

11. In step a, when the key management center generates the secret seed ζ, it generates the secret key sk and a check code of the secret key sk based on the secret seed ζ generated by the key management center in accordance with the same key generation algorithm as that of the secure element, and transmits the secret seed ζ and the check code to the secure element; In the step b, the secure element stores the secret seed ζ and the check code received from the key management center in the storage memory; In the step c, when the secure element generates the private key sk based on the secret seed ζ, the secure element verifies the integrity of the private key sk generated by the secure element using the check code stored in the storage memory.

11. The encryption key management method according to claim 10.

12. 12. The encryption key management method according to claim 10, further comprising the step (d) of: in said step (a), said key management center generates, in addition to said private key (sk) based on said secret seed (ζ) generated by said key management center, a public key (pk) that pairs with said private key (sk); and, in said step (d), said key management center erases said private key (sk) and stores said public key (pk).

Images