Decoding device, decoding method, and decoding program

Abstract

To secure safety even if a quantum computer appears, and to shorten a cipher text length.SOLUTION: In an encryption device of an embodiment, a public key acquisition unit acquires, as a public key, an n-variable symmetric indeterminate equation X which has elements of a predetermined degree or less of Fp [t] as coefficients and is a symmetric equation with respect to at least two variables. The plaintext embedding unit embeds the plaintext M in a coefficient of an n-variable plaintext polynomial m having an element of a predetermined degree or less of Fp [t] as a coefficient. The polynomial generation unit randomly generates a polynomial r of n variables having elements of a certain degree or less of Fp [t] as coefficients, randomly generates a symmetric polynomial s of n variables having elements of a certain degree or less of Fp [t] as coefficients and being symmetric with respect to at least two variables, and randomly generates a noise polynomial e having elements of a certain degree or less of Fp [t] as coefficients. The encryption unit generates, for a plaintext polynomial m of n variables, a ciphertext c from a polynomial r of n variables, a symmetric polynomial s of n variables, a noise polynomial e, and a symmetric indeterminate equation X of n variables.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program. [Background technology]

[0002] In today's networked society, where people communicate through the exchange of large amounts of information, including e-mail, cryptography is widely used as a means of protecting the confidentiality and authenticity of information. However, even the currently widely used RSA encryption and elliptic curve cryptography are at risk of being decrypted when quantum computers become available. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-204466 [Patent Document 2] Japanese Patent Application Publication No. 2022-77754 Summary of the Invention [Problem to be solved by the invention]

[0004] The problem to be solved by the present invention is to provide an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program that can ensure security even when quantum computers emerge and can shorten the ciphertext length. [Means for solving the problem]

[0005] The decryption device of the embodiment includes a key acquisition unit, a zero substitution unit, an approximate GCD calculation unit, a plaintext polynomial restoration unit, and a decryption unit. p On the univariate polynomial ring F p It has coefficients that are elements of [t] of a certain degree or less, and has at least two variables xi and x j The n-variable symmetric indeterminate equation X(x1, ···, x i , ···, x j , ···, x n ), which is symmetric for (1 ≤ i < j ≤ n), obtains one or more zeros u as the private key. The zero substitution unit generates a univariate polynomial h1(t) by substituting the zero u into the ciphertext c(x1, ···, x n ), and generates a univariate polynomial h2(t) by substituting the zero u into the ciphertext c(x1, ···, x i , ···, x j , ···, x n ) after reversing the variable x i and the variable x j . The approximate GCD calculation unit calculates the approximate greatest common divisor (GCD) of the univariate polynomials h k (t) (k = 1, 2) to obtain the univariate polynomial m(u) obtained by substituting the zero u into the n-variable plaintext polynomial m(x1, ···, x n ). The plaintext polynomial restoration unit obtains the plaintext polynomial m(x1, ···, x n ) by solving the system of linear equations derived from the univariate polynomial m(u) and the one or more zeros u. The decryption unit decrypts the plaintext M from the coefficients of the plaintext polynomial m(x1, ···, x n ).

Brief Description of Drawings

[0006] [Figure 1] Fig. showing an example of the approximate GCD algorithm of the embodiment. [Figure 2] Fig. showing an example of the ideal decomposition algorithm of the embodiment. [Figure 3] Fig. showing an example of the functional configuration of the encryption device of the embodiment. [Figure 4] Flowchart showing an example of the encryption method of the embodiment. [Figure 5] ​​​​FIG. 2 is a diagram illustrating an example of the functional configuration of a decoding device according to an embodiment. [Figure 6] 10 is a flowchart illustrating an example of a decoding method according to an embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of the functional configuration of a key generating apparatus according to the embodiment. [Figure 8] 1 is a flowchart illustrating an example of a key generation method according to an embodiment. [Figure 9] FIG. 10 is a diagram showing an example of the functional configuration of a decoding device according to a modified example of the embodiment. [Figure 10] 10 is a flowchart showing an example of a decoding method according to a modified example of the embodiment. [Figure 11] FIG. 2 is a diagram illustrating an example of the hardware configuration of an encryption device, a decryption device, and a key generation device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, embodiments of an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program will be described in detail with reference to the accompanying drawings.

[0008] Cryptography can be broadly divided into symmetric key cryptography and public key cryptography. Symmetric key cryptography is an encryption method based on a data mixing algorithm, which allows for high-speed encryption / decryption, but only allows for secret and authenticated communication between two parties who share a common key in advance. Public key cryptography is an encryption method based on a mathematical algorithm, and while encryption / decryption is not as fast as symmetric key cryptography, it does not require prior key sharing. Public key cryptography is characterized by the fact that it achieves secret communication using a public key made public by the sender, and enables authenticated communication (to prevent spoofing) by applying a digital signature using the sender's private key.

[0009] For this reason, symmetric key cryptography is mainly used to encrypt information that must be decrypted in real time after reception, such as in pay digital broadcasting, and the decryption key is distributed only to subscribers using a key distribution system called a conditional access system.On the other hand, online sites on the Internet need to encrypt customer information (credit card numbers, addresses, etc.) to protect it from eavesdropping, but since it is not always possible to distribute the encryption key in advance, public key cryptography is often used.

[0010] Representative public key cryptosystems include RSA cryptosystems and elliptic curve cryptosystems. The security of RSA cryptosystems is based on the difficulty of the prime factorization problem, and modular exponentiation operations are used for encryption operations. The security of elliptic curve cryptosystems is based on the difficulty of the discrete logarithm problem on an elliptic curve, and point operations on an elliptic curve are used for encryption operations. Although methods for cryptanalysis of specific keys (public keys) have been proposed for these public key cryptosystems, no general cryptanalysis methods are known, and therefore no serious security issues have been found to date, except for cryptanalysis using quantum computers, which will be discussed later.

[0011] Other public key cryptosystems include the knapsack cryptosystem, which bases its security on the difficulty of the knapsack problem (known as the NP problem), and the multidimensional multivariate cryptosystem, which is constructed using field extension theory and bases its security on solving simultaneous equations. However, methods for breaking the knapsack cryptosystem are already known in almost all its implementations, and its security is quite questionable.

[0012] While there are effective known attacks on multivariate ciphers, there are also implementations that are ineffective against known cryptanalysis, so the security of multivariate ciphers is significantly compromised, but not definitive. However, the key size required to avoid known cryptanalysis is becoming larger, which is beginning to be seen as a problem.

[0013] On the other hand, even the currently widely used RSA encryption and elliptic curve encryption are at risk of being broken if a quantum computer appears. A quantum computer is a computer that can perform massively parallel calculations (based on a different principle from current computers) by utilizing the physical phenomenon known as entanglement, which is known from quantum mechanics.

[0014] Until a few years ago, quantum computers were thought of as hypothetical computers whose operation had only been confirmed at the experimental level, but recently, quantum computers have been shown to have performance exceeding that of classical computers (quantum supremacy), and efforts to realize them are progressing rapidly. In 1994, Shor demonstrated that quantum computers can be used to construct algorithms that efficiently solve prime factorization and discrete logarithm problems. In other words, if quantum computers are realized, it will be possible to break RSA encryption, which is based on prime factorization, and elliptic curve cryptography, which is based on the discrete logarithm problem (on elliptic curves).

[0015] Under these circumstances, research into public key cryptography, which has the potential to remain secure even when quantum computers are realized, has become increasingly active in recent years. One public key cryptography that is currently feasible and is considered difficult to decipher even with a quantum computer is lattice cryptography. Lattice cryptography is a type of public key cryptography that bases its security on the problem of finding the point closest to the origin among all points other than the origin in a discrete n-dimensional vector space (linear space) called a lattice (shortest vector problem).

[0016] Although the shortest vector problem is an NP-hard problem, it is a linear problem, so small problems can be easily solved. Therefore, the number of dimensions required to achieve security increases, and the key sizes of public and private keys become larger, raising concerns about their applicability to low-end devices in particular. Furthermore, public key cryptography requires larger circuitry and longer processing time than symmetric key cryptography, making it impossible to implement in low-power environments such as mobile devices, or even if it is implemented, the processing time is long. Therefore, there is a demand for public key cryptography that can be implemented in low-power environments.

[0017] Generally, public key cryptography is constructed by finding a computationally difficult problem (such as integer factorization or discrete logarithm), and then constructing it so that decrypting the ciphertext (without knowing the private key) is equivalent to solving that computationally difficult problem. However, even if a computationally difficult problem is identified, it does not necessarily mean that it is easy to construct a public key cryptography system that bases its security on that problem. This is because if security is based on a problem that is too difficult to compute, the problem of generating a key will also be difficult, making it impossible to construct. On the other hand, if the problem is made easy enough that key generation is possible, decryption will also be easy.

[0018] Therefore, constructing a public key cryptosystem requires creativity to find a computationally difficult problem and to redesign it so that it is easy enough to generate a key, but not so easy that it can be decrypted (without knowing the generated private key). Because of the difficulty in constructing this part, only a handful of public key cryptosystems have been proposed to date. In this context, a public key cryptosystem using algebraic surfaces has been proposed (Patent Document 1), which may not be able to be decrypted efficiently even with calculations using a quantum computer and is expected to be able to process at high speed even in a low-power environment.

[0019] The public key cryptography of Patent Document 1 uses two sections corresponding to an algebraic surface X(x,y,t) as a private key, and the algebraic surface X(x,y,t) as a public key, and includes a polynomial generation means and an encryption means. The polynomial generation means performs a process of embedding plaintext m into plaintext polynomial m(x,y,t) and a process of generating random polynomials h(x,y,t),s1(x,y,t),s2(x,y,t),r1(x,y,t),r2(x,y,t) of three variables x, y, and t. The encryption means generates two ciphertexts c1=E from the plaintext polynomial m(x,y,t) by performing an encryption process that includes at least one of addition, subtraction, and multiplication between each polynomial and the defining formula X(x,y,t). pk (m,s1,r1,h,X),c2=E pk (m, s2, r2, h, X) is generated. Although the public key cryptography of Patent Document 1 has nonlinearity in the ciphertext, it was decrypted because there were two ciphertexts and no noise term.

[0020] To reinforce this, Patent Document 2 proposes a method that adds noise polynomials e1 and e2. Although this method provides nonlinearity by taking the product of the unknown parts m(x,y)s1(x,y) and m(x,y)s2(x,y) in the ciphertext, there is a problem in that the ciphertext length becomes large because there are two polynomials that make up the ciphertext.

[0021] In the following embodiment, in view of the current situation, a public key cryptosystem is constructed that can ensure security even in the event of the emergence of quantum computers, and that can significantly reduce the length of the ciphertext by using only one polynomial to construct the ciphertext.

[0022] [Algebraic explanation] First, we define the algebra used in this embodiment. First, let us denote the set of integers by Z, and let us denote the coset of integer Z at natural number p by Z. p It is written as Z. p is a coset, so usually, Z p ={[0],[1],...,[p-1]} Here, Z p Since each element of satisfies the following properties, addition, subtraction, and multiplication are defined. [a]+[b]=[a+b] [a]-[b]=[ab] [a]·[b]=[a·b] A set in which addition, subtraction, and multiplication can be defined, in which the associative law holds, and which contains the additive identity 0 and has an inverse element [-x] ([x]+[-x]=[0]) that is 0 when added to any element x other than 0, is called a ring. Furthermore, a ring in which the commutative law holds ([a]+[b]=[b]+[a], [a]·[b]=[b]·[a]) is called a commutative ring, and when it also has the multiplicative identity element [1], it is called a commutative ring with an identity element.

[0023] Regarding division, it can only be defined for [b] where there exists an element [x] that satisfies [b]·[x]=[x]·[b]=[1]. When such an element [x] exists, [x] is called the inverse of [b], and -1 ]. That is, for [b] where an inverse exists, the division [a] / [b] is [b]·[b -1 ]=[1] The inverse element [b -1 ] multiplied by [a] ([a]·[b -1 ])

[0024] Z p element [b] to the inverse element [b -1 ] exists if and only if GCD(b,p)=1. That is, Z p An element b of is inverse element [b -1 For example, when p=5, b=3 has the same meaning as [3 -1 ]=[2]. However, if p=6, then GCD(3,6)=3, which means they are not mutually prime and there is no inverse, so division cannot be performed.

[0025] Now, [0] represents the set that leaves a remainder of 0 when divided by p. If we write it explicitly, [0]={···,-2p,-p,0,p,2p,···} It means Z p When defining the operation on Z, since the answer will be the same regardless of which element of the set [0] is used for the calculation, for simplicity we consider using one element (representative) included in the set [0] as a representative and calculating it. This representative can be any element included in this set (due to its nature), but for simplicity in this embodiment, we will use 0 as the representative. Similarly, we will represent [1] with the smallest positive integer such as 1 and [2] with the smallest positive integer such as 2, and calculate Z. p Let be represented by {0, 1, , p-1}.

[0026] Here, if p is a prime number, all representatives other than 0 are relatively prime to p, and division can be defined. That is, if p is a prime number, then Z p In this way, addition, subtraction, multiplication and division can be defined. A set that is a commutative ring and has an inverse with respect to multiplication except for 0 is called a field. In particular, when p is a prime number, Z pA field consisting of a finite number of elements is called a finite field. The number of elements in a finite field is either a prime number or a power of a prime number, and the former is called a prime field. That is, Z mentioned here p is a prime field.

[0027] Next, we present the notation and definitions related to polynomials. p Let F be a set of univariate polynomials with coefficients. p It is written as [t]. p Although [t] can be added, subtracted, and multiplied, division of polynomials is not possible because there is no inverse except for polynomials consisting only of constant terms.

[0028] [Multivariate polynomial notation] Next, we define some terms and notations related to bivariate polynomials. First, we define the univariate polynomial ring F p The two-variable polynomial on [t] is written as the following equation (1).

[0029]

number

[0030] where τ i,j (t) is a univariate polynomial ring F p It is an element of [t]. The set Γ ξ is the set of pairs of exponents (i(x-index), j(y-index)) of non-zero monomials contained in the polynomial ξ(x,y), and is called the term set of the two-variable polynomial ξ(x,y).

[0031] For example, the term set of the polynomial on Z7 in the following formula (2) is the following formula (3).

[0032]

number

[0033]

number

[0034] where Γ ξThe number of elements of is equal to the number of monomials in the bivariate polynomial ξ(x,y). In the following, when it is clear that it is a bivariate polynomial, ξ(x,y) may be written simply as ξ.

[0035] In the embodiment, for simplicity, the term set of a two-variable polynomial of degree D is defined as its maximum term set, and Γ D That is, when D=2, the following formula (4) is obtained, and when D=3, the following formula (5) is obtained.

[0036]

number

[0037]

number

[0038] This Γ3 is the term set Γ of the above formula (3). ξ as a subset.

[0039] term set Γ D Given this term set Γ D A univariate polynomial ring F with p A set of two-variable polynomials on [t] is defined by the following equation (6).

[0040]

number

[0041] where a i,j (t) is F p It is an element on [t]. Note that the left side of the above formula (6) can be simply expressed as F ΓD Also, the coefficient a i,j When the degree of (t) is limited to d or less, it is expressed by the following formula (7), and similarly, simply F ΓD,d The German letter F in the numerator on the left side of equations (6) and (7) is sometimes written as a capital F in the text.

[0042]

number

[0043] Univariate polynomial ring F p The two-variable polynomial on [t] is converted into a three-variable polynomial and expressed as the following equation (8).

[0044]

number

[0045] where μ i,j,k is a finite field F p It is an element of the set Δ ξ is the set of indices (i (x-index), j (y-index), k (t-index)) of non-zero monomials contained in the polynomial ξ(x,y,t), and is called the term set of the three-variable polynomial ξ(x,y,t).

[0046] For example, the term set of polynomial (9) on F7 is the following formula (10).

[0047]

number

[0048]

number

[0049] Here, Δ ξ The number of elements of is equal to the number of monomials in the three-variable polynomial ξ(x,y,t). In the following, when it is clear that it is a three-variable polynomial, ξ(x,y,t) may be written simply as ξ.

[0050] The notation of the maximum term set follows the notation for two-variable polynomials, and the degree D of the three-variable polynomial with respect to x and y is i,j Let Δ be the maximal term set whose degree of (t) is limited to d or less. D,d It will be written as follows.

[0051] For example, when D=2 and d=1, the following equation (11) is obtained.

[0052]

number

[0053] [Solutions and Zeros] Univariate polynomial ring F p A univariate polynomial ring F satisfying the equation X(x,y)=0 on [t] p [t] the pair of elements (u x (t),u y (t)) is called a solution to the equation X(x,y) = 0. Also, when X(x,y) is viewed as a polynomial, the solutions to the equation X(x,y) = 0 are called zeros of X(x,y).

[0054] [Approximate GCD calculation for univariate polynomials] Univariate polynomial ring F p Suppose we are given polynomials in [t]: f1(t)=s(t)e1(t), f2(t)=s(t)e2(t).

[0055] In this case, if e'(t):=GCD(e1(t),e2(t)), the greatest common divisor (GCD) s(t)e'(t) of f1(t) and f2(t) can be found using the Euclidean algorithm. Here, we explain the calculation (approximate GCD calculation) to derive GCDs(t)e'(t) from the following equation (12), in which small-order noise a1(t) and a2(t) are added to f1(t) and f2(t), respectively.

[0056]

number

[0057] This calculation plays an important role in the decryption of the encryption method shown in this embodiment. It is known that if the condition of the following equation (13) is satisfied in equation (12), GCDs(t)e'(t) can be found by Algorithm 1 shown in Figure 1.

[0058] [Number]

[0059] Since the algorithm shown in FIG. 1 uses the Euclidean algorithm, efficient processing is possible. In this embodiment, this s(t)e’(t) is called the approximate GCD (Approximate Greatest Common Divisor) of f1(t) and f2(t). Here, n is a system parameter and a natural number greater than or equal to degGCD(e1(t), e2(t)). If n < degGCD(e1(t), e2(t)), the approximate GCD calculation fails.

[0060] [Ideal Decomposition of Multivariable Polynomials] Define the factorization (ideal decomposition) problem using ideals in the multivariable polynomial ring Fp[t][x,y], and show one solution algorithm. Ideal decomposition is the problem of finding h p [t][x,y] for two elements X and f (= Π j=1 n h j +X r ) when given. Here, r is also an element of F j [t][x,y], and so to speak, it is the factorization problem of the polynomial f in the residue ring F p [t][x,y] / (X). p

[0061] For the finite set of the multivariable polynomial ring F p [t][x,y], let G = {g1, ···, g s}. At this time, for any polynomial f (∈ Fp[t][x,y]), there exists a polynomial q i (h j (∈ Fp[t][x,y]) such that the following formula (14) holds, r = 0, or for any i, LM(r) is not divisible by LM(g i ).

[0062] [Number]

[0063] Here, LM(g i ),LM(r) is a multivariate polynomial ring F p It means the monomial that is the first in the monomial order defined in [t]. For example, if the order is defined as x>y>t, the order of monomials is x, y, t, and in the case of monomials with the same variables, the one with the highest exponent comes first in this order. If the polynomial in equation (9) is r, the monomial order of r is t. 2 x 2 ,2tx 2 ,6x 2 ,4t 2 x,x,3ty 2 ,5y 2 ,4t 2 ,t,3, and LM(r)=t 2 x 2 This becomes:

[0064] Using a finite set G, transforming f as in the above formula (14) is called normalization of f by G, and r is called the normal form of G, and NF G (f). Also, if the set G is a set called a Groebner basis for a polynomial ideal J, the normal form of any element f included in the ideal J is 0. In other words, it is known that it can be written as the following formula (15).

[0065]

number

[0066] where q i is an element of Fp[t][x,y].

[0067] Now, it is known that when the resultant of f and X is calculated, it becomes the following equation (16).

[0068]

number

[0069] Here, Res x (f,X) is a resultant for the variable x. Similarly, the resultant for the variable y can be calculated using the following formula (17).

[0070]

number

[0071] Here, the ideal J is expressed by the following formula (18).

[0072]

number

[0073] J is (h j ,X) and h j ∈J, we calculate the Groebner basis G of the ideal J, and under G, h j Calculating the normal form of is 0. Now, for simplicity, h j is simply written as h, and h is expressed by the following equation (19).

[0074]

number

[0075] where μ ijk is F p is a variable whose value is h. Calculating the normal form of h in G results in the following formula (20).

[0076]

number

[0077] x on both sides of this i y j t k By comparing the coefficients of the equations, we derive a system of linear equations and solve it to find μ ijk h can be recovered by obtaining

[0078] On the other hand, in reality, Res x (h i ,X),Res y (h i ,X) are Res x (f,X), Res y Factors of (f,X), and if they are not the correct combination, h i Taking these points into consideration, we can see that ideal decomposition can be realized by Algorithm 2 shown in Figure 2.

[0079] [Indeterminate equations and their solutions] An indeterminate equation can be defined as an equation in which the number of variables is greater than the number of expressions (contained in the equation). Indeterminate equations have few constraints, but a large degree of freedom in their solutions, so if they have solutions, they often have multiple (sometimes infinite) solutions (this is what "indeterminate" means). In fact, there are an infinite number of real (or complex) solutions to indeterminate equations with integer coefficients, and it is easy to find some of them as approximate solutions. On the other hand, such methods are usually not applicable to equations that have solutions in a discrete set, such as integer solutions to indeterminate equations with integer coefficients. Therefore, some kind of theoretical narrowing down is necessary, but even if such narrowing down is performed, it is known that it is generally impossible to determine the existence or non-existence of a solution using a finite number of methods (an unsolvable problem).

[0080] The indeterminate equation cryptography proposed in the embodiment is based on a one-variable polynomial ring F p [t] The basis of security is the problem of finding a one-variable polynomial solution to the indeterminate equation X(x,y)=0 defined above, which is defined as follows:

[0081] Definition 1 (univariate polynomial ring F p (Problem of solving an indeterminate equation on [t]) One-variable polynomial ring F p [t] Given the above defined indeterminate equation X(x,y)=0, F p [t] the solution (u x (t),u y (t)) can be solved by a univariate polynomial ring F pProblems solving indeterminate equations on [t], or finite fields F p This is called the problem of finding sections on the algebraic surface X(x,y) defined above.

[0082] An example of the indeterminate equation cryptography of this embodiment is shown below. In addition, to facilitate understanding of the algorithm shown below, small numerical examples are provided, but it should be noted that the security of the cryptography cannot be guaranteed with these numerical examples.

[0083] [Parameters] The symbols and parameters used in the method of this embodiment will be described below. p For a two-variable polynomial ξ(x,y) on [t], we define the following notation: D ξ : The total degree of ξ(x,y) with respect to x and y d ξ : Degree of the coefficient polynomial of ξ(x,y)

[0084] In the method of this embodiment, five F p A two-variable polynomial on [t] is used.

[0085]

number

[0086] In this, X(x,y) is (u x (t),u y (t)) as a zero point, and the zero point is degu x (t)=degu y (t) is satisfied, and this degree is written as d. The encryption parameters of this embodiment are p, d, and D ξ and d ξ (ξ=X,m,s,e,r). Hereinafter, for the purpose of decoding, the condition of the following equation (22) is assumed.

[0087]

number

[0088] In this embodiment, D m =3,D X =D s =2,D e =D r = 1, the condition of the above formula (22) becomes the following formula (23).

[0089]

number

[0090] In this embodiment, since the degree of the constant term in X and s is different from the degree of the other terms, the degree of each term is expressed as d X,0 ,d s,0 and is separately defined by the following equation (24).

[0091]

number

[0092] [Key generation algorithm] In the key generation method of this embodiment, among the above parameters, p, d, and D x and d x These parameters are directly related to the security of the encryption, and are determined based on the computational complexity of the attack methods described in the Security Considerations section below. In the numerical example, p=5, d=6, D x =2,d x =d-1=5.

[0093] 1. Generate a private key polynomial ring F p Two polynomials u of degree d in [t] x (t) and u y (t) is generated uniformly at random, and for example, a secret key (x, y)=(ux(t), uy(t)) of the following equation (25) is generated.

[0094]

number

[0095] 2. Public Key Coefficient Generation The degree d of the coefficient of the public key X(x,y) X Polynomial τ i,j (t)(i+j=ν) is generated uniformly at random. Note that τ is set so that X(x,y) is symmetric. i,j (t)=τ j,i (t). Here, d x = 5, it is generated as shown in the following formula (26).

[0096]

number

[0097] 3. Calculate the tentative constant for the public key The temporary constant term of the public key is calculated by the following formula (27).

[0098]

number

[0099] Specifically, in the above example, it is calculated using the following formula (28).

[0100]

number

[0101] Here, if X(x, y) is defined by the following equation (29), then (u x (t),u y (t)) is the solution to X(x,y)=0.

[0102]

number

[0103] On the other hand, the provisional constant term in the above equation (27) is of order d X +2d, and d X,0 =d XSince it is larger than +d, the coefficient is adjusted as follows:

[0104] 4. Coefficient order adjustment The temporary constant term in the above equation (27) is u x (t)u y If the quotient divided by (t) is q(t), the following equation (30) also holds true (u x (t),u y (t)) is a solution.

[0105]

number

[0106] where degq(t)=d X The constant term is given by the following equation (31).

[0107]

number

[0108] This is consistent with the following equation (32), so the order is d X It will be less than +d.

[0109]

number

[0110] Therefore, this transformation gives degτ 1,1 =d X Therefore, by updating X(x, y) to the following equation (33), degτ 0,0 (t)=2d―1=d X,0 This can be converted into an indeterminate equation that meets the conditions of the public key.

[0111]

number

[0112] In this example, q(t) is the following equation (34), and the public key X is updated to the following equation (35). The degree of the constant term is d X +d=11.

[0113]

number

[0114]

number

[0115] Here, the terms xy whose coefficients are changed are terms in which x and y are symmetric, and even if the degree of the coefficients is adjusted, X(x, y) remains a symmetric equation.

[0116] [Encryption algorithm] The encryption algorithm is as follows. In this embodiment, the plaintext M (message M) is expanded into a quinary system, (31223041112230202043)5 The quinary-expanded plaintext M is embedded in the coefficients of a plaintext polynomial m(x, y) that satisfies the following equation (36).

[0117]

number

[0118] where d m = 1, the plaintext M expanded into a quinary form is embedded as shown in the following formula (37).

[0119]

number

[0120] This plaintext polynomial m(x,y) is encrypted as follows:

[0121] 1.Generate polynomial s(x,y) The degree d of the coefficients of the polynomial s(x,y)s Polynomial s i,j (t) (0≦i+j≦2) is generated uniformly at random. Note that s(x,y) is symmetric. i,j (t)=s j,i (t). In this example, d s =28, and s(x, y) is generated as shown in the following equation (38).

[0122]

number

[0123] 2. Generate the noise polynomial e(x,y) d e A first-order two-variable polynomial e(x,y) with coefficients up to d is generated. In this example, e = 14, and e(x, y) is generated as shown in the following equation (39).

[0124]

number

[0125] 3. Generate a random polynomial r(x,y) d r A bivariate random polynomial r(x,y) of degree 1 with coefficients up to d r =37, and r(x, y) is generated as shown in the following equation (40).

[0126]

number

[0127] 4. Generate ciphertext c(x,y) The ciphertext is calculated by the following formula (41).

[0128]

number

[0129] In this example, c(x, y) is calculated as in the following equation (42).

[0130]

number

[0131] [Decryption algorithm] Minimum solution u:(x,y)=(u x (t),u y (t)) into the indeterminate equation X(x,y) x (t),u y Note that there is a relationship such that (t) = 0. The decoding algorithm is as follows:

[0132] 1. Substitute the solution u into the ciphertext c(x,y) and its inverse formula c(y,x) By substituting the solution u into c(x, y) and c(y, x), the following equation (43) is obtained.

[0133]

number

[0134] Note that s(x,y) = s(y,x), X(x,y) = X(y,x). In this example, c(u x (t),u y (t)) and c(u y (t),u x (t)) is calculated as shown in the following equation (44).

[0135]

number

[0136] 2.s(u x (t),u y (t)) is calculated by approximate GCD calculation. This is calculated by Algorithm 1 (FIG. 1) under the conditions of the above-mentioned formula (13). In this example, it is calculated as shown in the following formula (45).

[0137]

number

[0138] Here, the first two conditions of the above-mentioned equation (23) are necessary conditions for the above-mentioned equation (13) to be satisfied. The probability (decoding failure probability) that the above-mentioned equation (13) condition does not hold even when the above-mentioned equation (23) condition holds will be explained later in the section [Decoding Failure Probability].

[0139] 3.m(u x (t),u y Calculate (t) m(u x (t),u y (t)) is calculated using the following equation (46).

[0140]

number

[0141] In this example, m(u x (t),u y (t)) is calculated as shown in the following equation (47).

[0142]

number

[0143] 4. Calculating the plaintext polynomial m(x,y) The plaintext polynomial m(x,y) can be written as the following equation (48), so using the relationship in the following equation (49), m i,j,k By formulating and solving a linear equation with variables m(x,y), the plaintext polynomial m(x,y) can be obtained.

[0144]

number

[0145]

number

[0146] Here, the number of variables is 10(d m +1), and the number of equations is 3d+d m +1, when the number of expressions is greater than the number of variables, that is, d ≥ 3 (d m +1), a solution exists. This condition is the last condition of the above equation (23). In this example, the plaintext polynomial m(x, y) is given by the following equation (50), and it can be confirmed that the plaintext has been decrypted correctly.

[0147]

number

[0148] [Decoding failure probability] We evaluate the probability of decoding failure of this scheme. This scheme uses two polynomials c(u x (t),u y (t)) and c(u y (t),u x Even if (t)) satisfies the condition of the above-mentioned formula (23), there is a possibility that the decoding will fail because it does not satisfy the condition of the above-mentioned formula (13) for the approximate GCD calculation. To see this, if the condition of formula (23) is satisfied but the condition of formula (13) is not satisfied, then either condition (A) or (B) of the following formula (51) will be satisfied. Let us consider the possibility that these will hold.

[0149]

number

[0150] For simplicity, we use s(t):=s(u x (t),u y (t)),e'(t):=GCD(e(u x (t),u y (t)),e(u y (t),u x (t))),e(t):=e(ux (t),u y (t)),m(t):=m(u x (t),u y It is written as (t)).

[0151] Of these, condition (A) does not occur because the first condition of the condition of equation (23) leads to the following equation (52).

[0152]

number

[0153] Therefore, it is sufficient to consider the probability that condition (B) occurs, which requires that dege'(t) ≥ (d+d e) -3d-d m We can calculate the probability that an event occurs. Here, e(u x (t),u y (t)) and e(u y (t),u x Assuming that the distribution of the coefficients of (t) is uniform, this probability is p ―N (1-p ―1 ) Therefore, the decoding failure probability κ is evaluated by the following equation (53).

[0154]

number

[0155] Here, if a new parameter δ is defined by the following equation (54), the decoding failure probability κ can be written as the following equation (55), and it can be seen that the decoding failure probability decreases exponentially as the value of δ≦0 becomes smaller.

[0156]

number

[0157]

number

[0158] [Parameter determination method] First, we will explain how to determine the parameters shown in the above [Parameters]. The parameters that need to be determined when implementing and operating the encryption method of this embodiment are p, d, and D. ξ and d ξ Here, ξ is five polynomials of X, m, s, e, and r. To satisfy the condition of the above equation (23), p, d, and D are arranged in the following order: ξ and d ξ is determined.

[0159] 1.p and d m Decision p and d m is a parameter related to the security of the cryptography, and p and d m is determined based on an evaluation of the computational complexity of the attack method described in the Security Considerations section below.

[0160] 2.d Settings From the third condition of the above equation (23), d = 3(d m +1).

[0161] 3.d x Settings In this embodiment, d X is d x = d - 1, which is consistent with the setting in the key generation algorithm above.

[0162] 4. Setting the parameter δ related to the decoding failure probability From the above equation (55), the parameter δ is given by the following equation (56).

[0163]

number

[0164] Here, the right-hand side represents the smallest integer equal to or greater than κ / |p|, and |p| represents the bit length of p.

[0165] 5.d e Settings d e is set as shown in the following equation (57) from the second condition of the above equation (23) and the definition of δ in the above equation (54).

[0166]

number

[0167] 6.d s Settings d s From the first condition of the above equation (23), d s =2d e It is set as follows.

[0168] 7.d r Settings d r is d r =d e +d s -d X By setting it in this way, the condition of the following formula (58) is satisfied, and resistance to linear algebra attacks, which will be described later in [Linear Algebra Attacks], is achieved.

[0169]

number

[0170] In this way, parameters that satisfy the conditions of the above-mentioned equation (23) and equation (58) can be generated.

[0171] [Safety assumptions] A security assumption that serves as the basis for the security of the method of this embodiment is defined. n,d is defined by the following equation (59).

[0172]

number

[0173] The polynomial ξ(x,y) is the set Δ n,d To have it as a base is Δ n,d The monomial x corresponding to each element (i,j,k) of i y j t k The set of polynomials is defined by the following equation (60).

[0174]

number

[0175] Also, Δ X ,Δ s is defined as the following equation (61).

[0176]

number

[0177] In this case, the set Δ X Consider a set of polynomials such as the following equation (62) based on .

[0178]

number

[0179] This is F p [t] Δ with zeros of degree d defined on X Here, the set of symmetric polynomials with the set Δ as the support is expressed by the following formula (63).

[0180]

number

[0181] The following calculation problem is defined for the set of the following equation (64) that satisfies the condition of equation (23).

[0182]

number

[0183] Definition 2 (Approximate Ideal Decomposition Problem) Let c be a sample from the polynomial set of the following equation (65).

number

[0184] Furthermore, we define the approximate ideal decomposition assumption as follows:

[0185] Definition 3 (Approximate Ideal Decomposition Assumption) The approximate ideal decomposition assumption means that for any polynomial-time algorithm A, the probability of the following equation (66) can be ignored.

number

number

[0186] Theorem 1: Under the approximate ideal factorization assumption, the indeterminate equation encryption Σ=(Gen,Enc,Dec) is secure in the sense of OW-CPA. That is, if there is an adversary who can break the indeterminate equation encryption in polynomial time in the sense of OW-CPA, then there exists an algorithm A that solves the approximate ideal factorization problem in probabilistic polynomial time, and the following equation (68) holds.

number

[0187] Proof 1: Let c(x,y) be any sample of the approximate ideal decomposition problem. Suppose there is an adversary who can break the indeterminate equation encryption Σ in polynomial time in the sense of OW-CPA. In this case, we can use this adversary to obtain the plaintext polynomial m(x,y) and calculate the following equation (69).

[0188]

number

[0189] Furthermore, these resultants are calculated as shown in the following equation (70).

[0190]

number

[0191] By using Algorithm 2 (ideal decomposition) in Figure 2, s(x, y) and e(x, y) can be calculated. In other words, this adversary can solve the approximate ideal decomposition problem, and the following equation (71) holds.

[0192]

number

[0193] Several variations (modifications) of this embodiment will be described below.

[0194] [Ciphertext variations] The ciphertext in this embodiment is defined by the above formula (41), but even if this is changed to the following formula (72), the encryption method and decryption method of this embodiment will also be valid and will also satisfy the security described in the "Security Considerations" below.

[0195]

number

[0196] [Variations on compression of public key X(x,y)] In the above-described embodiment, the coefficients of the indeterminate equation X(x,y), which is the public key, are chosen uniformly at random except for the constant term, and only some of the terms (the xy term in the above-described embodiment) are adjusted. While adjustment requires secret key information, the unadjusted terms remain random. Therefore, by disclosing the seed used for generation, it is possible to specify a specific pseudorandom number generation function, hash function, or the like, and generate the public key. Therefore, only the seed and the adjusted coefficients can be disclosed, thereby compressing the size of the public key. In this way, in the above-described embodiment, the actual coefficients of only the part of equation (73) below are disclosed, and the remaining terms are disclosed as seeds (usually with the same bit length as the security parameter), thereby compressing the public key size. This variation allows for expanded use in low-end devices with small memory capacities.

[0197]

number

[0198] This variation makes it possible to expand its use to low-end devices with small memory capacities.

[0199] [Variations on the modulus of the public key X(x,y)] In the above embodiment, the coefficients of the indeterminate equation X(x, y), which is the public key, are taken uniformly at random except for the constant term, and only some of the terms (the xy term in the above embodiment) are adjusted. Here, each coefficient is F p [t], and the coefficients are not necessarily non-zero. If there are non-zero coefficients, the coefficients of some terms in the ciphertext X(x,y)r(x,y) may always be zero. In this case, some information about the random polynomial that makes up the ciphertext may be leaked in a linear algebra attack or coefficient comparison attack (even if not all information is leaked), and from there some information in the plaintext may be leaked. Therefore, in this variation, the coefficient τ of each term in the public key X(x,y) ij We will explain how to make the coefficient of (t) non-zero.

[0200] To achieve this, first, the coefficient τij When selecting (t) uniformly at random, the range of values ​​that can be randomly selected is set to 1 to p. Furthermore, as for the coefficients to be adjusted, if some of the coefficients become zero as a result of the adjustment, the private key u x (t),u y It is possible to make it non-zero by recalculating (t) or by changing the seed used when selecting it uniformly at random and recalculating it.

[0201] [Variations on how to select the set of terms] In the above embodiment, for simplicity, the term set is limited to the maximal term set. This is sufficient to effectively hide the plaintext using a polynomial with unknown coefficients, but it is not necessarily necessary because it requires that the terms s(x,y)e(x,y) and X(x,y)r(x,y) in the ciphertext c(x,y) have the same formula form. Therefore, in order to specify the form of these formulas, a parameter D ξ ,d ξ Change it to Δ ξ (where ξ is s, r, e, and X). By setting it in this way, it can be realized with a smaller term set than the maximal term set, so the size of the public key and ciphertext can be reduced.

[0202] [Variation to embed plaintext information in s, r, and e] Although the decryption algorithm does not restore s, r, and e, it is possible to restore s, r, and e after determining the plaintext polynomial m. That is, once m(x, y) is determined, the above equation (69) can be calculated, and s(x, y) and e(x, y) can be restored by applying the ideal decomposition explained in the above [Ideal decomposition of multivariate polynomials] to the right-hand side of equation (69). r(x, y) can also be restored by calculating the following equation (74) from the restored s(x, y) and e(x, y).

[0203]

number

[0204] By doing this, plaintext information or parts of plaintext information can be embedded in s, r, and e. This not only increases the bit length that can be encrypted at one time, but also adds information as an authenticator, making it possible to realize an encryption method that is resistant to attacks that tamper with the ciphertext. It is also possible to determine the area to be embedded in advance when embedding plaintext, including when embedding in a plaintext polynomial. In this case, the integrity of the ciphertext can be maintained by embedding random values ​​or information that will not be affected even if decrypted in the non-embedded parts. Furthermore, by not embedding plaintext in the parts where information leakage may occur, it is possible to deal with situations in which some information may be leaked due to vulnerabilities in the implementation, such as side-channel attacks.

[0205] [Variations for changing the order of approximate GCD in approximate GCD calculations] In the approximate GCD calculation described in the above embodiment [Approximate GCD calculation for one-variable polynomial], it is necessary to specify the degree of s(u)e'(t) which is the approximate GCD. The degree is searched for from degs(u), which is the minimum value of the degree of s(u)e'(t). The degree degs(u)e'(t) of the approximate GCD which is the input for the approximate GCD calculation is often D s d+d s That's all, but D s d+d s There are also cases where it is smaller than

[0206] In this variation, D s d+d s In order to implement this variation, the approximate GCD calculation step in the decoding algorithm is s d+d s Then, if the plaintext cannot be recovered, gradually increase the degree D until it reaches D s d+d s By doing this, it becomes possible to decrypt ciphertexts that previously failed to be decrypted because the degree of the approximate GCD was less than degs(u).

[0207] [Variations regarding variables] In the above-described embodiment, F p Although we have dealt with two-variable polynomials on [t], even if this is a general n-variable polynomial, the encryption algorithm, decryption algorithm, and key generation algorithm will hold as in this embodiment. Even if the number of variables is more than three, the indeterminate equation X(x1, , x n ) is only one, it is still an indeterminate equation, and the problem of solving it is computationally difficult. On the contrary, as the number of variables increases, the problem often becomes more computationally difficult, and security is strengthened. Therefore, not only can the key size be reduced, but the size of the plaintext that can be embedded increases because there are more variables. On the other hand, the system parameter d s =n(d m +1). When there are three or more variables, this embodiment is valid as long as at least two of the variables are symmetric.

[0208] [The coefficient m of the plaintext polynomial ij Variations that change the degree of (t) for each term] In the above embodiment, the coefficient m of the plaintext polynomial ij (t) degree is uniformly d m In the process of restoring m(x,y), m(u x (t),u y (t)), a linear simultaneous equation is formulated and solved in step 4 of the decoding algorithm shown in the above [Decoding Algorithm]. In this case, in order to derive a unique solution, the number of equations must be equal to or greater than the number of variables. The number of equations is a one-variable polynomial m(u x (t),u y (t)).

[0209] On the other hand, the higher-order terms of m(x,y) are D m = 3 then x 3 ,x 2 y,xy 2 ,y 3Therefore, by lowering the degree of the coefficients of the high-order terms and increasing the degree of the coefficients of the low-order terms in m(x,y), the number of expressions can be increased while keeping the number of variables down. Also, by configuring in this way, D e This also has the advantage that the decoding condition of the above equation (23) can be relaxed compared to when it is determined uniformly.

[0210] It should be noted that some or all of the above variations can be used in combination.

[0211] [Specific configuration] Next, specific configurations and operation methods of the encryption device, decryption device, and key generation device in the public key cryptography of this embodiment will be described.

[0212] First, the configuration and processing flow of the encryption device of this embodiment will be described along the flowchart shown in FIG. 4 with reference to the overall configuration diagram shown in FIG.

[0213] The encryption device 10 of the embodiment includes a plaintext acquisition unit 1, a public key acquisition unit 2, a plaintext embedding unit 3, a storage unit 4, an encryption unit 5, a polynomial generation unit 6, a random value generation unit 7, a polynomial calculation unit 8, and a ciphertext output unit 9.

[0214] First, the plaintext acquisition unit 1 acquires plaintext M (step S1). The plaintext acquisition unit 1 acquires encryption target data acquired from, for example, another application or another device as plaintext M. The plaintext acquisition unit 1 inputs the plaintext M acquired in step S1 to the plaintext embedding unit 3.

[0215] Next, the public key acquisition unit 2 acquires the two-variable symmetric indeterminate equation X(x, y) as a public key (step S2). The public key acquisition unit 2 acquires the public key from another device, such as a key generation device described later. The public key acquisition unit 2 inputs the public key acquired in step S2 to the encryption unit 5.

[0216] Next, the plaintext embedding unit 3 reads the system parameters p,D from the storage unit 4. m and dm The encryption unit 5 obtains the system parameters p,D that match the public key obtained in step S2 from the storage unit 4. s ,D r ,D e ,d s ,d r and d e is obtained (step S3).

[0217] Next, the plaintext embedding unit 3 embeds the plaintext M input from the plaintext acquisition unit 1 into a 10(d m +1) sub-blocks. The plaintext embedding unit 3 divides the plaintext M divided into each sub-block into F p The coefficients of the two-variable plaintext polynomial m(x, y) on [t] are embedded (step S4). Here, each coefficient m i,j The degree of (t) is d m and the coefficients of these polynomials are F p Therefore, the block size of the encryption method of this embodiment is 10(d m +1)|p|. When a plaintext larger than this is input, it is first divided into blocks of this size and then encrypted block by block. The plaintext embedding unit 3 inputs the plaintext polynomial m(x, y) generated in step S4 to the encryption unit 5.

[0218] Next, the encryption unit 5 encrypts the system parameters p,D s ,d s is input to the polynomial generator 6, and the maximum term set (hereinafter simply term set) Γ is formed from this. s According to s The polynomial generator 6 is instructed to generate two random symmetric polynomials s(x,y) having the following polynomial coefficients. The polynomial generator 6 instructs the random value generator 7 to generate the coefficients s ij The random value generator 7 generates a required number of integers from 0 to p-1 that will be coefficients of (t), and generates s(x, y) based on these integers (step S5). ij (t)=s ji (t) is necessary, D s= 2, then 4(d s +1) random values ​​between 0 and p-1 are generated.

[0219] Next, the encryption unit 5 continues to encrypt the system parameters p,D r ,d r is input to the polynomial generator 6, and d is generated in the same way as the random polynomial s(x,y) is generated. r D with the following polynomial coefficients r The next random polynomial r(x, y) is generated (step S6).

[0220] Next, the encryption unit 5 continues to encrypt the system parameters p,D e ,d e is input to the polynomial generator 6, and d is generated in the same way as the random polynomial s(x,y) is generated. e D with the following polynomial coefficients e The next random polynomial e(x, y) is generated (step S7).

[0221] Next, the encryption unit 5 calculates (generates) the ciphertext c(x, y) by having the polynomial calculation unit 8 calculate the polynomials s(x, y), r(x, y), e(x, y), the public key X(x, y), and the plaintext polynomial divisor m(x, y) according to the above-mentioned equation (41) each time (step S8). The encryption unit 5 inputs the ciphertext c(x, y) to the ciphertext output unit 9.

[0222] Finally, the ciphertext output unit 9 outputs the ciphertext c(x, y) (after transforming it into a predetermined format, if necessary) as the output of the encryption device 10 (step S9). The predetermined format is, for example, a binary data format determined as the input format of a downstream device to which the ciphertext is input.

[0223] Next, the configuration and processing flow of the decoding device of this embodiment will be described along the flowchart shown in FIG. 6 with reference to the overall configuration diagram shown in FIG.

[0224] The decryption device 20 of the embodiment includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero substitution unit 24, an approximate GCD calculation unit 25, a storage unit 26, a plaintext polynomial restoration unit 27, and a plaintext output unit .

[0225] First, the ciphertext acquisition unit 21 acquires the ciphertext c (step S21). The ciphertext acquisition unit 21 acquires the ciphertext c(x, y) from another device via a network, for example.

[0226] Next, the key acquisition unit 22 acquires the public key (X(x, y)) and the private key (zero point u:(u x (t),u y The key acquisition unit 22 acquires the public key (X(x, y)) from another device or the like via a network, for example, and acquires the private key (zero point u:(u x (t),u y (t)).

[0227] Next, the decryption unit 23 receives the ciphertext c from the ciphertext acquisition unit 21, and receives the public key (X(x, y)) and the private key (zero point u:(u x (t),u y Upon receiving (t), the decoding process begins.

[0228] The decryption unit 23 first inputs the ciphertext c(x, y) and the zero point u to the zero point substitution unit 24. The zero point substitution unit 24 substitutes the zero point u into c(x, y) and calculates h1(t) (step S23). The zero point substitution unit 24 inputs h1(t) to the decryption unit 23.

[0229] Next, the zero point substitution unit 24 substitutes the zero point u into c(y,x), which is the inverse of x and y in the ciphertext, and calculates h2(t) (step S24). The zero point substitution unit 24 inputs h2(t) to the decryption unit 23.

[0230] Next, the decoding unit 23 receives h from the zero point substitution unit 24. k (t)(k=1,2) is accepted, h k (t)(k=1,2) and s(u x (t),uy (t)) degree D s d+d s and are input to the approximate GCD calculation unit 25. The approximate GCD calculation unit 25 calculates h k (t) (k=1,2) and calculate the approximate GCD of the derived s(u x (t),u y (t))e'(t) (where e'(t):=GCD(e(ux(t),uy(t)),e(uy(t),ux(t)))) is input to the decoding unit 23.

[0231] Next, the decoding unit 23 receives s(u x (t),u y (t))e'(t), h1(t), i.e., c(u x (t),u y (t)) to s(u x (t),u y (t)) to get the remainder m(u x (t),u y (t)) is calculated (step S26).

[0232] Next, the plaintext polynomial restoration unit 27 restores the plaintext polynomial m(u x (t),u y (t)), zero point u, and system parameter d m From this, the plaintext polynomial m(x, y) is restored by the method explained in the above [Decryption Algorithm] (step S27). If the plaintext polynomial m(x, y) cannot be restored, the plaintext polynomial restoration unit 27 transmits an error to the decryption unit 23 and ends the process.

[0233] If the plaintext polynomial m(x, y) is restored, the plaintext output unit 28 extracts the plaintext M from the coefficients of the plaintext polynomial m(x, y), outputs the extracted plaintext M (step S28), and ends the processing.

[0234] Next, the configuration and processing flow of the key generation device of this embodiment will be described along the flowchart shown in FIG. 8 with reference to the overall configuration diagram shown in FIG.

[0235] The key generation device 40 of the embodiment includes a system parameter acquisition unit 41, a control unit 42, a polynomial generation unit 43, a random value generation unit 44, an indeterminate equation generation unit 45, a polynomial operation unit 46, and a key output unit 47.

[0236] First, the system parameter acquisition unit 41 acquires the system parameters p, d, and D x ,d x (Step S41) The system parameters p, d, and D are obtained. x ,d x are obtained by, for example, accepting input from a user. Also, for example, the system parameters p, d, and D x ,d x are the system parameters p, d, and D x ,d x It is obtained by reading the setting data including the above.

[0237] The system parameter acquisition unit 41 inputs the system parameters to the control unit 42. The control unit 42 performs the following processing in cooperation with other processing units based on the system parameters input from the system parameter acquisition unit 41.

[0238] First, the control unit 42 inputs p and d, among the system parameters input from the system parameter acquisition unit 41, to the polynomial generation unit 43, and p Two polynomials u of degree d contained in [t] x (t),u y Next, the polynomial generation unit 43 instructs the random value generation unit 44 to generate 2(d+1) integers from 0 to p-1. The random value generation unit 44 generates 2(d+1) random numbers from 0 to p-1 using a pseudo-random number generator or the like, and inputs them to the polynomial generation unit 43. The polynomial generation unit 43 generates a polynomial u having the 2(d+1) random numbers input from the random value generation unit 44 as coefficients. x (t),u y (t) is generated (step S42), and the polynomial u x (t),u y (t) is input to the control unit 42.

[0239] The control unit 42 receives the polynomial u from the polynomial generation unit 43. x (t),u y (t) is kept (stored) as a private key.

[0240] Furthermore, the control unit 42 generates a public key (a symmetric indeterminate equation X(x, y) expressed by the following equation (75)).

[0241]

number

[0242] In order to generate a public key, the control unit 42 calculates the coefficient τ ij (t) becomes d X The polynomial τ of the following order ij (t)(0≦i≦j≦D X ) to F p Extract from [t] and τ ji (t)=τ ij Set to (t).

[0243] Specifically, the control unit 42 calculates the above-mentioned polynomial u x (t),u y As in the case of generating (t), parameters p and d are input to the polynomial generating unit 43, and F p τ in [t] ij (t)(0≦i≦j≦D X The polynomial generator 43 uses the random value generator 44 to generate the polynomial τ ij The polynomial generation unit 43 generates the polynomial τ ij (t) is input to the control unit 42. The control unit 42 inputs τ ji (t)=τ ij Set to (t).

[0244] The control unit 42 calculates the polynomial τ generated by the polynomial generation unit 43. ij (t), system parameters p, d, D x ,d x and private key u x (t),u y(t) is input to the indeterminate equation generating unit 45.

[0245] The indeterminate equation generating unit 45 uses the polynomial operation unit 46 to generate an indeterminate equation without a constant term. Next, the indeterminate equation generating unit 45 generates an equation X′(x, y) (step S43). x (t),u y (t)) is substituted into the variables x and y of X′(x, y), respectively, to calculate a provisional constant term by the following equation (76) (step S44).

[0246]

number

[0247] Next, the indeterminate equation generating unit 45 and the polynomial operating unit 46 perform processing to reduce the degree of the temporary constant term in the above equation (76), thereby generating the indeterminate equation X(x, y) (step S45).

[0248] This degree reduction process involves a temporary constant term and a secret key u x (t),u y (t) and the indeterminate equation with the same zero point is of degree d x This is a process of converting into another indeterminate equation with a constant term less than (=d-1).

[0249] The basic principle is to use a secret key (zero point) to replace the constant term with an indeterminate equation of smaller degree that has the same zero point. The theoretical background is as described above, so only the procedure will be explained here.

[0250] For simplicity, in the following explanation, it is assumed that X(x, y) includes the term xy. First, the control unit 42 instructs the polynomial calculation unit 46 to calculate the following equation (77), and calculates this value as τ 0,0 (t), and instructs the polynomial calculation unit 46 to calculate the following equation (78), thereby obtaining the polynomial q(t).

[0251]

number

[0252]

number

[0253] Here, q(t) is the temporary constant term in the above equation (76) x (t)u y The quotient when divided by (t) is d x (=d-1). Also, τ 0,0 The degree of (t) is d X +d(=2d-1).

[0254] Finally, the control unit 42 outputs to the indeterminate equation generating unit 45 X(x,y)=X′(x,y)+q(t)xy+τ 0,0 The indeterminate equation generator 45 calculates (t) and sets the output as the indeterminate equation X(x, y) of the public key. The indeterminate equation generator 45 inputs the indeterminate equation X(x, y) thus generated to the controller 42.

[0255] The control unit 42 confirms that the above series of processes is completed, and then transfers the public key X(x, y) and private key u(x, y) generated in step S45. x (t),u y The key output unit 47 receives the public key (X(x, y) and the private key (u x (t),u y (t)) is output to the outside of the key generating device 40 (step S46).

[0256] [Specific configurations for the above variations] Next, specific configurations of the above-mentioned variations (modified examples) will be described.

[0257] The variations of the ciphertext can be realized by calculating the above equation (72) in the step of creating the ciphertext in the encryption unit 5 of the encryption device 10, and then by making obvious modifications in the decryption device 20 taking this into consideration.

[0258] Variations on public key compression can be achieved by adding a random number seed to the input to the random value generation unit 44 in the key generation device 40, or by adding the random number seed used for generation by the random value generation unit 44 to the output from the random value generation unit 44, and finally outputting the public key X(x, y) and the adjusted coefficients from the key output unit 47. When a public key is input, the encryption device 10 and the decryption device 20 can restore the original public key X(x, y) by using the random number seed to restore the unadjusted coefficients and adding the adjusted coefficients included in the public key. In this case, the decryption device 20 needs to be equipped with a polynomial generation unit similar to the polynomial generation unit 6 of the encryption device 10 and a random value generation unit having the same pseudo-random function as the random value generation unit 44 of the key generation device 40.

[0259] The variation regarding the public key coefficient is that the random value generation unit 44 in the key generation device 40 generates the coefficient τ of the public key X(x, y). ij When generating the coefficients of (t), the range of random numbers is set to 1 to p-1. The coefficient adjustment step (constant term τ 0,0 (t) to the zero point (u x (t),u y In the step of reducing by (t), the adjusted coefficient τ 1,1 (t),τ 0,0 If (t) contains non-zero coefficients, this is achieved by starting over from the part where coefficients other than the constant terms of the indeterminate equation X(x,y) are randomly generated.

[0260] The variations in the method of selecting the term set are as follows: ξ , d ξ A set of terms Δ ξ Change to Δ ξ This is achieved by generating public keys, random polynomials, and noise polynomials based on , where ξ is X, s, r, and e.

[0261] Regarding the variation of embedding plaintext information in s(x,y), r(x,y), and e(x,y), the encryption device 10 does not randomly generate s(x,y), r(x,y), and e(x,y), but embeds (part of) the plaintext in a manner similar to embedding plaintext in a polynomial.

[0262] The configuration and processing flow of the decoding device of this variation will be described with reference to the flowchart shown in FIG. 10 and the overall configuration diagram shown in FIG.

[0263] The decryption device 20-2 of this variation includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero substitution unit 24, an approximate GCD calculation unit 25, a memory unit 26, a plaintext polynomial restoration unit 27, a plaintext output unit 28, and an ideal decomposition unit 29. That is, the decryption device 20-2 of this variation is additionally equipped with the ideal decomposition unit 29.

[0264] In the decryption device 20-2 of this variation, the ciphertext c(x, y) is obtained from the ciphertext obtaining unit 21, and the public key X(x, y) and the private key (zero point u:(u x (t),u y The process starts by obtaining m(u x (t),u y The process (steps S61 to S67) from (t)) to restoring the plaintext polynomial m(x, y) is the same as the process (steps S21 to S27) of the decryption unit 23 in the above-described embodiment. Therefore, only the process thereafter will be described here.

[0265] If the plaintext polynomial restoration unit 27 successfully restores the plaintext polynomial m(x, y), the plaintext polynomial m(x, y) is input to the decryption unit 23, and if the restoration fails, an error is input to the decryption unit 23. If the decryption unit 23 receives an error from the plaintext polynomial restoration unit 27, it outputs the error to the plaintext output unit 28 and terminates.

[0266] When the decryption unit 23 receives the plaintext polynomial m(x,y) from the plaintext polynomial restoration unit 27, it calculates c(x,y)-m(x,y) and inputs c(x,y)-m(x,y) to the ideal decomposition unit 29. The ideal decomposition unit 29 performs ideal decomposition of c(x,y)-m(x,y) based on Algorithm 2 (FIG. 2) to derive s(x,y) and e(x,y) (step S68). The ideal decomposition unit 29 inputs s(x,y) and e(x,y) to the decryption unit 23.

[0267] Next, the decoding unit derives r(x,y) by calculating the above-mentioned equation (74) together with s(x,y), e(x,y), and m(x,y) (step S69).

[0268] If the polynomial cannot be restored in each of the above steps, the decryption unit 23 notifies the plaintext output unit 28 of the decryption error, and the plaintext output unit 28 outputs the decryption error and an empty decryption result. If m(x,y), s(x,y), e(x,y), and r(x,y) can all be restored, the decryption unit 23 extracts the divided plaintext from the coefficients of the decrypted plaintext polynomial and restores the plaintext M from the divided plaintext. The plaintext output unit 28 outputs the restored plaintext M (step S70).

[0269] For variations on the order of the approximate GCD in the approximate GCD calculation, see the following part of Algorithm 1 (Figure 1): for D=degs(t) to degs(t) + n do By determining an appropriate natural number m, for D=degs(t) ― m to degs(t) + n do That's all we need to do.

[0270] Regarding variations regarding variables, in the encryption algorithm, decryption algorithm, and key generation algorithm of the above-mentioned embodiment, the variables are changed from x, y to x1, . . . , x n For the polynomial X,s, we change these variables x1, ,x n This can be achieved by making at least two of the above equations symmetric.

[0271] Regarding the key generating device 40, the private key is (u x1 (t)···,u xn In the decryption device 20, in the process of substituting the private key u into the ciphertext, the ciphertext c(x1, . . . , x n ) can be trivially constructed by substituting only the symmetrical variables into the inverted polynomial.

[0272] For example, in the encryption device 10 of this variation, the public key acquisition unit 2 p On the univariate polynomial ring F p A symmetric indeterminate equation X(x1,...,x) of n variables that has coefficients of elements of [t] of a certain degree or less and is symmetric with respect to at least two variables. n ) as a public key. The plaintext embedding unit 3 embeds the plaintext M into a one-variable polynomial ring F p The n-variable plaintext polynomial m(x1, ,x n ) into the coefficients of the polynomial ring F p n-variable polynomial r(x1, ,x n ) and generate a univariate polynomial ring F p A symmetric polynomial s(x1, ,x n ) and generate a univariate polynomial ring F p The noise polynomial e(x1, ,x n ) is randomly generated. Then, the encryption unit 5 generates an n-variable plaintext polynomial m(x1, ,x n ), the n-variable polynomial r(x1, ,x n ) and a symmetric polynomial s(x1, ,x n ) and the noise polynomial e(x1, ,x n ) and the n-variable symmetric indeterminate equation X(x1, ,x n) performs an operation including at least one of addition, subtraction, and multiplication to generate a ciphertext c(x1, ···, x n ).

[0273] For example, in the decoder 20 of this variation, the key acquisition unit 22 has elements of a one-variable polynomial ring F p over a finite field F p [t] with degrees less than or equal to a certain degree as coefficients, and for at least two variables x i and x j (1 ≤ i < j ≤ n), it is a symmetric expression. The key acquisition unit 22 obtains one or more zeros u of the n-variable symmetric indeterminate equation X(x1, ···, x i , ···, x j , ···, x n ) as the secret key. The zero substitution unit 24 substitutes the zero u into the ciphertext c(x1, ···, x n ) to generate a one-variable polynomial h1(t), and substitutes the zero u into the ciphertext c(x1, ···, x i , ···, x j ​​​​​​​​​​​​​​​​​​​​​​​​​​​p A symmetric indeterminate equation X(x1,...,x) of n variables that has coefficients of elements of [t] of a certain degree or less and is symmetric with respect to at least two variables. n ) as a public key, and solve the n-variable symmetric indeterminate equation X(x1, ,x n ), the prime number p, the degree d, the variables x1,...,x n The total degree D x , and degree d x The polynomial generation unit 43 generates a one-variable polynomial ring F p [t] contains n polynomials u of degree d x1 (t),···,u xn (t) and solve the n-variable symmetric indeterminate equation X(x1, ,x n ) coefficients other than the constant term d X The polynomial τ of the following order ij (t)(0≦i≦j≦D X ,τ ji (t)=τ ij The indeterminate equation generator 45 generates n polynomials u x1 (t),···,u xn (t) and the polynomial τ ij (t)(0≦i≦j≦D X ,τ ji (t)=τ ij (t)) and the n-variable symmetric indeterminate equation X(x1, ,x n ) and calculate the temporary constant term of the polynomial u xi (t)u xj Based on the quotient and remainder of the division by (t), we solve the n-variable symmetric indeterminate equation X(x1, ,x n ) is generated. The key output unit 47 generates n polynomials u x1 (t),···,u xn (t) is output as a private key, and the n-variable symmetric indeterminate equation X(x1, ,x n ) as the public key.

[0275] Coefficient m of the plaintext polynomial ijRegarding variations in which the degree of (t) is changed for each term, the above embodiment is modified as follows: First, in encryption, when the encryption unit 5 generates the plaintext polynomial m(x, y), the system parameters p, D m ,d m The encryption unit 5 of this variation inputs p, d m,Dm ,d m,Dm―1 ,···,d m,1 ,d m,0 Here, d m,ν represents the order of the ν-th coefficient of m(x,y).

[0276] In decoding, the approximate GCD, i.e., s(u x (t),u y (t)), the decoding unit 23 calculates h1(t) mod s(u x (t),u y (t)) to m(u x (t),u y (t)) and calculate m(u x (t),u y (t)) is the zero point u and the system parameters d, d m,Dm ,d m,Dm―1 ,···,d m,1 ,d m,0 together with m(x, y) to the plaintext polynomial restoration unit 27. The plaintext polynomial restoration unit 27 inputs the restored m(x, y) to the decryption unit 23. If m(x, y) cannot be restored, the plaintext polynomial restoration unit 27 inputs an error to the decryption unit 23.

[0277] This concludes the description of the specific configurations of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of this embodiment.

[0278] [Safety Considerations] The following discusses the security of the public key cryptography configured in this embodiment. Note that with regard to a key recovery attack to recover a private key from a public key, this is a problem of solving an indeterminate equation for which no general solution algorithm exists, so only a brute force attack will be considered.

[0279] [Coefficient comparison attack] A coefficient comparison attack is an attack method in which the unknown parts of the plaintext polynomial, random polynomial, and noise polynomial in the ciphertext are calculated using variables, and the plaintext polynomial is derived along with other unknown parts by solving the simultaneous equations that arise when the coefficients are compared with the actual ciphertext. In this method, the only known part is the following equation (79).

[0280]

number

[0281] The unknown part is given by the following equation (80).

[0282]

number

[0283] By using these to create a ciphertext based on the above formula (41), the following formula (81) is obtained.

[0284]

number

[0285] The coefficients are compared between the above formula (81) and the actual ciphertext expressed by the following formula (82). Here, μ ijk ,c ijk is known.

[0286]

number

[0287] For simplicity, let us consider the public key X and its corresponding F p We will consider the polynomial c (= se + Xr + m) on [t] as given under the following conditions. An attack that analyzes only one of c1 and c2 in this way is called a one-sided attack. For simplicity, we will proceed with the discussion using the following equation (83).

[0288]

number

[0289] Then, m, r, s, and e are multiplied by the following equation (84), and s ijk ,e ijk ,r ijk ,m ijk is F p In addition, X and c are multiplied by the following equation (85), and τ ijk ,c ijk is F p is a constant whose value is

[0290]

number

[0291]

number

[0292] where x 2 , xy, y 2 , x, y terms and constant terms, the simultaneous equations of the following equation (86) can be derived.

[0293]

number

[0294] This simultaneous equation is a nonlinear indeterminate equation because it has 10 variables and 6 equations. Generally, the number of variables is #Δ Ds,ds +#Δ De,de +#Δ Dr,dr +#Δ Dm,dm and the number of expressions is #Δ Dx+Dr,dx+dr d X , d r As the equation grows larger, it is no longer an indeterminate equation, but becomes a problem of solving a nonlinear multivariate simultaneous equation, known as NP-hard.

[0295] [Linear algebra attack] A linear algebra attack is an attack method that linearizes the nonlinear part of a coefficient comparison attack, thereby changing what would normally be a system of nonlinear simultaneous equations into a system of linear simultaneous equations. This makes it possible to dramatically reduce the computational effort of the attack. Linearizing the nonlinear part means treating the nonlinear part (i.e., the part that is a product) as a single polynomial and setting the unknown part. In this method, since the term in which the plaintext is embedded (plaintext term) is nonlinear, such as s(x,y)e(x,y), this part is collectively treated as a single polynomial SE(x,y), i.e., the ciphertext is treated as the following equation (87).

[0296]

number

[0297] Let SE, r, m be the unknown part, and apply this to c(x, y) using the parameters shown in the above equation (83) to obtain the following equation (88), and let the known parts X and c be the following equations (89), respectively. Using the same considerations as in the coefficient comparison attack, the following simultaneous equations (90) can be derived.

[0298]

number

[0299]

number

[0300]

number

[0301] This simultaneous equation is a linear indeterminate equation because it has 10 variables and 6 equations. Generally, the number of variables is #Δ Dx+Dr,dx+dr +#Δ Dr,dr +#Δ Dm,dm and the number of expressions is #Δ Dx+Dr,dx+dr From this, #Δ Dr,dr +#ΔDm,dm In fact, we have a solution space of only r dimensions. ijk , m ijk to any F p Substituting the elements of , the corresponding SE ijk However, the correct SE is obtained as a result of decoding. ijk is one of them, and the only way to determine it is to verify that factoring the derived SE(x,y) gives s(x,y)e(x,y), which is currently only known to be a brute force attack on the solution space (other than a coefficient comparison attack). Therefore, if the solution space is large enough to avoid a brute force attack, this attack can be prevented.

[0302] [Brute force attack] The resistance to the various attacks explained above was basically evaluated by the amount of calculation required to solve simultaneous equations, but we will reconsider this from the perspective of brute force attacks. In a coefficient comparison attack, by brute force solving m(x,y), it is possible to obtain s(x,y) and e(x,y) by ideal decomposition using the same method as decryption. In this way, the number of times m(x,y) can be brute force solved is D m = 3 (because the characteristic p of the finite field is raised to the power of the number of variables) 10(dm+1) This also increases the computational cost exponentially. This is the same as with linear algebra attacks.

[0303] Also, in a key recovery attack, when solving a multivariate simultaneous equation, (u x (t),u y (t)), but this is only possible if you can find one of them (e.g., u x (t)) and try to find the corresponding y (t)) to X(u x (t), y) = 0. Taking these factors into consideration, u x It is necessary to consider the brute force of (t), and the number of brute force attempts is p d+1 and again it grows exponentially.

[0304] From the above considerations, it is clear that the amount of calculation increases exponentially in any of the existing attacks, and the encryption of this embodiment has sufficient security.

[0305] Finally, an example of the hardware configuration of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment will be described.

[0306] [Example of hardware configuration] FIG. 11 is a diagram showing an example of the hardware configuration of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 according to the embodiment.

[0307] The encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment include a control device 301, a main memory device 302, an auxiliary memory device 303, a display device 304, an input device 305, and a communication device 306. The control device 301, the main memory device 302, the auxiliary memory device 303, the display device 304, the input device 305, and the communication device 306 are connected via a bus 310.

[0308] The control device 301 executes a program read from the auxiliary storage device 303 to the main storage device 302. The main storage device 302 is memory such as a read-only memory (ROM) and a random access memory (RAM). The auxiliary storage device 303 is a hard disk drive (HDD), a solid state drive (SSD), a memory card, or the like.

[0309] The display device 304 displays display information. The display device 304 is, for example, a liquid crystal display. The input device 305 is an interface for operating the computer. The input device 305 is, for example, a keyboard or a mouse. If the computer is a smart device such as a smartphone or tablet terminal, the display device 304 and the input device 305 are, for example, a touch panel. The communication device 306 is an interface for communicating with other devices.

[0310] Programs that are executed by a computer are provided as computer program products, recorded in the form of installable or executable files on computer-readable storage media such as CD-ROMs, memory cards, CD-Rs, and DVDs (Digital Versatile Discs).

[0311] The program to be executed by the computer may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network, or the program to be executed by the computer may be provided via a network such as the Internet without being downloaded.

[0312] The program executed by the computer may be provided in advance in a ROM or the like.

[0313] The program executed by the computer has a modular configuration including functional blocks that can be realized by the program, among the functional configurations (functional blocks) of the encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 of the embodiment. As for each functional block, as actual hardware, the control device 301 reads the program from a storage medium and executes it, and the above functional block is loaded onto the main storage device 302. In other words, the above functional block is generated on the main storage device 302.

[0314] Note that some or all of the above-described functional blocks may be realized by hardware such as an integrated circuit (IC) instead of by software.

[0315] Furthermore, when each function is realized using a plurality of processors, each processor may realize one of the functions, or may realize two or more of the functions.

[0316] The encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 of the embodiment may be realized by any computer. For example, the encryption device 10 (the decryption devices 20, 20-2, and the key generation device 40) may be realized by a single computer. Also, for example, the encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 may be operated as a cloud system on a network.

[0317] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0318] 1. Plaintext Acquisition Unit 2 Public key acquisition section 3. Plaintext embedding part 4 Storage section 5 Encryption section 6 Polynomial generator 7 Random Value Generator 8 Polynomial operation section 9 Ciphertext output section 10 Encryption device 20 Decryption device 21 Ciphertext acquisition part 22 Key acquisition part 23 Decoding unit 24 Zero point substitution section 25 Approximate GCD calculation section 26 Memory section 27 Plaintext polynomial recovery unit 28 Plaintext output unit 29 Ideal decomposition part 40 Key generation device 41 System parameter acquisition unit 42 Control Unit 43 Polynomial generator 44 Random value generator 45 Indeterminate equation generator 46 Polynomial operation section 47 Key output unit 301 Control device 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input Device 306 Communication Equipment 310 Bus

Claims

1. finite field F ｐ The one-variable polynomial ring F on ｐ The coefficients of [t] are elements of a certain degree or less, and there are at least two variables x ｉ and x ｊ A symmetric indeterminate equation X(x) of n variables that is symmetric with respect to (1≦i<j≦n) １ , ..., x ｉ , ..., x ｊ , ..., x ｎ a key acquisition unit that acquires one or more zero points u of Ciphertext c(x １ , ..., x ｎ ) by substituting the zero point u into １ (t) and generate the ciphertext c(x １ , ..., x ｉ , ..., x ｊ , ..., x ｎ ) the variable x ｉ and the variable x ｊ The inverted ciphertext c(x １ , ..., x ｊ , ..., x ｉ , ..., x ｎ ) by substituting the zero point u into ２ a zero substitution unit that generates (t); The one-variable polynomial h ｋ By calculating the approximate GCD (Greatest Common Divisor) of (t) (k=1, 2), the n-variable plaintext polynomial m(x １ , ..., x ｎ an approximate GCD calculation unit for calculating a one-variable polynomial m(u) by substituting the zero point u into m(u); A plaintext polynomial m(x) is obtained by solving a simultaneous linear equation derived from the one-variable polynomial m(u) and the one or more zero points u. １ , ..., x ｎ ) a plaintext polynomial reconstruction unit; The plaintext polynomial m(x １ , ..., x ｎ a decryption unit for decrypting the plaintext M from the coefficients of A decoding device comprising:

2. The decoding device is a finite field F ｐ The one-variable polynomial ring F on ｐ The coefficients of [t] are elements of a certain degree or less, and there are at least two variables x ｉ and x ｊ A symmetric indeterminate equation X(x) of n variables that is symmetric with respect to (1≦i<j≦n) １ , ..., x ｉ , ..., x ｊ , ..., x ｎ ) as a private key; The decryption device decrypts the ciphertext c(x １ , ..., x ｎ ) by substituting the zero point u into １ (t) and generate the ciphertext c(x １ , ..., x ｉ , ..., x ｊ , ..., x ｎ ) the variable x ｉ and the variable x ｊ The inverted ciphertext c(x １ , ..., x ｊ , ..., x ｉ , ..., x ｎ ) by substituting the zero point u into ２ generating (t); The decoding device decodes the one-variable polynomial h ｋ By calculating the approximate GCD (Greatest Common Divisor) of (t) (k=1, 2), the n-variable plaintext polynomial m(x １ , ..., x ｎ ) to obtain a one-variable polynomial m(u) by substituting the zero point u; The decryption device solves simultaneous linear equations derived from the one-variable polynomial m(u) and the one or more zero points u to obtain a plaintext polynomial m(x １ , ..., x ｎ ) and The decoding device decrypts the plaintext polynomial m(x １ , ..., x ｎ ) the coefficients of the plaintext M; A decryption method including:

3. Computer, finite field F ｐ The one-variable polynomial ring F on ｐ The coefficients of [t] are elements of a certain degree or less, and there are at least two variables x ｉ and x ｊ A symmetric indeterminate equation X(x) of n variables that is symmetric with respect to (1≦i<j≦n) １ , ..., x ｉ , ..., x ｊ , ..., x ｎ a key acquisition unit that acquires one or more zero points u of Ciphertext c(x １ , ..., x ｎ ) by substituting the zero point u into １ (t) and generate the ciphertext c(x １ , ..., x ｉ , ..., x ｊ , ..., x ｎ ) the variable x ｉ and the variable x ｊ The inverted ciphertext c(x １ , ..., x ｊ , ..., x ｉ , ..., x ｎ ) by substituting the zero point u into ２ a zero substitution unit that generates (t); The one-variable polynomial h ｋ By calculating the approximate GCD (Greatest Common Divisor) of (t) (k=1, 2), the n-variable plaintext polynomial m(x １ , ..., x ｎ an approximate GCD calculation unit for calculating a one-variable polynomial m(u) by substituting the zero point u into m(u); A plaintext polynomial m(x) is obtained by solving a simultaneous linear equation derived from the one-variable polynomial m(u) and the one or more zero points u. １ , ..., x ｎ ) a plaintext polynomial reconstruction unit; The plaintext polynomial m(x １ , ..., x ｎ a decryption unit for decrypting the plaintext M from the coefficients of A decryption program to function as a

Images