Key generation device, key generation method, and key generation program

Abstract

To secure safety even if a quantum computer appears, and to shorten a key size and a cipher text size.SOLUTION: In an encryption device, a public key acquisition unit acquires, as a public key, an n-variable symmetric indeterminate equation X which has, as a coefficient, an element equal to or less than a predetermined degree of Fp [t] and determined depending on a total degree of each term, and is a symmetric equation with respect to at least two variables. The polynomial generation unit randomly generates a polynomial r of n variables having elements of a certain degree or less of Fp [t] as coefficients, randomly generates a symmetric polynomial s of n variables having elements of a certain degree or less of Fp [t] and determined depending on a total degree of each term as coefficients and being symmetric with respect to at least two variables, and randomly generates a noise polynomial e having elements of a certain degree or less of Fp [t] as coefficients. The encryption unit generates, for a plaintext polynomial m of n variables, a ciphertext c from a polynomial r of n variables, a symmetric polynomial s of n variables, a noise polynomial e, and a symmetric indeterminate equation X of n variables.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program. [Background technology]

[0002] In today's networked society, where people communicate through the exchange of large amounts of information, including e-mail, cryptography is widely used as a means of protecting the confidentiality and authenticity of information. However, even the currently widely used RSA encryption and elliptic curve cryptography are at risk of being decrypted when quantum computers become available. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-204466 [Patent Document 2] Japanese Patent Application Publication No. 2022-77754 [Non-patent literature]

[0004] [Non-Patent Document 1] Z.Gao, D.Panario,Degree Distribution of the Greatest Common Divisor of Polynomials over Fq,Random Structures and Algorithms,29(1),pp.26-37,(2006) Summary of the Invention [Problem to be solved by the invention]

[0005] The problem to be solved by the present invention is to provide an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program that can ensure security even when quantum computers emerge and can reduce the key size and ciphertext size. [Means for solving the problem]

[0006] The key generation device of the embodiment includes a system parameter acquisition unit, a polynomial generation unit, an indeterminate equation generation unit, and a key output unit. p On the univariate polynomial ring F p An n-variable indeterminate equation X(x1, ,x n ) as a public key, and the n-variable indeterminate equation X(x1, ,x n ), the prime number p, the degree d, the variables x1,...,x n The total degree D x , and the degree of the coefficient of the term of total degree ν, d x,ν The polynomial generator has n(d+1) randomly generated random numbers ranging from 0 to p-1 as coefficients, and generates the one-variable polynomial ring F p n polynomials u of degree d included in [t] x1 (t),···,u xn (t) and solve the n-variable indeterminate equation X(x1, ,x n ) the coefficients other than the constant term of the above d X,ν The polynomial τ of the following order ij (t)(i+j=ν≦D x The indeterminate equation generator generates the n polynomials u x1 (t),···,u xn (t) and the polynomial τ ij (t)(i+j=ν≦D X ) and the n-variable indeterminate equation X(x1, ,x n ) and calculate the temporary constant term of the polynomial u xi (t)u xjBased on the quotient and remainder obtained by dividing by (t), the n-variable indeterminate equation X(x1, , x n The key output unit generates the n polynomials u x1 (t),···,u xn (t) is output as the private key, and the n-variable indeterminate equation X(x1, ,x n ) is output as the public key. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 2 is a diagram illustrating an example of an approximate GCD algorithm according to the embodiment. [Figure 2] FIG. 10 is a diagram showing an example of an ideal decomposition algorithm according to the embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of the functional configuration of an encryption device according to the embodiment. [Figure 4] 1 is a flowchart illustrating an example of an encryption method according to an embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of the functional configuration of a decoding device according to an embodiment. [Figure 6] 10 is a flowchart illustrating an example of a decoding method according to an embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of the functional configuration of a key generating apparatus according to the embodiment. [Figure 8] 1 is a flowchart illustrating an example of a key generation method according to an embodiment. [Figure 9] FIG. 10 is a diagram showing an example of the functional configuration of a decoding device according to a modified example of the embodiment. [Figure 10] 10 is a flowchart showing an example of a decoding method according to a modified example of the embodiment. [Figure 11] 10 is a flowchart showing an example of an encryption method according to a modified example of the embodiment (when X(x, y) is not a symmetrical formula). [Figure 12] 10 is a flowchart showing an example of a decoding method according to a modified example of the embodiment (when X(x, y) is not a symmetrical expression). [Figure 13] 10 is a flowchart showing an example of a key generation method according to a modified example of the embodiment (when X(x, y) is not a symmetric formula). [Figure 14] FIG. 2 is a diagram illustrating an example of the hardware configuration of an encryption device, a decryption device, and a key generation device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0008] Hereinafter, embodiments of an encryption device, a decryption device, a key generation device, an encryption method, a decryption method, a key generation method, an encryption program, a decryption program, and a key generation program will be described in detail with reference to the accompanying drawings.

[0009] Cryptographic technologies can be broadly divided into symmetric key cryptography and public key cryptography. Symmetric key cryptography is an encryption method based on a data mixing algorithm, which allows for high-speed encryption / decryption, but only allows for secret and authenticated communication between two parties who share a common key in advance. Public key cryptography is an encryption method based on a mathematical algorithm, and while encryption / decryption is not as fast as symmetric key cryptography, it does not require prior key sharing. Public key cryptography is characterized by the fact that it achieves secret communication using a public key made public by the sender when communicating, and enables authenticated communication (to prevent spoofing) by applying a digital signature using the sender's private key.

[0010] For this reason, symmetric key cryptography is mainly used to encrypt information that must be decrypted in real time after reception, such as in pay digital broadcasting, and the decryption key is distributed only to subscribers using a key distribution system called a conditional access system.On the other hand, online sites on the Internet need to encrypt customer information (credit card numbers, addresses, etc.) to protect it from eavesdropping, but since it is not always possible to distribute the encryption key in advance, public key cryptography is often used.

[0011] Representative public key cryptosystems include RSA cryptosystems and elliptic curve cryptosystems. The security of RSA cryptosystems is based on the difficulty of the prime factorization problem, and modular exponentiation operations are used for encryption operations. The security of elliptic curve cryptosystems is based on the difficulty of the discrete logarithm problem on an elliptic curve, and point operations on an elliptic curve are used for encryption operations. Although methods for cryptanalysis of specific keys (public keys) have been proposed for these public key cryptosystems, no general cryptanalysis methods are known, and therefore no serious security issues have been found to date, except for cryptanalysis using quantum computers, which will be discussed later.

[0012] Other public key cryptosystems include the knapsack cryptosystem, which bases its security on the difficulty of the knapsack problem (known as the NP problem), and the multivariate cryptosystem, which is constructed using field extension theory and bases its security on solving simultaneous equations. However, methods for breaking the knapsack cryptosystem are already known for almost all of its implementations.

[0013] While there are effective attacks against multivariate ciphers, there are also implementations that are ineffective against known cryptanalysis, so security is significantly compromised but not definitive. However, the key size required to avoid known cryptanalysis is large.

[0014] On the other hand, even the currently widely used RSA encryption and elliptic curve encryption are at risk of being broken if a quantum computer appears. A quantum computer is a computer that can perform massively parallel calculations (based on a different principle from current computers) by utilizing the physical phenomenon known as entanglement, which is known from quantum mechanics.

[0015] Until a few years ago, quantum computers were thought of as hypothetical computers whose operation had only been confirmed at the experimental level, but recently, quantum computers have been shown to have performance exceeding that of classical computers (quantum supremacy), and efforts to realize them are progressing rapidly. In 1994, Shor demonstrated that quantum computers can be used to construct algorithms that efficiently solve prime factorization and discrete logarithm problems. In other words, if quantum computers are realized, it will be possible to break RSA encryption, which is based on prime factorization, and elliptic curve cryptography, which is based on the discrete logarithm problem (on elliptic curves).

[0016] Under these circumstances, research into public key cryptography, which has the potential to remain secure even when quantum computers are realized, has become increasingly active in recent years. One public key cryptography that is currently feasible and is considered difficult to decipher even with a quantum computer is lattice cryptography. Lattice cryptography is a type of public key cryptography that bases its security on the problem of finding the point closest to the origin among all points other than the origin in a discrete n-dimensional vector space (linear space) called a lattice (shortest vector problem).

[0017] Although the shortest vector problem is an NP-hard problem, it is a linear problem, so small problems can be easily solved. Therefore, the number of dimensions required to achieve security increases, and the key sizes of public and private keys become larger, raising concerns about their applicability to low-end devices. Furthermore, public key cryptography requires larger circuitry and longer processing time than symmetric key cryptography, making it impossible to implement in low-power environments such as mobile devices, or even if it is implemented, it takes a long time to process. Therefore, there is a demand for public key cryptography that can be implemented in low-power environments.

[0018] Generally, public key cryptography is constructed by finding a computationally difficult problem (such as integer factorization or discrete logarithm), and then constructing it so that decrypting the ciphertext (without knowing the private key) is equivalent to solving that computationally difficult problem. However, even if a computationally difficult problem is identified, it does not necessarily mean that it is easy to construct a public key cryptography system that bases its security on that problem. This is because if security is based on a problem that is too difficult to compute, the problem of generating a key will also be difficult, making it impossible to construct. On the other hand, if the problem is made easy enough that key generation is possible, decryption will also be easy.

[0019] Therefore, constructing a public key cryptosystem requires creativity to find a computationally difficult problem and to redesign it so that it is easy enough to generate a key, but not so easy that it can be decrypted (without knowing the generated private key). Because of the difficulty in constructing this part, only a handful of public key cryptosystems have been proposed to date. In this context, a public key cryptosystem using algebraic surfaces has been proposed (Patent Document 1), which may not be able to be decrypted efficiently even with calculations using a quantum computer and is expected to be able to process at high speed even in a low-power environment.

[0020] The public key cryptography of Patent Document 1 uses two sections corresponding to an algebraic surface X(x,y,t) as a private key, and the algebraic surface X(x,y,t) as a public key, and includes a polynomial generation means and an encryption means. The polynomial generation means performs a process of embedding plaintext m into plaintext polynomial m(x,y,t) and a process of generating random polynomials h(x,y,t),s1(x,y,t),s2(x,y,t),r1(x,y,t),r2(x,y,t) of three variables x, y, and t. The encryption means generates two ciphertexts c1=E from the plaintext polynomial m(x,y,t) by performing an encryption process that includes at least one of addition, subtraction, and multiplication between each polynomial and the defining formula X(x,y,t). pk (m,s1,r1,h,X),c2=E pk (m, s2, r2, h, X) is generated. Although the public key cryptography of Patent Document 1 has nonlinearity in the ciphertext, it was decrypted because there were two ciphertexts and no noise term.

[0021] To reinforce this, Patent Document 2 proposes a method that adds noise polynomials e1 and e2. Although this method has nonlinearity due to the product of unknown parts m(x,y)s1(x,y) and m(x,y)s2(x,y) in the ciphertext, the computational difficulty of solving the problem varies depending on the characteristics of the indeterminate equation X(x,y), which serves as the public key. This method has the problem that the key size (public key size and private key size) and ciphertext size increase depending on the selection of X(x,y).

[0022] In the following embodiment, in view of the current situation, a public key cryptosystem is constructed that can ensure security even when quantum computers emerge, and can reduce the key size and ciphertext size by setting the public key to increase the computational difficulty of solving the indeterminate equation X(x, y) = 0.

[0023] [Algebraic explanation] First, we define the algebra used in this embodiment. First, let us denote the set of integers by Z, and let us denote the coset of integer Z at natural number p by Z. p It is written as Z. p is a coset, so usually, Z p ={[0],[1],...,[p-1]} Here, Z p Since each element of satisfies the following properties, addition, subtraction, and multiplication are defined. [a]+[b]=[a+b] [a]-[b]=[ab] [a]·[b]=[a·b] A set in which addition, subtraction, and multiplication can be defined, in which the associative law holds, and which contains the additive identity 0 and has an inverse element [-x] ([x]+[-x]=[0]) that is 0 when added to any element x other than 0, is called a ring. Furthermore, a ring in which the commutative law holds ([a]+[b]=[b]+[a], [a]·[b]=[b]·[a]) is called a commutative ring, and when it also has the multiplicative identity element [1], it is called a commutative ring with an identity element.

[0024] Regarding division, it can only be defined for [b] where there exists an element [x] that satisfies [b]·[x]=[x]·[b]=[1]. When such an element [x] exists, [x] is called the inverse of [b], and -1 ]. That is, for [b] where an inverse exists, the division [a] / [b] is [b]·[b -1 ]=[1] The inverse element [b -1 ] multiplied by [a] ([a]·[b -1 ])

[0025] Z p element [b] to the inverse element [b -1 ] exists if and only if GCD(b,p)=1. That is, Z p An element b of is inverse element [b -1 For example, when p=5, b=3 has the same meaning as [3 -1 ]=[2]. However, if p=6, then GCD(3,6)=3, which means they are not mutually prime and there is no inverse, so division cannot be performed.

[0026] Now, [0] represents the set that leaves a remainder of 0 when divided by p. If we write it explicitly, [0]={···,-2p,-p,0,p,2p,···} It means Z p When defining the operation on Z, since the answer will be the same regardless of which element of the set [0] is used for the calculation, for simplicity, we will use one element (representative) included in the set [0] as a representative. This representative can be any element included in this set (due to its nature), but in this embodiment, for simplicity, we will use 0 as a representative. Similarly, we will represent [1] with the smallest positive integer such as 1 and [2] with the smallest positive integer such as 2, and use Z p Let be represented by {0, 1, , p-1}.

[0027] Here, if p is a prime number, all representatives other than 0 are relatively prime to p, and division can be defined. That is, if p is a prime number, then Zp In this way, addition, subtraction, multiplication and division can be defined. A set that is a commutative ring and has an inverse with respect to multiplication except for 0 is called a field. In particular, when p is a prime number, Z p A field consisting of a finite number of elements is called a finite field. The number of elements in a finite field is either a prime number or a power of a prime number, and the former is called a prime field. That is, Z mentioned here p is a prime field. To clarify that it is a finite field, we will use F p It is written as follows.

[0028] Next, we present the notation and definitions related to polynomials. p Let F be a set of univariate polynomials with coefficients. p It is written as [t]. p Although [t] can be added, subtracted, and multiplied, division of polynomials is not possible because there is no inverse except for polynomials consisting only of constant terms.

[0029] [Multivariate polynomial notation] Next, we define some terms and notations related to bivariate polynomials. First, we define the univariate polynomial ring F p The two-variable polynomial on [t] is written as the following equation (1).

[0030]

number

[0031] where τ i,j (t) is a univariate polynomial ring F p It is an element of [t]. The set Γ ξ is the set of pairs of exponents (i(x-index), j(y-index)) of non-zero monomials contained in the polynomial ξ(x,y), and is called the term set of the two-variable polynomial ξ(x,y).

[0032] For example, the term set of the polynomial on Z7 in the following formula (2) is the following formula (3).

[0033]

number

[0034]

number

[0035] where Γ ξ The number of elements of is equal to the number of monomials in the bivariate polynomial ξ(x,y). In the following, when it is clear that it is a bivariate polynomial, ξ(x,y) may be written simply as ξ.

[0036] In the embodiment, for simplicity, the term set of a two-variable polynomial of degree D is defined as its maximum term set, and Γ D That is, when D=2, the following formula (4) is obtained, and when D=3, the following formula (5) is obtained.

[0037]

number

[0038]

number

[0039] This Γ3 is the term set Γ of the above formula (3). ξ as a subset.

[0040] term set Γ D Given this term set Γ D A univariate polynomial ring F with p A set of two-variable polynomials on [t] is defined by the following equation (6).

[0041]

number

[0042] where a i,j (t) is F p It is an element on [t]. Note that the left side of the above formula (6) can be simply expressed as F ΓD Also, the coefficient a i,jWhen the degree of (t) is limited to d or less, it is expressed by the following formula (7), and similarly, simply F ΓD,d It is sometimes written as follows.

[0043]

number

[0044] Univariate polynomial ring F p The two-variable polynomial on [t] is converted into a three-variable polynomial and expressed as the following equation (8).

[0045]

number

[0046] where μ i,j,k is a finite field F p It is an element of the set Δ ξ is the set of indices (i (x-index), j (y-index), k (t-index)) of non-zero monomials contained in the polynomial ξ(x,y,t), and is called the term set of the three-variable polynomial ξ(x,y,t).

[0047] For example, the term set of polynomial (9) on F7 is the following formula (10).

[0048]

number

[0049]

number

[0050] Here, Δ ξ The number of elements of is equal to the number of monomials in the three-variable polynomial ξ(x,y,t). In the following, when it is clear that it is a three-variable polynomial, ξ(x,y,t) may be written simply as ξ.

[0051] The notation of the maximum term set follows the notation for two-variable polynomials, and the degree D of the three-variable polynomial with respect to x and y isi,j Let Δ be the maximal set of terms whose degree of (t) is limited to d or less. D,d It will be written as follows.

[0052] For example, when D=2 and d=1, the following equation (11) is obtained.

[0053]

number

[0054] [Solutions and Zeros] Univariate polynomial ring F p A univariate polynomial ring F satisfying the equation X(x,y)=0 on [t] p [t] the pair of elements (u x (t),u y (t)) is called a solution to the equation X(x,y) = 0. Also, when X(x,y) is viewed as a polynomial, the solutions to the equation X(x,y) = 0 are called zeros of X(x,y).

[0055] [Approximate GCD calculation for univariate polynomials] Univariate polynomial ring F p Suppose we are given polynomials in [t]: f1(t)=s(t)e1(t), f2(t)=s(t)e2(t).

[0056] In this case, if e'(t):=GCD(e1(t),e2(t)), the greatest common divisor (GCD) s(t)e'(t) of f1(t) and f2(t) can be found using the Euclidean algorithm. Here, we explain the calculation (approximate GCD calculation) to derive GCDs(t)e'(t) from the following equation (12), in which small-order noise a1(t) and a2(t) are added to f1(t) and f2(t), respectively.

[0057]

number

[0058] This operation plays an important role in the decryption of the encryption method shown in this embodiment. It is known that when the condition of the following formula (13) is satisfied in formula (12), GCDs(t)e’(t) can be obtained by Algorithm1 shown in FIG. 1.

[0059] [Number]

[0060] Since the algorithm shown in FIG. 1 uses the Euclidean algorithm, efficient processing is possible. In this embodiment, this s(t)e’(t) is called the approximate GCD (Approximate Greatest Common Divisor) of f1(t) and f2(t). Here, n is a system parameter and a natural number greater than or equal to degGCD(e1(t), e2(t)). If n < degGCD(e1(t), e2(t)), the approximate GCD calculation fails.

[0061] [Ideal Decomposition of Multivariable Polynomials] Define the factorization (ideal decomposition) problem using an ideal in the multivariable polynomial ring Fp[t][x,y], and show one solution algorithm. Ideal decomposition means finding h p [t][x,y] for two elements X and f (= Π j=1 n h j +X r ) when given. Here, r is also an element of F j [t][x,y], which is, so to speak, the factorization problem of the polynomial f in the quotient ring F p [t][x,y] / (X). p p

[0062] Let the finite set of the multivariable polynomial ring F p [t][x,y] be G = {g1, ···, g s}. At this time, for any polynomial f (∈ Fp[t][x,y]), the polynomial q i (h j(∈Fp[t][x,y]) exists such that the following equation (14) holds true for r=0 or for any i, and LM(r) is equal to LM(g i ) is known to be indivisible by

[0063]

number

[0064] Here, LM(g i ),LM(r) is a multivariate polynomial ring F p It means the monomial that is the first in the monomial order defined in [t]. For example, if the order is defined as x>y>t, the order of monomials is x, y, t, and in the case of monomials with the same variables, the one with the highest exponent comes first in this order. If the polynomial in equation (9) is r, the monomial order of r is t. 2 x 2 ,2tx 2 ,6x 2 ,4t 2 x,x,3ty 2 ,5y 2 ,4t 2 ,t,3, and LM(r)=t 2 x 2 This becomes:

[0065] Using a finite set G, transforming f as in the above formula (14) is called normalization of f by G, and r is called the normal form of G, and NF G (f). Also, if the set G is a set called a Groebner basis for a polynomial ideal J, the normal form of any element f included in the ideal J is 0. In other words, it is known that it can be written as the following formula (15).

[0066]

number

[0067] where q i is an element of Fp[t][x,y].

[0068] Now, it is known that when the resultant of f and X is calculated, it becomes the following equation (16).

[0069]

number

[0070] Here, Res x (f,X) is a resultant for the variable x. Similarly, the resultant for the variable y can be calculated using the following formula (17).

[0071]

number

[0072] Here, the ideal J is expressed by the following formula (18).

[0073]

number

[0074] J is (h j ,X) and h j ∈J, we calculate the Groebner basis G of the ideal J, and under G, h j Calculating the normal form of is 0. Now, for simplicity, h j is simply written as h, and h is expressed by the following equation (19).

[0075]

number

[0076] where μ ijk is F p is a variable whose value is h. Calculating the normal form of h in G results in the following formula (20).

[0077]

number

[0078] x on both sides of this i y j t k By comparing the coefficients of the equations, we derive a system of linear equations and solve it to find μ ijk h can be recovered by obtaining

[0079] On the other hand, in reality, Res x (h i ,X),Res y (h i ,X) are Res x (f,X), Res y Factors of (f,X), and if they are not the correct combination, h i Taking these points into consideration, we can see that ideal decomposition can be realized by Algorithm 2 shown in Figure 2.

[0080] [Indeterminate equations and their solutions] Univariate polynomial ring F p A univariate polynomial ring F satisfying the equation X(x,y)=0 on [t] p [t] the pair of elements (u x (t),u y (t)) is called a solution to the equation X(x,y) = 0. Also, when X(x,y) is viewed as a polynomial, the solutions to the equation X(x,y) = 0 are called zeros of X(x,y).

[0081] An indeterminate equation can be defined as an equation in which the number of variables is greater than the number of expressions (contained in the equation). Indeterminate equations have few constraints, but a large degree of freedom in their solutions, so if they have solutions, they often have multiple (sometimes infinite) solutions (this is what "indeterminate" means). In fact, there are an infinite number of real (or complex) solutions to indeterminate equations with integer coefficients, and it is easy to find some of them as approximate solutions. On the other hand, such methods are usually not applicable to equations that have solutions in a discrete set, such as integer solutions to indeterminate equations with integer coefficients. Therefore, some kind of theoretical narrowing down is necessary, but even if such narrowing down is performed, it is known that it is generally impossible to determine the existence or non-existence of a solution using a finite number of methods (an unsolvable problem).

[0082] The indeterminate equation cryptography proposed in the embodiment is based on a one-variable polynomial ring F p [t] The basis of security is the problem of finding a one-variable polynomial solution to the indeterminate equation X(x,y)=0 defined above, which is defined as follows:

[0083] Definition 1 (univariate polynomial ring F p (Problem of solving an indeterminate equation on [t]) One-variable polynomial ring F p [t] Given the above defined indeterminate equation X(x,y)=0, F p [t] the solution (u x (t),u y (t)) can be solved by a univariate polynomial ring F p Problems solving indeterminate equations on [t], or finite fields F p This is called the problem of finding sections on the algebraic surface X(x,y) defined above.

[0084] This problem has also been shown to be unsolvable. On the other hand, when used for cryptography, the univariate polynomial u x (t),u y (t) is limited to the case where the degree of u x (t),u y A simultaneous equation can be set up with the coefficients of (t) as variables. That is, the given indeterminate equation X(x, y) is expressed as the following equation (21):

[0085]

number

[0086] Section (u x (t),u y The degree of each element of (t),t) is degu x (t)=degu y (t)=d Assuming the above, we set the following equations (22) and (23):

[0087]

number

number

[0088] By substituting this into X(x, y, t) = 0, we obtain the following relational expression (24).

[0089]

number

[0090] Here, the coefficients of each term in the indeterminate equation X(x,y) have the same degree, and this is called d X In equation (24), t is an indeterminate element, so by comparing the coefficients on both sides, we obtain the simultaneous equations in equation (25) below.

[0091]

number

[0092] If X(x, y) is a nonlinear polynomial, then the simultaneous equations (25) will also be nonlinear, and their degree will match the total degree of x and y in X(x, y). In this embodiment, in order to specifically consider the problems of computational difficulty and safety analysis, the total degree of X(x, y) is assumed to be 2. Therefore, the problem of solving an indeterminate equation becomes a problem of solving a quadratic multivariable simultaneous equation (MQ problem).

[0093] The MQ problem is a computationally intractable problem that forms the basis of the security of multivariate polynomial cryptography, and is generally an NP problem. The most efficient solution known to date is a method that uses Groebner basis calculations, and it is known that the worst-case computational complexity of Groebner basis calculations grows doubly exponentially. However, the average computational complexity is unknown, and computational complexity analyses based on computer experiments have been widely conducted. The following two findings have been obtained from these computational complexity analyses. 1. The calculation becomes difficult when the difference between the number of expressions and the number of variables is small. 2. It becomes difficult to calculate when each equation contains many terms.

[0094] Regarding the first point, in this problem, the number of variables is 2(d+1) and the number of equations is 2d+d. X +1, so d X If ≧2, the number of equations is greater, and the difference between the number of equations and the number of variables is d X -1. Here, d X By setting d to a fixed value (2 or more) that does not depend on other parameters, the computational difficulty of the problem becomes stable, and X The smaller the value, the greater the computational difficulty.

[0095] Regarding the second point, since the number of variables is 2(d+1), the number of terms that can appear in the equation is quadratic, 2(d+1) H2= 2d+3 C2=(2d+3)(2d+2) / 2 The first-order term is 2(d+1), and the zeroth-order term (constant term) is 1. In this problem, due to its structure, these terms are not included in all equations. On the other hand, it is possible to include more terms in each equation, and in order to do so, the order of the coefficients d X However, d X If is made larger than necessary, the number of equations will also increase, and as a result, the difference between the number of equations and the number of variables will increase, and from the first point of view, the calculation will no longer be difficult.

[0096] Therefore, in order to increase the number of terms while keeping the number of equations constant, we add (x,y)=(u x (t),u y Consider the following equation (26) into which (t)) is substituted.

[0097]

number

[0098] This u x (t),u yBy substituting the variables defined in the above equations (22) and (23) for (t), and comparing the coefficients on both sides, the above equation (25) is obtained. Here, degτ i,j If (t)(0≦i,j≦2) is constant regardless of i and j, the number of equations is determined by the second-order term, 2d+degτ i,j (t)(i+j=2).

[0099] On the other hand, the second-order term in the above equation (25) is the second-order term τ 2,0 (t)u x (t) 2 ,τ 1,1 (t)u x (t)u y (t),τ 0,2 (t)u y (t) 2 The first-order term is the first-order term τ in the above equation (26). 1,0 (t)u x (t),_τ 0,1 (t)u y (t), and the zeroth-order term is the zeroth-order term _τ in the above equation (26). 0,0 (t) only. Therefore, to increase the number of terms without increasing the number of equations, the coefficients of the non-quadratic terms, _τ i,j One method is to increase the degree of (t)(i+j=0,1). On the other hand, in order to avoid increasing the number of equations even when increasing the degree, the maximum d+degτ in the first-order term is 2,0 (t), the zeroth-order term is up to 2d+degτ 2,0 It needs to be (t).

[0100] Therefore, we focus on the total degree of the terms included in the polynomial X(x,y) (total degree for x,y), and define the degree of the coefficient of the term with total degree ν as d X,ν If we define it as: d X,2 = constant, d X,1 =d+d X,2 ,d X,0 =2d+d X,2 It turns out that this is a good idea.

[0101] Here, we have discussed a configuration that satisfies both of the two requirements derived from knowledge of the computational difficulty of the MQ problem, but these two properties can sometimes be contradictory. That is, when the number of expressions and the number of variables are brought closer together, the constraints on variables by the expressions are reduced, making it easier for multiple solutions to be generated, which in turn makes the Gröbner basis more complex and increases the amount of Gröbner basis calculations. However, if the number of terms included in the expressions is further increased, the constraints on variables increase, reducing the number of solutions and simplifying the Gröbner basis, resulting in a reduction in the amount of Gröbner basis calculations. Furthermore, since the maximum computational cost of the Gröbner basis varies depending on the size of the finite field, it is determined by focusing on the total degree of the terms included in the polynomial X(x,y) (total degree with respect to x and y) while taking other parameters into consideration. It is important to do so.

[0102] An example of the indeterminate equation cryptography of this embodiment is shown below. In addition, to facilitate understanding of the algorithm shown below, small numerical examples are provided, but it should be noted that the security of the cryptography cannot be guaranteed with these numerical examples. In addition, in this embodiment, the indeterminate equation X(x,y) and the random polynomial s(x,y), which are the public key, are assumed to be symmetric with respect to x and y. However, the present embodiment can be applied even when the equations are not symmetric, as will be shown later in the "Variation in which the indeterminate equation X(x,y) is not assumed to be symmetric."

[0103] [Parameters] The symbols and parameters used in the method of this embodiment will be described below. p For a two-variable polynomial ξ(x,y) on [t], we define the following notation: D ξ : The total degree of ξ(x,y) with respect to x and y d ξ,ν : Degree of the coefficient polynomial of the νth degree term of ξ(x,y) (total degree as a polynomial of x,y)

[0104] In the method of this embodiment, five F p A two-variable polynomial on [t] is used.

[0105]

number

[0106] In this, X(x,y) is (u x (t),u y (t)) as a zero point, and the zero point is degu x (t)=degu y (t) is satisfied, and this degree is written as d. The encryption parameters of this embodiment are p, d, and D ξ and d ξ,ν (ξ=X,m,s,e,r,ν=0,···,D ξ ) where d ξ,ν Let us explain this using an example. If the two-variable polynomial ξ(x, y) is expressed as the following equation (28), then D ξ = 2, and d ξ,2 =1,d ξ,1 =2,d ξ,0 =4.

[0107]

number

[0108] In addition, d ξ,ν When is constant regardless of the value of ν, that is, d ξ,0 =···=d ξ,Dξ When , d ξ,ν Simply d ξ In this embodiment, d ξ,ν This notation is used only when _ξ=X,s.

[0109] Hereinafter, for the purpose of decoding, the condition of the following equation (29) is assumed.

[0110]

number

[0111] In this embodiment, D m =3,D X =D s =2,D e =D r= 1, the condition of the above formula (29) becomes the following formula (30).

[0112]

number

[0113] [Key generation algorithm] In the key generation method of this embodiment, the above parameters p, d and d x,ν (ν=0,1,2) is input. Among these parameters, p, d and d x,2 is a parameter directly related to the security of the encryption, and is determined based on the amount of calculation required for the attack method described in the "Security Considerations" below. In the numerical example, p=7,d m = 1, and then, according to the determination method shown in [Parameter Determination Method] below, d = 3 (d m +1) = 6. Also, d x,ν (_ν=1,2) is set using the following equation (31).

[0114]

number

[0115] Therefore, in the numerical example, d x,1 =5,d x,0 =11.

[0116] 1. Generate a private key polynomial ring F p Two polynomials u of degree d in [t] x (t) and u y (t) is generated uniformly at random, and for example, a secret key (x, y)=(ux(t), uy(t)) of the following equation (32) is generated.

[0117]

number

[0118] 2. Public Key Coefficient Generation The degree d of the coefficients other than the constant term of the public key X(x,y) X,ν Polynomial τ i,j (t)(i+j=ν,ν=1,2) is generated uniformly randomly. Note that τ is set so that X(x,y) is symmetric. i,j (t)=τ j,i (t). Here, d x,2 =2,d x,1 = 5, it is generated as shown in the following formula (33).

[0119]

number

[0120] 3. Calculate the tentative constant for the public key The temporary constant term of the public key is calculated by the following formula (34).

[0121]

number

[0122] Specifically, in the above example, it is calculated using the following formula (35).

[0123]

number

[0124] Here, if X(x, y) is defined by the following equation (36), then (u x (t),u y (t)) is the solution to X(x,y)=0.

[0125]

number

[0126] On the other hand, the provisional constant term in the above equation (34) has the order 2d+d X,2 and d X,0 = 2d-1, the coefficients are adjusted as follows:

[0127] 4. Coefficient order adjustment The temporary constant term in the above equation (34) is u x (t)u y If the quotient divided by (t) is q(t), the following equation (37) also holds true (u x (t),u y (t)) is a solution.

[0128]

number

[0129] where degq(t)=d X,2 The constant term is given by the following equation (38).

[0130]

number

[0131] This coincides with the following equation (39), so the degree is 2d-1 or less.

[0132]

number

[0133] Therefore, this transformation also satisfies the requirement of the degree of each term. Therefore, by updating X(x,y) to the following equation (40), degτ 0,0 (t)=2d―1=d X,0 This can be converted into an indeterminate equation that meets the conditions of the public key.

[0134]

number

[0135] In this example, q(t) is expressed by the following equation (41), and τ 1,1 (t),τ 0,0 Since (t) is transformed as in the following equation (42), the public key X is updated to the following equation (43). The degree of the constant term is dX,0 =11.

[0136]

number

[0137]

number

[0138]

number

[0139] Here, the terms xy whose coefficients are changed are terms in which x and y are symmetric, and even if the degree of the coefficients is adjusted, X(x, y) remains a symmetric equation.

[0140] This algorithm calculates the parameters p, d, and d x,2 In addition, a polynomial X(x, y) that satisfies the condition of the following equation (44) can be generated uniformly and randomly.

[0141]

number

[0142] [Encryption algorithm] The encryption algorithm is as follows. In this embodiment, the plaintext M (message M) is expanded into a septenary form: (56632522322665105554)7 The plaintext M expanded into a septenary is embedded in the coefficients of a plaintext polynomial m(x, y) that satisfies the following equation (45).

[0143]

number

[0144] where D m =3,d mNote that =1, the plaintext M expanded into a septenary is embedded as in the following formula (46).

[0145]

number

[0146] This plaintext polynomial m(x,y) is encrypted as follows:

[0147] 1.Generate polynomial s(x,y) The degree d of the coefficients of the polynomial s(x,y) s,ν Polynomial s i,j (t)(i+j=ν,ν=0,1,2) are generated uniformly at random. Note that s(x,y) is symmetric. i,j (t)=s j,i (t), where d s,1 ,d s,0 is expressed as the following equation (47).

[0148]

number

[0149] Here, d s,2 =28,d s,1 =31,d s,0 = 37. In this example, s(x, y) is generated as in the following equation (48).

[0150]

number

[0151] 2. Generate the noise polynomial e(x,y) d e A first-order two-variable polynomial e(x,y) with coefficients up to d is generated. In this example, e = 14, and e(x, y) is generated as shown in the following equation (49).

[0152]

number

[0153] 3. Generate a random polynomial r(x,y) d r A bivariate random polynomial r(x,y) of degree 1 with coefficients up to d r = 40, and r(x, y) is generated as shown in the following equation (50).

[0154]

number

[0155] 4. Generate ciphertext c(x,y) The ciphertext is calculated by the following formula (51).

[0156]

number

[0157] In this example, c(x, y) is calculated as in the following equation (52).

[0158]

number

[0159] [Decryption algorithm] Minimum solution u:(x,y)=(u x (t),u y (t)) into the indeterminate equation X(x,y) x (t),u y Note that there is a relationship such that (t) = 0. The decoding algorithm is as follows:

[0160] 1. Substitute the solution u into the ciphertext c(x,y) and its inverse formula c(y,x) By substituting the solution u into c(x, y) and c(y, x), the following equation (53) is obtained.

[0161]

number

[0162] Note that s(x,y) = s(y,x), X(x,y) = X(y,x). In this example, c(u x (t),u y (t)) and c(u y (t),u x (t)) is calculated as shown in the following equation (54).

[0163]

number

[0164] 2.s(u x (t),u y (t)) is calculated by approximate GCD calculation. This is calculated by Algorithm 1 (FIG. 1) under the conditions of the above-mentioned formula (13). In this example, it is calculated as shown in the following formula (55).

[0165]

number

[0166] Here, the first two conditions of the above-mentioned equation (30) are necessary conditions for the above-mentioned equation (13) to be satisfied. The probability (decoding failure probability) that the condition of the above-mentioned equation (13) does not hold even when the condition of the above-mentioned equation (30) holds will be explained later in the section [Decoding Failure Probability].

[0167] 3.m(u x (t),u y Calculate (t) m(u x (t),u y (t)) is calculated using the following equation (56).

[0168]

number

[0169] In this example, m(u x (t),u y (t)) is calculated as shown in the following equation (57).

[0170]

number

[0171] 4. Calculating the plaintext polynomial m(x,y) The plaintext polynomial m(x,y) can be written as the following equation (58), so using the relationship in the following equation (59), m i,j,k By formulating and solving a linear equation with variables m(x,y), the plaintext polynomial m(x,y) can be obtained.

[0172]

number

[0173]

number

[0174] Here, the number of variables is 10(d m +1), and the number of equations is 3d+d m +1, when the number of expressions is greater than the number of variables, that is, d ≥ 3 (d m +1), a solution exists. This condition is the last condition of the above equation (30). In this example, the plaintext polynomial m(x, y) is given by the following equation (60), and it can be confirmed that the plaintext has been decrypted correctly.

[0175]

number

[0176] [Decoding failure probability] We evaluate the probability of decoding failure of this scheme. This scheme uses two polynomials c(ux (t),u y (t)) and c(u y (t),u x Even if (t)) satisfies the condition of the above-mentioned formula (30), there is a possibility that the decoding will fail because it does not satisfy the condition of the above-mentioned formula (13) for the approximate GCD calculation. To see this, if the condition of formula (30) is satisfied but the condition of formula (13) is not satisfied, then either condition (A) or (B) of the following formula (61) will be satisfied. Let us consider the possibility that these will hold.

[0177]

number

[0178] For simplicity, we use s(t):=s(u x (t),u y (t)),e'(t):=GCD(e(u x (t),u y (t)),e(u y (t),u x (t))),e(t):=e(u x (t),u y (t)),m(t):=m(u x (t),u y It is written as (t)).

[0179] Of these, condition (A) does not occur because the first condition of the condition of equation (30) leads to the following equation (62).

[0180]

number

[0181] Therefore, it is sufficient to consider the probability that condition (B) occurs, which requires that dege'(t) ≥ (d+d e) -3d-d m We can calculate the probability that an event occurs. Here, e(u x (t),u y (t)) and e(u y (t),u xAssuming that the distribution of the coefficients of (t) is uniform, this probability is p ―N (1-p ―1 ) Therefore, the decoding failure probability κ is evaluated by the following equation (63).

[0182]

number

[0183] Here, if a new parameter δ is defined by the following equation (64), the decoding failure probability κ can be written as the following equation (65), and it can be seen that the decoding failure probability decreases exponentially as the value of δ≦0 becomes smaller.

[0184]

number

[0185]

number

[0186] [Parameter determination method] First, we will explain how to determine the parameters shown in the above [Parameters]. The parameters that need to be determined when implementing and operating the encryption method of this embodiment are p, d, and D. ξ and d ξ,ν Here, ξ is a set of five polynomials, X, m, s, e, and r. To satisfy the conditions of the above equations (30) and (31), p, d, and D are set in the following order: ξ and d ξ,ν is determined.

[0187] 1.p,d m and d x,2 Decision p,d m and d x,2 is a parameter related to the security of the cryptography, and p and d m is determined based on an evaluation of the computational complexity of the attack method described in the Security Considerations section below.

[0188] 2.d Settings From the third condition of the above equation (30), d = 3(d m +1).

[0189] 3.d x Settings In this embodiment, d X From condition (31), x,1 =d―1,d x,0 =2d-1.

[0190] 4. Setting the parameter δ related to the decoding failure probability From the above equation (65), the parameter δ is given by the following equation (66).

[0191]

number

[0192] Here, the right-hand side represents the smallest integer equal to or greater than κ / |p|, and |p| represents the bit length of p.

[0193] 5.d e Settings d e is set as shown in the following equation (67) from the second condition of the above equation (30) and the definition of δ in the above equation (64).

[0194]

number

[0195] 6.d s Settings d s From the first condition of the above equation (30), d s,2 =2d e In addition, d s,1 =d s,2 +(d-1-d x,2 ),d s,0 =d s,1 It is set to +d.

[0196] 7.d r Settings d r is d r =d e +d s,2 -d X,2 By setting it in this way, the condition of the following formula (68) is satisfied, and resistance to linear algebra attacks, which will be described later in [Linear Algebra Attacks], is achieved.

[0197]

number

[0198] In this way, parameters that satisfy the above-mentioned equations (30), (31) and (68) can be generated.

[0199] [Safety assumptions] A security assumption that serves as the basis for the security of the method of this embodiment is defined. n,d is defined by the following equation (69).

[0200]

number

[0201] The polynomial ξ(x,y) is the set Δ n,d To have it as a base is Δ n,d The monomial x corresponding to each element (i,j,k) of i y j t k The set of polynomials is defined by the following equation (70).

[0202]

number

[0203] Also, Δ X ,Δ s is defined as the following equation (71).

[0204]

number

[0205] In this case, the set Δ X Consider a set of polynomials such as the following equation (72) based on .

[0206]

number

[0207] This is F p [t] Δ with zeros of degree d defined on X Here, the set of symmetric polynomials with the set Δ as the support is expressed by the following formula (73).

[0208]

number

[0209] The following calculation problem is defined for the set of the following equation (74) that satisfies the condition of equation (30).

[0210]

number

[0211] Definition 2 (Approximate Ideal Decomposition Problem) Let c be a sample from the polynomial set of the following equation (75).

number

[0212] Furthermore, we define the approximate ideal decomposition assumption as follows:

[0213] Definition 3 (Approximate Ideal Decomposition Assumption) The approximate ideal decomposition assumption means that for any polynomial-time algorithm A, the probability of the following equation (76) is negligible.

number

number

[0214] Theorem 1: Under the approximate ideal factorization assumption, the indeterminate equation encryption Σ=(Gen,Enc,Dec) is secure in the sense of OW-CPA. That is, if there is an adversary who can break the indeterminate equation encryption in polynomial time in the sense of OW-CPA, then there exists an algorithm A that solves the approximate ideal factorization problem in probabilistic polynomial time, and the following equation (78) holds.

number

[0215] Proof Let c(x,y) be any sample of the approximate ideal decomposition problem. Suppose there is an adversary who can break the indeterminate equation encryption Σ in polynomial time in the sense of OW-CPA. In this case, we can use this adversary to obtain the plaintext polynomial m(x,y) and calculate the following equation (79).

[0216]

number

[0217] Furthermore, these resultants are calculated as shown in the following equation (80).

[0218]

number

[0219] By using Algorithm 2 (ideal decomposition) in Figure 2, s(x, y) and e(x, y) can be calculated. In other words, this adversary can solve the approximate ideal decomposition problem, and the following equation (81) holds.

[0220]

number

[0221] Several variations (modifications) of this embodiment will be described below.

[0222] [Ciphertext variations] The ciphertext in this embodiment is defined by the above formula (51), but even if this is changed to the following formula (82), the encryption method and decryption method of this embodiment will also be valid and will also satisfy the security described in the "Security Considerations" below.

[0223]

number

[0224] [Variations on compression of public key X(x,y)] In the above-described embodiment, the coefficients of the indeterminate equation X(x, y), which is the public key, are chosen uniformly at random except for the constant term, and only some of the terms (the xy term in the above-described embodiment) are adjusted. While adjustment requires secret key information, the unadjusted terms remain random. Therefore, by disclosing the seed used for generation, it is possible to specify a specific pseudorandom number generation function, hash function, or the like, and generate the public key. Therefore, only the seed and the adjusted coefficients can be made public, thereby compressing the size of the public key. In this way, in the above-described embodiment, the actual coefficients of only the part of equation (83) below are made public, and the remaining terms are made public using the seed (usually a seed with the same bit length as the security parameter), thereby compressing the public key size. This variation allows for expanded use in low-end devices with small memory capacities.

[0225]

number

[0226] This variation makes it possible to expand its use to low-end devices with small memory capacities.

[0227] [Variations on the modulus of public key X(x,y)] In the above embodiment, the coefficients of the indeterminate equation X(x, y), which is the public key, are taken uniformly at random except for the constant term, and only some of the terms (the xy term in the above embodiment) are adjusted. Here, each coefficient is F p [t], and the coefficients are not necessarily non-zero. If there are non-zero coefficients, the coefficients of some terms in the ciphertext X(x,y)r(x,y) may always be zero. In this case, some information about the random polynomial that makes up the ciphertext may be leaked in a linear algebra attack or coefficient comparison attack (even if not all information is leaked), and from there some information in the plaintext may be leaked. Therefore, in this variation, the coefficient τ of each term in the public key X(x,y) ij We will explain how to make the coefficient of (t) non-zero.

[0228] To achieve this, first, the coefficient τ ij When selecting (t) uniformly at random, the range of values ​​that can be randomly selected is set to 1 to p. Furthermore, as for the coefficients to be adjusted, if some of the coefficients become zero as a result of the adjustment, the private key u x (t),u y It is possible to make it non-zero by recalculating (t) or by changing the seed used when selecting it uniformly at random and recalculating it.

[0229] [Variations regarding how to select a set of terms] In the above embodiment, for simplicity, the e(x,y) and r(x,y) term sets are limited to the maximum term sets (e.g., d e,ν ,d r,νis not defined). This is sufficient to effectively hide the plaintext using a polynomial with unknown coefficients, but it is not necessary because it requires that the terms s(x,y)e(x,y) and X(x,y)r(x,y) in the ciphertext c(x,y) have the same form. Therefore, the parameter D is used to specify the form of these expressions. ξ ,d ξ Change it to Δ ξ (where ξ is replaced by e and r). By setting it in this way, it can be realized with a smaller term set than the maximal term set, so the size of the public key and ciphertext can be reduced.

[0230] [Variation to embed plaintext information in s, r, and e] Although the decryption algorithm does not restore s, e, and r, it is possible to restore s, e, and r after determining the plaintext polynomial m. That is, once m(x, y) is determined, the above equation (79) can be calculated, and s(x, y) and e(x, y) can be restored by applying the ideal decomposition explained in the above [Ideal decomposition of multivariate polynomials] to the right-hand side of equation (79). r(x, y) can also be restored by calculating the following equation (84) from the restored s(x, y) and e(x, y).

[0231]

number

[0232] By doing this, plaintext information or parts of plaintext information can be embedded in s, e, and r. This not only increases the bit length that can be encrypted at one time, but also realizes an encryption method that is resistant to attacks that tamper with the ciphertext by adding information as an authenticator. When embedding plaintext, including embedding in a plaintext polynomial, it is also possible to determine the area to be embedded in advance. In this case, the integrity of the ciphertext can be maintained by embedding random values ​​or information that will not be affected even if decrypted in the parts that are not to be embedded. Furthermore, by not embedding plaintext in parts where information leakage may occur, it is possible to deal with situations in which some information may be leaked due to vulnerabilities in the implementation, such as side-channel attacks.

[0233] [Variations for changing the order of approximate GCD in approximate GCD calculations] In the approximate GCD calculation described in the above embodiment [Approximate GCD calculation for one-variable polynomial], it is necessary to specify the degree of s(u)e'(t) which is the approximate GCD. The degree is searched for from degs(u), which is the minimum value of the degree of s(u)e'(t). The degree degs(u)e'(t) of the approximate GCD which is the input for the approximate GCD calculation is often D s d+d s That's all, but D s d+d s There are also cases where it is smaller than

[0234] In this variation, D s d+d s In order to implement this variation, the approximate GCD calculation step in the decoding algorithm is s d+d s Then, if the plaintext cannot be recovered, gradually increase the degree D until it reaches D s d+d s By doing this, it becomes possible to decrypt ciphertexts that previously failed to be decrypted because the degree of the approximate GCD was less than degs(u).

[0235] [Variations regarding variables] In the above-described embodiment, F p Although we have dealt with two-variable polynomials on [t], even if this is a general n-variable polynomial, the encryption algorithm, decryption algorithm, and key generation algorithm will hold as in this embodiment. Even if the number of variables is more than three, the indeterminate equation X(x1, , x n ) is only one, it is still an indeterminate equation, and the problem of solving it is computationally difficult. On the contrary, as the number of variables increases, the problem often becomes more computationally difficult, and security is strengthened. Therefore, not only can the key size be reduced, but the size of the plaintext that can be embedded increases because there are more variables. On the other hand, the system parameter d s =n(d m +1). When there are three or more variables, this embodiment is valid as long as at least two of the variables are symmetric.

[0236] [The coefficient m of the plaintext polynomial ij Variations that change the degree of (t) for each term] In the above embodiment, the coefficient m of the plaintext polynomial ij (t) degree is uniformly d m In the process of restoring m(x,y), m(u x (t),u y (t)), a linear simultaneous equation is formulated and solved in step 4 of the decoding algorithm shown in the above [Decoding Algorithm]. In this case, in order to derive a unique solution, the number of equations must be equal to or greater than the number of variables. The number of equations is a one-variable polynomial m(u x (t),u y (t)).

[0237] On the other hand, the higher-order terms of m(x,y) are D m = 3 then x 3 ,x 2 y,xy 2 ,y 3Therefore, by lowering the degree of the coefficients of the high-order terms and increasing the degree of the coefficients of the low-order terms in m(x,y), the number of expressions can be increased while keeping the number of variables down. Also, by configuring in this way, D e This also has the advantage that the decoding condition of the above equation (30) can be relaxed compared to when it is determined uniformly.

[0238] [Variation of the indeterminate equation X(x,y) as a non-symmetric equation] In the above-described embodiment, the indeterminate equation X(x, y), which is the public key, is a symmetric equation. When the indeterminate equation X(x, y) is a symmetric equation, the ciphertext is a single polynomial, which is highly effective in reducing the ciphertext length. However, since the indeterminate equations that can be used as the public key are limited, there is a risk that the security of the cipher will be threatened by cryptanalysis. Therefore, a variation in which the above-described embodiment is applied to Patent Document 2, on which the above-described embodiment is based, is conceivable.

[0239] In Patent Document 2, there are two plaintext polynomials m(x,y), two random polynomials e(x,y), and two r(x,y), and a ciphertext (c1(x,y), c2(x,y)) consisting of the two polynomials is generated as shown in the following equation (85).

[0240]

number

[0241] Here, since there are two plaintext polynomials, the plaintext M is bit-split into two parts, as in M ​​= M1||M2, and these are embedded in m1(x,y) and m2(x,y), respectively. That is, in this variation, it is possible to encrypt plaintexts that are twice as long as in the above-mentioned embodiment. Furthermore, the method for generating each polynomial required for encryption is the same as in the above-mentioned embodiment, except that s(x,y) is not limited to a symmetric polynomial.

[0242] In addition, in the decryption, the above embodiment uses c(x, y) and c(y, x) with a secret key (u x (t),uy (t)) and c(u x (t),u y (t)), c(u y (t),u x (t))) and calculate the approximate GCD from these polynomials. x (t),u y (t)), c2(u x (t),u y (t)) and modify the polynomials to calculate the approximate GCD.

[0243] In addition, the recovery of the plaintext is also performed by calculating the approximate GCDs (u x (t),u y (t)), the following equation (86) is calculated, and m1(u x (t),u y (t)), m2(u x (t),u y (t)), m1(x,y) and m2(x,y) are restored using the same procedure as in the above embodiment.

[0244]

number

[0245] [Variations regarding the order of the coefficient of the public key X(x,y)] In the above embodiment, the degree of the coefficient of the indeterminate equation X(x, y), which is the public key, is d X,2 is a constant, d x,1 =d―1,d x,0 =2d―1 However, as shown in the above [Indeterminate equations and their solution problems], there is not just one way to choose these parameters, and they must be determined by the total degree ν of each term, taking into consideration their relationship with other parameters.

[0246] In addition, as shown in the above [Indeterminate equations and their solutions] d x,1 =d+d x,2 ,d x,0=2d+d x,2 This is another way to determine it, and if you do so, you can increase the number of terms in the simultaneous equations that appear in the process of solving an indeterminate equation, which can make the problem more difficult to calculate.

[0247] Also, if you do this, d s,ν too d s,1 =d s,2 +d,d s,0 =d s,1 +d By deciding that, d r =d e +d s,ν -d x,ν The value of is consistent for all ν = 0, 1, 2, and the condition of the above equation (68) is satisfied, so that the linear algebra attack can be avoided. s,2 =2d e is.

[0248] This concludes the explanation of the variations, but since these variations are all independent, some or all of the above-described variations can be used in combination.

[0249] [Specific configuration] Next, specific configurations and operation methods of the encryption device, decryption device, and key generation device in the public key cryptography of this embodiment will be described.

[0250] First, the configuration and processing flow of the encryption device of this embodiment will be described along the flowchart shown in FIG. 4 with reference to the overall configuration diagram shown in FIG.

[0251] The encryption device 10 of the embodiment includes a plaintext acquisition unit 1, a public key acquisition unit 2, a plaintext embedding unit 3, a storage unit 4, an encryption unit 5, a polynomial generation unit 6, a random value generation unit 7, a polynomial calculation unit 8, and a ciphertext output unit 9.

[0252] First, the plaintext acquisition unit 1 acquires plaintext M (step S1). The plaintext acquisition unit 1 acquires encryption target data acquired from, for example, another application or another device as plaintext M. The plaintext acquisition unit 1 inputs the plaintext M acquired in step S1 to the plaintext embedding unit 3.

[0253] Next, the public key acquisition unit 2 acquires the two-variable symmetric indeterminate equation X(x, y) as a public key (step S2). The public key acquisition unit 2 acquires the public key from another device, such as a key generation device described later. The public key acquisition unit 2 inputs the public key acquired in step S2 to the encryption unit 5.

[0254] Next, the plaintext embedding unit 3 reads the system parameters p,D from the storage unit 4. m and d m The encryption unit 5 obtains the system parameters p,D that match the public key obtained in step S2 from the storage unit 4. s ,D r ,D e ,d s,ν ,d r and d e is obtained (step S3).

[0255] Next, the plaintext embedding unit 3 embeds the plaintext M input from the plaintext acquisition unit 1 into a 10(d m In this embodiment, the plaintext polynomial is a cubic expression, so the plaintext embedding unit 3 embeds the plaintext M divided into each sub-block into F p The coefficients of the two-variable plaintext polynomial m(x, y) on [t] are embedded (step S4). Here, each coefficient m i,j The degree of (t) is d m and the coefficients of these polynomials are F p Therefore, the block size of the encryption method of this embodiment is 10(d m +1)|p|. When a plaintext larger than this is input, it is first divided into blocks of this size and then encrypted block by block. The plaintext embedding unit 3 inputs the plaintext polynomial m(x, y) generated in step S4 to the encryption unit 5.

[0256] Furthermore, the encryption unit 5 generates the symmetric polynomial s(x, y) of the following formula (87), by dividing each term x i y j Generate coefficients corresponding to the total degree i+j of

[0257]

number

[0258] Here, D s = 2, first, the order of the coefficient of the quadratic term of s(x,y) is d s,2 is input to the polynomial generation unit 6, and instructs the random value generation unit 7 to generate a random polynomial (step S5). s,2 +1 random values ​​from 0 to p-1 are generated, and the values ​​input from the random value generator 7 are embedded in the coefficients to generate the quadratic term x 2 Coefficient s of 2,0 (t). The polynomial generator 6 generates the generated coefficients s 2,0 (t) is input to the encryption unit 5. The encryption unit 5 receives x 2 and y 2 The coefficients of the terms are stored in the storage unit 4.

[0259] In addition, the encryption unit 5 uses the same means to obtain the coefficient s of the quadratic term xy. 11 Next, the encryption unit 5 generates the degree d of the coefficient of the linear term x (step S6). s,1 is input to the polynomial generator 6, and instructs the random value generator 7 to generate a random polynomial. s,1 +1 random values ​​from 0 to p-1 are generated, and the values ​​input from the random value generator 7 are embedded in the coefficients. The coefficient s of the linear term x is calculated. 1,0 (t). The polynomial generator 6 generates the generated coefficients s 1,0 (t) is input to the encryption unit 5. The encryption unit 5 stores it in the storage unit 4 as the coefficient of the x and y terms.

[0260] The encryption unit 5 uses the same means to encrypt the coefficient s of the zeroth-order term (constant term)0,0 Next, the encryption unit 5 generates the degree d of the coefficient of the constant term (step S7). s,0 is input to the polynomial generator 6, and instructs the random value generator 7 to generate a random polynomial. s,0 +1 random values ​​from 0 to p-1 are generated, and the values ​​input from the random value generator 7 are embedded in the coefficients. The coefficient s of the constant term x is calculated. 0,0 (t). The polynomial generator 6 generates the generated coefficients s 0,0 (t) is input to the encryption unit 5. The encryption unit 5 stores it in the storage unit 4 as a constant term.

[0261] From the above, the coefficient of the quadratic term, the coefficient of the linear term and the constant term (s i,j (t) (0≦i+j≦2)) is generated. i,j (t) (0≦i+j≦2) is input and an instruction is given to generate a two-variable symmetric polynomial s(x,y). The polynomial generation unit 6 calculates the following equation (88) and inputs the calculated two-variable symmetric polynomial s(x,y) to the encryption unit 5.

[0262]

number

[0263] Next, the encryption unit 5 continues to encrypt the system parameters p,D r ,d r is input to the polynomial generator 6, and the same method as for generating the random polynomial s(x,y) is used to generate a uniform d r D with the following polynomial coefficients r The next random polynomial r(x, y) is generated (step S8).

[0264] Next, the encryption unit 5 continues to encrypt the system parameters p,D e ,d e is input to the polynomial generator 6, and the same method as for generating the random polynomial s(x,y) is used to generate a uniform d e D with the following polynomial coefficients e The next random polynomial e(x, y) is generated (step S9).

[0265] Next, the encryption unit 5 calculates (generates) the ciphertext c(x, y) by having the polynomial calculation unit 8 calculate the polynomials s(x, y), r(x, y), e(x, y), the public key X(x, y), and the plaintext polynomial divisor m(x, y) according to the above-mentioned equation (51) each time (step S10). The encryption unit 5 inputs the ciphertext c(x, y) to the ciphertext output unit 9.

[0266] Finally, the ciphertext output unit 9 outputs the ciphertext c(x, y) (after transforming it into a predetermined format, if necessary) as the output of the encryption device 10 (step S11). The predetermined format is, for example, a binary data format determined as the input format of a downstream device to which the ciphertext is input.

[0267] Next, the configuration and processing flow of the decoding device of this embodiment will be described along the flowchart shown in FIG. 6 with reference to the overall configuration diagram shown in FIG.

[0268] The decryption device 20 of the embodiment includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero substitution unit 24, an approximate GCD calculation unit 25, a storage unit 26, a plaintext polynomial restoration unit 27, and a plaintext output unit .

[0269] First, the ciphertext acquisition unit 21 acquires the ciphertext c (step S21). The ciphertext acquisition unit 21 acquires the ciphertext c(x, y) from another device via a network, for example.

[0270] Next, the key acquisition unit 22 acquires the public key (X(x, y)) and the private key (zero point u:(u x (t),u y The key acquisition unit 22 acquires the public key (X(x, y)) from another device or the like via a network, for example, and acquires the private key (zero point u:(u x (t),u y (t)).

[0271] Next, the decryption unit 23 receives the ciphertext c from the ciphertext acquisition unit 21, and receives the public key (X(x, y)) and the private key (zero point u:(u x (t),u y Upon receiving (t), the decoding process begins.

[0272] The decryption unit 23 first inputs the ciphertext c(x, y) and the zero point u to the zero point substitution unit 24. The zero point substitution unit 24 substitutes the zero point u into c(x, y) and calculates h1(t) (step S23). The zero point substitution unit 24 inputs h1(t) to the decryption unit 23.

[0273] Next, the zero point substitution unit 24 substitutes the zero point u into c(y,x), which is the inverse of x and y in the ciphertext, and calculates h2(t) (step S24). The zero point substitution unit 24 inputs h2(t) to the decryption unit 23.

[0274] Next, the decoding unit 23 receives h from the zero point substitution unit 24. k (t)(k=1,2) is accepted, h k (t)(k=1,2) and s(u x (t),u y (t)) degree D s d+d s,2 and are input to the approximate GCD calculation unit 25. The approximate GCD calculation unit 25 calculates h k (t) (k=1,2) and calculate the approximate GCD of the derived s(u x (t),u y (t))e'(t) (where e'(t):=GCD(e(u x (t),u y (t)),e(u y (t),u x (t)))) is input to the decoding unit 23.

[0275] Next, the decoding unit 23 receives s(u x (t),u y (t))e'(t), h1(t), i.e., c(u x (t),u y (t)) to s(u x (t),u y(t)) to get the remainder m(u x (t),u y (t)) is calculated (step S26).

[0276] Next, the plaintext polynomial restoration unit 27 restores the plaintext polynomial m(u x (t),u y (t)), zero point u, and system parameter d m From this, the plaintext polynomial m(x, y) is restored by the method explained in the above [Decryption Algorithm] (step S27). If the plaintext polynomial m(x, y) cannot be restored, the plaintext polynomial restoration unit 27 transmits an error to the decryption unit 23 and ends the process.

[0277] If the plaintext polynomial m(x, y) is restored, the plaintext output unit 28 extracts the plaintext M from the coefficients of the plaintext polynomial m(x, y), outputs the extracted plaintext M (step S28), and ends the processing.

[0278] Next, the configuration and processing flow of the key generation device of this embodiment will be described along the flowchart shown in FIG. 8 with reference to the overall configuration diagram shown in FIG.

[0279] The key generation device 40 of the embodiment includes a system parameter acquisition unit 41, a control unit 42, a polynomial generation unit 43, a random value generation unit 44, an indeterminate equation generation unit 45, a polynomial operation unit 46, and a key output unit 47.

[0280] First, the system parameter acquisition unit 41 acquires the system parameters p, d, and D x ,d x,ν (Step S41) The system parameters p, d, and D are obtained. x ,d x,ν are obtained by, for example, accepting input from a user. Also, for example, the system parameters p, d, and D x ,d x,ν are the system parameters p, d, and D x ,d x,ν It is obtained by reading the setting data including the above.

[0281] The system parameter acquisition unit 41 inputs the system parameters to the control unit 42. The control unit 42 performs the following processing in cooperation with other processing units based on the system parameters input from the system parameter acquisition unit 41.

[0282] First, the control unit 42 inputs p and d, among the system parameters input from the system parameter acquisition unit 41, to the polynomial generation unit 43, and p Two polynomials u of degree d contained in [t] x (t),u y Next, the polynomial generation unit 43 instructs the random value generation unit 44 to generate 2(d+1) integers from 0 to p-1. The random value generation unit 44 generates 2(d+1) random numbers from 0 to p-1 using a pseudo-random number generator or the like, and inputs them to the polynomial generation unit 43. The polynomial generation unit 43 generates a polynomial u having the 2(d+1) random numbers input from the random value generation unit 44 as coefficients. x (t),u y (t) is generated (step S42), and the polynomial u x (t),u y (t) is input to the control unit 42.

[0283] The control unit 42 receives the polynomial u from the polynomial generation unit 43. x (t),u y (t) is kept (stored) as a private key.

[0284] Furthermore, the control unit 42 generates a public key (a symmetric indeterminate equation X(x, y) expressed by the following equation (89)).

[0285]

number

[0286] First, the control unit 42 generates coefficients other than the constant term of X(x, y) (steps S43 and S44). X = 2, the order of the coefficient of the quadratic term of X(x,y) is d x,2is input to the polynomial generation unit 43, and instructs the random value generation unit 44 to generate a random polynomial. x,2 +1 random values ​​from 0 to p-1 are generated, and the values ​​input from the random value generator 44 are embedded in the coefficients to generate the quadratic term x 2 The coefficient τ of 2,0 The polynomial generator 43 generates the generated coefficients τ 2,0 (t) is input to the control unit 42. The control unit 42 2,0 (t) to x 2 and retain it as a coefficient of y 2 The coefficient τ of the term 0,2 Also retained as (t).

[0287] In addition, the control unit 42 calculates the coefficient τ of the quadratic term xy by the same means. 1,1 Next, the control unit 42 generates the coefficient of the first-order term x, the degree d x,1 is input to the polynomial generation unit 43, and instructs the random value generation unit 44 to generate a random polynomial. x,1 +1 random values ​​from 0 to p-1 are generated, and the values ​​input from the random value generator 44 are embedded in the coefficients. The coefficient τ of the linear term x is calculated. 1,0 The polynomial generator 43 generates the generated coefficients τ 1,0 (t) is input to the control unit 42. The control unit 42 1,0 (t) is kept as the coefficient of x, and the coefficient τ of the y term 0,1 Also retained as (t).

[0288] The coefficient of the second-order term and the coefficient of the first-order term (τ i,j When the generation of (t)(0≦i+j≦_2) is completed, the control unit 42 sends the coefficient τ i,j (t) (0≦i+j≦_2) is input, and an instruction is given to generate a two-variable indeterminate equation X'(x,y) without a constant term. The indeterminate equation generation unit 45 performs calculations using the following equation (90) (step S45), and inputs the calculated X'(x,y) to the control unit 42. Here, the indeterminate equation generation unit 45 sends instructions to the polynomial operation unit 46 to execute each operation.

[0289]

number

[0290] Next, when the control unit 42 receives the input of X′(x, y) from the indeterminate equation generating unit 45, it generates the secret key (polynomial u x (t),u y (t)) is substituted into the variables x and y of X′(x, y), respectively, to calculate a temporary constant term by the following equation (91) (step S46).

[0291]

number

[0292] Next, the indeterminate equation generating unit 45 and the polynomial operating unit 46 perform processing to reduce the degree of the temporary constant term in the above equation (91), thereby generating the indeterminate equation X(x, y) (step S47).

[0293] This degree reduction process involves a temporary constant term and a secret key u x (t),u y (t) and the indeterminate equation with the same zero point is of degree d x,0 This is a process of converting it into another indeterminate equation with a constant term:

[0294] The basic principle is to use a secret key (zero point) to replace the constant term with an indeterminate equation of smaller degree that has the same zero point. The theoretical background is as described above, so only the procedure will be explained here.

[0295] For simplicity, in the following explanation, it is assumed that X(x, y) includes the term xy. First, the control unit 42 instructs the polynomial calculation unit 46 to calculate the following equation (92), and this value is τ 0,0 (t), and instructs the polynomial calculation unit 46 to calculate the following equation (93), thereby obtaining the polynomial q(t).

[0296]

number

[0297]

number

[0298] Here, q(t) is the temporary constant term in the above equation (91) x (t)u y The quotient when divided by (t) is d x,2 In addition, τ 0,0 The degree of (t) is d X,0 (=2d-1), which satisfies the condition of the above equation (31).

[0299] Finally, the control unit 42 outputs to the indeterminate equation generating unit 45 X(x,y)=X′(x,y)+q(t)xy+τ 0,0 The indeterminate equation generator 45 calculates (t) and sets the output as the indeterminate equation X(x, y) of the public key. The indeterminate equation generator 45 inputs the indeterminate equation X(x, y) thus generated to the controller 42.

[0300] The control unit 42 confirms that the above series of processes is completed, and then transfers the public key X(x, y) and private key u(x, y) generated in step S47. x (t),u y The key output unit 47 receives the public key (X(x, y) and the private key (u x (t),u y (t)) is output to the outside of the key generating device 40 (step S48).

[0301] In the example of the flowchart in FIG. 8, the zeroth-order term (constant term) of the indeterminate equation X(x, y) is not randomly generated, but the zeroth-order term of the indeterminate equation X(x, y) may be generated in the same manner as in the generation processes of the second-order and first-order terms (steps S42 and S43). Specifically, between steps S44 and S45, the zeroth-order term τ of the indeterminate equation X(x, y) may be generated. 0,0 (t) to d X,0 A step of randomly generating the following polynomial may be added.

[0302] [Specific configurations for the above variations] Next, specific configurations of the above-mentioned variations (modified examples) will be described.

[0303] The variations of the ciphertext can be realized by calculating the above equation (82) in the step of creating the ciphertext in the encryption unit 5 of the encryption device 10, and then by making obvious modifications in the decryption device 20 taking this into consideration.

[0304] Variations on public key compression can be achieved by adding a random number seed to the input to the random value generation unit 44 in the key generation device 40, or by adding the random number seed used for generation by the random value generation unit 44 to the output from the random value generation unit 44, and finally outputting the public key X(x, y) and the adjusted coefficients from the key output unit 47. When a public key is input, the encryption device 10 and the decryption device 20 can restore the original public key X(x, y) by using the random number seed to restore the unadjusted coefficients and adding the adjusted coefficients included in the public key. In this case, the decryption device 20 needs to be equipped with a polynomial generation unit similar to the polynomial generation unit 6 of the encryption device 10 and a random value generation unit having the same pseudo-random function as the random value generation unit 44 of the key generation device 40.

[0305] The variation regarding the public key coefficient is that the random value generation unit 44 in the key generation device 40 generates the coefficient τ of the public key X(x, y). ij When generating the coefficients of (t), the range of random numbers is set to 1 to p-1. The coefficient adjustment step (constant term τ 0,0 (t) to the zero point (u x (t),u y In the step of reducing by (t), the adjusted coefficient τ 1,1 (t),τ 0,0 If (t) contains non-zero coefficients, this is achieved by starting over from the part where coefficients other than the constant terms of the indeterminate equation X(x,y) are randomly generated.

[0306] The variations in the method of selecting the term set are as follows: ξ , d ξ (and d ξ,ν ) is the specified term set Δ ξ Change to Δ ξ This is achieved by generating public keys, random polynomials, and noise polynomials based on , where ξ is X, s, r, and e.

[0307] Regarding the variation of embedding plaintext information in s(x,y), r(x,y), and e(x,y), the encryption device 10 does not randomly generate s(x,y), r(x,y), and e(x,y), but embeds (part of) the plaintext in a manner similar to embedding plaintext in a polynomial.

[0308] The configuration and processing flow of the decoding device of this variation will be described with reference to the flowchart shown in FIG. 10 and the overall configuration diagram shown in FIG.

[0309] The decryption device 20-2 of this variation includes a ciphertext acquisition unit 21, a key acquisition unit 22, a decryption unit 23, a zero substitution unit 24, an approximate GCD calculation unit 25, a memory unit 26, a plaintext polynomial restoration unit 27, a plaintext output unit 28, and an ideal decomposition unit 29. That is, the decryption device 20-2 of this variation is additionally equipped with the ideal decomposition unit 29.

[0310] In the decryption device 20-2 of this variation, the ciphertext c(x, y) is obtained from the ciphertext obtaining unit 21, and the public key X(x, y) and the private key (zero point u:(u x (t),u y The process starts by obtaining m(u x (t),u y The process (steps S61 to S67) from (t)) to restoring the plaintext polynomial m(x, y) is the same as the process (steps S21 to S27) of the decryption unit 23 in the above-described embodiment. Therefore, only the process thereafter will be described here.

[0311] If the plaintext polynomial restoration unit 27 successfully restores the plaintext polynomial m(x, y), the plaintext polynomial m(x, y) is input to the decryption unit 23, and if the restoration fails, an error is input to the decryption unit 23. If the decryption unit 23 receives an error from the plaintext polynomial restoration unit 27, it outputs the error to the plaintext output unit 28 and terminates.

[0312] When the decryption unit 23 receives the plaintext polynomial m(x,y) from the plaintext polynomial restoration unit 27, it calculates c(x,y)-m(x,y) and inputs c(x,y)-m(x,y) to the ideal decomposition unit 29. The ideal decomposition unit 29 performs ideal decomposition on c(x,y)-m(x,y) based on Algorithm 2 (FIG. 2) to derive s(x,y) and e(x,y) (step S68). The ideal decomposition unit 29 inputs s(x,y) and e(x,y) to the decryption unit 23.

[0313] Next, the decoding unit derives r(x,y) by calculating the above equation (84) using s(x,y), e(x,y), and m(x,y) together (step S69).

[0314] If the polynomial cannot be restored in each of the above steps, the decryption unit 23 notifies the plaintext output unit 28 of the decryption error, and the plaintext output unit 28 outputs the decryption error and an empty decryption result. If m(x,y), s(x,y), e(x,y), and r(x,y) can all be restored, the decryption unit 23 extracts the divided plaintext from the coefficients of the decrypted plaintext polynomial and restores the plaintext M from the divided plaintext. The plaintext output unit 28 outputs the restored plaintext M (step S70).

[0315] For variations on the order of the approximate GCD in the approximate GCD calculation, see the following part of Algorithm 1 (Figure 1): for D=degs(t) to degs(t) + n do By determining an appropriate natural number m, for D=degs(t) - m to degs(t) + n do That's all we need to do.

[0316] Regarding variations regarding variables, in the encryption algorithm, decryption algorithm, and key generation algorithm of the above-mentioned embodiment, the variables are changed from x, y to x1, . . . , x n For the polynomial X,s, we change these variables x1, ,x n This can be achieved by making at least two of the above equations symmetric.

[0317] Regarding the key generating device 40, the private key is (u x1 (t)···,u xn In the decryption device 20, in the process of substituting the private key u into the ciphertext, the ciphertext c(x1, . . . , x n ) can be trivially constructed by substituting only the symmetrical variables into the inverted polynomial.

[0318] For example, in the encryption device 10 of this variation, the public key acquisition unit 2 p On the univariate polynomial ring F p A symmetric indeterminate equation X(x1,...,x) of n variables that is symmetric with respect to at least two variables and has coefficients that are determined by the total degree of each term in [t] and that are elements of a certain degree or less in [t]. n ) as a public key. The plaintext embedding unit 3 embeds the plaintext M into a one-variable polynomial ring F p The n-variable plaintext polynomial m(x1, ,x n ) into the coefficients of the polynomial ring F p n-variable polynomial r(x1, ,x n ) and generate a univariate polynomial ring F p An n-variable symmetric polynomial s(x1, ,x n ) and generate a univariate polynomial ring F p The noise polynomial e(x1, ,x n) is randomly generated. Then, the encryption unit 5 performs an encryption process including at least one of addition, subtraction, and multiplication on an n-variable plaintext polynomial m(x1, ···, x n ) with respect to an n-variable polynomial r(x1, ···, x n ), an n-variable symmetric polynomial s(x1, ···, x n ), a noise polynomial e(x1, ···, x n ), and an n-variable symmetric indeterminate equation X(x1, ···, x n ) to generate a ciphertext c(x1, ···, x n ).

[0319] Also, for example, in the decryption device 20 of this variation, the key acquisition unit 22 has an element of degree less than or equal to a certain degree in the univariate polynomial ring F p over a finite field F p [t], with coefficients being elements determined depending on the total degree of each term, and for at least two variables x i and x j (1 ≤ i < j ≤ n), it is a symmetric equation with respect to the n-variable symmetric indeterminate equation X(x1, ···, x i , ···, x j , ···, x n ). One or more zeros u of it are obtained as a secret key. The zero substitution unit 24 substitutes the zero u into the ciphertext c(x1, ···, x n ) to generate a univariate polynomial h1(t), and substitutes the zero u into the ciphertext c(x1, ···, x i , ···, x j , ···, x n ) after reversing the variables x i and the variable x j in the ciphertext c(x1, ···, x j , ···, x i , ···, x n ) to generate a univariate polynomial h2(t). The approximate GCD calculation unit 25 calculates the approximate GCD of the univariate polynomials h k (t) (k = 1, 2) to obtain the n-variable plaintext polynomial M(x1, ···, x nThe plaintext polynomial reconstruction unit 27 solves simultaneous linear equations derived from the one-variable polynomial m(u) and one or more zero points u to obtain the plaintext polynomial m(x1, , x n ) is obtained. Then, the decryption unit 23 obtains the plaintext polynomial m(x1, ,x n ) to decrypt the plaintext M.

[0320] Furthermore, for example, in the key generation device 40 of this variation, the system parameter acquisition unit 41 acquires the finite field F p On the univariate polynomial ring F p A symmetric indeterminate equation X(x1,...,x) of n variables that is symmetric with respect to at least two variables and has coefficients that are determined by the total degree of each term in [t] and that are elements of a certain degree or less in [t]. n ) as a public key, and solve the n-variable symmetric indeterminate equation X(x1, ,x n ), the prime number p, the degree d, the variables x1,...,x n The total degree D x , and the degree of the coefficient of the term of total degree ν, d x,ν The polynomial generation unit 43 generates a one-variable polynomial ring F p [t] contains n polynomials u of degree d x1 (t),···,u xn (t) and solve the n-variable symmetric indeterminate equation X(x1, ,x n ) coefficients other than the constant term d X The polynomial τ of the following order ij (t)(i+j=ν≦D x ,τ ji (t)=τ ij The indeterminate equation generator 45 generates n polynomials u x1 (t),···,u xn (t) and the polynomial τ ij (t)(i+j=ν≦D X ,τ ji (t)=τ ij (t)) and the n-variable symmetric indeterminate equation X(x1, ,x n) and calculate the temporary constant term of the polynomial u xi (t)u xj Based on the quotient and remainder of the division by (t), we solve the n-variable symmetric indeterminate equation X(x1, ,x n ) is generated. The key output unit 47 generates n polynomials u x1 (t),···,u xn (t) is output as a private key, and the n-variable symmetric indeterminate equation X(x1, ,x n ) as the public key.

[0321] Coefficient m of the plaintext polynomial ij Regarding variations in which the degree of (t) is changed for each term, the above embodiment is modified as follows: First, in encryption, when the encryption unit 5 generates the plaintext polynomial m(x, y), the system parameters p, D m ,d m The encryption unit 5 of this variation inputs p, d m,Dm ,d m,Dm―1 ,···,d m,1 ,d m,0 Here, d m,ν represents the order of the ν-th coefficient of m(x,y).

[0322] In decoding, the approximate GCD, i.e., s(u x (t),u y (t)), the decoding unit 23 calculates h1(t) mod s(u x (t),u y (t)) to m(u x (t),u y (t)) and calculate m(u x (t),u y (t)) is the zero point u and the system parameters d, d m,Dm ,d m,Dm―1 ,···,d m,1 ,d m,0together with m(x, y) to the plaintext polynomial restoration unit 27. The plaintext polynomial restoration unit 27 inputs the restored m(x, y) to the decryption unit 23. If m(x, y) cannot be restored, the plaintext polynomial restoration unit 27 inputs an error to the decryption unit 23.

[0323] In a variation in which the indeterminate equation X(x, y) is not a symmetric equation, the configurations of the encryption device 10, decryption device 20, and key generation device 40 are the same as those in the above-described embodiment, but partial changes are required in each algorithm. Here, the differences will be mainly explained based on the flowcharts in Figures 11 to 13. Note that explanations similar to those in the flowcharts of the above-described embodiment (Figures 4, 6, and 8) will be omitted.

[0324] The encryption algorithm of this variation is shown in Figure 11. In this variation, in addition to the fact that the indeterminate equation X(x, y), which is the public key, is not limited to a symmetric equation, the following changes are also made:

[0325] First, multiple plaintext polynomials m(x,y) are prepared. k (x, y) In this variation, m k Let (x, y) (k=1, 2). Plaintext M is embedded in the coefficients of these plaintext polynomials (step S84). s(x, y) is not limited to a symmetric formula, but can be expressed as d s,ν (_ν=0,1,···,D s ) are generated. Also, a plurality of polynomials e(x, y) and r(x, y) are generated (steps S88 and S89). Here, these are generated according to e k (x,y),r k (x,y)(k=1,2) and ciphertext c k (x, y) (k=1, 2) is generated by the following equation (94) (step S90).

[0326]

number

[0327] Regarding the decryption algorithm of this variation, only the difference from this embodiment will be explained based on the flowchart shown in Fig. 12. In this variation, two polynomials c k Since (x, y) are included, the secret keys are substituted into these polynomials to obtain h1(t) and h2(t) respectively (steps S103 and S104).

[0328] The process of the decryption device 20 when the private key is substituted is the same as in the above-described embodiment. k Based on (t), an approximate GCD calculation is performed, and the approximate GCD is s(u x (t),u y (t)) is required, c k (u x (t),u y (t)) mod s(u x (t),u y (t)) By m k (u x (t),u y (t)) is calculated (step S107), but this operation is the same as in the above embodiment. c(u x (t),u y (t)) mod s(u x (t),u y (t)) and c(u y (t),u x (t)) mod s(u x (t),u y (t)) The subsequent processing is similar to that described above.

[0329] The flowchart of the key generation algorithm in this variation is shown in Figure 13. Here, when the quadratic term of X(x, y) is generated (because symmetry is not taken into account), _τ 2,1 (t),τ 0,2 (t),τ 1,1 (t) are generated individually (step S123). The same is true when the first-order terms of X(x, y) are generated, and τ 1,0(t),τ 0,1 (t) are generated individually (step S124). The rest of the processing is the same as in the above embodiment.

[0330] In this variation, we also change the variables from x, y to x1,...,x n may be changed to.

[0331] For example, in the encryption device 10 of this variation, the public key acquisition unit 2 p On the univariate polynomial ring F p An n-variable indeterminate equation X(x1, ,x n ) as a public key. The plaintext embedding unit 3 embeds the plaintext M into the one-variable polynomial ring F p A plaintext polynomial m of n variables whose coefficients are elements of [t] of a certain degree or less i (x1,...,x n ) (i=1, 2). The polynomial generator 6 embeds the coefficients of the 1-variable polynomial ring F p n-variable polynomial r with coefficients that are elements of [t] up to a certain degree i (x1,...,x n ) and generate a univariate polynomial ring F p The n-variable polynomial s has coefficients that are determined by the total degree of each term and are elements of [t] that are equal to or less than a certain degree. i (x1,...,x n ) and generate a univariate polynomial ring F p The noise polynomial e with coefficients that are elements of [t] up to a certain degree i (x1,...,x n ) is randomly generated by the encryption unit 5. i (x1,...,x n ) for n-variable polynomial r i (x1,...,x n ) and n-variable polynomial s i (x1,...,x n ) and the noise polynomial e i (x1,...,x n ) and the n-variable indeterminate equation X(x1, ,x n) and the ciphertext c by an encryption process that performs an operation including at least one of addition, subtraction, and multiplication. i (x1,...,x n )

[0332] Furthermore, for example, in the decryption device 20 of this variation, the key acquisition unit 22 p On the univariate polynomial ring F p An n-variable indeterminate equation X(x1, ,x n ) as a private key. i (x1,...,x n ) (i=1,2) by substituting the zero point u, we obtain the univariate polynomial h i The approximate GCD calculation unit 25 generates a one-variable polynomial h i (t) (i=1,2) by calculating the approximate GCD (Greatest Common Divisor) of the n-variable plaintext polynomial m i (x1,...,x n ) by substituting the zero point u into the one-variable polynomial m i (u) is obtained by the plaintext polynomial reconstruction unit 27. i (u) and one or more zeros u, we solve the simultaneous linear equations to obtain the plaintext polynomial m i (x1,...,x n The decryption unit 23 obtains the plaintext polynomial m i (x1,...,x n ) to decrypt the plaintext M.

[0333] Furthermore, for example, in the key generation device 40 of this variation, the system parameter acquisition unit 41 acquires the finite field F p On the univariate polynomial ring F p An n-variable indeterminate equation X(x1, ,x n ) as a public key, and solve the n-variable indeterminate equation X(x1, ,x n), the prime number p, the degree d, the variables x1,...,x n The total degree D x , and the degree of the coefficient of the term of total degree ν, d x,ν The polynomial generation unit 43 generates a one-variable polynomial ring F p [t] contains n polynomials u of degree d x1 (t),···,u xn (t) and solve the n-variable indeterminate equation X(x1, ,x n ) coefficients other than the constant term d X The polynomial τ of the following order ij (t)(i+j=ν≦D X ) is generated. The indeterminate equation generating unit 45 generates n polynomials u x1 (t),···,u xn (t) and the polynomial τ ij (t)(i+j=ν≦D x ) and, from the n-variable indeterminate equation X(x1, ,x n ) and calculate the temporary constant term of the polynomial u xi (t)u xj Based on the quotient and remainder of the division by (t), we can solve the n-variable indeterminate equation X(x1, ,x n ) is generated. The key output unit 47 generates n polynomials u x1 (t),···,u xn (t) is output as a secret key, and the n-variable indeterminate equation X(x1, ,x n ) as the public key.

[0334] For variations in the order of the modulus of the public key X(x,y), this variation is determined by the parameter d x,ν and d s,ν Since this is a variation on how to determine the key generation device 40 of the above-described embodiment, the only difference is the system parameters input to the key generation device 40. Also, in the encryption device 10 and the decryption device 20, the only difference is the parameters stored in the storage units 4 and 26, so the configurations and processing of each device in this variation are the same as those in the above-described embodiment.

[0335] This concludes the description of the specific configurations of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of this embodiment.

[0336] [Safety Considerations] The security of the public key cryptography configured in this embodiment will be considered below. Note that with regard to a key recovery attack to recover a private key from a public key, this is a problem of solving an indeterminate equation for which no general solution algorithm exists, so only a brute force attack will be considered.

[0337] [Coefficient comparison attack] A coefficient comparison attack is an attack method in which the unknown parts of the plaintext polynomial, random polynomial, and noise polynomial in the ciphertext are calculated using variables, and the unknown parts are compared with the actual ciphertext to solve the simultaneous equations that arise, thereby deriving the plaintext polynomial along with other unknown parts. In this method, the only known part is the following equation (95).

[0338]

number

[0339] The unknown part is given by the following equation (96).

number

[0340] By using these to create a ciphertext based on the above equation (51), the following equation (97) is obtained.

[0341]

number

[0342] The coefficients are compared between the above formula (97) and the actual ciphertext expressed by the following formula (98). Here, μ ijk ,c ijk is known.

[0343]

number

[0344] For simplicity, let us consider the public key X and its corresponding F p We will consider the polynomial c (= se + Xr + m) on [t] as given under the following conditions. An attack that analyzes only one of c1 and c2 in this way is called a one-sided attack. For simplicity, we will proceed with the discussion using the following equation (99).

[0345]

number

[0346] Then, m, r, s, and e are multiplied by the following equation (100), and s ijk ,e ijk ,r ijk ,m ijk is F p In addition, X and c are multiplied by the following equation (101), and τ ijk ,c ijk is F p is a constant whose value is

[0347]

number

[0348]

number

[0349] where x 2 , xy, y 2 , x, y terms and constant terms, the simultaneous equations of the following equation (102) can be derived.

[0350]

number

[0351] This simultaneous equation is a nonlinear indeterminate equation because it has 10 variables and 6 equations. Generally, the number of variables is #Δ Ds,ds +#Δ De,de +#Δ Dr,dr +#Δ Dm,dm and the number of expressions is #Δ Dx+Dr,dx+dr d X , d r As the equation grows larger, it is no longer an indeterminate equation, but becomes a problem of solving a nonlinear multivariate simultaneous equation, known as NP-hard.

[0352] [Linear algebra attack] A linear algebra attack is an attack method that linearizes the nonlinear part of a coefficient comparison attack, thereby changing what would normally be a system of nonlinear simultaneous equations into a system of linear simultaneous equations. This makes it possible to dramatically reduce the amount of calculation required for the attack. Linearizing the nonlinear part means treating the nonlinear part (i.e., the product part) as a single polynomial and setting the unknown part. In this method, since the term in which the plaintext is embedded (plaintext term) is nonlinear, such as s(x,y)e(x,y), this part is collectively treated as a single polynomial SE(x,y), i.e., the ciphertext is treated as the following equation (103).

[0353]

number

[0354] Let SE, r, m be the unknown part, and apply this to c(x, y) using the parameters shown in the above equation (99) to obtain the following equation (104), and let the known parts X and c be the following equations (105), respectively. Using the same considerations as in the coefficient comparison attack, the following simultaneous equations (106) can be derived.

[0355]

number

[0356]

number

[0357]

number

[0358] This simultaneous equation is a linear indeterminate equation because it has 10 variables and 6 equations. Generally, the number of variables is #Δ Dx+Dr,dx+dr +#Δ Dr,dr +#Δ Dm,dm and the number of expressions is #Δ Dx+Dr,dx+dr From this, #Δ Dr,dr +#Δ Dm,dm In fact, we have a solution space of only r dimensions. ijk , m ijk to any F p Substituting the elements of , the corresponding SE ijk However, the correct SE is obtained as a result of decoding. ijk is one of them, and the only way to determine it is to verify that factoring the derived SE(x,y) gives s(x,y)e(x,y), which is currently only known to be a brute force attack on the solution space (other than a coefficient comparison attack). Therefore, if the solution space is large enough to avoid a brute force attack, this attack can be prevented.

[0359] [Brute force attack] The resistance to the various attacks explained above was basically evaluated by the amount of calculation required to solve simultaneous equations, but we will reconsider this from the perspective of brute force attacks. In a coefficient comparison attack, by brute force solving m(x,y), it is possible to obtain s(x,y) and e(x,y) by ideal decomposition using the same method as decryption. In this way, the number of times m(x,y) can be brute force solved is D m = 3 (because the characteristic p of the finite field is raised to the power of the number of variables) 10(dm+1) This also increases the computational cost exponentially. This is the same as with linear algebra attacks.

[0360] Also, in a key recovery attack, when solving a multivariate simultaneous equation, (u x (t),u y(t)), but this is only possible if you can find one of them (e.g., u x (t)) and try to find the corresponding y (t)) to X(u x (t), y) = 0. Taking these factors into consideration, u x It is necessary to consider the brute force of (t), and the number of brute force attempts is p d+1 and again it grows exponentially.

[0361] From the above considerations, it is clear that the amount of calculation increases exponentially in any of the existing attacks, and the encryption of this embodiment has sufficient security.

[0362] Finally, an example of the hardware configuration of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment will be described.

[0363] [Example of hardware configuration] FIG. 14 is a diagram illustrating an example of the hardware configuration of the encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 according to the embodiment.

[0364] The encryption device 10, the decryption devices 20 and 20-2, and the key generation device 40 of the embodiment include a control device 301, a main memory device 302, an auxiliary memory device 303, a display device 304, an input device 305, and a communication device 306. The control device 301, the main memory device 302, the auxiliary memory device 303, the display device 304, the input device 305, and the communication device 306 are connected via a bus 310.

[0365] The control device 301 executes a program read from the auxiliary storage device 303 to the main storage device 302. The main storage device 302 is memory such as a read-only memory (ROM) and a random access memory (RAM). The auxiliary storage device 303 is a hard disk drive (HDD), a solid state drive (SSD), a memory card, or the like.

[0366] The display device 304 displays display information. The display device 304 is, for example, a liquid crystal display. The input device 305 is an interface for operating the computer. The input device 305 is, for example, a keyboard or a mouse. If the computer is a smart device such as a smartphone or tablet terminal, the display device 304 and the input device 305 are, for example, a touch panel. The communication device 306 is an interface for communicating with other devices.

[0367] Programs that are executed by a computer are provided as computer program products, recorded in the form of installable or executable files on computer-readable storage media such as CD-ROMs, memory cards, CD-Rs, and DVDs (Digital Versatile Discs).

[0368] The program to be executed by the computer may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network, or the program to be executed by the computer may be provided via a network such as the Internet without being downloaded.

[0369] The program executed by the computer may be provided in advance in a ROM or the like.

[0370] The program executed by the computer has a modular configuration including functional blocks that can be realized by the program, among the functional configurations (functional blocks) of the encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 of the embodiment. As for each functional block, as actual hardware, the control device 301 reads the program from a storage medium and executes it, and the above functional block is loaded onto the main storage device 302. In other words, the above functional block is generated on the main storage device 302.

[0371] Note that some or all of the above-described functional blocks may be realized by hardware such as an integrated circuit (IC) instead of by software.

[0372] Furthermore, when each function is realized using a plurality of processors, each processor may realize one of the functions, or may realize two or more of the functions.

[0373] The encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 of the embodiment may be realized by any computer. For example, the encryption device 10 (the decryption devices 20, 20-2, and the key generation device 40) may be realized by a single computer. Also, for example, the encryption device 10, the decryption devices 20, 20-2, and the key generation device 40 may be operated as a cloud system on a network.

[0374] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0375] 1. Plaintext Acquisition Unit 2 Public key acquisition section 3. Plaintext embedding part 4 Storage section 5 Encryption section 6 Polynomial generator 7 Random Value Generator 8 Polynomial operation section 9 Ciphertext output section 10 Encryption device 20 Decryption device 21 Ciphertext acquisition part 22 Key acquisition part 23 Decoding unit 24 Zero point substitution part 25 Approximate GCD calculation section 26 Memory section 27 Plaintext polynomial recovery unit 28 Plaintext output unit 29 Ideal decomposition part 40 Key generation device 41 System parameter acquisition unit 42 Control Unit 43 Polynomial generator 44 Random value generator 45 Indeterminate equation generator 46 Polynomial operation section 47 Key output unit 301 Control device 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input Device 306 Communication Equipment 310 Bus

Claims

1. finite field F ｐ The one-variable polynomial ring F on ｐ An n-variable indeterminate equation X(x) with coefficients that are elements of a certain degree or less of [t] and are determined depending on the total degree of each term １ , ..., x ｎ ) as a public key, and the n-variable indeterminate equation X(x １ , ..., x ｎ ) is used to generate one or more zero points u of the １ , ..., x ｎ The total degree D ｘ , and the degree d of the coefficient of the term of total degree ν ｘ，ν a system parameter acquisition unit that acquires the The one-variable polynomial ring F ｐ The n polynomials u of degree d included in [t] ｘ１ (t), ..., u ｘｎ (t) and solve the n-variable indeterminate equation X(x １ , ..., x ｎ ) The coefficients other than the constant term of Ｘ，ν The polynomial τ of the following order ｉｊ (t)(i+j=ν≦D ｘ ), and a polynomial generator for generating The n polynomials u ｘ１ (t), ..., u ｘｎ (t) and the polynomial τ ｉｊ (t)(i+j=ν≦D Ｘ ) and the n-variable indeterminate equation X(x １ , ..., x ｎ ) and calculate the provisional constant term of the polynomial u ｘｉ (t)u ｘｊ Based on the quotient and remainder obtained by dividing by (t), the n-variable indeterminate equation X(x １ , ..., x ｎ ) and an indeterminate equation generator; The n polynomials u ｘ１ (t), ..., u ｘｎ (t) as the secret key, and the n-variable indeterminate equation X(x １ , ..., x ｎ ) as the public key; and A key generation device comprising:

2. The n-variable indeterminate equation X(x １ , ..., x ｎ ) is a symmetric indeterminate equation that is symmetric with respect to at least two variables, The polynomial generator Ｘ，ν The polynomial τ of the following order ｉｊ (t)(i+j=ν≦D Ｘ ) and τ ｊｉ (t) = τ ｉｊ (t), The key generating device according to claim 1 .

3. The key generating device generates a finite field F ｐ The one-variable polynomial ring F on ｐ An n-variable indeterminate equation X(x) with coefficients that are elements of a certain degree or less of [t] and are determined depending on the total degree of each term １ , ..., x ｎ ) as a public key, and the n-variable indeterminate equation X(x １ , ..., x ｎ ) is used to generate one or more zero points u of the １ , ..., x ｎ The total degree D ｘ , and the degree d of the coefficient of the term of total degree ν ｘ，ν and obtaining The key generation device has n(d+1) random numbers from 0 to p-1 as coefficients, and the one-variable polynomial ring F ｐ The n polynomials u of degree d included in [t] ｘ１ (t), ..., u ｘｎ (t) and solve the n-variable indeterminate equation X(x １ , ..., x ｎ ) The coefficients other than the constant term of Ｘ，ν The polynomial τ of the following order ｉｊ (t)(i+j=ν≦D ｘ ) The key generating device generates the n polynomials u ｘ１ (t), ..., u ｘｎ (t) and the polynomial τ ｉｊ (t)(i+j=ν≦D Ｘ ) and the n-variable indeterminate equation X(x １ , ..., x ｎ ) and calculate the provisional constant term of the polynomial u ｘｉ (t)u ｘｊ Based on the quotient and remainder obtained by dividing by (t), the n-variable indeterminate equation X(x １ , ..., x ｎ ) The key generating device generates the n polynomials u ｘ１ (t), ..., u ｘｎ (t) as the secret key, and the n-variable indeterminate equation X(x １ , ..., x ｎ ) as the public key; A key generation method including:

4. Computer, finite field F ｐ The one-variable polynomial ring F on ｐ An n-variable indeterminate equation X(x) with coefficients that are elements of a certain degree or less of [t] and are determined depending on the total degree of each term １ , ..., x ｎ ) as a public key, and the n-variable indeterminate equation X(x １ , ..., x ｎ ) is used to generate one or more zero points u of the １ , ..., x ｎ The total degree D ｘ , and the degree d of the coefficient of the term of total degree ν ｘ，ν a system parameter acquisition unit that acquires the The one-variable polynomial ring F ｐ The n polynomials u of degree d included in [t] ｘ１ (t), ..., u ｘｎ (t) and solve the n-variable indeterminate equation X(x １ , ..., x ｎ ) The coefficients other than the constant term of Ｘ，ν The polynomial τ of the following order ｉｊ (t)(i+j=ν≦D Ｘ ), and a polynomial generator for generating The n polynomials u ｘ１ (t), ..., u ｘｎ (t) and the polynomial τ ｉｊ (t)(i+j=ν≦D ｘ ) and the n-variable indeterminate equation X(x １ , ..., x ｎ ) and calculate the provisional constant term of the polynomial u ｘi (t)u ｘj Based on the quotient and remainder obtained by dividing by (t), the n-variable indeterminate equation X(x １ , ..., x ｎ ) and an indeterminate equation generator; The n polynomials u ｘ１ (t), ..., u ｘｎ (t) as the secret key, and the n-variable indeterminate equation X(x １ , ..., x ｎ a key output unit that outputs the public key; A key generation program to function as a

Images