Cryptographic systems, adjustment devices, decryption devices, and programs

Abstract

To construct a threshold public-key cryptosystem based on the LWE problem that does not limit the secret sharing method and allows for security proof with a realistic ciphertext size. [Solution] The cryptographic system 100 includes a key generation unit 11 that generates a key along with an error for adjusting the ciphertext; a secret sharing unit 12 that distributes to each party a share obtained by secretly sharing the secret key and the error using a predetermined linear secret sharing scheme, as well as a seed set; an error transmission unit 41 that, at each party, masks the error share with a pseudo-random number based on the seed value and transmits it to the adjustment device 30; a ciphertext adjustment unit 31 that, at the adjustment device 30, adjusts the ciphertext by adding the masked error and the ciphertext of zero; a partial decryption unit 42 that, at each party, partially decrypts the adjusted ciphertext and masks it with a pseudo-random number based on the seed value; and a whole decryption unit 43 that decrypts the message based on the sum of the number of partially decrypted sentences that are greater than or equal to a threshold.

Description

[Technical Field]

[0001] This invention relates to a method for constructing a threshold public-key cryptosystem based on the Learning with Errors (LWE) problem. [Background technology]

[0002] (t,N)-Threshold Public Key Cryptography (Threshold PKE: ThPKE) is a public key cryptosystem in which, out of all N participants who have different private key shares, t people perform partial decryption, and decryption is possible by collecting these partially decrypted statements. Patent Document 1 proposes a simulation-secure threshold public-key cryptography scheme based on LWE using binary coefficient linear secret sharing. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] Specification of Japanese Patent Application No. 2023-218151 [Non-patent literature]

[0004] [Non-Patent Document 1] L. Valiant. "Short monotone formula for the majority function". Journal of Algorithms 5.3 (1984), pp. 363-366. [Non-Patent Document 2] A. Shamir. "How to share a secret". Commun. ACM 22.11 (Nov. 1979), pp. 612-613. [Non-Patent Document 3] D. Boneh, R. Gennaro, S. Goldfeder, A. Jain, S. Kim, PMR Rasmussen, A. Sahai. "Threshold Cryptosystems from Threshold Fully Homomorphic Encryption". CRYPTO 2018. 2018, pp. 565-596.

Non-licensed Document 4

Non-licensed Document 5

Non-licensed Document 6

Non-licensed Document 7

[0005] In binary coefficient linear secret sharing, the size of the secret key share distributed to each participant depends on the number of participants N, and is O(N). 4 Because it increases with the number of participants, it is known that it can become inefficient depending on the number of participants (see, for example, Non-Patent Document 1). For this reason, cryptographic schemes that apply other more efficient secret sharing methods have been desired. For example, Shamir's secret sharing (see, e.g., Non-Patent Document 2) is known as a method that optimizes the size of the secret key share. A threshold public-key cryptosystem using Shamir's secret sharing has also been proposed (see, e.g., Non-Patent Document 3). However, for its security proof, the modulo q of the ciphertext must be O(N! 2 ) had grown larger and become inefficient.

[0006] The present invention aims to provide a cryptographic system that constructs a threshold public-key cryptosystem based on the LWE problem, which does not limit the secret sharing method and enables security proof with a realistic ciphertext size. [Means for solving the problem]

[0007] The cryptographic system according to the present invention comprises a key generation unit that generates a private key and a corresponding public key for threshold public-key cryptography based on Learning with Errors (LWE), along with an error for adjusting the noise distribution of the ciphertext, and each of the N parties P i In contrast, the private key and the error are secretly shared using a predetermined linear secret sharing scheme, and the shares of the private key and the error, as well as the seed set {seedi,j ,seed j,i} j∈[N] a secret sharing unit that distributes, and an active party P i in the active party P, an error transmitting unit that masks the error share with a pseudorandom number based on the seed value seed corresponding to said active party i,j , and transmits the masked error to an adjustment apparatus; in said adjustment apparatus, a ciphertext adjustment unit that generates an adjusted ciphertext by adding the masked errors respectively received from each of said active parties and a ciphertext of 0 to a ciphertext obtained by encrypting a message with said public key; in the active party P i , a partial decryption unit that partially decrypts said adjusted ciphertext using the secret key share, and further generates a partial decryption text by masking with a pseudorandom number based on the seed value seed corresponding to said active party j,i ; and an overall decryption unit that decrypts said message based on a sum of said partial decryption texts of which the number is equal to or greater than a threshold value obtained from said active parties.

[0008] The linear secret sharing scheme may be Shamir's secret sharing scheme.

[0009] The LWE may be Ring-LWE.

[0010] The threshold public key encryption may be fully homomorphic encryption.

[0011] In the adjustment apparatus according to the present invention, an error for adjusting the noise distribution of a ciphertext is generated together with a secret key of Learning with Errors (LWE)-based threshold public key encryption and a public key corresponding to the secret key, and each party P among the total N parties i with respect to which, after a secret key share obtained by secretly sharing said secret key and said error by a predetermined linear secret sharing scheme, an error share, and a seed set {seed i,j ,seed j,i} j∈[N] have been distributed, an active party P iIn this context, the share of the error is determined by the seed value for the active party. i,j The system includes a ciphertext adjustment unit that, when masked with a pseudo-random number based on the public key, adds the masked error received from each of the active parties and the ciphertext of 0 to the ciphertext encrypted with the public key to generate an adjusted ciphertext, and the active party P i In this process, the adjusted ciphertext is partially decrypted using the shared secret key, and furthermore, the seed value related to the active party j,i By generating partially decoded sentences by masking them with pseudo-random numbers based on the above, the message can be decoded based on the sum of the number of partially decoded sentences obtained from the active party that is greater than or equal to a threshold.

[0012] The decryption device according to the present invention generates errors for adjusting the noise distribution of the ciphertext, along with the secret key and the corresponding public key of a threshold public-key cryptosystem based on Learning with Errors (LWE). i The following are distributed to the recipients: the share of the secret key and the share of the error obtained by secretly sharing the secret key and the error using a predetermined linear secret sharing scheme, and the seed set {seed i,j ,seed j,i} j∈[N] Received, active party P i The share of the aforementioned error is determined by the seed value related to the active party. i,j An error transmission unit that masks errors with pseudorandom numbers based on and sends the masked errors to a management device, and when the management device receives an adjusted ciphertext by adding the masked errors received from each of the active parties and the ciphertext of 0 to the ciphertext encrypted with the public key, it partially decrypts the adjusted ciphertext using the share of the private key, and further, the seed value related to the active party j,iThe system comprises a partial decoding unit that generates partially decoded sentences by masking them with pseudorandom numbers based on a certain condition, and a whole decoding unit that decodes the message based on the sum of the number of partially decoded sentences obtained from the active party that is equal to or greater than a threshold.

[0013] The adjustment program according to the present invention is for causing a computer to function as the adjustment device.

[0014] The decryption program according to the present invention is for causing a computer to function as the decryption device. [Effects of the Invention]

[0015] According to the present invention, a threshold public-key cryptosystem based on the LWE problem can be constructed that does not limit the secret sharing method and allows for security proof with a realistic ciphertext size. [Brief explanation of the drawing]

[0016] [Figure 1] This figure shows the functional configuration of the cryptographic system in the embodiment. [Figure 2] The first figure shows an algorithm for implementing threshold public-key cryptography in the embodiment. [Figure 3] The second figure shows an algorithm for implementing threshold public-key cryptography in the embodiment. [Figure 4] This figure shows the protocol for the process of decrypting ciphertext in the embodiment. [Figure 5] This figure illustrates an overview of Pairwise Shared Seeds Masking as modified in this embodiment. [Figure 6] Figure 1 shows an algorithm for defining the simulation safety of ThPKE in an embodiment. [Figure 7] The second figure shows an algorithm for defining the simulation safety of ThPKE in an embodiment. [Modes for carrying out the invention]

[0017] An example of an embodiment of the present invention will be described below. First, the notation, definitions, and lemmas used in this embodiment will be explained in the following sections [A] to [F].

[0018] [A. Notation] In this embodiment, the following notation is used. log represents the logarithm with base 2. For N ∈ N (natural numbers), we define [N] = {1, ..., N}. The set {x i} i∈S Given a set of subscripts, the set of subscripts S is also given. Vectors are generally represented by bold lowercase letters, and matrices by bold uppercase letters, although this rule does not apply when it is clear that something is a vector or a matrix. Vector x = (x1, ..., x n For ), the i-th component is x i Alternatively, we will denote it as x[i]. The transpose of vector x is x T It is written as follows. For modulo q ∈ Z (an integer),

number

[0019] [B. Statistics-related] When random variables X1 and X2 independently follow the same distribution χ,

number

number

[0020] (Definition B.1) The statistical distance between the distributions χ1 and χ2 of Ω is,

number

[0021] (Definition B.2 Statistical indistinguishability) Δ(χ1,χ2)=negl(κ) holds true.

number

[0022] (Definition B.3 Computational Indistinguishability) For any PPT algorithm A, |Pr[A(χ1)=1]-Pr[A(χ2)=1]|=negl(κ) holds.

number

[0023] (Fact B.4)

number

[0024] (Fact B.5)

number

[0025] (Definition B.6 B-bounded) The distribution χ on R is Pr X←χ A condition is called B-bounded if [X≧B]=negl(n).

[0026] [C. Discrete Gaussian distribution] A lattice L is a set of linearly independent vectors b1, ..., b n ∈R m It is the set of linear sums of integer coefficients, that is,

number

number

[0027] A continuous Gaussian distribution with mean 0 and standard deviation σ>0 is N σ It is written as follows. A column-full rank matrix S∈R n×m For R n The covariance matrix Σ=SS shown above. T ∈R n×m The Gaussian function is,

number

number

[0028] (Definition C.1 Discrete Gaussian distribution on a lattice L) For a column full rank matrix S, the covariance matrix Σ:= SS T A discrete Gaussian distribution on a lattice L is a distribution with the following probability function:

number

[0029] (Fact C.2)

number

number

[0030] (Definition C.3 Smoothing parameter) For a lattice L and a sufficiently small ε>0, the smoothing parameter of L is:

number

[0031] (Fact C.4) For any ε>0,

number

number

[0032] (Lemma C.5 A special case of Theorem 3.3 in Non-Patent Document 4) e∈Z mLet gcd(e)=1, and for i=1,…,m,

number

number

number

number

number

[0033] (Lemma C.6 System 5.4 in Non-Patent Document 5) Let n ∈ N, q be a prime number, m ≥ 2n log q, and s ≥ ω(√(log m)),

number

number

[0034] (Lemma C.7 Lemma 4.4 in Non-Patent Literature 6) Any n-rank lattice L, ε∈(0,1), s≧η ε Regarding (L),

number

[0035] (Lemma C.8) For any ε∈(0,1), s≧η ε + For (Z), t∈N,

number

number

[0036] [D. Pseudorandom Function] (Definition D.1 Pseudorandom Function) PRF:{*}→S is a deterministic algorithm whose output is pseudorandom (computationally indistinguishable from uniform random). That is, for any input seed, the following is satisfied:

number

[0037] [E. Shamir's secret sharing] Threshold secret sharing (SS) is defined below. (Definition E.1 (t,n)-SS) Let K be a finite field, n∈N,t <nとする。

number

[0038] • Share generation algorithm:

number

Math

[0039] SS must satisfy the following conditions. · Perfect Reconstructability: For any s∈K, [s]←Share(s), S I such that for |I|≧t, Recon(S I )=s. In other words, if t or more shares are collected, the secret can be reconstructed with 100% probability. · Perfect Privacy: For any s∈K, [s]←Share(s), S I such that for |I|<t, P(s)=P(s|S I ). In other words, even if an incomplete share set S with fewer than t shares I is obtained, no information about s can be obtained at all.

[0040] Shamir SS, which is one of the configurations of (t,n)-SS, is defined below. This (t,n)-Shamir SS is known to satisfy Perfect Reconstructability and Perfect Privacy.

[0041] (Configuration E.2 Shamir's (t,n) threshold scheme) As (t,n)-Shamir SS,

Math

[0042] ·Shamir.Share(s): coefficients (a1,…,a t-1 ) ∈ K are randomly selected, and a (t-1)-th degree polynomial f(x)=s+Σ j=1 t-1 a j x j is defined. [s] = (s1,…,s n ) = (f(d1),…,f(d n )) is output. ·Shamir.Recon(S I ): S I = {s i | i ∈ I s.t. |I| > t} is received as input, and the following is output.

Math

Math

[0043] Specifically, Shamir's (t,n) threshold scheme is executed according to the following procedure. First, let K be a field, set secret information s ∈ K, participants P1,…,P n and their respective IDs d1,…,d n ∈ K (d i ≠ d j ≠ 0), and set a dealer D. (1) Dealer D executes Share(s) → [s]:=(s1,…,s n ), and sends s1,…,s n respectively to participants P1,…,P n through a secure communication channel. (2) The party {P i} i∈I (I⊂{1,…,n}) receives the shared share set S I ={s i | i ∈ I} as input, and outputs Recon(S I ) → s'. Here, s'=s holds only when |I|≧t.

[0044] [F. LWE problem] (Definition F.1 LWE distribution) n, m, q ∈ N (natural numbers), χ = Z q Let the distribution be on (integers). Fixed,

number

number

[0045] (Definition F.2 Decision-LWE problem) d-LWE s (n,m,q,χ) is LWE s (n,m,q,χ) and the uniform distribution U(Z q m×n ×Z q m This is a problem of distinguishing between ) and ).

number

[0046] [Structure of this embodiment] Next, the configuration of the threshold public-key cryptography in this embodiment will be described in detail. In this embodiment, in threshold public-key cryptography based on LWE, the sharing of secret information regarding errors in the public key and the private key is distributed to the participants (party), and the noise distribution of the ciphertext is adjusted by using this information.

[0047] Figure 1 is a diagram showing the functional configuration of the encryption system 100 in this embodiment. The encryption method implemented in the encryption system 100 is a threshold public-key cryptography based on LWE, and comprises a management device 10 that generates parameters and key information, an encryption device 20 that generates ciphertext of a message using the public key, an adjustment device 30 that adjusts the noise distribution of the ciphertext for decryption processing, and multiple parties (decryption devices 40) that share secret information and are capable of partial decryption of the ciphertext. In this embodiment, the encryption system 100 is configured to include three types of information processing devices, but it is not limited to this configuration. Each function included in the encryption method may be consolidated into fewer devices or distributed.

[0048] Figures 2 and 3 show algorithm 1 for implementing threshold public-key cryptography in this embodiment. Here, we define each variable in the algorithm as follows: N: Number of participating parties t(≦N): Decryptable threshold corr⊂[N]: Set of participants that have been corrupted, |corr| <t sid: Partially decoded session ID act⊆[N]: A collection of active participants, |act| <t

[0049] The control unit of the management device 10 functions as a key generation unit 11 and a secret sharing unit 12 by executing software stored in the memory unit.

[0050] The key generation unit 11 uses various parameters obtained by executing Params (step 1) to generate a private key and a corresponding public key for threshold public-key cryptography based on LWE, along with an error for adjusting the noise distribution of the ciphertext, using KeyGen (steps 2-3).

[0051] The secret sharing unit 12 uses KeyGen to determine which party P is responsible for the total number of parties N. i For this, the secret key and error are secretly shared using a predetermined linear secret sharing scheme, and the shares of the secret key and error, as well as the seed set of pseudorandom numbers {seedi,j ,seed j,i} j∈[N] Distribute the materials (steps 4-7). Here, the linear secret sharing scheme can be, for example, Shamir's secret sharing scheme mentioned earlier.

[0052] The control unit of the encryption device 20 functions as an encryption unit 21 by executing software stored in the storage unit.

[0053] The encryption unit 21 performs Enc to encrypt the message μ using the public key and random numbers according to a predetermined distribution, and generates the ciphertext ct (steps 8-9).

[0054] The control unit of the adjustment device 30 functions as a ciphertext adjustment unit 31 by executing software (adjustment program) stored in the memory unit.

[0055] The ciphertext adjustment unit 31 uses ServerRerand to add the masked errors received from each active party, as well as the ciphertext of zero, to the ciphertext to generate an adjusted ciphertext (step 12).

[0056] The control unit of the decryption device 40 executes the software (decryption program) stored in the memory unit, thereby enabling the active party P involved in decrypting the ciphertext. i It functions as an error transmission unit 41, a partial decoding unit 42, and a whole decoding unit 43 in (i∈act).

[0057] The error transmission unit 41 uses MaskErr to share errors with the seed value related to the active party. i,j The masked errors are masked with pseudo-random numbers based on the above, and the masked errors are sent to the management device 10 (steps 10-11).

[0058] The partial decryption unit 42, using PartDec, partially decrypts the ciphertext prepared by the management device using the secret key share, and further, the seed value related to the active party.j,i The partially decoded text is generated by masking it with pseudo-random numbers based on the above (steps 13-15).

[0059] The overall decoding unit 43 decodes the message using FinDec based on the sum of the number of partially decoded sentences obtained from the active party that are greater than or equal to a threshold (steps 16-17).

[0060] Figure 4 shows the protocol for the decryption process in this embodiment. As a preliminary step, a trusted dealer (e.g., management device 10) generates parameters using Params, and then generates a public key, private key, error, and a share of the secret information using KeyGen. The dealer then publishes the parameters and public key and distributes a share of the secret information to each party.

[0061] The inputs are the decryption session ID, the set of active parties participating in this session, and the ciphertext ct. The decryption result of the ciphertext ct is then output according to the following protocol.

[0062] Each party (decryption device 40) executes MaskErr and sends the masked error to the server (adjustment device 30). The server runs ServerRerand to adjust the ciphertext and broadcasts the adjusted ciphertext to all active parties. Each party executes PartDec and broadcasts the partially decrypted ciphertext to all active parties. However, each party does not send the partially decrypted text to the server. Each party executes FinDec and obtains the decryption result.

[0063] The protocol of this embodiment has, in particular, the following features (1) to (4). (1) Shamir's secret sharing (4th line of algorithm 1): By using Shamir's secret sharing scheme (configuration E.2) instead of binary coefficient linear secret sharing as the secret sharing method, the size of the share becomes more efficient (O(N)). 4 ) → O(N))

[0064] (2) Pairwise Shared Seeds Masking (lines 5, 6, 10, and 13 of Algorithm 1): By modifying the Pairwise Shared Seeds Masking technique used in the configuration of threshold digital signature schemes (see Non-Patent Document 7) and applying it to threshold public-key cryptography, security is ensured by masking the partially decrypted text.

[0065] As mentioned above, the threshold public-key cryptography using Shamir's secret sharing proposed in Non-Patent Document 3 requires that the size modulo q (defined F.1) of the ciphertext be O(N!) for proof of its security. 2 This resulted in inefficiency. This problem has been solved in Non-Patent Document 7 in the context of threshold electronic signature schemes, and an efficient scheme has been proposed. In this embodiment, an efficient scheme is constructed using this method while maintaining O(N) complexity for the modulus q as well.

[0066] Figure 5 is a diagram illustrating an overview of the modified Pairwise Shared Seeds Masking in this embodiment. Each party P i is the seed value {seed i,j ,seed j,i It possesses} and uses the deterministic algorithm pseudorandom function PRF to obtain the mask value m i,j =PRF(seed i,j It is possible to generate ) and the sum of each row,

number

number

[0067] In the example shown in the diagram, act={1,2,3,4,5}, corr={1,2,3}, and hon={4,5}. The attacker who corrupts the party set corr is represented by the mask value {m} within the box. i,j} min(i,j)≦3 ,{m i row ,m i col} i∈corr While this part can be calculated, no information can be obtained about the other parts under the assumption of pseudo-randomness of the function PRF.

[0068] On the other hand, Party P i and P j between seed i,j Because they are shared (=Pairwise shared),

number

[0069] Furthermore, in the threshold signature of Non-Patent Document 7, m i row Public information, m i col Although it is treated as confidential, in this embodiment, m i row and m i col Both will be kept confidential.

[0070] (3) ServerRerand (line 12 of Algorithm 1): Similar to the threshold (fully homomorphic) public-key cryptography proposed in Non-Patent Document 8, this assumes the existence of an untrusted but semi-honest server (which attempts to obtain plaintext information if possible but does not deviate from the protocol) that does not collude with any of the participants (is not corrupted). Partial decryption is performed only on the output ciphertext whose noise distribution has been adjusted by the Server-Rerand process.

[0071] (4) MaskErr (lines 3 and 11 of Algorithm 1): The error term used to adjust the noise distribution of the ciphertext contains information about the private key (∥e∥), and therefore cannot be directly provided to an untrusted server. Consequently, the error term is generated during key generation and held by the participants through secret sharing. Then, participants send the data to the server with error terms further masked using Pairwise Shared Seeds Masking through MaskErr processing.

[0072] [correctness] The definition of "validity" (the ability to correctly decode ThPKE in this embodiment) is given below, and the necessary conditions for satisfying this validity and their proof are shown.

[0073] (Definition 1: Validity) Algorithm 1 uses an overwhelming proportion of (pk, sk, err) generated by KeyGen() to determine the value of any act satisfying |act|≧t with an overwhelming probability using FinDec({pd i} i∈act The condition is considered valid when ) = μ holds true.

[0074] (Theorem 2) ThPKE (Algorithm 1) is,

number

number

[0075] (Proof) First, the output of ServerRerand from Algorithm 1

number

number

number

number

number

[0076] Next, in FinDec of algorithm 1, pd i From the definition and the legitimacy of Shamir's secret sharing, the following holds:

number

[0077] Here,

number

number

number

number

number

[0078] Furthermore, from Lemma C.7

Math

Math

Math

Math

Math

Math

Math

[0079] [Security] The security of the ThPKE of this embodiment is defined below, and the necessary conditions for satisfying the security and the proof thereof are shown. Note that security refers to a valid set of partial decryptions

Math

number

[0080] Figures 6 and 7 show the game (trial) algorithm for defining the simulation safety of ThPKE in this embodiment.

[0081] (Definition 3: Simulation Safety) ThPKE=(KeyGen,Enc,MaskErr,ServerRerand,PartDec,FinDec) is said to be simulation safe if the following conditions are met: There exists a probabilistic polynomial-time (PPT) simulation algorithm Sim, and the trial Ext A,Real (1 λ ) and Expt A,Ideal (1 λ ) and are computationally indistinguishable, that is, for any PPT attack algorithm A=(A1,A2), the following must hold:

number

[0082] (Theorem 4) ThPKE (Algorithm 1) is simulation safe if the following holds: • A necessary condition for Lemma C.6: that is, n ∈ N, q is a prime number,

number

[0083] (Proof) For simplicity, this proof will be provided only for the case where an adversary corrupts the maximum possible number of parties, i.e., |corr|=t-1, and the minimum required number of participating parties |act|=t. Furthermore, in this case, let the index of the only party not corrupted by the adversary be given as {h}:=corr-act. Note that essentially the same proof can be applied in the case where |corr|<t-1.

[0084] There exists a simulator Sim, in Expt A,Real (1 λ ), the view of adversary A (obtained information) D Real is, in Expt A,Ideal (1 λ ), view D of A Ideal is computationally indistinguishable, that is, [Formula] only needs to be shown. This proof is constructed via the transitive law (Fact B.5) and Fact B.4, going through intermediate views of D1~D5. First, all views and configurations of Sim are described below, [Formula] each is proven to hold individually.

[0085] [Formula] The adversary [Formula] possesses the above, so [Formula] can be generated. Therefore, setting this as (null) is still equivalent. Furthermore, because {pd i} i∈corr is possessed, pd h to Σ i∈act pd i=pd h +Σ i∈corr pd i It is still equivalent even after replacement.

[0086] [Math.] Σ i∈act pd i subtract the known (b - -msg), [Math.] is obtained. Here, from the configuration of Pairwise Shared Seeds Masking, [Math.] holds true.

[0087] [Math.] This holds from Lemma C.6.

[0088] [Math.] b - -msg subtract the known Σ i∈corr m act,i row to obtain [Math.] can be obtained, but from the pseudorandomness of PRF, [Math.] holds. [Math.] even when defined as such, u′~U, therefore [Math.] holds.

[0089]

Num.

Num.

Num.

[0090]

Num.

Num.

[0091] According to the present embodiment, the cryptographic system 100 can apply Pairwise Shared Seeds Masking to threshold public key encryption, and security is ensured by masking error information for adjusting ciphertexts and partially decrypted text. ThPKE configured in this manner is guaranteed to have correctness and security regardless of the secret sharing scheme. As a result, without limiting the secret sharing scheme, the cryptographic system 100 can configure a threshold public key encryption based on the LWE problem that enables security proof with a practical ciphertext size.

[0092] Since the cryptographic system 100 does not limit the secret sharing scheme, for example, by adopting Shamir's secret sharing scheme, the size of the share of the secret information can be reduced, and an efficient threshold public-key cryptography that satisfies legitimacy and security with a realistically small key and ciphertext (mod q) size can be realized.

[0093] The LWE in this embodiment can be replaced with a Ring-LWE or a Module-LWE. Furthermore, Threshold FHE may be constructed by replacing the PKE portion with fully homomorphic encryption (FHE), and a Universal Thresholdizer (Non-Patent Literature 3) can be constructed using Threshold FHE, which can then be used to construct threshold signatures, CCA-secure Threshold PKE, distributed PRFs, functional cryptography, and the like.

[0094] Furthermore, this embodiment enables, for example, the realization of secure and efficient threshold public-key cryptography, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), "Build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0095] Although embodiments of the present invention have been described above, the present invention is not limited to the embodiments described above. Furthermore, the effects described in the embodiments described above are merely a list of the most preferred effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0096] The encryption method of the encryption system 100 is implemented by software or hardware circuitry. If implemented by software, the programs constituting this software are installed on an information processing device (computer). These programs may also be distributed to users by being recorded on removable media such as a CD-ROM, or by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a web service via a network without being downloaded. [Explanation of symbols]

[0097] 10 Management device 11 Key generation section 12 Secret Sharing Department 20 Encryption device 21 Encryption section 30 Adjustment device 31 Ciphertext Coordination Department 40 Decoder 41 Error transmission section 42 Partial Decoding Section 43 Overall Decoding Unit 100 Cryptographic Systems

Claims

1. A key generation unit that generates errors to adjust the noise distribution of ciphertext, along with a private key and a corresponding public key for threshold public-key cryptography based on Learning with Errors (LWE), Total number of parties N, each party P ｉ In contrast, the private key and the error are secretly shared using a predetermined linear secret sharing scheme, and the shares of the private key and the error, as well as the seed set {seed ｉ，ｊ , seed ｊ，ｉ } ｊ∈［Ｎ］ The secret sharing unit that distributes, Active Party P ｉ In this case, the share of the error is the seed value for the active party. ｉ，ｊ An error transmission unit that masks errors with pseudo-random numbers based on and sends the masked errors to an adjustment device, The adjustment device includes a ciphertext adjustment unit that adds the masked error and the ciphertext of zero received from each of the active parties to the ciphertext encrypted with the public key to generate an adjusted ciphertext, The active party P ｉ In this process, the adjusted ciphertext is partially decrypted using the shared secret key, and furthermore, the seed value related to the active party is ｊ，ｉ A partial decoding unit that generates partially decoded sentences by masking them with pseudorandom numbers based on the above, A cryptographic system comprising: a whole decryption unit that decrypts the message based on the sum of a number of partial decryption statements obtained from the active party that is greater than or equal to a threshold; and a whole decryption unit that decrypts the message.

2. The cryptographic system according to claim 1, wherein the linear secret sharing scheme is Shamir's secret sharing scheme.

3. The cryptographic system according to claim 1 or claim 2, wherein the LWE is a Ring-LWE.

4. The cryptographic system according to claim 1 or claim 2, wherein the threshold public-key cryptography is fully homomorphic.

5. Along with a secret key of a threshold public key cryptosystem based on Learning with Errors (LWE) and a public key corresponding to said secret key, an error for adjusting the noise distribution of a ciphertext is generated, and each party P among the total number N of parties ｉ , a secret key share and an error share obtained by secretly sharing said secret key and said error via a predetermined linear secret sharing scheme, and a seed set {seed ｉ，ｊ , seed ｊ，ｉ} ｊ∈［Ｎ］ after being distributed, Active Party P ｉ In this case, the share of the error is the seed value for the active party. ｉ，ｊ The ciphertext adjustment unit generates an adjusted ciphertext by masking it with a pseudo-random number based on the public key, and adding the masked error and zero ciphertext received from each of the active parties to the ciphertext encrypted with the public key. The active party P ｉ In this process, the adjusted ciphertext is partially decrypted using the share of the secret key, and furthermore, the seed value related to the active party ｊ，ｉ An adjustment device that generates partially decoded sentences by masking them with pseudo-random numbers based on the above, thereby enabling the decoded message based on the sum of the number of partially decoded sentences obtained from the active party that is greater than or equal to a threshold.

6. When errors are generated to adjust the noise distribution of the ciphertext, along with the private key and the corresponding public key of a threshold public-key cryptosystem based on Learning with Errors (LWE), each party P of the total number of parties N ｉ The following are distributed to the recipients: the share of the secret key and the share of the error obtained by secretly sharing the secret key and the error using a predetermined linear secret sharing scheme, and the seed set {seed} ｉ，ｊ , seed ｊ，ｉ } ｊ∈［Ｎ］ signal, Active Party P ｉ as, The share of the aforementioned error is determined by the seed value for the active party. ｉ，ｊ An error transmission unit that masks errors with pseudo-random numbers based on and sends the masked errors to a management device, In the management device, when the masked error and the ciphertext of zero received from each of the active parties are added to the ciphertext encrypted with the public key, and the adjusted ciphertext is received, the adjusted ciphertext is partially decrypted using the share of the private key, and further, the seed value related to the active party is... ｊ，ｉ A partial decoding unit that generates partially decoded sentences by masking them with pseudorandom numbers based on the above, A decoding device comprising: a whole decoding unit that decodes the message based on the sum of a number of partially decoded sentences obtained from the active party that is greater than or equal to a threshold; and a whole decoding unit that decodes the message.

7. An adjustment program for causing a computer to function as the adjustment device described in claim 5.

8. A decoding program for causing a computer to function as the decoding device described in claim 6.

Images