Cryptographic system, encryption device, decryption device, method, and program

Abstract

This cryptographic system encrypts and decrypts with a public key cryptography schema involving tag-based encryption TBE=(GenTBE, EncTBE, DecTBE), a weak commitment scheme wCom=(Init, S, R) and a message authentication code MAC=(T, V), and is provided with: a key generation unit which, with κ as a security parameter, generates an encryption key ekTBE and a decryption key dkTBE on the basis of a key generation algorithm GenTBE(1κ), generates a common parameter pub on the basis of an initialization algorithm Init (1κ), and sets the encryption key ekTBE and the common parameter pub as the encryption key ek in the public key encryption scheme, and the decryption key dkTBE as the decryption key dk in the public key encryption scheme; an encryption unit which generates a random number r, a commitment com and a decommitment dec on the basis of a sender algorithm S (1κ, pub), generates a coded text c on the basis of the encryption algorithm EncTBE (ekTBE, com, (m, dec)) with m as the plaintext to be encrypted, generates a tag σ by means of the MAC generation algorithm T (r, c), and sets the commitment com, the coded text c and the tag σ as the coded text ct in the public key encryption scheme; and a decryption unit which parses the coded text ct into the commitment com, the coded text c and the tag σ, generates a plaintext m and a decommitment dec by means of a decryption algorithm DecTBE (dkTBE, com, c), verifies whether it was possible to commit to the random number r by means of the receiver algorithm R (pub, com, dec), and if the commit was successful, verifies the tag σ by means of a verification algorithm V(r, c, σ).

Description

[Technical field]

[0001] The present invention relates to a cryptosystem, an encryption device, a decryption device, a method, and a program. [Background technology]

[0002] There is a known method for constructing IND-CCA secure public key cryptography from ID-based cryptography or tag-based cryptography by Boneh-Katz transformation (hereinafter also referred to as BK transformation). For example, Non-Patent Document 1 describes a method for constructing IND-CCA secure public key cryptography from ID-based cryptography by BK transformation. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Dan Boneh, Ran Canetti, Shai Halevi, and Jonathan Katz. Chosen-ciphertext security from identity-based encryption. SIAM J. Comput., 36(5):1301-1328, 2007. Summary of the Invention [Problem to be solved by the invention]

[0004] However, the conventional method described in Non-Patent Document 1 and the like has problems in that if a public key is included in the ciphertext, it becomes possible to determine from the ciphertext who the ciphertext is addressed to, and therefore anonymity cannot be sufficiently ensured.

[0005] An embodiment of the present invention has been made in consideration of the above points, and has an object to realize a secure public key cryptography that ensures anonymity. [Means for solving the problem]

[0006] In order to achieve the above object, an encryption system according to one embodiment provides a tag-based encryption scheme TBE=(Gen TBE ,Enc TBE ,Dec TBE A cryptosystem that performs encryption and decryption using a public key cryptosystem consisting of a weak commitment scheme wCom=(Init,S,R) and a message authentication code scheme MAC=(T,V), with a security parameter κ and a key generation algorithm Gen TBE (1 κ ) to generate the encryption key ek TBE and the decryption key dk TBE and initialize the algorithm Init(1 κ ) to generate a common parameter pub, and the encryption key ek TBE and the common parameter pub, the encryption key ek of the public key cryptosystem, and the decryption key dk TBE A key generation unit that generates a decryption key dk of the public key cryptosystem, and a sender algorithm S(1 κ , pub) to generate a random number r, a commitment com, and a decommitment dec, and use the encryption algorithm Enc TBE (ek TBE an encryption unit that generates a ciphertext c by a MAC generation algorithm T(r,c), generates a tag σ by a MAC generation algorithm T(r,c), and converts the commitment com, the ciphertext c, and the tag σ into a ciphertext ct of the public key cryptosystem; TBE (dk TBE and a decryption unit that generates a plaintext m and a decommitment dec using a receiver algorithm R(pub,com,dec), verifies whether or not the random value r can be committed using a receiver algorithm R(pub,com,dec), and verifies the tag σ using a verification algorithm V(r,c,σ) if the commitment is successful. Effect of the Invention

[0007] It is possible to realize a secure public key cryptosystem that ensures anonymity. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of an overall configuration of a cryptographic system according to an embodiment of the present invention. [Diagram 2] FIG. 2 illustrates an example of a hardware configuration of a computer. [Diagram 3] FIG. 2 is a sequence diagram showing an example of the overall processing flow of the cryptographic system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of the present invention will be described below. In this embodiment, a cryptosystem 1 that realizes secure public key cryptography that ensures anonymity (hereinafter, also referred to as anonymous public key cryptography) will be described.

[0010] <Preparation> Below we provide the building blocks necessary to explain anonymous public key cryptography.

[0011] Public Key Cryptography Public key cryptography (PKE) is a method to encrypt and ciphertext using three algorithms: PKE ,Enc PKE ,Dec PKE )

[0012] Gen PKE (1 κ ) → (ek,dk) Key generation algorithm Gen PKE is the 1 using the safety parameter κ κ The input is a key pair (ek, dk) and the output is a key pair (ek, dk). ek is called the encryption key and dk is called the decryption key. κ represents a κ bit string of 1. To be precise, κ is called a security parameter, but to be clear, it is 1 κ may be referred to as safety parameters.

[0013] Enc PKE (ek,m) →c Encryption algorithm Enc PKEtakes encryption key ek and plaintext m∈M as input and outputs ciphertext c∈C, where M represents the plaintext space and C represents the ciphertext space.

[0014] Dec PKE (dk,c)→m / ⊥ Decoding algorithm Dec PKE takes the decryption key dk and the ciphertext c as input, and outputs the plaintext m∈M or the symbol ⊥ representing rejection. Note that the symbol ⊥ representing rejection means that the decryption of the ciphertext c has failed, and is not included in the plaintext space M.

[0015] <Tag-based encryption> The tag-based encryption scheme TBE uses three algorithms (Gen TBE ,Enc TBE ,Dec TBE )

[0016] Gen TBE (1 κ ) → (ek,dk) Key generation algorithm Gen TBE is the 1 using the safety parameter κ κ It takes input and outputs a key pair (ek, dk).

[0017] Enc TBE (ek, τ, m) → c Encryption algorithm Enc TBE takes encryption key ek, tag τ, and plaintext m∈M as input, and outputs ciphertext c∈C.

[0018] Dec TBE (dk,τ,c)→m / ⊥ Decoding algorithm Dec TBE takes the decryption key dk, the tag τ, and the ciphertext c as input, and outputs the plaintext m∈M or the symbol ⊥ representing rejection.

[0019] <Weak commitment> The weak commitment scheme wCom consists of three algorithms: Init, S, and R.

[0020] ·Init(1κ ) →pub The initialization algorithm Init is a 1 with a safety parameter κ. κ It takes input and outputs common parameter pub.

[0021] ·S(1 κ ,pub) →(r,com,dec) The sender algorithm S is a 1 with a security parameter κ. κ and the common parameter pub as input, and a random value r∈{0,1} κ and output the commitment com and decommitment dec. Note that {0,1} κ represents a binary sequence of length κ bits.

[0022] ·R(pub,com,dec)→r / ⊥ The receiver algorithm R takes public parameters pub, commitment com, and decommitment dec as input, and returns a random value r∈{0,1} κ Or, it outputs the symbol ⊥, which indicates denial. Note that the symbol ⊥, which indicates denial, means that the commit has failed, and is expressed as {0, 1}. κ is not included.

[0023] Message Authentication Code The message authentication code (MAC) is composed of two algorithms (T, V).

[0024] ·T(r,μ)→σ The MAC generation algorithm T uses key r∈{0,1} κ and message μ∈{0,1} * The input is {0,1} and the output is a tag σ. * represents a binary sequence of any length.

[0025] ·V(r,μ,σ)→T / ⊥ The verification algorithm V takes the key r, the message μ, and the tag σ as input, and outputs the symbol T, which indicates acceptance, or the symbol ⊥, which indicates rejection. Note that when the symbol T, which indicates acceptance, is output, it means that the verification of the tag σ has been successful, and when the symbol ⊥, which indicates rejection, it means that the verification of the tag σ has failed.

[0026] <Anonymous public key cryptography> Next, the anonymous public key encryption scheme PKE according to this embodiment is configured using the tag-based encryption scheme TBE, the weak commitment scheme wCom, and the message authentication code scheme MAC prepared above. Note that this configuration method itself is the BK transformation described in the above Non-Patent Document 1. However, the above Non-Patent Document 1 uses the ID-based encryption scheme IBE instead of the tag-based encryption scheme TBE.

[0027] The anonymous public key cryptography method PKE=(Gen PKE ,Enc PKE ,Dec PKE In the following, the encryption key ek and the decryption key dk of the tag-based encryption scheme TBE are denoted as ek and dk, respectively. TBE and dk TBE This is expressed as:

[0028] Gen PKE (1 κ ) → (ek,dk) Key generation algorithm Gen PKE is the 1 using the safety parameter κ κ The input is the encryption key ek and the decryption key dk pair (ek, dk) are output. In this case, the key generation algorithm Gen PKE outputs (ek, dk) by the following Step 1-1 to Step 1-3. Note that Step 1-1 and Step 1-2 can be performed in any order.

[0029] Step1-1:(ek TBE ,dk TBE )←Gen TBE (1 κ ) Step1-2:pub←Init(1κ ) Step1-3:ek:=(ek TBE ,pub) and dk:=dk TBE Output.

[0030] Enc PKE (ek,m) →ct Encryption algorithm Enc PKE takes encryption key ek and plaintext m∈M as input and outputs ciphertext ct∈C. In this case, the encryption algorithm Enc PKE The ciphertext ct is output by the following Step 2-1 to Step 2-4.

[0031] Step2-1: (r, com, dec) ← S(1 κ ,pub) Step2-2: c←Enc TBE (ek TBE ,com,(m,dec)) Step2-3: σ←T(r,c) Step2-4: Output ct:=(com,c,σ).

[0032] Dec PKE (dk,ct) →m / ⊥ Decoding algorithm Dec PKE takes the decryption key dk and the ciphertext ct as input, and outputs the plaintext m∈M or the symbol ⊥ representing rejection. PKE outputs the plaintext m or the symbol ⊥ representing denial through the following Steps 3-1 to 3-4.

[0033] Step 3-1: Parse ct = (com, c, σ). Note that parsing ct means extracting com, c, and σ from ct.

[0034] Step3-2: (m,dec)←Dec TBE (dk TBE ,com,c); and if (m,dec)=⊥, output the symbol ⊥, which indicates rejection. Step 3-3: r←R(pub,com,dec); If r=⊥, output the symbol ⊥, which indicates rejection. Step 3-4: If V(r, c, σ)=⊥, output ⊥; otherwise, output m.

[0035] <Safety> The security of the anonymous public key encryption scheme PKE constructed above varies depending on the security of its components, the tag-based encryption scheme TBE, the weak commitment scheme wCom, and the message authentication code scheme MAC.

[0036] - In the case of BK conversion (same as conventional technology) Tag-based encryption scheme TBE is IND-st-wCCA secure Weak commitment method wCom is safe Message Authentication Code (MAC) is sEUF-OT-CMA secure If , the anonymous public key encryption scheme PKE is IND-CCA secure.

[0037] Safety Pattern 1 Tag-based encryption scheme TBE is INDr-st-wCCA secure Weak commitment method wCom is secure and INdr is secure Message authentication code MAC is sEUF-OT-CMA secure and pseudorandom If so, then the anonymous public key encryption scheme PKE is INDr-CCA secure.

[0038] Safety Pattern 2 Tag-based encryption scheme TBE is OS-st-wCCA secure Weak commitment method wCom is safe and OS safe Message authentication code MAC is sEUF-OT-CMA secure and OS secure If , then the anonymous public key encryption scheme PKE is OS-CCA secure.

[0039] In this way, the security of the anonymous public key encryption method PKE configured as above is changed by changing the security of its components. Also, as described above, in security pattern 1 and security pattern 2, the security of the anonymous public key encryption method PKE is INdr-CCA secure and OS-CCA secure, respectively. Therefore, by adopting security pattern 1 or security pattern 2 as the security of the tag-based encryption method TBE, the weak commitment method wCom, and the message authentication code method MAC, a secure public key encryption method PKE that ensures anonymity can be realized. Note that it is possible to prove that the anonymous public key encryption method PKE is INdr-CCA secure in the case of security pattern 1, and that the anonymous public key encryption method PKE is OS-CCA secure in the case of security pattern 2.

[0040] Although the above definitions of safety are generally known, please refer to the following references if necessary.

[0041] Reference 1: Ran Canetti and Marc Fischlin. Universally composable commitments. In Joe Kilian, editor, CRYPTO 2001, volume 2139 of LNCS, pages 19-40. Springer, Heidelberg, August 2001. Reference 2: Charles Rackoff and Daniel R. Simon. Noninteractive zero-knowledge proof of knowledge and chosen ciphertext attack. In Joan Feigenbaum, editor, CRYPTO'91, volume 576 of LNCS, pages 433-444. Springer, Heidelberg, August 1992. Reference 3: Mihir Bellare, Anand Desai, David Pointcheval, and Phillip Rogaway. Relations among notions of security for public-key encryption schemes. In Hugo Krawczyk, editor, CRYPTO'98, volume 1462 of LNCS, pages 26-45. Springer, Heidelberg, August 1998. Reference 4: Eike Kiltz. Chosen-ciphertext security from tag-based encryption. In Shai Halevi and Tal Rabin, editors, TCC 2006, volume 3876 of LNCS, pages 581-600. Springer, Heidelberg, March 2006. <Overall configuration of cryptosystem 1> Next, the overall configuration of the cryptosystem 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the cryptosystem 1 according to this embodiment.

[0042] 1, the cryptographic system 1 according to the present embodiment includes an encryption device 10 and a decryption device 20. The encryption device 10 and the decryption device 20 are communicatively connected to each other via a communication network 30 such as the Internet.

[0043] The encryption device 10 is an information processing device such as a terminal or device that encrypts a plaintext m. The encryption device 10 includes an encryption processing unit 101 and a storage unit 102. The encryption processing unit 101 encrypts a plaintext m using an encryption algorithm Enc PKE The storage unit 102 stores the encryption algorithm Enc PKE Various information required for executing (eg, encryption key ek, security parameter κ, common parameter pub, etc.) is stored.

[0044] The decryption device 20 is an information processing device such as a terminal or device that decrypts the ciphertext ct. The decryption device 20 includes a key generation processing unit 201, a decryption processing unit 202, and a storage unit 203. The key generation processing unit 201 generates a key using a key generation algorithm Gen PKE The decryption processing unit 202 generates the encryption key ek and the decryption key dk by the decryption algorithm Dec of the anonymous public key cryptography PKE. PKE The storage unit 203 stores a key generation algorithm Gen PKE and the decoding algorithm Dec PKE The information required for executing (for example, security parameter κ, common parameter pub, decryption key dk, etc.) is stored. Note that, hereinafter, the security parameter κ and the common parameter pub are also referred to as public parameters.

[0045] 1, the encryption key ek and the decryption key dk of the anonymous public key cryptosystem PKE are generated by the decryption device 20, but this is only an example, and for example, a server functioning as a key generation station or the like may generate the encryption key ek and the decryption key dk. In this case, the server has a key generation processing unit 201, which generates the encryption key ek and the decryption key dk and distributes the decryption key dk to the decryption device 20 in some secure manner, while the encryption key ek and the public parameters are made public to the encryption device 10 and the decryption device 20.

[0046] <Hardware configuration of cryptosystem 1> Next, a description will be given of the hardware configuration of the encryption device 10 and the decryption device 20 included in the cryptographic system 1 according to this embodiment. The encryption device 10 and the decryption device 20 can be realized, for example, by the hardware configuration of a computer 500 shown in FIG.

[0047] 2 includes, as hardware, an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a processor 505, and a memory device 506. Each of these pieces of hardware is connected to each other via a bus 507 so as to be able to communicate with each other.

[0048] The input device 501 is, for example, a keyboard, a mouse, a touch panel, etc. The display device 502 is, for example, a display, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502.

[0049] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0050] The communication I / F 504 is an interface for connecting to the communication network 30. The processor 505 is, for example, various types of arithmetic devices such as a central processing unit (CPU) and a graphics processing unit (GPU). The memory device 506 is, for example, various types of storage devices such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), a read only memory (ROM), a flash memory, etc.

[0051] The encryption device 10 and the decryption device 20 according to this embodiment can realize various processes described below using the hardware configuration of a computer 500 shown in Fig. 2. Note that the hardware configuration of the computer 500 shown in Fig. 2 is merely an example, and various hardware configurations may be adopted depending on the application of the target to which the encryption system 1 is applied.

[0052] The encryption processing unit 101 is realized, for example, by a process in which one or more programs installed in the encryption device 10 are executed by a processor 505 of a computer 500 that realizes the encryption device 10. The storage unit 102 is realized, for example, by a memory device 506 of the computer 500 that realizes the encryption device 10.

[0053] Similarly, the key generation processing unit 201 and the decryption processing unit 202 are realized, for example, by a process in which one or more programs installed in the decryption device 20 are executed by a processor 505 of a computer 500 that realizes the decryption device 20. Also, the storage unit 203 is realized, for example, by a memory device 506 of the computer 500 that realizes the decryption device 20.

[0054] <Overall processing of cryptosystem 1> Next, the overall process flow of the cryptographic system 1 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a sequence diagram showing an example of the overall process flow of the cryptographic system 1 according to this embodiment.

[0055] First, the key generation processing unit 201 of the decryption device 20 generates a key generation algorithm Gen PKE (1 κ ) to generate an encryption key ek and a decryption key dk (step S101). The decryption key dk is stored in the storage unit 203.

[0056] Next, the key generation processing unit 201 of the decryption device 20 transmits the public parameters (i.e., the security parameter κ and the common parameter pub) and the encryption key ek generated in the above step S101 to the encryption device 10 (step S102). Note that, although the public parameters and the encryption key ek are transmitted to the encryption device 10 in this step, they do not necessarily have to be transmitted and may be stored in, for example, a server that the encryption device 10 can refer to.

[0057] The encryption processing unit 101 of the encryption device 10 uses the encryption algorithm Enc PKE (ek, m) is executed to encrypt the plaintext m (step S103), thereby generating the ciphertext ct.

[0058] Next, the encryption processing unit 101 of the encryption device 10 transmits the ciphertext ct generated in the above step S103 to the decryption device 20 (step S104).

[0059] The decryption processing unit 202 of the decryption device 20 uses the decryption algorithm Dec of the anonymous public key cryptography PKE. PKE (dk, ct) is executed to decrypt the ciphertext ct (step S105), thereby generating the plaintext m.

[0060] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0061] 1. Cryptographic Systems 10 Encryption device 20 Decryption device 30 Communication Network 101 Encryption processing unit 102 Storage section 201 Key generation processing unit 202 Decryption processing unit 203 Storage section

Claims

1. Tag-based encryption scheme TBE=(Gen ＴＢＥ , Enc ＴＢＥ , Dec ＴＢＥ A cryptosystem for performing encryption and decryption using a public key cryptosystem consisting of a weak commitment scheme wCom=(Init, S, R) and a message authentication code scheme MAC=(T, V), With the security parameter κ, the key generation algorithm Gen ＴＢＥ (1 κ ) to obtain the encryption key ek ＴＢＥ and the decryption key dk ＴＢＥ and generates the initialization algorithm Init(1 κ ) to generate a common parameter pub, and the encryption key ek ＴＢＥ and the common parameter pub, the encryption key ek of the public key cryptosystem, and the decryption key dk ＴＢＥ a key generation unit for generating a decryption key dk of the public key cryptosystem; Sender algorithm S(1 κ , pub), generate a random number r, a commitment com, and a decommitment dec, and use the encryption algorithm Enc ＴＢＥ (e.g. ＴＢＥ an encryption unit that generates a ciphertext c using a MAC generation algorithm T(r, c), generates a tag σ using a MAC generation algorithm T(r, c), and converts the commitment com, the ciphertext c, and the tag σ into a ciphertext ct of the public key cryptography; The ciphertext ct is parsed into the commitment com, the ciphertext c, and the tag σ, and a decryption algorithm Dec ＴＢＥ (d.k. ＴＢＥ a decryption unit that generates a plaintext m and a decommitment dec using a receiver algorithm R(pub, com, dec), verifies whether or not the random value r can be committed using a receiver algorithm R(pub, com, dec), and verifies the tag σ using a verification algorithm V(r, c, σ) if the commitment is successful; A cryptosystem having

2. If the tag-based encryption scheme TBE is INDr-st-wCCA secure, the weak commitment scheme wCom is secure and INDr secure, and the message authentication code scheme MAC is sEUF-OT-CMA secure and pseudorandom, the public key encryption scheme is INDr-CCA secure; 2. The cryptographic system of claim 1, wherein the public key cryptography is OS-CCA secure if the tag-based encryption scheme TBE is OS-st-wCCA secure, the weak commitment scheme wCom is secure and OS secure, and the message authentication code scheme MAC is sEUF-OT-CMA secure and OS secure.

3. Tag-based encryption scheme TBE=(Gen ＴＢＥ , Enc ＴＢＥ , Dec ＴＢＥ ), a weak commitment scheme wCom=(Init, S, R), and a message authentication code scheme MAC=(T, V), Let the security parameter be κ and the common parameter be pub. κ , pub) to generate a random number r, a commitment com, and a decommitment dec, and set the encryption key of the public key cryptosystem as ek = ek ＴＢＥ Encryption algorithm Enc ＴＢＥ (e.g. ＴＢＥ an encryption unit that generates a ciphertext c using a MAC generation algorithm T(r, c), generates a tag σ using a MAC generation algorithm T(r, c), and converts the commitment com, the ciphertext c, and the tag σ into a ciphertext ct of the public key cryptography; a transmission unit that transmits the ciphertext ct to a decryption device that is connected to the encryption device via a communication network; An encryption device having:

4. Tag-based encryption scheme TBE=(Gen ＴＢＥ , Enc ＴＢＥ , Dec ＴＢＥ ), a weak commitment scheme wCom=(Init, S, R), and a message authentication code scheme MAC=(T, V), With the security parameter κ, the key generation algorithm Gen ＴＢＥ (1 κ ) to obtain the encryption key ek ＴＢＥ and the decryption key dk ＴＢＥ and generates the initialization algorithm Init(1 κ ) to generate a common parameter pub, and the encryption key ek ＴＢＥ and the common parameter pub, the encryption key ek of the public key cryptosystem, and the decryption key dk ＴＢＥ a key generation unit for generating a decryption key dk of the public key cryptosystem; The ciphertext ct is parsed into a commitment com, a ciphertext c, and a tag σ, and a decryption algorithm Dec ＴＢＥ (d.k. ＴＢＥ a decryption unit that generates a plaintext m and a decommitment dec using a receiver algorithm R(pub, com, dec), verifies whether or not the random value r can be committed using a receiver algorithm R(pub, com, dec), and verifies the tag σ using a verification algorithm V(r, c, σ) if the commitment is successful; A decoding device having the above configuration.

5. Tag-based encryption scheme TBE=(Gen ＴＢＥ , Enc ＴＢＥ , Dec ＴＢＥ A cryptosystem that performs encryption and decryption using a public key cryptosystem consisting of a weak commitment scheme wCom=(Init, S, R) and a message authentication code scheme MAC=(T, V), With the security parameter κ, the key generation algorithm Gen ＴＢＥ (1 κ ) to obtain the encryption key ek ＴＢＥ and the decryption key dk ＴＢＥ and generates the initialization algorithm Init(1 κ ) to generate a common parameter pub, and the encryption key ek ＴＢＥ and the common parameter pub, the encryption key ek of the public key cryptosystem, and the decryption key dk ＴＢＥ a key generation step for generating a decryption key dk of the public key cryptosystem; Sender algorithm S(1 κ , pub), generate a random number r, a commitment com, and a decommitment dec, and use the encryption algorithm Enc ＴＢＥ (e.g. ＴＢＥ an encryption procedure of generating a ciphertext c using a MAC generation algorithm T(r, c), generating a tag σ using a MAC generation algorithm T(r, c), and taking the commitment com, the ciphertext c, and the tag σ as the ciphertext ct of the public key cryptography; The ciphertext ct is parsed into the commitment com, the ciphertext c, and the tag σ, and a decryption algorithm Dec ＴＢＥ (d.k. ＴＢＥ a decryption procedure in which a plaintext m and a decommitment dec are generated by a receiver algorithm R(pub, com, dec), and whether or not the random value r can be committed is verified by a receiver algorithm R(pub, com, dec), and if the commitment is successful, the tag σ is verified by a verification algorithm V(r, c, σ); How to do it.

6. A program for causing a computer to function as the encryption device according to claim 3 or the decryption device according to claim 4.

Images