KEY EXCHANGE SYSTEM, DEVICE, KEY EXCHANGE METHOD, AND PROGRAM

Abstract

A key exchange system according to one embodiment has: a key generation unit that generates a first short-term private key and a first short-term public key of a quantum-resistant first key encapsulation mechanism, and a second short-term private key and a second short-term public key of a second key encapsulation mechanism, said second key encapsulation mechanism being traditional compared to the first key encapsulation mechanism, and generates a third short-term private key in which the first short-term private key and the second short-term private key are linked, and a third short-term public key in which the first short-term public key and the second short-term public key are linked; an encryption unit that uses the third short-term public key to generate a first ciphertext and a first shared key of the first key encapsulation mechanism, and a second ciphertext and a second shared key of the second key encapsulation mechanism, and generates a third shared key using a key generation function that treats the first shared key, the second shared key, the third short-term public key, the first ciphertext, and the second ciphertext as inputs; and a decryption unit that uses the third short-term private key to decrypt each of the first ciphertext and the second ciphertext and generate the first shared key and the second shared key, and generates the third shared key using the key generation function that treats the first shared key, the second shared key, the third short-term public key, the first ciphertext, and the second ciphertext as inputs.

Description

[Technical field]

[0001] The present invention relates to a key exchange system, a device, a key exchange method, and a program. [Background technology]

[0002] It is known that the practical application of quantum computers will make it possible to solve mathematical problems (e.g., the prime factorization problem and the discrete logarithm problem) that form the basis of the security of existing cryptographic methods within a realistic time. This raises the risk that existing cryptographic methods such as RSA and elliptic curve cryptography may be compromised, making it necessary to transition to cryptography that cannot be decrypted even by quantum computers (quantum-resistant cryptography).

[0003] A technology called Key Encapsulation Mechanism (KEM) is known. Key encapsulation is a technology that uses public key cryptography to encapsulate a shared key and deliver the shared key to a recipient in a single communication. A quantum-safe KEM has been proposed in a contest held by the National Institute of Standards and Technology (NIST) and other organizations (see, for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] NIST Post-Quantum Cryptography Standardization Activities, Internet<URL:https: / / csrc.nist.gov / Projects / post-quantum-cryptography / round-3-submissions> Summary of the Invention [Problem to be solved by the invention]

[0005] However, because quantum-safe KEM is a new technology, unlike conventional cryptography, whose security has been thoroughly verified, its security is currently being verified, and so there is a possibility that completely new attacks may be discovered that could compromise it.

[0006] One embodiment of the present invention has been made in consideration of the above points, and aims to realize a key encapsulation technology that is a hybrid of a cryptographic method with verified security and a post-quantum cryptographic method. [Means for solving the problem]

[0007] In order to achieve the above object, a key exchange system according to one embodiment includes a key generation unit that generates a first short-term private key and a first short-term public key of a quantum-resistant first key encapsulation mechanism, and a second short-term private key and a second short-term public key of a classical second key encapsulation mechanism with respect to the first key encapsulation mechanism, and generates a third short-term private key by concatenating the first short-term private key and the second short-term private key, and a third short-term public key by concatenating the first short-term public key and the second short-term public key, and a key generation unit that generates a first ciphertext and a first shared key of the first key encapsulation mechanism using the third short-term public key. an encryption unit that generates a second ciphertext and a second shared key of the second key encapsulation mechanism, and generates the third shared key by a key generation function that has as input the first shared key, the second shared key, the third short-term public key, the first ciphertext, and the second ciphertext; and a decryption unit that decrypts the first ciphertext and the second ciphertext, respectively, using the third short-term private key to generate the first shared key and the second shared key, and generates the third shared key by the key generation function that has as input the first shared key, the second shared key, the third short-term public key, the first ciphertext, and the second ciphertext. Effect of the Invention

[0008] It is possible to realize a key encapsulation technique that is a hybrid of a cryptographic method whose security has been verified and a post-quantum cryptographic method. [Brief description of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of an overall configuration of a key exchange system according to an embodiment of the present invention. [Diagram 2] FIG. 11 is a sequence diagram showing an example of a key exchange process according to the embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of a device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] An embodiment of the present invention will be described below. In this embodiment, a hybrid key encapsulation technique that combines an encryption technique whose safety has been thoroughly verified with a post-quantum encryption technique is proposed, and a key exchange system 1 that performs key exchange using this key encapsulation technique will be described.

[0011] <Key encapsulation technology> The key encapsulation technique KEM consists of three algorithms (KeyGen, Encap, Decap). These algorithms may also be called functions, procedures, etc.

[0012] KeyGen() → (sk, pk): The KeyGen algorithm outputs a short-term private key sk and a short-term public key pk. Note that the KeyGen algorithm may also take parameters, such as the key size, as input.

[0013] Encap(pk)→(k,C): The Encap algorithm inputs a short-term public key pk and outputs a session key k and a ciphertext C.

[0014] Decap(sk, C) → k / error: The Decap algorithm inputs a short-term secret key sk and a ciphertext C, and outputs a session key k or an error indicating a decryption failure.

[0015] In the following, we refer to the KEM of the post-quantum cryptography method (hereinafter, also referred to as the post-quantum KEM). POSTQ =(KeyGenPOSTQ ,Encap POSTQ ,Decap POSTQ )

[0016] The inputs and outputs of these algorithms are KeyGen POSTQ ()→(sk POSTQ ,pk POSTQ ) Encap POSTQ (pk POSTQ ) → (k POSTQ ,C POSTQ ) Decap(sk POSTQ ,C POSTQ ) → k POSTQ / error Let us assume that.

[0017] In addition, the security of conventional cryptographic methods has been thoroughly verified, and these methods are called classical KEMs (because they are classical cryptographic methods in comparison with post-quantum cryptography). PREQ =(KeyGen PREQ ,Encap PREQ ,Decap PREQ )

[0018] The inputs and outputs of these algorithms are KeyGen PREQ ()→(sk PREQ ,pk PREQ ) Encap PREQ (pk PREQ ) → (k PREQ ,C PREQ ) Decap(sk PREQ ,C PREQ ) → k PREQ / error Let us assume that.

[0019] In addition, quantum-resistant KEM POSTQ Specific examples of classical KEM include the technologies proposed in the NIST quantum-safe contest (for more on these technologies, see Non-Patent Document 1).PREQ Specific examples include PSEC-KEM, RSA-KEM, etc. For details on PSEC-KEM, see Reference 1 below, and for details on RSA-KEM, see Reference 2 below.

[0020] Reference 1: PSEC-KEM Specification version 2.2, Internet<URL:https: / / info.isl.ntt.co.jp / crypt / psec / dl / iso / psec-kem_v2.2_20080414e.pdf> Reference 2: Use of the RSA-KEM Key Transport Algorithm in the Cryptographic Message Syntax (CMS), Internet<URL:https: / / tools.ietf.org / pdf / rfc5990.pdf> However, the above specific examples are just examples. POSTQ Any quantum-resistant KEM can be used as the PREQ Any classical KEM (especially a KEM whose security has been thoroughly verified) can be used as the KEM.

[0021] More than quantum-resistant KEM POSTQ and Classical KEM PREQ A hybrid KEM (hereinafter, also referred to as a hybrid KEM) is constructed by using the above. h =(KeyGen h ,Encap h ,Decap h )

[0022] KeyGen h =KeyGen POSTQ ||KeyGen PREQ Let us assume that.

[0023] Specifically, KeyGen h ()→(sk h ,pk h )=(sk POSTQ||sk PREQ ,pk POSTQ ||pk PREQ ), where || represents concatenation (also called linking, joining, concatenating, or simply concatenating bit strings).

[0024] That is, hybrid KEM h Short-term private key sk h Quantum-resistant KEM POSTQ Short-term private key sk POSTQ and Classical KEM PREQ Short-term private key sk PREQ Similarly, the hybrid KEM h Ephemeral public key pk h Quantum-resistant KEM POSTQ Ephemeral public key pk POSTQ and Classical KEM PREQ Ephemeral public key pk PREQ and are concatenated.

[0025] Encap h =Encap POSTQ ||Encap PREQ Let us assume that.

[0026] Specifically, Encap h (pk h ) → (k,C h ) as follows:

[0027] C h =C POSTQ ||C PREQ k h =k POSTQ ||k PREQ k = KDF(k h ||pk h ||C h ) where KDF() is the key derivation function.

[0028] Decap h =Decap POSTQ ||Decap PREQ Let us assume that.

[0029] Specifically, Decap h (sk h ,C h ) → k = KDF(k h ||pk h ||C h ) / error.

[0030] Thus, quantum-resistant KEM POSTQ and Classical KEM PREQ Using the above, a hybrid KEM h =(KeyGen h ,Encap h ,Decap h In this case, when generating the session key k, we simply POSTQ and k PREQ The concatenated key k h Instead of using pk as a session key, use the short-term public key pk h and ciphertext C h Then, the session key k = KDF(k h ||pk h ||C h In other words, the short-term public key pk is used as the session ID in the key exchange. h and ciphertext C h A session key k is generated using the session ID including the

[0031] This allows, for example, POSTQ In addition, when generating the session key k, the short-term public key pk h and ciphertext C h is also input to the key derivation function KDF, so even if the session key k is leaked, other sessions will not be affected.

[0032] <Overall composition> Next, the hybrid KEM h The overall configuration of a key exchange system 1 that realizes key exchange by the above will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of a key exchange system 1 according to this embodiment.

[0033] 1, a key exchange system 1 according to this embodiment includes a device 10 and a device 20. The devices 10 and 20 are communicatively connected via a communication network N such as the Internet.

[0034] Device 10, KeyGen h Algorithms and Decaps h The device 20 is a device that executes the Encapsulation algorithm. h The devices 10 and 20 execute an algorithm. Examples of the devices 10 and 20 include various devices and equipment such as general-purpose servers, PCs (personal computers), smartphones, tablet terminals, wearable devices, in-vehicle devices, industrial devices, home appliances, and robots.

[0035] Here, the device 10 includes a key generation unit 101, a decryption unit 102, and a storage unit 103. The key generation unit 101 and the decryption unit 102 are realized, for example, by a processor such as a CPU (Central Processing Unit) executing one or more programs installed in the device 10. The storage unit 103 is realized, for example, by various memory devices such as a HDD (Hard Disk Drive), an SSD (Solid State Drive), and a flash memory.

[0036] The key generation unit 101 is a KeyGen h Run the algorithm and generate the short-term private key sk h and the short-term public key pk h In addition, the key generation unit 101 generates a short-term public key pk h is transmitted to device 20.

[0037] The decryption unit 102 receives the ciphertext C h When it receives Decap h Run the algorithm to generate the session key k.

[0038] The storage unit 103 stores the KeyGenh Algorithms and Decaps h It stores various information used in the execution of algorithms, the outputs of those algorithms, etc.

[0039] The device 20 also includes an encryption unit 201 and a storage unit 202. The encryption unit 201 is realized, for example, by a process in which one or more programs installed in the device 20 are executed by a processor such as a CPU. The storage unit 202 is realized, for example, by various memory devices such as an HDD, an SSD, or a flash memory.

[0040] The encryption unit 201 is Encap h Run the algorithm and get the ciphertext C h The encryption unit 201 generates a session key k by h is transmitted to device 10.

[0041] The storage unit 202 stores the Encap h It stores various information used in the algorithm, the output of this algorithm, etc.

[0042] <Key exchange process> Next, the key exchange process according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a sequence diagram showing an example of the key exchange process according to this embodiment.

[0043] First, the key generation unit 101 of the device 10 h () gives the short-term private key sk h and the short-term public key pk h (Step S101). h and short-term public key pk h is stored in the storage unit 103.

[0044] Next, the key generation unit 101 of the device 10 generates the short-term public key pk h to the device 20 (step S102).

[0045] The encryption unit 201 of the device 20 receives the short-term public key pk h When you receive the Encap h (pk h ) to obtain the session key k and the ciphertext C h is generated (step S103).

[0046] Here, pk h =pk POSTQ ||pk PREQ Therefore, the encryption unit 201 encrypts pk h pk POSTQ andpk PREQ After dividing it into POSTQ (pk POSTQ ) → (k POSTQ ,C POSTQ ) and Encap PREQ (pk PREQ ) → (k PREQ ,C PREQ ) and generate a session key k as follows:

[0047] C h =C POSTQ ||C PREQ k h =k POSTQ ||k PREQ k = KDF(k h ||pk h ||C h ) The session key k is stored in the storage unit 202 .

[0048] Next, the encryption unit 201 of the device 20 encrypts the ciphertext C h to the device 10 (step S104).

[0049] The decryption unit 102 of the device 10 decrypts the ciphertext C h When it receives Decap h (sk h ,C h ) to generate a session key k (step S105).

[0050] Here, Ch =C POSTQ ||C PREQ and sk h =sk POSTQ ||sk PREQ Therefore, the decoding unit 102 obtains C h C POSTQ and C. PREQ Divide into sk h sk POSTQ and sk PREQ Then, Decap(sk POSTQ ,C POSTQ ) → k POSTQ / error and Decap(sk PREQ ,C PREQ ) → k PREQ Run / error and then k POSTQ and k PREQ If k is obtained, the decryption unit 102 generates a session key k as follows:

[0051] k h =k POSTQ ||k PREQ k = KDF(k h ||pk h ||C h ) The session key k is stored in the storage unit 103 .

[0052] In this manner, the session key k is shared between the device 10 and the device 20, and the key exchange process is completed. After this, the devices 10 and 20 can realize encrypted communication using the session key k.

[0053] <Application Examples> The hybrid KEM described in this embodiment will be described below. h As an application example, we explain the hybridization of quantum-resistant DMKD.

[0054] Multiparty key exchange technologies include GKE (Group Key Exchange), which is a mesh-type key exchange, and MKD (Multi Key Distribution), which is a star-type key exchange. These key exchanges have issues such as communication costs increasing in proportion to the number of participants, and the shared key being transmitted to the server. These issues have been resolved by a key exchange technology called DMKD (Multi-Cast Key Distribution: Scalable, Dynamic and Provably Secure Construction) (see Reference 3 below, for example). DMKD allows key exchange to be performed in a constant number of rounds regardless of the number of participants, and also keeps the shared key secret from the server. In addition, a method for constructing the DMKD protocol has been proposed that makes it possible to apply quantum-safe methods to the key exchange part of DMKD (see Reference 4 below, for example).

[0055] Reference 3: Kazuki Yoneyama, Reo Yoshida, Yuto Kawahara, Tetsutaro Kobayashi, Hitoshi Fuji, Tomohide Yamamoto, Multi-Cast Key Distribution: Scalable, Dynamic and Provably Secure Construction, ProvSec(2016) Reference 4: Koha Kinjo, Hiroki Okano, Tsunekazu Saito, Keita Kusakawa, Tetsutaro Kobayashi, Fumiaki Hoshino, Dynamic Multi-Party Key Distribution Protocol Using KEM, Symposium on Cryptography and Information Security (2018) The quantum-safe DMKD protocol consists of five algorithms: Setup, Dist, Join, Leave, and Update. These algorithms use attribute-based encryption, public key encryption, key encapsulation, commitment, and message authentication.

[0056] In this application example, in order to hybridize the quantum-resistant DMKD, a hybrid method is used for attribute-based encryption, which is a public key system, public key encryption, key encapsulation technology, and commitment. At this time, the hybrid method is used for hybridizing the key encapsulation technology, using the hybrid KEM described in this embodiment. h On the other hand, for technologies other than key encapsulation, hybridization can be achieved by simple concatenation. In other words, any algorithm of the hybrid method of technologies other than key encapsulation (attribute-based encryption, public key encryption, and commitment) can be concatenated as Alg. h The relevant algorithm for quantum-resistant cryptography is Alg POSTQ The classical cryptography algorithm is Alg PREQ Then, Alg h =Alg POSTQ ||Alg PREQ In this case, the key and various information can be simply linked.

[0057] As specific examples of attribute-based cryptography, for example, there is IntelliCryptography in classical cryptography, and there is lattice-based attribute-based cryptography in post-quantum cryptography. Please refer to Reference 5 below for IntelliCryptography, and Reference 6 below for lattice-based attribute-based cryptography.

[0058] Reference 5: Okamoto, Tatsuaki, and KatsuyukiTakashima. "Fully secure functional encryption with general relations from the decisional linear assumption." Annual cryptology conference. Springer, Berlin, Heidelberg, 2010. Reference 6: YongtaoWang, Lattice CiphertextPolicy Attribute-based Encryption in the Standard Model, International Journal of Network Security, Vol.16, No.6, PP.444-451, Nov. 2014. Specific examples of public key cryptography and key encapsulation techniques include, for example, PSEC-KEM for classical cryptography and the technology proposed in the NIST Post-Quantum Contest for post-quantum cryptography.

[0059] Specific examples of commitments include classical cryptography such as ECDSA and EdDSA, and post-quantum cryptography such as the technologies proposed in the NIST Post-Quantum Contest.

[0060] However, the above specific examples are merely examples, and the present invention is not limited to these specific examples.

[0061] <Hardware configuration> Finally, the hardware configuration of the devices 10 and 20 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the hardware configuration of the devices 10 and 20 according to this embodiment. Note that the devices 10 and 20 can be realized with the same hardware configuration, so the hardware configuration of the device 10 will be described below.

[0062] 3, the device 10 according to the present embodiment includes an input device 301, a display device 302, an external I / F 303, a communication I / F 304, a processor 305, and a memory device 306. Each of these pieces of hardware is communicatively connected via a bus 307.

[0063] The input device 301 is, for example, a keyboard, a mouse, a touch panel, etc. The display device 302 is, for example, a display, etc. Note that the device 10 does not necessarily have to have at least one of the input device 301 and the display device 302, for example.

[0064] The external I / F 303 is an interface with an external device such as a recording medium 303a. The device 10 can read and write data from and to the recording medium 303a via the external I / F 303. Examples of the recording medium 303a include a compact disc (CD), a digital versatile disc (DVD), a secure digital memory card (SD memory card), and a universal serial bus (USB) memory card.

[0065] The communication I / F 304 is an interface for connecting the device 10 to the communication network N. The processor 305 is, for example, various types of arithmetic devices such as a CPU. The memory device 306 is, for example, various types of storage devices such as an HDD, SSD, flash memory, RAM (Random Access Memory), and ROM (Read Only Memory).

[0066] The devices 10 and 20 according to the present embodiment can realize the above-mentioned key exchange process by having the hardware configuration shown in Fig. 3. Note that the hardware configuration shown in Fig. 3 is only an example, and the devices 10 and 20 may have, for example, multiple processors or multiple memory devices, or may have various other hardware configurations.

[0067] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0068] 1. Key Exchange System 10 equipment 20 equipment 101 Key generation section 102 Decoding section 103 Storage section 201 Encryption section 202 Storage section 301 Input Device 302 Display device 303 External I / F 303a Recording media 304 Communication I / F 305 Processor 306 Memory Device 307 Bus

Claims

1. a key generation unit that generates a first short-term private key and a first short-term public key of a quantum-resistant first key encapsulation mechanism, and a second short-term private key and a second short-term public key of a classical second key encapsulation mechanism whose security has been verified against the first key encapsulation mechanism, and generates a third short-term private key obtained by concatenating the first short-term private key and the second short-term private key, and a third short-term public key obtained by concatenating the first short-term public key and the second short-term public key; an encryption unit that generates a first ciphertext and a first shared key of the first key encapsulation mechanism, and a second ciphertext and a second shared key of the second key encapsulation mechanism, using the third short-term public key, and generates the third shared key by a key generation function having as input a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext; a decryption unit that uses the third short-term private key to decrypt the first ciphertext and the second ciphertext, respectively, to generate the first shared key and the second shared key, and generates the third shared key using the key generation function that receives as input a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext; A key exchange system having

2. The encryption unit includes: generating the third shared key by inputting a concatenated value of the first shared key and the second shared key, the third short-term public key, and a concatenated value of the first ciphertext and the second ciphertext into the key generation function; The decoding unit is 2. The key exchange system of claim 1, wherein the third shared key is generated by inputting a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext into the key generation function.

3. a key generation unit that generates a first short-term private key and a first short-term public key of a quantum-resistant first key encapsulation mechanism, and a second short-term private key and a second short-term public key of a classical second key encapsulation mechanism whose security has been verified against the first key encapsulation mechanism, and generates a third short-term private key obtained by concatenating the first short-term private key and the second short-term private key, and a third short-term public key obtained by concatenating the first short-term public key and the second short-term public key; a transmission unit that transmits the third short-term public key to another device connected via a communication network; a decryption unit that uses the third short-term private key to decrypt a ciphertext received from the other device to generate a first shared key of the first key encapsulation mechanism and a second shared key of the second key encapsulation mechanism, and generates a third shared key to be shared with the other device by a key generation function that receives as input a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and the ciphertext; Equipment having the above configuration.

4. an encryption unit that generates a first ciphertext and a first shared key of a first key encapsulation mechanism having quantum resistance, and a second ciphertext and a second shared key of a classical second key encapsulation mechanism whose safety has been verified against the first key encapsulation mechanism, using a short-term public key received from another device connected via a communication network, and generates a third shared key to be shared with the other device by a key generation function having as input a value obtained by concatenating the first shared key and the second shared key, the short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext; Equipment having the above configuration.

5. a key generation step of generating a first short-term private key and a first short-term public key of a quantum-resistant first key encapsulation mechanism, and a second short-term private key and a second short-term public key of a classical second key encapsulation mechanism whose security has been verified against the first key encapsulation mechanism, and generating a third short-term private key by concatenating the first short-term private key and the second short-term private key, and a third short-term public key by concatenating the first short-term public key and the second short-term public key; an encryption step of generating a first ciphertext and a first shared key of the first key encapsulation mechanism, and a second ciphertext and a second shared key of the second key encapsulation mechanism, using the third short-term public key, and generating the third shared key by a key generation function having as inputs a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext; a decryption step of generating the first shared key and the second shared key by decrypting the first ciphertext and the second ciphertext using the third short-term private key, and generating the third shared key using the key generation function that receives as input a value obtained by concatenating the first shared key and the second shared key, the third short-term public key, and a value obtained by concatenating the first ciphertext and the second ciphertext; A key exchange method performed by a computer.

6. A program for causing a computer to function as the key exchange system according to claim 1 or 2.

Images