Identity-based encryption method using Pedersen Commit and corresponding decryption method

Abstract

It provides a method to perform identity-based encryption using Pedersen Commit. In a method for performing identity-based encryption using Pedersen Commit, an encryptor receives public parameters and a public key (S310) and randomly determines cryptographic constants (S320), parses a plurality of parameters and a parameter vector from the public parameters (S330), determines a first ciphertext and a second ciphertext (S340) using the plurality of parameters, the cryptographic constants, and a message, parses an ID value including a plurality of bits (S350) from the public key, and calculates a third ciphertext (S360) using the ID value, and outputs the determined first ciphertext, second ciphertext, and third ciphertext (S370).

Description

[Technical field]

[0001] The present invention relates to an identity-based encryption method using Pedersen Commit and a corresponding decryption method. [Background technology]

[0002] Zero-knowledge proofs are often used to provide verifiability in blockchain systems that guarantee privacy and cloud systems that delegate computation. zk-SNARK (zero-knowledge Succinct Non-interactive ARguments of Knowledge) is often used as a zero-knowledge proof algorithm, and zk-SNARK can prove that an operation on an arbitrary circuit has been performed correctly without disclosing the secret information used in the circuit. There are many cases where in-circuit encryption technology is included depending on the application. At this time, most encryption technologies necessarily include complex cryptographic operations, which increases the size of the circuit. Since the proof generation time of zk-SNARK is linearly proportional to the size of the circuit, the more complex the in-cryptographic operations are, the less practical zk-SNARK becomes. Therefore, efforts have been made to shorten such proof generation time. Summary of the Invention [Problem to be solved by the invention]

[0003] It is an object of the present invention to provide a method for performing identity-based encryption using Pedersen Commit.

[0004] It is yet another object of the present invention to provide a method for decrypting a ciphertext encrypted based on identity using Pedersen Commit. [Means for solving the problem]

[0005] According to an embodiment of the present disclosure, a method for encrypting a message based on identity, performed by at least one processor, includes the steps of receiving public parameters and a public key, randomly determining a cryptographic constant, parsing a plurality of parameters from the public parameters, calculating a first cypher text and a second cypher text using the plurality of parameters, the cryptographic constant, and the message, parsing an ID value including a plurality of bits from the public key, calculating a third cypher text using the ID value, and outputting the first cypher text, the second cypher text, and the third cypher text, wherein at least one of the first cypher text, the second cypher text, and the third cypher text has a Pedersen commit format.

[0006] According to one embodiment, the step of calculating the first ciphertext and the second ciphertext may include a step of determining, as the first ciphertext, a value obtained by multiplying a first parameter among the plurality of parameters by the power of the message and a value obtained by multiplying the second parameter by the power of the cryptographic constant.

[0007] According to one embodiment ,before The first ciphertext ct1 can be characterized as being determined by the following mathematical formula: In the formula, g 1 is the first commit value, and g 2 is the second committed value, m is the message, and t is a cryptographic constant.

[0008]

number

[0009] According to an embodiment, the step of calculating the first ciphertext and the second ciphertext comprises: First Parameter The step of determining the second ciphertext as a value obtained by raising the cryptographic constant to the power of

[0010] According to one embodiment, the first ParametersWhen g is the number of ciphertexts and t is the cryptographic constant, the second ciphertext ct2 can be determined by the following mathematical formula:

[0011]

number

[0012] According to one embodiment, the step of calculating the third ciphertext may include the steps of parsing a third parameter and a parameter vector from the public parameters, obtaining an index set including an index corresponding to a first bit value among a plurality of bits of the ID value, and calculating the third ciphertext using an element corresponding to the index set among elements included in the parameter vector and the third parameter.

[0013] JPEG0007627923000004.jpg18169

[0014]

number

[0015] A method for decrypting an identification-based encrypted message performed by at least one processor according to an embodiment of the present disclosure includes the steps of receiving a public parameter, a first ciphertext, a second ciphertext, and a third ciphertext, parsing a first commit value and a second commit value from the public parameters, obtaining a first private key and a second private key, obtaining a first pairing value from the first ciphertext and the second commit value using a pairing function, obtaining a second pairing value from the second ciphertext and the second private key using a pairing function, obtaining a third pairing value from the third ciphertext and the first private key using a pairing function, obtaining a decryption text through an operation on the first pairing value, the second pairing value, and the third pairing value, and obtaining a decryption text from the public parameters. The above No. 1 Commit Value Oh And No. 2 Parameters The method may include the step of: decrypting the message from the decrypted text using

[0016] According to one embodiment, the step of decrypting the message may include the steps of obtaining a fourth pairing value for the second parameter and the first commitment value using a pairing function, and determining an exponent value for the message that can achieve the decrypted text through exponentiation of the fourth pairing value.

[0017] According to one embodiment, obtaining the decrypted text may include obtaining the decrypted text by multiplying the first pairing value by the third pairing value and dividing the second pairing value.

[0018] According to an embodiment, the third ciphertext may be constructed in the form of a power of the first commitment value.

[0019] According to an embodiment, the first private key and the second private key may be configured in the form of a power of the second commitment value.

[0020] According to one embodiment, when the second commit key is h, the second constant is β, the third constant is γ, the element of the parameter vector is u, and the index set is S, the first private key sk1 and the second private key sk2 can be determined by the following mathematical formula:

[0021]

number

[0022] According to the technical idea of ​​the present invention, identity-based encryption is performed using Pedersen commits, which can be proven using a zero-knowledge proof algorithm. By using Pedersen commits, efficient encryption can be performed while shortening the proof time for a ciphertext. [Brief description of the drawings]

[0023] [Figure 1] FIG. 1 is a block diagram illustrating a system according to an exemplary embodiment of the present disclosure. [Diagram 2] 4 is a flowchart illustrating a method of operation of a system according to an exemplary embodiment of the present disclosure. [Figure 3a] 4 is a flow chart illustrating a set-up phase according to an exemplary embodiment of the present disclosure. [Figure 3b] 1 is a diagram illustrating a setup algorithm according to an exemplary embodiment of the present disclosure. [Figure 4a] 4 is a flow chart illustrating a key generation stage according to an exemplary embodiment of the present disclosure. [Figure 4b] 1 is a diagram illustrating a key generation algorithm according to an exemplary embodiment of the present disclosure. [Figure 5a] 4 is a flow chart illustrating an encryption stage according to an exemplary embodiment of the present disclosure. [Figure 5b] 1 is a diagram illustrating an encryption algorithm according to an exemplary embodiment of the present disclosure. [Figure 6a] 4 is a flowchart illustrating a decoding step according to an exemplary embodiment of the present disclosure. [Figure 6b] 1 is a diagram illustrating a decoding algorithm according to an exemplary embodiment of the present disclosure. [Figure 7a] 4 is a flow chart illustrating a verification step according to an exemplary embodiment of the present disclosure. [Figure 7b] 1 is a diagram illustrating a verification algorithm according to an exemplary embodiment of the present disclosure. [Figure 8] FIG. 1 is a block diagram illustrating a computing system according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0024] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. The advantages and features of the present invention, and the methods for achieving them, will become clear with reference to the following embodiments described in detail with the accompanying drawings. However, the technical idea of ​​the present invention is not limited to the following embodiments, and may be embodied in various different forms. However, the following embodiments are provided to complete the technical idea of ​​the present invention and to fully inform those skilled in the art of the present invention of the scope of the present invention, and the technical idea of ​​the present invention is only defined by the scope of the claims.

[0025] In attaching reference numerals to components in each drawing, it should be noted that the same numerals are used for the same components even if they are displayed in different drawings. In addition, in describing the present invention, if it is determined that a detailed description of related known configurations or functions may obscure the gist of the present invention, the detailed description will be omitted.

[0026] Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used in the sense commonly understood by those having ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly defined otherwise. The terms used herein are intended to describe the embodiments and are not intended to limit the present invention. In the present specification, the singular form includes the plural form unless otherwise specified in the text.

[0027] In addition, in describing components of the present invention, terms such as first, second, A, B, (a), (b), etc. may be used. Such terms are merely used to distinguish the components from other components, and do not limit the nature, order, or sequence of the components. When a component is described as being "coupled," "coupled," or "connected" to another component, it should be understood that the component may be directly coupled or connected to the other component, but that other components may also be "coupled," "coupled," or "connected" between each component.

[0028] As used herein, "comprises" and / or "comprising" does not exclude the presence or addition of one or more other components, steps, operations and / or elements to a stated component, step, operation and / or element.

[0029] Components included in any one embodiment and components including a common function may be described using the same names in other embodiments. Unless otherwise specified, the description of any one embodiment may be applied to other embodiments, and detailed description may be omitted to the extent that it overlaps or is obvious to a person of ordinary skill in the art.

[0030] Hereinafter, some embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0031] The present invention will now be described in detail with reference to preferred embodiments thereof and the accompanying drawings.

[0032] FIG. 1 is a block diagram illustrating a system according to an exemplary embodiment of the present disclosure.

[0033] Referring to FIG. 1, a system 10 is a system for encrypting, decrypting, and verifying a message m, and the components included in the system 10 may be configured with multiple terminals. In one example, the key generator 100, the encryptor 200, the decryptor 300 and the verifier 400 may each be configured with at least one terminal, and the at least one terminal may include various terminal devices capable of communication, such as a cellular phone, a smart phone, a laptop, a personal computer (PC), a navigation system, a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular (PDC), a personal handyphone system (PHS), a personal digital assistant (PDA), an international mobile telecommunication (IMT)-2000, a code division multiple access (CDMA)-2000, a W-code division multiple access (W-CDMA), a wireless broadband internet (Wibro) terminal, a smartpad, a tablet PC, and the like. In yet another example, each of the key generator 100, the encryptor 200, the decryptor 300 and the verifier 400 may be embodied in a server.

[0034] The key generator 100, the encryptor 200, the decryptor 300 and the verifier 400 may be connected through a network capable of communicating with each other wired or wirelessly. When connected wired, the network may use a serial method, and when connected wirelessly, the network may communicate using a wireless communication network. Examples of wireless communication networks include, but are not limited to, local area networks (LAN), wide area networks (WAN), the World Wide Web (WWW), wired and wireless data communication networks, telephone networks, wired and wireless television communication networks, 3G, 4G, 5G, 3GPP (registered trademark) (3rd Generation Partnership Project), 5GPP (5th Generation Partnership Project), LTE (Long Term Evolution), WIMAX (World Interoperability for Microwave Access), Wi-Fi, the Internet, local area networks (LAN), wireless local area networks (Wireless LAN), wide area networks (WAN), personal area networks (PAN), radio frequency (RF), Bluetooth (registered trademark) networks, near-field communication (NFC) networks, satellite broadcasting networks, analog broadcasting networks, digital multimedia broadcasting (DMB) networks, and blockchain networks.

[0035] The key generator 100 can generate multiple keys ck, sk, and pk for encrypting and decrypting a message m. To this end, the key generator 100 can be operated by a certified authority (e.g., an authenticator certified by a government). In one embodiment, the key generator 100 can represent parameters preset to perform an encryption and decryption method that generates multiple keys ck, sk, and pk based on a public parameter pp, a master key mk, an ID value id, and a security parameter sp, which will be described in detail below with reference to FIG. 3A and FIG. 3B. The master key mk can represent a key preset to generate a secret key sk, which will be described in detail below with reference to FIG. 3A and FIG. 3B. The ID value id can represent a value corresponding to the identity of the key generator 100 or an entity that is attempting to generate a key, and can include multiple bits. The security parameter sp represents an encryption level, and in one example, can represent a cipher length such as 128 bits, 256 bits, or 512 bits.

[0036] The key generator 100 may transmit the generated keys ck, sk, and pk to each component of the system 10. In one embodiment, the key generator 100 may generate a public key pk based on an ID value id and transmit the generated public key pk to the encryptor 200. In one embodiment, the key generator 100 may generate a secret key sk based on a master key mk and at least one parameter and transmit the generated secret key sk to the decryptor 300. In one embodiment, the key generator 100 may generate a commit key ck based on at least one parameter and the ID value id and transmit the generated commit key ck to the verifier 400. The key generation operation of the key generator 100 will be described in detail below with reference to Figures 4a and 4b.

[0037] According to one embodiment of the present disclosure, the key generator 100 can generate an ID value id, which is a user's identity information, using a public key pk, and the convenience of the encryption algorithm can be improved by utilizing the user's identity information as the public key pk rather than a separate generation algorithm for the public key pk.

[0038] The encryptor 200 may receive a public key pk and generate a ciphertext ct by encrypting a message m using public parameters pp and the public key pk. In one example, the encryptor 200 may be operated by a user to encrypt and transmit a message. In one embodiment, the encryptor 200 may randomly determine a cryptographic constant t and generate at least one ciphertext ct by encrypting the message m based on the public parameters pp and an ID value id of the public key pk. The encryption operation of the encryptor 200 will be described in detail below with reference to FIG. 5a and FIG. 5b.

[0039] The decryptor 300 receives a secret key sk and a ciphertext ct and can derive a message m by decrypting the ciphertext ct based on the secret key sk and the public parameters pp. In one embodiment, the decryptor 300 can be operated by a user to decrypt and verify a message. The decryption operation of the decryptor 300 will be described in detail below with reference to Figures 6a and 6b.

[0040] The verifier 400 receives the message m and the ciphertext ct, and can verify whether the ciphertext ct has been encrypted in a valid manner using a commitment key ck. In one example, the verifier 400 can be operated by a verification authority that verifies the validity of the ciphertext ct. In one embodiment, the verifier 400 can verify the ciphertext ct by proving the ciphertext ct using a zero-knowledge proof method. In this specification, the zero-knowledge proof method is a method of verifying the integrity of a message without verifying the message (e.g., the ciphertext ct), and in one example, a zk-SNARK (zero-knowledge SNARK) or a cc-SNARK can be used as the zero-knowledge proof method. The verification operation of the verifier 400 will be described in detail later with reference to FIG. 7a and FIG. 7b.

[0041] In one embodiment, the commit key ck may be generated in a Pedersen commit format. According to one embodiment of the present disclosure, since the commit key ck follows the Pedersen commit format, a zero-knowledge proof based on a CC-SNARK (commit carrying SNARK) algorithm can be performed on the ciphertext ct, and the zero-knowledge proof for the ciphertext ct can be quickly performed by utilizing CC-SNARK, which is a high-speed zero-knowledge proof algorithm.

[0042] Although not shown, the system 10 may further include terminals for setting up public parameters pp and master keys mk, which will be explained in more detail below in Figures 3a and 3b.

[0043] In this specification, the operation of the system 10 and each component included in the system 10 may refer to an operation performed by a processor included in each component based on a computer program including at least one instruction stored in a storage device included in each component, and the storage device may include a non-volatile memory, a volatile memory, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), etc. Also, the processor may include at least one of a central processing unit (CPU), a graphic processing unit (GPU), a neural processing unit (NPU), a RAM, a ROM, a system bus, and an application processor.

[0044] FIG. 2 is a flow chart illustrating a method of operation of a system according to an exemplary embodiment of the present disclosure.

[0045] 2, elements necessary for encryption, such as public parameters pp and master key mk, may be determined in a setup step (S10). The setup step (S10) may be performed in advance before encryption, may be performed by a recognized certification authority, and the public parameters pp and master key mk generated in the setup step (S10) may be made public so as to be accessible by multiple entities.

[0046] In a key generation step (S20), a number of keys may be generated using the public parameters pp and the master key mk. In one embodiment, the identity of the user may be used in the key generation.

[0047] In the encryption step (S30), a ciphertext ct can be generated by encrypting the message m using a public key pk among the generated keys.

[0048] In the decryption step (S40), the message m can be derived by performing decryption on the ciphertext ct using the secret key sk from among the generated keys.

[0049] In a verification step (S50), the ciphertext ct can be verified using a commit key ck from among the generated keys.

[0050] FIG. 3a is a flow chart illustrating a setup stage (S10) according to an exemplary embodiment of the present disclosure, and FIG. 3b is a diagram illustrating a setup algorithm according to an exemplary embodiment of the present disclosure.

[0051] 3a and 3b, the system 10 can obtain a first parameter g and a second parameter h from predetermined parameter groups G1 and G2 (S110). The system 10 can also randomly determine a first constant α, a second constant β, and a third constant γ (S120). The system 10 can also randomly determine a unit vector u (S130).

[0052] JPEG0007627923000007.jpg48169 Furthermore, the first parameter vector U can be determined by the unit vector u power of the first parameter g, and the second parameter vector V can be determined by the unit vector u power of the second parameter h.

[0053] JPEG0007627923000008.jpg18170

[0054] In addition, the system 10 may output a master key mk generated using the second parameter h and the first constant α and the second constant β (S160). In one example, the system 10 may determine the second parameter h to the power of the first constant α and the second constant β as the master key mk.

[0055] According to one embodiment of the present disclosure, at least a portion of the public parameters pp and the master key mk may be configured in a Pedersen commit form in the form of exponentiation, and thus, a high-speed zero-knowledge proof algorithm can be used in the verification process, so that the verification process can be performed quickly.

[0056] FIG. 4a is a flow chart illustrating the key generation step (S20) according to an exemplary embodiment of the present disclosure, and FIG. 4b is a diagram illustrating a key generation algorithm according to an exemplary embodiment of the present disclosure.

[0057] 4a and 4b, the key generator 100 can obtain the public parameters pp and the master key mk (S210). The key generator 100 also obtains the security parameters 1 λ In one example, the key generator 100 may receive the public parameters pp and the master key mk from a certification authority, and may receive the security parameters 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 29, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, λ And the ID value id can be input by the user.

[0058] The JPEG0007627923000009.jpg12169 key generator 100 can acquire an index set S including indexes corresponding to a first bit value (e.g., either one of "1" or "0") among a plurality of bits of the ID value id (S240). In one example, when the ID value id is "1010", the indexes having the first bit value ("1") can be "0" (the first "1") and "2" (the third "1"), and the index set can be composed of "0" and "2".

[0059] In one example, the key generator 100 may generate the key vector W according to the equation shown in FIG. 4b.

[0060] The key generator 100 may generate the ID value id as a public key pk (S260). The key generator 100 may also generate a commit key ck using the commitment values ​​g1, g2, and the key vector W (S270). In one embodiment, the key generator 100 may generate the commit key ck using the first parameter g, the first commitment value g1, the second commitment value g2, and the key vector W as shown in FIG 4b.

[0061] The key generator 100 may generate a secret key sk using the second parameter h, the master key mk, and the key vector W (S280). In one embodiment, the key generator 100 may generate a secret key sk by multiplying the second parameter h by a random constant (h) as shown in FIG. 4b. r ), the product of the master key and the key vector raised to a random constant (mk W r ) can be generated as the secret key sk.

[0062] According to an embodiment of the present disclosure, the convenience of the encryption algorithm may be improved by generating a public key pk and a key vector W based on an ID value id.

[0063] FIG. 5a is a flow chart illustrating the encryption step (S30) according to an exemplary embodiment of the present disclosure, and FIG. 5b is a diagram illustrating the encryption algorithm according to an exemplary embodiment of the present disclosure.

[0064] 5a and 5b, the encryptor 200 may receive public parameters pp and a public key pk (S310) and randomly determine a cryptographic constant t (S320). The encryptor 200 may parse a plurality of parameters and a parameter vector from the public parameters pp (S330). The encryptor 200 may utilize the plurality of parameters, the cryptographic constant t, and the message m to determine a first ciphertext ct1 and a second ciphertext ct2 (S340).

[0065] In one embodiment, the encryptor 200 is a first Commit value g1 to the power of message m and the second Commit value g The value obtained by multiplying 2 by the cryptographic constant t is determined as the first ciphertext ct1, and Parameter g The second ciphertext ct2 may be determined as a value obtained by raising the cryptographic constant t to the power of . In one example, the encryptor 200 may determine the first ciphertext ct1 and the second ciphertext ct2 based on the following Equation 1.

[0066] (mathematical formula 1)

number

[0067] The encryptor 200 may parse an ID value id including a number of bits from the public key pk (S350) and use the ID value id to compute a third ciphertext ct3 (S360).

[0068] In one embodiment, the encryptor 200 may determine the third ciphertext ct3 based on the following Equation 2:

[0069] (mathematical formula 2)

number

[0070] The encryptor 200 can output the determined first ciphertext ct1 to third ciphertext ct3 (S370).

[0071] FIG. 6a is a flow chart illustrating the decoding step (S40) according to an exemplary embodiment of the present disclosure, and FIG. 6b is a diagram illustrating the decoding algorithm according to an exemplary embodiment of the present disclosure.

[0072] 6a and 6b, the decryptor 300 can receive the public parameters pp, the first ciphertext ct1, the second ciphertext ct2, and the third ciphertext ct3 (S410), and parse the first commit value g1 and the second commit value g2 from the public parameters pp (S420). The decryptor 300 can also parse the first secret key sk1 and the second secret key sk2 from the secret key sk (S430).

[0073] The decryptor 300 can use the pairing function to obtain a first pairing value from the first ciphertext ct1 and the second commit value g2 (S440), obtain a second pairing value from the second ciphertext ct2 and the second secret key sk2 (S450), and obtain a third pairing value from the third ciphertext ct3 and the first commit key g1 (S460). The pairing function refers to a process of uniquely encoding two values ​​into one value, and in this specification, "e()" is represented as the pairing function.

[0074] The decryptor 300 may obtain the decrypted text by performing an operation on the first pairing value, the second pairing value, and the third pairing value (S470). In one example, the decryptor 300 may obtain the decrypted text according to the following Equation 3.

[0075] (mathematical formula 3)

number

[0076] The decryptor 300 may use the first commitment value g1 and the second parameter h to decrypt the message m from the decryption text (S480). In one embodiment, the decryptor 300 may use a pairing function to obtain a fourth pairing value for the first commitment value g1 and the second parameter h, and may determine an exponent value as the message m that can achieve the decryption text through exponentiation of the fourth pairing value. In one embodiment, the decryptor 300 may determine the message m by discretely calculating a log value for the fourth pairing value.

[0077] Referring to FIG. 3B and FIG. 4B, secret keys sk1 and sk2 can be expressed as the following Equation 4, and a proof of the decryption process utilizing the properties of the pairing function can be proved as the following Equation 5.

[0078] (mathematical formula 4)

number

[0079] (mathematical formula 5)

number

[0080] FIG. 7a is a flow chart illustrating the verification step (S50) according to an exemplary embodiment of the present disclosure, and FIG. 7b is a diagram illustrating a verification algorithm according to an exemplary embodiment of the present disclosure.

[0081] 7a and 7b, the verifier 400 may receive a commit key ck, a plurality of ciphertexts ct1 to ct3, a cryptographic constant t, and a message m (S510). The verifier 400 may perform a zero-knowledge proof for the first ciphertext ct1 based on the second commit key ck2, the third commit key ck3, the cryptographic constant t, and the message m (S520). In one embodiment, the verifier 400 may perform the zero-knowledge proof by checking whether the value obtained by multiplying the second commit key ck2 to the power of the message m by the third commit key ck3 to the power of the cryptographic constant t matches the first ciphertext ct1, and checking the result value applied to the zero-knowledge algorithm, as shown in FIG. 7b.

[0082] The verifier 400 may perform a zero-knowledge proof for the second ciphertext ct2 based on the first commit key ck1 and the cryptographic constant t (S530). In one embodiment, the verifier 400 may perform the zero-knowledge proof by checking whether the first commit key ck1 raised to the power of the cryptographic constant t matches the second ciphertext ct2 and applying the result to a zero-knowledge algorithm, as shown in FIG 7b.

[0083] The verifier 400 may perform a zero-knowledge proof for the third ciphertext ct3 based on the fourth commit key ck4 and the cryptographic constant t (S540). In one embodiment, the verifier 400 may perform the zero-knowledge proof by checking whether the fourth commit key ck4 raised to the power of the cryptographic constant t matches the third ciphertext ct3 and applying the result to a zero-knowledge algorithm, as shown in FIG 7b.

[0084] According to one embodiment of the present disclosure, the commitment key ck is configured in the Pedersen commit format, so that the fast cc-SNARK algorithm can be used when performing zero-knowledge proof, and as a result, the verification process can be performed quickly.

[0085] FIG. 8 is a block diagram illustrating a computing system according to an exemplary embodiment of the present disclosure.

[0086] 8, the computing system 1000 may constitute at least one of the components 100, 200, 300, and 400 constituting the system 10, and may include a processor 1100, a memory device 1200, a storage device 1300, a power supply 1400, and a display device 1500. Meanwhile, although not shown in FIG. 8, the computing system 1000 may further include a port capable of communicating with a video card, a sound card, a memory card, a USB device, or the like, or communicating with other electronic devices.

[0087] In this manner, the processor 1100, memory device 1200, storage device 1300, power supply 1400, and display device 1500 included in the computing system 1000 can perform the encryption, decryption, and verification methods according to the embodiments of the technical concepts of the present invention. Specifically, the processor 1100 can perform the encryption, decryption, and verification methods, etc., detailed in Figures 1 to 7b, by controlling the memory device 1200, storage device 1300, power supply 1400, and display device 1500.

[0088] The processor 1100 may perform a particular calculation or task. In some embodiments, the processor 1100 may be a microprocessor or a central processing unit (CPU). The processor 1100 may communicate with the memory device 1200, the storage device 1300, and the display device 1500 through a bus 1600 such as an address bus, a control bus, and a data bus. In some embodiments, the processor 1100 may also be coupled to an expansion bus such as a Peripheral Component Interconnect (PCI) bus.

[0089] The memory device 1200 may store data necessary for the operation of the computing system 1000. For example, the memory device 1200 may be implemented with DRAM, mobile DRAM, SRAM, PRAM, FRAM, RRAM, and / or MRAM. The storage device 1300 may include a solid state drive, a hard disk drive, a CD-ROM, etc. The storage device 1300 may store programs relating to the encryption, decryption, and verification methods detailed in FIGS. 1 to 7b, application program data, system data, operating system data, etc.

[0090] The display device 1500 is an output means for notifying a user, and can display various information described herein to a user, etc. The power supply device 1400 can supply an operating voltage required for the operation of the computing system 1000.

[0091] As described above, exemplary embodiments have been invented in the drawings and the specification. Although specific terms have been used in the description of the embodiments, these terms are merely used for the purpose of describing the technical ideas of the present invention, and are not used to limit the meaning or scope of the present invention described in the claims. Therefore, a person having ordinary skill in the art will understand that various modifications and equivalent other embodiments are possible. Therefore, the true technical scope of the present invention should be determined by the technical ideas of the appended claims.

[0092] This research (invention) was supported by a grant from the Institute of Information & communications Technology Planning & Evaluation (IITP) funded by the Korean government (MSIT) (No. 2021-0-00532-003, Project name: Blockchain Technology Development for IITP Data Economy, Task name: Blockchain scalability solutions supporting high performance / capacity transactions, Contribution rate: 100%).

Claims

1. 1. A method for encrypting a message based on an identification, the method being performed by at least one processor, comprising: receiving public parameters and a public key; randomly determining a cryptographic constant; parsing a plurality of parameters from the public parameters; computing a first cipher text and a second cipher text utilizing the plurality of parameters, the cryptographic constants, and the message; parsing an ID value from the public key, the ID value comprising a plurality of bits; computing a third ciphertext utilizing the ID value; and outputting the first ciphertext, the second ciphertext, and the third ciphertext; 11. A method of encryption, comprising: at least one of the first ciphertext, the second ciphertext, and the third ciphertext having a Pedersen commit format.

2. The step of computing the first ciphertext and the second ciphertext comprises:

2. The encryption method according to claim 1, further comprising: determining, as the first ciphertext, a value obtained by multiplying a first commit value among the plurality of parameters by the message and a value obtained by multiplying a second commit value by the cryptographic constant.

3. The plurality of parameters includes the first commit value and the second commit value, The first ciphertext (ct １ ) is determined by the following mathematical formula:

3. The method of claim 2, wherein g1 is the first commit value, g2 is the second commit value, m is the message, and t is the cryptographic constant. [0089]

4. The step of computing the first ciphertext and the second ciphertext comprises:

2. The encryption method according to claim 1, further comprising: determining, as the second ciphertext, a value obtained by raising a first parameter of the plurality of parameters to the power of the cryptographic constant.

5. When the first parameter is (g) and the cryptographic constant is (t), the second ciphertext (ct ２ 5. The method of claim 4, wherein: ##EQU00011##

6. The step of calculating the third ciphertext comprises: parsing a third parameter and a parameter vector from the public parameters; obtaining an index set including an index corresponding to a first bit value of the plurality of bits of the ID value; and 2. The method of claim 1, further comprising: calculating the third ciphertext using elements included in the parameter vector that correspond to the index set and the third parameter. 【Request 7】 【Number】 7. The encryption method according to claim 6, wherein the encryption method comprises: ##EQU00012##

8. 1. A method for decrypting an identification-based encrypted message, the method being performed by at least one processor, comprising: receiving a public parameter, a first ciphertext, a second ciphertext, and a third ciphertext; parsing a first committed value and a second committed value from the public parameters; obtaining a first private key and a second private key; obtaining a first pairing value from the first ciphertext and the second committed value utilizing a pairing function; obtaining a second pairing value from the second ciphertext and the second private key utilizing a pairing function; obtaining a third pairing value from the third ciphertext and the first private key utilizing a pairing function; obtaining a decrypted text through an operation on the first pairing value, the second pairing value, and the third pairing value; decrypting a message from the decrypted text utilizing the first commit value and a second parameter obtained from the public parameter.

9. The step of decoding the message comprises: obtaining a fourth pairing value for the second parameter and the first committed value utilizing a pairing function; and 9. The method of claim 8, further comprising: determining as the message an exponent value that can achieve the decryption through exponentiation of the fourth pairing value.

10. The step of obtaining the decrypted text comprises:

9. The method of claim 8, comprising obtaining the decrypted text by multiplying the first pairing value by the third pairing value and dividing the second pairing value.

11. The method of claim 8, wherein the third ciphertext is constructed in a form of a power of the first commit value.

12. 9. The method of claim 8, wherein the first private key and the second private key are constructed in the form of a power of the second commitment value.

13. When the second parameter is (h), the first constant is (α), the second constant is (β), the third constant is (γ), the element of the parameter vector is (u), the index set is (S), and the random constant is (r), the first secret key (sk １ ) and the second secret key (sk ２ 13. The method of claim 12, wherein: ##EQU00013##

Images