Secret value generation device, key exchange system, secret value generation method, and secret value generation program

Abstract

To provide a secret value generation device, a key exchange system, a secret value generation method and a secret value generation program, capable of reducing a risk that information on randomness of a secret value may leak.SOLUTION: A secret value generation device 1 that generates a secret value based on a random number and outputs a public value calculated based on the secret value, comprises two or more independent pseudorandom number generators 11, and a selection pseudorandom number generator 12 that selects any one of the pseudorandom number generators 11, where a random number is generated by any one of the pseudorandom number generators 11 selected by the selection pseudorandom number generator 12.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a system for preventing attacks that obtain information about a secret value from a public value. [Background technology]

[0002] In the latest version of the encrypted communications protocol TLS (Transport Layer Security), TLS1.3, key exchange using static private keys such as RSA encryption has been abolished to avoid the risk of past communication content being leaked due to leakage of the static private key. Meanwhile, the National Institute of Standards and Technology (NIST) Quantum-Resistant Cryptography Standardization Project (NIST-PQC) is targeting only key exchange using static private keys for standardization.

[0003] In this situation, a protocol is being considered in which a public value of a temporary key is exchanged in a manner similar to the Diffie-Hellman key exchange using lattice cryptography, which is a quantum-resistant cryptography method, and the two parties share a private key through calculations (for example, see Non-Patent Documents 1 to 3). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Jintai Ding, Xiang Xie, Xiaodong Lin, “A Simple Provably Secure Key Exchange Scheme Based on the Learning with Errors Problem,” Cryptology ePrint Archive, Report 2012 / 688 [Non-Patent Document 2] V. Singh, “A Practical Key Exchange for the Internet using Lattice Cryptography,” Cryptology ePrint Archive, Report 2015 / 138 [Non-Patent Document 3] E. Alkim, L. Ducas, T. P¨oppelmann, and P. Schwabe, “Post-quantum key exchange - a new hope,” Cryptology ePrint Archive, Report 2015 / 1092 [Non-Patent Document 4] Satoshi Okada, Yuntao Wang, Tsuyoshi Takagi, “Improving Key Mismatch Attack on NewHope with Fewer Queries”, 25th Australasian Conference on Information Security and Privacy, ACISP 2020, LNCS 12248, pp. 505-524, 2020 [Non-Patent Document 5] Osumi, K. Uemura, K. Kudo, and T. Takagi, “Key mismatch attack on the lattice cipher SABER,” 2021 Symposium on Cryptography and Information Security (SCIS2021), 3A3-2 [Non-Patent Document 6] Okada, Wang, "Proposal of a key reuse attack against lattice cryptosystems CRYSTALS-KYBER and SABER," 2021 Symposium on Cryptography and Information Security (SCIS2021), 3A3-1 Summary of the Invention [Problem to be solved by the invention]

[0005] However, in key exchange protocols such as those described in Non-Patent Documents 1 to 3, if the same random number is reused, an attack has been shown that can restore the random number (see, for example, Non-Patent Documents 4 to 6). It has also been shown that even if the random number is changed each time, if the same pseudorandom number generator is used, some information regarding randomness may be leaked (see, for example, Non-Patent Document 6).

[0006] An object of the present invention is to provide a secret value generation device, a key exchange system, a secret value generation method, and a secret value generation program that can reduce the risk of information relating to the randomness of a secret value being leaked. [Means for solving the problem]

[0007] The secret value generation device of the present invention is a device that generates a secret value based on a random number and outputs a public value calculated based on the secret value, and is equipped with two or more independent pseudo-random number generators and a selection pseudo-random number generator for selecting one of the pseudo-random number generators, and generates the random number using one of the pseudo-random number generators selected by the selection pseudo-random number generator.

[0008] In the key exchange system of the present invention, the two private value generation devices exchange the public values, and at least one of the private value generation devices calculates a private key based on the private value and the public value obtained through the exchange, and shares the private key with the other private value generation device.

[0009] The other private value generation device may generate a random number as the private key, and generate the public value by the calculation based on the random number.

[0010] The other secret value generation device may generate a random number as the secret key by one of the pseudorandom number generators selected by the selection pseudorandom number generator.

[0011] A secret value generation method according to the present invention is a secret value generation device that generates a secret value based on a random number and outputs a public value calculated based on the secret value, which uses two or more independent pseudo-random number generators and a selection pseudo-random number generator for selecting one of the pseudo-random number generators, and generates the random number using one of the pseudo-random number generators selected by the selection pseudo-random number generator.

[0012] A secret value generation program according to the present invention causes a computer to function as the secret value generation device. Effect of the Invention

[0013] According to the present invention, the risk of information regarding the randomness of a secret value being leaked can be reduced. [Brief description of the drawings]

[0014] [Figure 1] 2 is a diagram illustrating a functional configuration of a secret value generation device according to an embodiment. [Diagram 2] FIG. 1 illustrates a conventional key exchange algorithm. [Diagram 3] FIG. 10 is a diagram illustrating an algorithm for key exchange in an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] An example of an embodiment of the present invention will now be described. The secret value generation device of this embodiment is an information processing device that generates a secret value based on a random number and outputs a public value calculated based on this secret value. Here, as an example, a key exchange system consisting of two terminal devices (secret value generation devices) in which a key exchange protocol based on a post-quantum cryptography method is implemented is shown.

[0016] FIG. 1 is a diagram showing the functional configuration of a secret value generation device 1 in this embodiment. The secret value generation device 1 is an information processing device (computer) such as a server device or a personal computer, and includes a control unit 10 and a storage unit 20, as well as various data input / output devices and communication devices.

[0017] The control unit 10 is a part that controls the entire secret value generation device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0018] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the secret value generation device 1, various data, etc., and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), etc. Specifically, the storage unit 20 stores a program (secret value generation program) for causing the control unit 10 to execute each function of this embodiment, as well as various data during processing, etc.

[0019] The control unit 10 includes two or more independent pseudo-random number generators 11, a selection pseudo-random number generator 12 for selecting one of these pseudo-random number generators 11, and a calculation unit 13.

[0020] The calculation unit 13 is a functional unit that executes the key exchange protocol, and generates random numbers used as temporary secret values ​​in this protocol by one of the pseudorandom number generators 11 selected by the selection pseudorandom number generator 12.

[0021] In a key exchange system, two private value generation devices 1 exchange public values ​​calculated from private values, and at least one of the two private value generation devices 1 calculates a private key based on the private value and the public value obtained through the exchange, and shares the private key with the other private value generation device 1.

[0022] Here, the other secret value generation device 1 may generate random numbers as a shared secret key in accordance with an applied protocol, and generate public values ​​for exchange by performing calculations based on these random numbers. At this time, the other secret value generation device 1 may generate a random number as a secret key by using one of the pseudo-random number generators 11 selected by the selection pseudo-random number generator 12 .

[0023] Next, a conventional key exchange algorithm and the key exchange algorithm in this embodiment will be compared and explained. FIG. 2 is a diagram illustrating a conventional key exchange algorithm. As an example, an algorithm for key exchange based on the lattice cryptography CRYSTALS-KYBER between two terminals (secret value generating devices) Alice and Bob is shown here.

[0024] Alice uses a random number s as a one-time secret. A and e A Generate the public value P A The following calculation is performed. Bob uses a random number s as a one-time secret value. B ,e B ,e' B Then, the random number m as the private key and the public value P received from Alice are generated. A The public value (c1, c2) is calculated using

[0025] Alice calculates private key m' using the received public value (c1, c2) and a secret value that she holds, and thus Alice and Bob share private key m=m'.

[0026] FIG. 3 is a diagram illustrating an algorithm for key exchange in this embodiment. Compared to the conventional algorithm (Figure 2), the processing within the dashed box has been changed. In this example, three pseudo-random number generators 11 (rand0, rand1, rand2) are provided in each of two terminals, Alice and Bob.

[0027] seed0, seed1, seed2, and seed3 are initial values ​​given to pseudo-random number generators rand0, rand1, rand2, and rand3, respectively, and are different values ​​that are independent of each other. Based on the random numbers (integers from 0 to 2) generated by the pseudorandom number generator rand3 (selection pseudorandom number generator 12), the pseudorandom number generator rand0, rand1, or rand2 to be used is selected when generating random numbers as secret values. For convenience, the pseudorandom number generators and initial values ​​of both terminals are given the same subscripts, but the pseudorandom number generators and initial values ​​are provided independently of each other.

[0028] In this algorithm, Bob generates a private key m as follows: m←rand() As with other secret values, this random number can be b←rand3[0:2], m←rand b () As shown above, the pseudo-random number may be generated by the pseudo-random number generator rand0, rand1, or rand2 selected by rand3 (selection pseudo-random number generator 12).

[0029] According to this embodiment, the secret value generation device 1 generates a secret value based on a random number, and when outputting a public value calculated based on this secret value, the selection pseudo-random number generator 12 selects one of two or more independent pseudo-random number generators 11. Therefore, the secret value generation device 1 has a two-stage configuration in which a plurality of pseudo-random number generators 11 initialized with independent initial values ​​are randomly selected, and random numbers are generated by the selected pseudo-random number generators 11, thereby reducing the risk of information regarding the randomness of the secret value being leaked.

[0030] Here, the more the number of pseudo-random number generators 11 is increased, the more improved the security can be expected; however, the processing load increases, so the number of pseudo-random number generators 11 may be appropriately designed depending on the processing performance of the secret value generation device 1 and the required security. In addition, a plurality of selection pseudorandom number generators 12 may be provided, and the selection pseudorandom number generator 12 may be selected by another pseudorandom number generator. Similarly, multiple stages of randomness, such as three or more stages, may be constructed.

[0031] By the two private value generation devices 1 exchanging public values, a key exchange system is constructed in which at least one of the two private value generation devices 1 (for example, the above-mentioned terminal Alice) calculates a private key based on the private value and the public value acquired through the exchange, and shares the private key with the other private value generation device 1. In particular, in a key exchange protocol based on quantum-resistant cryptography, by generating a random number as a private value by a randomly selected pseudorandom number generator 11, it is possible to prevent attacks that obtain the private value and information related to the private value from the public value.

[0032] In the key exchange protocol, the other private value generation device 1 (the above-mentioned terminal Bob) may generate a random number as a private key and generate its own public value by calculation based on this random number, the private value, and the acquired public value. Even in this case, the private value generation device 1 calculates the public value by calculation based on the private value to which security measures have been applied, so that the security of the private key is guaranteed.

[0033] Furthermore, the private value generation device 1 may generate the random number as the private key by any one of the pseudorandom number generators 11 selected by the selection pseudorandom number generator 12. This can further improve security against leakage of the private key.

[0034] Note that this embodiment can realize, for example, a secure quantum-safe key exchange protocol, which can contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0035] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0036] The secret value generation method by the secret value generation device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). Moreover, these programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0037] 1. Secret value generator 10 Control section 11 Pseudorandom number generators 12 Pseudorandom number generator for selection 13 Arithmetic section 20 Memory section

Claims

1. A private value generation device that generates a first random number as a private value and outputs a public value calculated based on the private value, Three or more mutually independent pseudorandom number generators; A selection pseudorandom number generator for selecting one of the pseudorandom number generators; a secret value generation device that generates all of the first random numbers by one of the pseudorandom number generators selected based on the second random numbers generated by the selection pseudorandom number generator;

2. 2. The secret value generating device according to claim 1 exchanges the public value between two devices, A key exchange system in which at least one of the private value generation devices calculates a private key based on the private value and the public value obtained through the exchange, and shares the private key with the other private value generation device.

3. 3. The key exchange system according to claim 2, wherein the other private value generation device generates a third random number as the private key, and generates the public value by the calculation based on the third random number.

4. 4. The key exchange system according to claim 3, wherein the other secret value generation device generates the entire third random number using one of the pseudorandom number generators selected based on a fourth random number generated by the selection pseudorandom number generator.

5. A secret value generation device that generates a first random number as a secret value and outputs a public value calculated based on the secret value, Three or more mutually independent pseudorandom number generators; A selection pseudorandom number generator for selecting one of the pseudorandom number generators, A secret value generation method, comprising: generating all of the first random numbers by one of the pseudorandom number generators selected based on the second random numbers generated by the selection pseudorandom number generator.

6. A secret value generating program for causing a computer to function as the secret value generating device according to claim 1.

Images