Encryption device, encrypted communication system, encryption method, and program

Abstract

This encryption device comprises: a key storage unit that stores a secret key and a public key of a public key cryptosystem; and an encryption unit that encrypts communication data using the secret key and the public key.

Description

[Technical field]

[0001] The present invention relates to an encryption device, an encrypted communication system, an encryption method, and a program. [Background technology]

[0002] There are two known encryption methods for encrypting communication content in online data communications: symmetric key encryption and public key encryption. Hybrid encryption, which combines the two encryption methods, is also known.

[0003] For example, Non-Patent Document 1 discloses a method of encrypting communication contents using a common key cryptosystem and encrypting the key used in the common key cryptosystem using a public key cryptosystem. This method is a method that addresses the fact that the encryption and decryption processes of the public key cryptosystem are very slow compared to the common key cryptosystem. Specifically, in this method, communication data is encrypted using a high-speed common key cryptosystem because the encryption is repeated a number of times according to the length of the communication data, and the key to be distributed is encrypted using a public key cryptosystem to solve the key distribution problem that occurs in the common key cryptosystem. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Daisuke Moriyama, Ryo Nishimaki, Tatsuaki Okamoto, "Mathematics of Public Key Cryptography", Kyoritsu Shuppan Co., Ltd., 2011, pp.147-154 Summary of the Invention [Problem to be solved by the invention]

[0005] In online conference systems, in order to communicate using a limited communication bandwidth, data such as voice collected from each terminal is synthesized (added) by the service provider server and then transmitted to each terminal. There is also a demand for end-to-end encrypted communication to be realized, which keeps the contents of communication secret for service providers.

[0006] In order to perform processes such as adding encrypted communication content, it is possible to convert the content into plain text at the service providing server. However, in that case, the communication content cannot be kept secret from the service provider, and end-to-end encrypted communication cannot be realized.

[0007] Therefore, complete end-to-end encryption that keeps communication contents secret even from service providers can be achieved by using a special encryption method that has homomorphism, which allows additions to be made on the server while still being encrypted. Previous research has shown that homomorphism exists in public key encryption methods such as ElGamal encryption.

[0008] In this way, depending on the purpose of the cryptographic communication, it may be necessary to encrypt not only the key to be distributed but also the communication data using a public key cryptosystem rather than a common key cryptosystem as in Non-Patent Document 1.

[0009] However, the encryption process using the conventional public key cryptosystem is very slow, and there is a problem that it cannot be used for processing in real-time communications such as in a video conference system.

[0010] The disclosed technology aims to increase the speed of encryption processing using a public key cryptosystem. [Means for solving the problem]

[0011] The disclosed technology includes a key storage unit that stores a private key and a public key of a public key cryptosystem; The private key and, The public key and a pre-calculation table generated based on the public key. Using By KH-PKE and an encryption unit that encrypts communication data. Effect of the Invention

[0012] It is possible to speed up encryption processing using the public key cryptosystem. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram for explaining an encryption device in a conventional public key cryptosystem. [Diagram 2] 1 is a diagram for explaining an encryption device in a public key cryptosystem according to an embodiment of the present invention; [Diagram 3] 1 is a configuration diagram of an encrypted communication system according to a first embodiment. [Figure 4] FIG. 4 is a sequence diagram showing encrypted communication processing according to the first embodiment. [Diagram 5] FIG. 11 is a configuration diagram of an encrypted communication system according to a second embodiment. [Figure 6] FIG. 11 is a sequence diagram showing encrypted communication processing according to the second embodiment. [Figure 7] FIG. 11 is a configuration diagram of an encrypted communication system according to a third embodiment. [Figure 8] FIG. 11 is a sequence diagram showing encrypted communication processing according to the third embodiment. [Figure 9] FIG. 11 is a configuration diagram of an encrypted communication system according to a fourth embodiment. [Figure 10] FIG. 13 is a sequence diagram showing encrypted communication processing according to the fourth embodiment. [Figure 11] FIG. 2 illustrates an example of a hardware configuration of each device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0015] Before describing the technology according to the present embodiment, first, a description will be given of the conventional technology related to the encryption of the present embodiment and the problems involved therein.

[0016] (Regarding the Prior Art) A conventional public key cryptosystem will be described with reference to FIG.

[0017] As shown in FIG. 1, when a message M and a public key pk are input, a conventional encryption device encrypts the message M using the public key pk and outputs a ciphertext C.

[0018] However, encryption processing using the public key pk requires a long calculation time, and is therefore not suitable for cryptographic communications that require real-time performance, such as in a video conference system.

[0019] The following describes a technique according to the present embodiment that solves the above problems.

[0020] (Outline of this embodiment) First, an overview of the technique according to the present embodiment will be described. Fig. 2 is a diagram for explaining an encryption device in a public key cryptosystem according to the present embodiment.

[0021] In the encryption method according to the present embodiment, as shown in Fig. 2, when an encryption device receives an input of a message M, a public key pk, and a private key sk, the encryption device encrypts the message M using the public key pk and the private key sk, and outputs a ciphertext C. That is, the encryption device differs from the conventional technology in that it uses not only the public key pk but also the private key sk in the encryption process. Note that the message M is an example of communication data in encrypted communication. Also, the ciphertext C is an example of encrypted communication data.

[0022] (Embodiment 1) Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0023] Fig. 3 is a configuration diagram of a cryptographic communication system according to the present embodiment. As shown in Fig. 3, the cryptographic communication system 1 includes an encryption device 10, a decryption device 20, and a key generation device 30. The encryption device 10, the decryption device 20, and the key generation device 30 are connected to each other so as to be able to communicate with each other via a communication network or the like.

[0024] The key generating device 30 receives the bit length designation data (1 l ), the encryption device 10 generates a public key pk and a private key sk for a public key cryptosystem, and transmits the public key pk and the private key sk to the encryption device 10 and the decryption device 20.

[0025] The encryption device 10 includes an encryption unit 11 and a key storage unit 12. The key storage unit 12 stores the public key pk and the private key sk received from the key generation device 30. The encryption unit 11 generates a ciphertext C by encrypting an input message M using the public key pk and the private key sk, and transmits the ciphertext C to the decryption device 20.

[0026] The decryption device 20 includes a key storage unit 22 and a decryption unit 21. The key storage unit 22 stores the public key pk and the private key sk received from the key generation device 30. The decryption unit 21 obtains a message M by decrypting the ciphertext C received from the encryption device 10 using the public key pk and the private key sk.

[0027] Next, a description will be given of the operation of the encrypted communication system 1 according to the present embodiment. Fig. 4 is a sequence diagram showing the encrypted communication process according to the present embodiment.

[0028] The key generating device 30 receives designated data (1 l ) (step S101). Then, the key generating device 30 executes a key generating process to generate a key of the specified bit length (step S102). Specifically, the key generating device 30 generates a public key pk and a secret key sk of a public key cryptosystem.

[0029] Next, the key generation device 30 transmits the public key pk and the private key sk to the encryption device 10 (step S103). The key storage unit 12 of the encryption device 10 stores the received public key pk and private key sk. Similarly, the key generation device 30 transmits the public key pk and the private key sk to the decryption device 20 (step S104). The key storage unit 22 of the decryption device 20 stores the received public key pk and private key sk.

[0030] The encryption device 10 receives an input of a message M by a user operation or the like (step S105). The encryption unit 11 executes an encryption process (step S106). Specifically, the encryption unit 11 encrypts the message M using a public key pk and a private key sk stored in the key storage unit 12 to generate a ciphertext C.

[0031] The encryption device 10 transmits the ciphertext C to the decryption device 20 (step S107). The decryption unit 21 of the decryption device 20 executes a decryption process (step S108). Specifically, the decryption unit 21 decrypts the ciphertext C using both the public key pk and the private key sk to obtain the message M.

[0032] Hereinafter, several examples will be described in detail regarding the processing according to this embodiment.

[0033] (Example A of the first embodiment: RSA encryption) In the embodiment A, an example of encryption using RSA encryption will be shown. RSA encryption is one type of public key encryption based on the difficulty of factorizing a composite number with a large number of digits, which provides security.

[0034] Details of each process using RSA encryption are as follows:

[0035] (i) Key generation process (FIG. 4: step S102) The key generating device 30 l When n, e is input, the key generating device 30 outputs a public key pk=(n, e) and a private key sk=(d, p, q), where p and q are prime numbers with roughly the same bit length. The specific process executed by the key generating device 30 is as follows.

[0036] (i-1)Let p and q be prime numbers of approximately equal bit length, and let n=pq.

[0037] Let (i-2)φ(n) = (p-1)(q-1).

[0038] (i-3)Let e ​​be a positive integer less than φ(n) and relatively prime to φ(n). Let d be the inverse of e modulo φ(n). Depending on how these numbers are selected, de ≡ 1 (mod φ(n)) holds.

[0039] (i-4) Let n and e obtained above be the public key pk, and d, p, and q be the private key sk.

[0040] In what follows, the set of integers greater than or equal to 0 and less than n will be represented as Zn.

[0041] (ii) Encryption process (FIG. 4: step S106) Let message M be an element of Zn.

[0042] The encryption unit 11 encrypts the data by C=M e Calculate mod n and output the ciphertext C.

[0043] (iii) Decryption process (FIG. 4: step S108) The decryption unit 21 performs the following calculation on the ciphertext C to obtain the plaintext message M.

[0044] M=C d mod n

[0045] Particularly, in (ii) encryption processing, the encryption unit 11 can use a private key sk=(d,p,q) in addition to a public key pk=(n,e). The encryption unit 11 can replace mod n with a combination of mod p and mod q by the Chinese Remainder Theorem. That is, the encryption unit 11 converts to a divisor with a shorter bit length by the Chinese Remainder Theorem and performs a remainder operation. This reduces the cost of operations and speeds up the encryption processing.

[0046] (Example B of the first embodiment: Paillier encryption) In the embodiment B, an example of encryption using the Paillier encryption will be shown. The Paillier encryption is one of the public key encryption methods that satisfies the property that the ciphertext of m1+m2 can be calculated from the ciphertext of m1 and the ciphertext of m2 (additive homomorphism).

[0047] Details of each process using the Paillier cipher are as follows.

[0048] (i) Key generation process (FIG. 4: step S102) The specific process executed by the key generating device 30 is as follows.

[0049] (i-1) Randomly choose two large prime numbers p and q, and let n=pq.

[0050] (i-2) Let k be chosen arbitrarily from Zn, and g = 1 + kn mod n 2 Let us assume that.

[0051] (i-3) Let the public key pk = (n, g) and the private key sk = (p, q).

[0052] (ii) Encryption process (FIG. 4: step S106) (ii-1) The encryption unit 11

[0053]

number

[0054] (ii-2)C=g m ·r n mod n 2 is the ciphertext.

[0055] (iii) Decryption process (FIG. 4: step S108) (iii-1)Let λ = lcm(p-1, q-1).

[0056] (iii-1) The decoding unit 21 calculates M=L(C λ mod n 2 ) / L(g λ mod n 2 ) mod n to get the original message.

[0057] In particular, in the (ii) encryption process, the encryption unit 11 can use the private key sk=(p,q) and the parameter k generated in the key generation process in addition to the public key pk=(n,g). The key generation device 30 can transmit the parameter k to the encryption device 10 together with the public key pk and the private key sk. This makes it possible to obtain the mod n 2 The above calculation can be performed using the Chinese Remainder Theorem. That is, the encryption unit 11 converts the divisor into one with a shorter bit length by the Chinese Remainder Theorem and performs the remainder calculation. Therefore, the calculation cost can be reduced and the encryption process can be accelerated.

[0058] (Embodiment 2) The second embodiment will be described below with reference to the drawings. The second embodiment differs from the first embodiment in that the encryption device 10 and the decryption device 20 include a pre-computation unit and a pre-computation table storage unit. Therefore, in the following description of the second embodiment, the differences from the first embodiment will be mainly described, and the same reference numerals as those used in the description of the first embodiment will be given to components having the same functional configuration as the first embodiment, and the description thereof will be omitted.

[0059] FIG. 5 is a configuration diagram of an encrypted communication system according to the second embodiment. A key generating device 30 according to the present embodiment generates designated data (1 l ), and receives system parameters Sys to generate a public key pk and a private key sk for a public key cryptosystem. The key generating device 30 then transmits the public key pk, the private key sk, and the system parameters Sys to the encryption device 10 and the decryption device 20.

[0060] The encryption device 10 includes an encryption unit 11 and a key storage unit 12, as well as a pre-computation unit 13 and a pre-computation table storage unit 14. The key storage unit 12 stores a public key pk, a private key sk, and a system parameter Sys received from the key generation device 30.

[0061] The pre-computation unit 13 performs pre-computation. The pre-computation is a calculation that is performed before encryption processing and can be performed at a stage where the data to be encrypted (message M, etc.) has not yet been determined. Specifically, the pre-computation unit 13 performs pre-computation based on the public key pk and the system parameter Sys, generates a pre-computation table TBL, and stores it in the pre-computation table storage unit 14.

[0062] The encryption unit 11 generates a ciphertext C by encrypting the input message M using the public key pk and the private key sk as well as the system parameters Sys and the pre-computation table TBL, and transmits the ciphertext C to the decryption device 20.

[0063] Similarly, the decryption device 20 includes a pre-computation unit 23 and a pre-computation table storage unit 24 in addition to a decryption unit 21 and a key storage unit 22. The key storage unit 22 stores the public key pk, the private key sk, and the system parameters Sys received from the key generation device 30.

[0064] The functions of the pre-computation unit 23 and the pre-computation table storage unit 24 included in the decryption device 20 are similar to those of the pre-computation unit 13 and the pre-computation table storage unit 14 included in the encryption device 10 .

[0065] The decryption unit 21 obtains the message M by decrypting the ciphertext C received from the encryption device 10 using the public key pk and the private key sk as well as the system parameters Sys and the pre-computation table TBL.

[0066] Next, an operation of the encrypted communication system 1 according to the present embodiment will be described. Fig. 6 is a sequence diagram showing an encrypted communication process according to the second embodiment.

[0067] In the encrypted communication process according to the present embodiment, following step S103, the pre-computation unit 13 of the encryption device 10 executes pre-computation processing (step S201). Similarly, following step S104, the pre-computation unit 23 of the decryption device 20 executes pre-computation processing (step S202).

[0068] Hereinafter, several examples will be described in detail regarding the processing according to this embodiment.

[0069] (Example C of the second embodiment: ElGamal encryption) In embodiment C, an example of encryption using ElGamal encryption will be shown. ElGamal encryption is one of the public key encryption methods whose security is based on the difficulty of the discrete logarithm problem in a group with a large order.

[0070] Details of each process using ElGamal encryption are as follows.

[0071] (i) Key generation process (FIG. 6: step S102) The key generating device 30 l and Sys=(G0,G), it outputs a public key pk=(q,H), a private key sk=x, and a system parameter Sys=(G0,G). The specific processing executed by the key generating device 30 is as follows.

[0072] (i-1) Choose a cyclic group G whose order q is prime and whose number of bits of q is k.

[0073] Choose (i-2)x randomly from {0, 1, 2, , q-1}.

[0074] Let (i-3)H = xG0.

[0075] Let (i-4)(q,H) be the public key pk and x be the private key sk.

[0076] (ii) Pre-calculation processing (FIG. 6: steps S201 and S202) The pre-calculation unit 13 and the pre-calculation unit 23 generate a pre-calculation table TBL=(G0[0][0], G0[0][1], G0[0][2]...G0[i][j]) based on pk=(q,H) and Sys=(G0,G).

[0077] (iii) Encryption process (FIG. 6: step S106) Let M be an element of G as plaintext.

[0078] The encryption unit 11 executes the following processes.

[0079] (iii-1) Choose r randomly from {0, 1, 2, , q-1}.

[0080] (iii-2) Calculate C1 = rG0 and C2 = M + rH.

[0081] (iii-3)(C1,C2) is the ciphertext.

[0082] (iv) Decryption process (FIG. 6: step S108) The decryption unit 21 performs the following calculation using the received ciphertext (C1, C2).

[0083] M=C2-xC1

[0084] In the above encryption and decryption processes, the encryption unit 11 and the decryption unit 21 perform elliptic curve scalar multiplication with a fixed base by using fixed-base exponentiation that utilizes the pre-calculation table TBL.

[0085] In particular, (ii) in the encryption process, by being able to use the private key sk=(x) in addition to the public key pk=(q,H), the encryption unit 11 can calculate H by xG0. This eliminates the need for the pre-computation table storage unit 24 to have a separate pre-computation table for the elliptic curve scalar multiplication of H, and allows the pre-computation table based on G0 to be used.

[0086] Since the size of the pre-calculation table is related to the overall calculation cost, making the pre-calculation table smaller contributes to reducing the overall calculation cost. Therefore, according to the configuration of embodiment C, the pre-calculation table is smaller than the conventional one, which reduces the calculation cost and speeds up the encryption process.

[0087] (Example D of the second embodiment: KH-PKE) In the embodiment D, an example of encryption using Keyed-Homomorphic Public-Key Encryption (KH-PKE) is shown. KH-PKE is an encryption method disclosed in the following reference [1].

[0088] [References for Example D] [1] Emura, K., Hanaoka, G., Nuida, K. et al. Chosen ciphertext secure keyed-homomorphic public-key cryptosystems. Des. Codes Cryptogr. 86, 1623-1683 (2018). https: / / doi.org / 10.1007 / s10623-017-0417-6

[0089] Details of each process using KH-PKE are as follows.

[0090] (i) Key generation process (FIG. 6: step S102) The key generating device 30 l and Sys=(G0,G1,G) is input, public key pk=S and private key

[0091]

number

[0092] (ii) Pre-calculation processing (FIG. 6: steps S201 and S202) The pre-calculation unit 13 and the pre-calculation unit 23 generate a pre-calculation table TBL=((G0[0][0], G0[0][1], G0[0][2]···G0[i][j]), (G1[0][0], G1[0][1], G1[0][2]···G1[i][j]), (S[0][0], S[0][1], S[0][2]···S[i][j])) based on pk=S and Sys=(G0, G1, G).

[0093] (iii) Encryption process (FIG. 6: step S106) The encryption unit 11 uses the pre-computation table TBL to execute processing defined in the following encryption algorithm on the message M to obtain the ciphertext C.

[0094]

number

[0095] (iv) Decryption process (FIG. 6: step S108) The decryption unit 21 obtains the message M by decrypting the ciphertext C using the pre-computation table TBL.

[0096] For comparison, a conventional method will be described. In the conventional KH-PKE, since the secret key sk is not used in the encryption process, the following is used as the pre-computation table TBL.

[0097]

number

[0098] In the encryption process, the pre-calculation table TBL is used to execute the process defined in the following encryption algorithm on the message M to obtain the ciphertext C.

[0099]

number

[0100] According to the method of the above-mentioned embodiment D, the size of the pre-calculation table in KH-PKE can be reduced by 50% or more compared to the conventional method. Since the size of the pre-calculation table is related to the overall calculation cost, reducing the pre-calculation table contributes to reducing the overall calculation cost. Therefore, according to the configuration of embodiment D, the pre-calculation table is reduced, the calculation cost is reduced, and the encryption process is accelerated.

[0101] (Embodiment 3) Hereinafter, the third embodiment will be described with reference to the drawings. The third embodiment differs from the second embodiment in that the third embodiment further includes a pre-calculation device. Therefore, in the following description of the third embodiment, the differences from the second embodiment will be mainly described, and the same reference numerals as those used in the description of the second embodiment will be given to components having the same functional configuration as the second embodiment, and the description thereof will be omitted.

[0102] 7 is a configuration diagram of an encrypted communication system according to embodiment 3. The encrypted communication system 1 according to this embodiment further includes a pre-computation device 40 in addition to the devices according to embodiment 2.

[0103] The pre-calculation device 40 receives the system parameters Sys, generates a pre-calculation table TBL_Sys, and transmits it to the encryption device 10.

[0104] The pre-computation unit 13 of the encryption device 10 generates a pre-computation table TBL_pk based on the public key pk. The pre-computation table storage unit 14 stores TBL_Sys and TBL_pk.

[0105] The encryption unit 11 generates a ciphertext C by encrypting the message M based on pk, sk, and Sys stored in the key storage unit 12 and TBL_Sys and TBL_pk stored in the pre-computation table storage unit 14.

[0106] Next, an operation of the encrypted communication system 1 according to the present embodiment will be described. Fig. 8 is a sequence diagram showing an encrypted communication process according to the third embodiment.

[0107] In the encryption communication process according to the present embodiment, the pre-computation device 40 receives the system parameter Sys (step S301) and executes the pre-computation process (step S302). Then, the pre-computation device 40 transmits the generated pre-computation table TBL_Sys to the encryption device 10 (step S303).

[0108] In the pre-computation process in step S201, the pre-computation unit 13 generates a pre-computation table TBL_pk based on the public key pk.

[0109] (Example E of the third embodiment: KH-PKE) In Example E, an example of encryption using KH-PKE in this embodiment will be described.

[0110] (i) Pre-calculation processing (FIG. 8: step S201) The pre-calculation unit 13 generates a pre-calculation table TBL_pk=(S[0][0], S[0][1], S[0][2], S[i][j]) based on pk=S. Generate.

[0111] (ii) Pre-calculation processing (FIG. 8: step S302) The pre-calculation device 40 generates a pre-calculation table TBL_Sys=((G0[0][0], G0[0][1], G0[0][2]...G0[i][j]), (G1[0][0], G1[0][1], G1[0][2]...G1[i][j])) based on Sys=(G0, G1, G).

[0112] (iii) Encryption process (FIG. 8: step S106) The encryption unit 11 performs the same process as the encryption algorithm according to the second embodiment on the message M to obtain a ciphertext C.

[0113] According to the encrypted communication system 1 of the present embodiment, the encryption device 10 does not perform pre-calculation based on the system parameter Sys, and therefore the amount of pre-calculation can be smaller than that of embodiment 2. Therefore, the calculation cost of the encryption device 10 can be further reduced compared to embodiment 2, and the encryption process can be further accelerated.

[0114] (Embodiment 4) The fourth embodiment will be described below with reference to the drawings. The fourth embodiment differs from the third embodiment in that the encryption device 10 does not include a pre-calculation unit. Therefore, in the following description of the fourth embodiment, the differences from the third embodiment will be mainly described, and the same reference numerals as those used in the description of the third embodiment will be given to components having the same functional configuration as the third embodiment, and the description thereof will be omitted.

[0115] 9 is a configuration diagram of an encrypted communication system according to the fourth embodiment. The encryption device 10 according to this embodiment does not include the pre-computation unit 13 according to the third embodiment. Therefore, the pre-computation table storage unit 14 stores a pre-computation table TBL_Sys based on the system parameter Sys. In other words, the pre-computation table storage unit 14 does not store a pre-computation table TBL_pk based on the public key pk.

[0116] The encryption unit 11 generates a ciphertext C by encrypting the message M based on pk, sk, and Sys stored in the key storage unit 12 and TBL_Sys stored in the pre-computation table storage unit 14.

[0117] Next, an operation of the encrypted communication system 1 according to the present embodiment will be described. Fig. 10 is a sequence diagram showing an encrypted communication process according to the fourth embodiment.

[0118] In the encrypted communication process according to the present embodiment, the encryption device 10 does not execute pre-computation processing (there is no process corresponding to step S201 in FIG. 8 in FIG. 10).

[0119] (Example F of the fourth embodiment: ElGamal encryption) In the embodiment F, an example of encryption using ElGamal encryption in the present embodiment will be described. Details of each process using ElGamal encryption are described below.

[0120] (ii) Pre-calculation processing (FIG. 10: step S302) The pre-calculation device 40 generates a pre-calculation table TBL=(G0[0][0], G0[0][1], G0[0][2]...G0[i][j]) based on Sys=(G0,G).

[0121] In the ElGamal encryption, the encryption unit 11 performs encryption using sk, so it is sufficient to use the pre-calculation table TBL=(G0[0][0], G0[0][1], G0[0][2], G0[i][j]) based on the system parameter Sys=(G0, G). This allows the encryption device 10 to be configured not to perform pre-calculation processing.

[0122] (Example G of the fourth embodiment: KH-PKE)

[0123] (i) Pre-calculation processing (FIG. 10: step S302) The pre-calculation device 40 generates a pre-calculation table TBL_Sys=((G0[0][0], G0[0][1], G0[0][2]...G0[i][j]), (G1[0][0], G1[0][1], G1[0][2]...G1[i][j])) based on Sys=(G0, G1, G).

[0124] (iii) Encryption process (FIG. 8: step S106) The encryption unit 11 performs processing on the message M defined in the following encryption algorithm to obtain a ciphertext C.

[0125]

number

[0126] According to this encryption algorithm, the encryption unit 11 can perform encryption using a pre-calculation table TBL_Sys=((G0[0][0], G0[0][1], G0[0][2]...G0[i][j]), (G1[0][0], G1[0][1], G1[0][2]...G1[i][j])) based on the system parameter Sys=(G0, G1, G). This allows the encryption device 10 to be configured not to perform pre-calculation processing.

[0127] According to the methods of the above-mentioned examples F and G, the encryption device 10 does not perform pre-calculation processing, and therefore the calculation cost of the encryption device 10 can be further reduced. Note that, compared to the configuration of the third embodiment, the configuration of the fourth embodiment reduces the load of pre-calculation, but increases the load of encryption processing. Therefore, when constructing the encrypted communication system 1, a more appropriate configuration can be achieved by selecting one of the forms in consideration of the trade-off between the two.

[0128] (Hardware configuration example) The encryption device 10, the decryption device 20, the key generation device 30, and the pre-computation device 40 (collectively referred to as "devices") can all be realized, for example, by causing a computer to execute a program describing the processing contents described in this embodiment. Note that this "computer" may be a physical machine or a virtual machine on the cloud. When a virtual machine is used, the "hardware" described here is virtual hardware.

[0129] The above program can be recorded on a computer-readable recording medium (such as a portable memory) and can be stored or distributed. The above program can also be provided via a network such as the Internet or e-mail.

[0130] Fig. 11 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 11 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are all connected to each other via a bus B.

[0131] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0132] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0133] In each of the above-described embodiments, an example has been shown in which the key generation device 30 generates the public key pk and the private key sk, but the scope of the present invention is not limited to this, and the encryption device 10 or the decryption device 20 may generate the public key pk and the private key sk.

[0134] (Summary of the embodiment) This specification describes at least the encryption device, the encrypted communication system, the encryption method, and the program described in the following sections. (Section 1) a key storage unit for storing a private key and a public key of a public key cryptosystem; an encryption unit that encrypts communication data using the private key and the public key; Encryption device. (Section 2) the encryption unit encrypts the communication data using a pre-calculation table generated by a device different from the encryption device; 2. An encryption device as defined in claim 1. (Section 3) The encryption unit encrypts the communication data using ElGamal encryption or KH-PKE. 3. An encryption device as defined in claim 2. (Section 4) The encryption unit converts the bit length of the divisor into a short divisor according to the Chinese Remainder Theorem and performs a remainder operation. 4. An encryption device according to any one of claims 1 to 3. (Section 5) The encryption unit encrypts the communication data using RSA encryption or Paillier encryption. 5. An encryption device as defined in claim 4. (Section 6) A cryptographic communication system including an encryption device and a decryption device that perform cryptographic communication with each other, The encryption device includes: a key storage unit for storing a private key and a public key of a public key cryptosystem; an encryption unit that encrypts communication data by using the private key and the public key, The decoding device comprises: a key storage unit that stores the private key and the public key; a decryption unit that decrypts the communication data encrypted by the encryption device using the private key. Cryptographic communication system. (Section 7) 1. A method implemented by a cryptographic device that stores a private key and a public key of a public key cryptosystem, comprising: encrypting communication data using the private key and the public key; Encryption method. (Section 8) A program for causing a computer to function as each unit in the encryption device according to any one of claims 1 to 5.

[0135] Although each embodiment has been described above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0136] 1. Encrypted communication system 10 Encryption device 11 Encryption section 12 Key storage 13 Pre-calculation section 14 Pre-calculation table storage unit 20 Decryption device 21 Decoding section 22 Key storage section 23 Pre-calculation section 24 Pre-calculation table storage unit 30 Key generation device 40 Pre-computation device

Claims

1. a key storage unit for storing a private key and a public key of a public key cryptosystem; an encryption unit that encrypts communication data by KH-PKE using the private key, the public key, and a pre-calculation table generated based on the public key; Encryption device.

2. the encryption unit encrypts the communication data using the pre-computation table generated by a device different from the encryption device; The encryption device according to claim 1 .

3. The encryption unit converts the bit length of the divisor into a short divisor according to the Chinese Remainder Theorem and performs a remainder operation.

3. An encryption device according to claim 1 or 2.

4. A cryptographic communication system including an encryption device and a decryption device that perform cryptographic communication with each other, The encryption device includes: a key storage unit for storing a private key and a public key of a public key cryptosystem; an encryption unit that encrypts communication data by KH-PKE using the private key, the public key, and a pre-calculation table generated based on the public key; The decoding device comprises: a key storage unit that stores the private key and the public key; a decryption unit that decrypts the communication data encrypted by the encryption device using the private key. Cryptographic communication system.

5. 1. A method implemented by a cryptographic device that stores a private key and a public key of a public key cryptosystem, comprising: encrypting communication data by KH-PKE using the private key, the public key, and a pre-calculation table generated based on the public key; Encryption method.

6. A program for causing a computer to function as each unit in the encryption device according to any one of claims 1 to 3.

Images