Cryptographic system, method and program

Abstract

A cryptosystem according an embodiment of the present disclosure includes an encryption device that generates ciphertext by using a secondary-function-type cipher, and a decryption device that decrypts the ciphertext by using the secondary-function-type cipher, wherein: the encryption device has an encryption unit that is configured to receive input of data being encrypted {xi}i∈S_c (where S_c denotes a predetermined first attribute set) and generate ciphertext CT of the data {xi}i∈S_c, employing a hash value wi=H(i) of each attribute i∈S_c as an encryption parameter; and the decryption device has a decryption unit that is configured to receive input of the ciphertext CT and a secret key SK that corresponds to a second attribute set S_k and generate a secondary function value of the data {xi}i∈S_c, when S_k⊆S_c, as the decrypted value of the ciphertext CT.

Description

[Technical Field]

[0001] The present disclosure relates to cryptographic systems, methods, and programs. [Background technology]

[0002] Functional encryption is a technology that can decrypt only a function value related to the original data from a ciphertext. More specifically, when there is a ciphertext CT of data x and a secret key SK corresponding to a function f, when the ciphertext CT is decrypted with the secret key SK, only the function value f(x) is decrypted, and no other information related to the original data x is leaked. In particular, a method is known that utilizes an efficient operation called pairing to construct functional encryption in which the function f is a quadratic function and the ciphertext length is linear with respect to the data x (for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] CEZ Baltico, D. Catalano, D. Fiore, and R. Gay. Practical functional encryption for quadratic functions with applications to predicate encryption. In J. Katz and H. Shacham, editors, CRYPTO 2017, Part I, volume 10401 of LNCS, pages 67-98. Springer, Heidelberg, Aug. 2017. Summary of the Invention [Problem to be solved by the invention]

[0004] However, conventional methods have the limitation that the data size (data length) that can be encrypted is fixed within the system. Generally, when encrypting a large amount of data within a system, if the data length is fixed, the following two problems can occur. The first problem is that data longer than the fixed data length cannot be encrypted. The second problem is that when encrypting data shorter than the fixed data length, the difference must be filled with dummy data. For this reason, when encrypting various data within a system using conventional methods, the efficiency of encryption decreases.

[0005] The present disclosure has been made in consideration of the above points, and aims to realize a quadratic function encryption system that can encrypt data of any length and in which the ciphertext length is linear with respect to the length of the original data. [Means for solving the problem]

[0006] A cryptosystem according to one aspect of the present disclosure includes an encryption device that generates a ciphertext using quadratic function encryption and a decryption device that decrypts the ciphertext using the quadratic function encryption, and the encryption device generates data to be encrypted {x i} i∈S_c (where S_c is a predetermined first attribute set) and calculate the hash value w for each attribute i∈S_c. i =H(i) as encryption parameters and i} i∈S_c the decryption device receives the ciphertext CT and a secret key SK corresponding to a second attribute set S_k, and when S_k ⊆ S_c, generates the data {x i} i∈S_c a decoding unit configured to generate a quadratic function value of [Effects of the Invention]

[0007] It is possible to encrypt data of any length, and to realize a quadratic function encryption in which the ciphertext length is linear with respect to the length of the original data. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of a cryptographic system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a key generation device according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a functional configuration of an encryption device according to the present embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of the functional configuration of a decoding device according to the present embodiment. [Figure 5] FIG. 10 is a sequence diagram showing an example of the overall processing of the cryptographic system according to the present embodiment. [Figure 6] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0009] An embodiment of the present invention will be described below. In the following embodiment, a quadratic function cipher capable of encrypting data of any length and in which the ciphertext length is linear with respect to the length of the original data (hereinafter referred to as "unlimited quadratic function cipher") is constructed, and a cryptographic system 1 that realizes various cryptographic processes using this quadratic function cipher will be described.

[0010] <Construction of Unlimited Quadratic Function Encryption> An example of the configuration of the unrestricted quadratic function cryptosystem proposed in this embodiment will be described below.

[0011] Let p be a prime number. Let Z be the set of all integers. p :=Z / pZ. A cryptographic bilinear group e:G1×G2→G of order p T The generator g1 of G1 and the generator g2 of G2 are assumed to be given as public parameters.

[0012] Furthermore, a hash function with G2 as the codomain, a function-secret inner product function encryption, and an unbounded inner product function encryption are used as components. All of these components are existing technologies. The function-secret inner product function encryption is composed of four algorithms (iSetup, iEnc, iKeyGen, iDec). For a specific method of configuring the function-secret inner product function encryption, see, for example, Reference 1. The unbounded inner product function encryption is composed of four algorithms (uSetup, uEnc, uKeyGen, uDec). For a specific method of configuring the unbounded inner product function encryption, see, for example, Reference 2. In particular, the unbounded inner product function encryption uses what is called the ct-dom type described in Reference 2.

[0013] In the configuration example of the unrestricted quadratic function encryption proposed in this embodiment, each algorithm needs to be able to take a group element as an input, but it is obvious that the above components can take a group element as an input.

[0014] The encryption algorithm of the unrestricted quadratic function encryption proposed in this embodiment takes data as a vector, and each element of the vector is associated with an ID (attribute). The set of IDs is denoted as S c and the data vector is {x i} i∈S_c However, "S_c" can be expressed as "S c " represents.

[0015] On the other hand, the quadratic function corresponding to the secret key is expressed as a coefficient sequence, and each coefficient has information indicating which ID and which ID's quadratic term it is a coefficient for. In other words, the coefficient sequence is expressed as a sequence of coefficients for the ID set S k For {c i,j} i,j∈S_k However, "S_k" is given in the form of "S k " represents.

[0016] Decryption is S k ⊆S c In this case, the decoded value is Σ i,j∈S_kc i,j x i x j However, the above x i and c i,j are all Z p It is assumed that the source of

[0017] Example of unlimited quadratic function encryption configuration The unrestricted quadratic function encryption proposed in this embodiment is composed of four algorithms (Setup, Enc, KeyGen, Dec). The ID space may be any character string.

[0018] Setup: This algorithm is called the setup algorithm. In the setup algorithm, a pair of public key and master private key for unrestricted inner product function cryptography is generated by (uPK, uMSK) ← uSetup, and these are used as a pair of public key PK and master private key MSK for unrestricted quadratic function cryptography. That is, PK = uPK, MSK = uMSK.

[0019] Enc(PK,S c ,{x i} i∈S_c ): This algorithm is called the encryption algorithm. In the encryption algorithm, the ciphertext CT is calculated by the following steps 1 to 7.

[0020] (Step 1) First, generate a master secret key for a two-dimensional function-secret inner-product function cryptosystem using iMSK←iSetup.

[0021] (Step 2) Next, i} i∈S_c Z p Choose randomly from.

[0022] (Step 3) Next, for all i∈S c For the function-secret inner product function encryption, the ciphertext is expressed as iCT i ←iEnc(iMSK,(x i ,s i )) is calculated.

[0023] (Step 4) Next, use the hash function H to find all i∈S c In response to i =H(i).

[0024] (Step 5) Next, for all i∈S c The secret key of the function-secret inner product function cryptosystem is iSK i ←iKeyGen(iMSK,(g2 x_i ,w i )) where "x_i" is "x i " represents.

[0025] (Step 6) Next, the ciphertext of the unbounded inner product function encryption is calculated as uCT←uEnc(uPK,{s i} i∈S_c ) is calculated.

[0026] (Step 7) Then, CT = ({iCT i ,iSK i} i∈S_c ,uCT).

[0027] KeyGen(MSK,{c i,j} i,j∈S_k ): This algorithm is called the key generation algorithm. In the key generation algorithm, the secret key SK is calculated as follows:

[0028]

number

[0029] Dec(CT,SK): This algorithm is called the decryption algorithm. In the decryption algorithm, S k ⊆S c If so, the decryption result d is calculated as follows:

[0030]

number

[0031] The setup algorithm Setup has security parameter 1 λ Although public parameters are input to the encryption algorithm Enc, the key generation algorithm KeyGen, and the decryption algorithm Dec, they are not shown above.

[0032] <Example of overall configuration of cryptosystem 1> An example of the overall configuration of a cryptographic system 1 according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the cryptographic system 1 according to this embodiment includes a key generation device 10, an encryption device 20, and a decryption device 30. These are connected to each other so as to be able to communicate with each other via a communication network 40 including, for example, the Internet.

[0033] The key generation device 10 is any of various information processing devices (for example, a PC (personal computer), a general-purpose server, etc.) that executes a setup algorithm Setup and a key generation algorithm KeyGen.

[0034] The encryption device 20 is any of various information processing devices (for example, various devices such as a PC, a general-purpose server, or an IoT (Internet of Things) device) that executes the encryption algorithm Enc.

[0035] The decryption device 30 is any of various information processing devices (for example, various devices such as a PC, a general-purpose server, an IoT device, etc.) that executes the decryption algorithm Dec.

[0036] The overall configuration of the cryptosystem 1 shown in Fig. 1 is an example and is not limited to this. For example, the cryptosystem 1 shown in Fig. 1 includes one encryption device 20 and one decryption device 30, but there may be multiple encryption devices 20 and multiple decryption devices 30.

[0037] <Example of functional configuration of the key generation device 10, encryption device 20, and decryption device 30> Below, examples of functional configurations of the key generation device 10, encryption device 20, and decryption device 30 according to this embodiment will be described.

[0038] ≪Key generation device 10≫ An example of the functional configuration of the key generation device 10 according to this embodiment is shown in Fig. 2. As shown in Fig. 2, the key generation device 10 according to this embodiment includes a setup processing unit 101, a key generation processing unit 102, and a communication unit 103. These units are realized, for example, by processing that one or more programs installed in the key generation device 10 execute on a calculation device such as a CPU (Central Processing Unit). The key generation device 10 according to this embodiment also includes a storage unit 104. The storage unit 104 is realized, for example, by an auxiliary storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.

[0039] The setup processing unit 101 executes a setup algorithm Setup to generate a public key PK and a master secret key MSK. The key generation processing unit 102 executes a key generation algorithm KeyGen to generate a secret key SK. The communication unit 103 transmits and receives various data to and from the encryption device 20 and the decryption device 30. The storage unit 104 stores, for example, the public key PK, the master secret key MSK, etc.

[0040] ≪Encryption device 20≫ An example of the functional configuration of the encryption device 20 according to this embodiment is shown in Fig. 3. As shown in Fig. 3, the encryption device 20 according to this embodiment includes an encryption processing unit 201 and a communication unit 202. These units are realized, for example, by a processing unit such as a CPU executing one or more programs installed in the encryption device 20. The encryption device 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by an auxiliary storage device such as an HDD, an SSD, or a flash memory.

[0041] The encryption processing unit 201 executes the encryption algorithm Enc to generate a ciphertext CT. The communication unit 202 transmits and receives various data to and from the key generation device 10 and the decryption device 30. The storage unit 203 stores, for example, a public key PK.

[0042] <Decryption device 30> An example of the functional configuration of the decoding device 30 according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the decoding device 30 according to this embodiment includes a communication unit 301 and a decoding processing unit 302. These units are realized, for example, by a process in which one or more programs installed in the decoding device 30 are executed by a calculation device such as a CPU. The decoding device 30 according to this embodiment also includes a storage unit 303. The storage unit 303 is realized, for example, by an auxiliary storage device such as an HDD, an SSD, or a flash memory.

[0043] The communication unit 301 transmits and receives various data to and from the key generation device 10 and the encryption device 20. The decryption processing unit 302 executes the decryption algorithm Dec to generate a decrypted value d. The storage unit 303 stores, for example, a private key SK.

[0044] <Example of overall processing of cryptosystem 1> The overall processing of the cryptographic system 1 according to this embodiment will be described below with reference to Fig. 5. Here, steps S101 to S104 are setup processing, steps S201 to S203 are private key generation processing, and steps S301 to S302 are encryption and decryption processing. The setup processing need only be executed once, for example, when setting up the cryptographic system 1. On the other hand, the private key generation processing is executed when a private key SK is generated for the first time or when the private key SK is changed. Furthermore, the encryption and decryption processing are executed when it becomes necessary to encrypt data and decrypt its function value, etc.

[0045] <<Setup process>> First, the setup processing unit 101 of the key generating device 10 executes the setup algorithm Setup to generate a pair of a public key PK=uPK and a master secret key MSK=uMSK (step S101).

[0046] Next, the setup processing unit 101 of the key generating device 10 stores the public key PK and master secret key MSK generated in the above step S101 in the storage unit 104 (step S102).

[0047] Next, the communication unit 103 of the key generation device 10 transmits the public key PK generated in the above step S101 to the encryption device 20 (step S103).

[0048] Then, when the communication unit 202 of the encryption device 20 receives the public key PK from the key generation device 10, the communication unit 202 stores this public key PK in the storage unit 203 (step S104).

[0049] <<Private key generation process>> First, the key generation processing unit 102 of the key generation device 10 uses a key generation algorithm KeyGen(MSK, {c i,j} i,j∈S_k ) and calculate the coefficient sequence {c i,j} i,j∈S_k A secret key SK corresponding to the quadratic function is generated (step S201). i,j} i,j∈S_k may be provided by the user of the key generating device 10, may be provided by the user of the encryption device 20, or may be provided by another user such as a system administrator.

[0050] Next, the communication unit 103 of the key generation device 10 transmits the private key SK generated in the above step S202 to the decryption device 30 (step S202). At this time, the communication unit 103 transmits the private key SK to the decryption device 30 via any secure communication path.

[0051] Then, when the communication unit 301 of the decryption device 30 receives the private key SK from the key generation device 10, the communication unit 301 stores the private key SK in the storage unit 303 (step S203).

[0052] It should be noted that the private key generation process does not necessarily have to be executed before the encryption and decryption processes, but it is sufficient that it is executed at least before step S303, which will be described later.

[0053] <Encryption and decryption processing> The encryption processing unit 201 of the encryption device 20 uses the encryption algorithm Enc(PK,S c ,{x i} i∈S_c ) to generate the ciphertext CT (step S301).

[0054] Next, the communication unit 202 of the encryption device 20 transmits the ciphertext CT generated in the above step S301 to the decryption device 30 (step S302).

[0055] When the decryption processing unit 302 of the decryption device 30 receives the ciphertext CT from the encryption device 20 via the communication unit 301, the decryption processing unit 302 executes the decryption algorithm Dec(CT, SK) to generate a decrypted value d (step S303).

[0056] <Example of Hardware Configuration of Key Generation Device 10, Encryption Device 20, and Decryption Device 30> The key generation device 10, encryption device 20, and decryption device 30 included in the cryptographic system 1 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 6. The computer 500 shown in Fig. 6 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. These hardware components are connected to each other via a bus 509 so as to be able to communicate with each other.

[0057] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0058] The external I / F 503 is an interface with an external device such as a recording medium 503a. Examples of the recording medium 503a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0059] The communication I / F 504 is an interface for connecting the computer 500 to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a storage device (storage device) such as an HDD, SSD, or flash memory. The processor 508 is an arithmetic device such as a CPU.

[0060] The key generation device 10, encryption device 20, and decryption device 30 included in the cryptographic system 1 according to this embodiment can realize the various processes described above by having, for example, the hardware configuration of a computer 500 shown in Fig. 6. Note that the hardware configuration shown in Fig. 6 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0061] <Summary> As described above, the cryptographic system 1 according to this embodiment can realize various processes (setup process, key generation process, encryption and decryption process) using unrestricted quadratic function cryptography based on pairing.

[0062] Moreover, the unrestricted quadratic function cryptography configured in this embodiment does not create the parameters required for encryption in advance and make them public parameters within the system as in conventional technology, but rather uses a hash function to ad-hocly generate the parameters required for encryption. In other words, the parameters required for encryption (encryption parameters) are generated as needed during encryption. This makes it possible to encrypt data of any size according to its length.

[0063] Therefore, by using the cryptographic system 1 according to this embodiment, it is possible to encrypt data of any size, and the size of the ciphertext can be made linear with the size of the original data. Therefore, by applying the cryptographic system 1 according to this embodiment to a system that encrypts data of various sizes, it becomes possible to encrypt data very efficiently compared to conventional techniques.

[0064] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0065] [References] Reference 1: H. Lin. Indistinguishability obfuscation from SXDH on 5-linear maps and locality-5 PRGs. In J. Katz and H. Shacham, editors, CRYPTO 2017, Part I, volume 10401 of LNCS, pages 599-629. Springer, Heidelberg, Aug. 2017. Reference 2: J. Tomida and K. Takashima. Unbounded inner product functional encryption from bilinear maps. In T. Peyrin and S. Galbraith, editors, ASIACRYPT 2018, Part II, volume 11273 of LNCS, pages 609-639. Springer, Heidelberg, Dec. 2018. [Explanation of symbols]

[0066] 1. Cryptographic Systems 10 Key generator 20 Encryption device 30 Decryption device 40 Communication Network 101 Setup processing section 102 Key generation processing unit 103 Communications Department 104 Storage section 201 Encryption processing unit 202 Communications Department 203 Storage section 301 Communications Department 302 Decryption processing unit 303 Storage section 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. A cryptosystem including an encryption device that generates a ciphertext using quadratic function encryption and a decryption device that decrypts the ciphertext using the quadratic function encryption, The encryption device Data to be encrypted {x ｉ } ｉ∈Ｓ_ｃ (where S_c is a predetermined first attribute set) is input, and a hash value w of each attribute i∈S_c is calculated. ｉ =H(i) as an encryption parameter to encrypt the data {x ｉ } ｉ∈Ｓ_ｃ an encryption unit configured to generate a ciphertext CT of The decoding device When the cipher text CT and a secret key SK corresponding to the second attribute set S_k are input, if S_k ⊆ S_c, the data {x ｉ } ｉ∈Ｓ_ｃ and a decryption unit configured to generate a quadratic function value of

2. the cryptographic system further includes a key generation device; The key generation device The coefficient sequence {c ｉ，ｊ } ｉ，ｊ∈Ｓ_ｋ is input, and the hash value w of each attribute j∈S_k is calculated. ｊ 2. The cryptographic system according to claim 1, further comprising a key generation unit configured to generate the private key SK using =H(j) as a parameter for generating the private key.

3. The key generation unit 3. The cryptographic system according to claim 2, wherein the cryptographic system is configured to generate the secret key SK by a key generation algorithm of an unrestricted inner product function cryptography using the parameters for generating the secret key.

4. The encryption unit Using the encryption parameters, each hash value w is generated by a secret key generation algorithm of the function-secret inner product function encryption. ｉ The private key iSK corresponding to each ｉ Generate Each (x ｉ , s ｉ ) (where {s ｉ } ｉ∈Ｓ_ｃ is a set Z of integers between 0 and p, where p is a prime number. ｐ The ciphertext iCT corresponding to each element (randomly selected from ｉ Generate The encryption algorithm of the unlimited inner product function encryption ｉ } ｉ∈Ｓ_ｃ Generate a ciphertext uCT of The ciphertext CT = ({iCT ｉ , iSK ｉ } ｉ∈Ｓ_ｃ 4. The cryptographic system of claim 3, configured to generate a cryptographic vector (uCT).

5. The decoding unit If S_k ⊆ S_c, the secret key iSK ｉ The ciphertext iCT is decrypted by the function-secret inner product function encryption decryption algorithm using ｉ The result of decoding is iDec(iCT ｉ , iSK ｉ ) and the coefficient sequence {c ｉ，ｊ } ｉ，ｊ∈Ｓ_ｋ and (iDec(iCT) for i, j∈S_k) based on the result uDec(uCT, uSK) of decrypting the ciphertext uCT using the secret key SK=uSK (where uSK is the secret key of the unrestricted scalar product function cipher) by the decryption algorithm of the unrestricted scalar product function cipher. ｉ , iSK ｉ )^c ｉ，ｊ 5. The cryptographic system of claim 4, wherein the cryptographic system is configured to calculate the product of uDec(uCT, uSK) / uDec(uCT, uSK) as the decrypted value of the ciphertext CT.

6. A method for use in a cryptosystem including an encryption device that generates a ciphertext using quadratic function encryption and a decryption device that decrypts the ciphertext using the quadratic function encryption, The encryption device Data to be encrypted {x ｉ } ｉ∈Ｓ_ｃ (where S_c is a predetermined first attribute set) is input, and a hash value w of each attribute i∈S_c is calculated. ｉ =H(i) as an encryption parameter to encrypt the data {x ｉ } ｉ∈Ｓ_ｃ an encryption procedure to generate a ciphertext CT of The decoding device When the cipher text CT and a secret key SK corresponding to the second attribute set S_k are input, if S_k ⊆ S_c, the data {x ｉ } ｉ∈Ｓ_ｃ a decoding procedure that generates a quadratic function value of

7. A program that causes a computer to function as an encryption device or a decryption device included in the encryption system according to claim 1.

Images