Decryption device, decryption method, and program

Abstract

To increase the speed of encryption-related processing.SOLUTION: An encryption device is provided, comprising an encryption unit configured to identify an ellipse point corresponding to an entered plain text by referring to a storage unit storing multiple possible integer values for the plain text m and ellipse points mP corresponding to respective ones of the values in association with each other, and encrypt the plain text.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention relates to revenge Device No. , revenge Method No. and program.

Background Art

[0002] The Elliptic Lifted-ElGamal cryptosystem is an improvement of the Elliptic ElGamal cryptosystem. While the Elliptic ElGamal cryptosystem limits the plaintext to points on an elliptic curve, the Elliptic Lifted-ElGamal cryptosystem can take an integer value as the input message m. Also, the Elliptic Lifted-ElGamal cryptosystem has additive homomorphic properties.

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] The basic operations in the Elliptic Lifted-ElGamal cryptosystem are carried out on an elliptic curve, but operations on an elliptic curve are slower compared to integer calculations, and speeding up such processing has become an issue.

[0005] The present invention has been made in view of the above points, and an object thereof is to speed up processing related to cryptography.

Means for Solving the Problems

[0006] Therefore, in order to solve the above problems, The decryption device is configured to decrypt the ciphertext by referring to a storage unit that stores a plurality of possible values ​​for the integer plaintext m, an elliptic point mP corresponding to each of the plurality of values, and the hash value of the elliptic point mP, and identifying the plaintext corresponding to the hash value of the elliptic point related to the input ciphertext. has.

Effects of the Invention

[0007] This allows for faster processing related to cryptography. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example of the hardware configuration of a computer that functions as an encryption device 10E or a decryption device 10D in an embodiment of the present invention. [Figure 2] This figure shows an example of the functional configuration of the encryption device 10E in an embodiment of the present invention. [Figure 3] This figure shows an example configuration of the m-mP full table T1. [Figure 4] This figure shows an example of the functional configuration of the decoding device 10D in an embodiment of the present invention. [Figure 5] This figure shows an example of the functional configuration of the cryptographic conversion device 10T in an embodiment of the present invention. [Figure 6] This figure shows an example of a system configuration that includes a homomorphic adder 20 between the encryption device 10E and the decryption device 10D. [Figure 7] This figure shows an example configuration of a web conferencing system including the encryption device 10E and decryption device 10D of this embodiment. [Modes for carrying out the invention]

[0009] [Elliptic Lifted-ElGamal Cryptography] First, let's explain the elliptic lifted-ElGamal cryptography. Elliptic lifted-ElGamal cryptography consists of four algorithms: key generation, encryption, decryption, and homomorphic operation.

[0010] Setup: Elliptic curve G of prime order p = Key generation: Using the security parameter as input, randomly determine s ← F p Here, s is the private key and H is the public key. Calculate H ← sP.

[0011] Encryption: Using the public key H, the random number r output from the encryption random number generator, and the elliptic point P determined by the elliptic curve to be used, encrypt the integer input m and output the ciphertext C = (S, T). (i) M ← mP (ii) S ← M + rH, T ← rP Decryption: Input the private key s and the ciphertext C = (S, T) and output m. (i) M ← S - sT (ii) m ← M (ii) is realized by solving the "discrete logarithm problem" of obtaining m from P and M = mP.

[0012] Homomorphic operation: Input the ciphertexts C1 and C2 of different integer values m1 and m2, and output Cadd ← C1 + C2.

[0013] Conventionally, among these algorithms, in encryption and decryption, the following two pre-operations and the pre-operation table created thereby are used (Non-Patent Document 1).

[0014] This is a table in which nH is pre-calculated based on the public key H. It is used to quickly derive the value of rH corresponding to an arbitrary integer value r input. Hereinafter, this table is referred to as the "public key table".

[0015] In the decryption of the elliptic Lifted-ElGamal cipher, it is finally necessary to obtain m based on mP and P. This is a very difficult problem called the Discrete Logarithm Problem (DLP). To solve this problem quickly, in the elliptic Lifted-ElGamal cipher, the possible values of mP are calculated in advance and used as a hash table during decryption. Hereinafter, the hash table is referred to as the "hash table for DLP".

[0016] [Outline of Embodiment of the Present Invention] This embodiment speeds up encryption and decryption by using a new precomputation table. The precomputation table lists all patterns of pairs of messages and the corresponding elliptic points. The precomputation table precomputes the values of mP corresponding to a plurality of integer values m and forms a table of the correspondence between m and mP. As will be described later, the precomputation table may also be a table of the correspondence between m, mP, and the hash value of mP. By using such a table, the operation cost of m→M = mP that occurred in the prior art can be replaced with a single table search, and the number of elliptic scalar multiplications can be reduced. In addition, this table can also be used as part of the hash table (hash table T3 for DLP) used in the process of solving the DLP of M→m, and when the output value is in the same space as m, the processing time can be reduced.

[0017] In this embodiment, the meaning of each symbol used in the encryption and decryption operations follows the description of the above elliptic Lifted-ElGamal cipher.

[0018] [Encryption Device 10E and Decryption Device 10D in Embodiment of the Present Invention] Embodiments of the present invention will be described below with reference to the drawings. Figure 1 is a diagram showing an example of the hardware configuration of a computer that functions as an encryption device 10E or a decryption device 10D in an embodiment of the present invention. The computer in Figure 1 has a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, etc., which are all interconnected by bus B.

[0019] The program that enables computer processing is provided on a recording medium 101 such as a CD-ROM. When the recording medium 101 containing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101; it may also be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files and data.

[0020] The memory device 103 reads and stores a program from the auxiliary storage device 102 when a program startup command is received. The processor 104 is either a CPU or a GPU (Graphics Processing Unit), or both a CPU and a GPU, and executes computer-related functions according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0021] [Encryption device 10E] Figure 2 shows an example of the functional configuration of the encryption device 10E in an embodiment of the present invention. In Figure 2, the encryption device 10E includes an encryption random number generation unit 111, an encryption unit 112, and a pre-calculation table storage unit 130E. The encryption random number generation unit 111 and the encryption unit 112 are realized by a process in which one or more programs installed on a computer functioning as the encryption device 10E are executed by a processor 104. However, each of these units may be realized by a circuit. The pre-calculation table storage unit 130E can be realized using, for example, an auxiliary storage device 102.

[0022] The encrypted random number generation unit 111 generates a random number r.

[0023] The encryption unit 112 encrypts the integer input plaintext m by performing the following operations using a random number r and an elliptic point P determined by the elliptic curve used, and outputs the ciphertext E(m)=(S,T). Examples of input plaintext m include audio data, image data, video data, etc. (i)M←mP (ii) S←M+rH,T←rP In (i), the encryption unit 112 performs the calculation in (i) at high speed by referring to the m-mP full table T1 which is pre-stored in the pre-calculation table storage unit 130E.

[0024] Figure 3 shows an example of the configuration of the m-mP full table T1. Two examples, (a) and (b), are shown in Figure 3. The following input plaintext

[0025]

number

[0026] The m-mP full table T1 in (a) is a table that stores all possible values ​​of m and their corresponding pre-calculated mP values.

[0027] The m-mP full table T1 in (b) is a table that stores the pre-calculated values ​​of mP and the values ​​of H(mP) associated with all possible values ​​of m. Here, H(mP) is the result of passing mP as input to a hash function.

[0028] The encryption unit 112 may use either table (a) or (b). In either case, the encryption unit 112 refers to the full m-mP table T1 to identify the value of mP corresponding to the input plaintext value m, and then performs the operation (i).

[0029] Furthermore, the encryption unit 112, in the same manner as in the conventional technology, refers to the public key table T2 to quickly derive the value of rH corresponding to the random number r for the operation in (ii).

[0030] Figure 4 shows an example of the functional configuration of the decryption device 10D in an embodiment of the present invention. In Figure 4, the decryption device 10D has a decryption unit 121 and a pre-calculation table storage unit 130D. The decryption unit 121 is realized by a process in which one or more programs installed on a computer that functions as an encryption device 10E cause the processor 104 to execute. However, the decryption unit 121 may be realized by a circuit. The pre-calculation table storage unit 130D can be realized using, for example, an auxiliary storage device 102.

[0031] The decryption unit 121 takes the secret key s and the ciphertext E(m)=(S,T) as input, performs the following operations, and outputs m. (i)M←S-sT (ii)m←M In (ii), the decryption unit 121 performs the calculation in (ii) at high speed by referring to the m-mP full table T1 (Figure 3) which is pre-stored in the pre-calculation table storage unit 130D. In this case, the decryption unit 121 may use either Figure 3(a) or (b). In this embodiment, decryption is basically performed by using the m-mP full table T1 instead of the DLP hash table T3. However, the DLP hash table T3 may be used to improve the efficiency of calculation processing when the decrypted value exceeds m.

[0032] When using table (a), the decryption unit 121 refers to the table to identify m, which corresponds to M (=mP), the calculation result of (i) for the input ciphertext. To further speed up this search, table (a) in the decryption device 10D may be sorted by the value of mP. However, M is a point on the group and will be a large value. For example, when using the elliptic Lifted-ElGamal encryption scheme with a 256-bit elliptic curve, M consists of four 256-bit integer values, so the value is too large to use directly. Therefore, by using table (b) instead of (a), further speed improvements can be expected.

[0033] When using the table in (b), the decryption unit 121 applies the hash function H(x) to the input M to obtain a small hash value (H(M)). The decryption unit 121 identifies the m corresponding to this hash value by referring to the table in (b).

[0034] Although the above example shows the encryption unit 112 and the decryption unit 121 being implemented in different devices, as shown in Figure 5, both the encryption unit 112 and the decryption unit 121 may be included in the same device. In Figure 5, the same parts as in Figure 2 or Figure 4 are denoted by the same reference numerals. In the encryption conversion device 10T shown in Figure 5, the m-mP full table T1 is shared by the encryption unit 112 and the decryption unit 121.

[0035] Furthermore, a device that performs homomorphic operations may be interposed between the encryption device 10E and the decryption device 10D.

[0036] Figure 6 shows an example of a system configuration including a homomorphic adder 20 between the encryption device 10E and the decryption device 10D. In Figure 6, the same parts as in Figure 2 or Figure 4 are denoted by the same reference numerals. In Figure 6, the homomorphic adder 20 receives the ciphertext E(m1) output by the encryption device 10E-1 when it encrypts the plaintext m1, and the ciphertext E(m2) output by the encryption device 10E-2 when it encrypts the plaintext m2, performs homomorphic addition on E(m1) and E(m2), and outputs E(m1+m2). The decryption device 10D receives E(m1+m2) as input, decrypts it, and outputs (m1+m2).

[0037] Although the encryption device 10E and decryption device 10D can be used for various purposes, here we will describe an example of their use in a web conferencing system.

[0038] Figure 7 shows an example configuration of a web conferencing system including the encryption device 10E and decryption device 10D of this embodiment.

[0039] In Figure 7, user terminal 30-1 and user terminal 30-2 (hereinafter referred to as "user terminal 30" when not distinguishing between them) connect to the intermediate server 40 via a network such as the Internet.

[0040] User terminal 30 is a PC (Personal Computer) or other device used by participants in a web conference. Figure 7 assumes a web conference with two participants, but in the case of a web conference with three or more participants, there will be three or more user terminals 30.

[0041] In Figure 7, each user terminal 30 has an encryption device 10E, a communication unit 31, and a decryption device 10D.

[0042] The encryption device 10E encrypts the input mn, which is plaintext audio data, image data, video data, etc., and outputs ciphertext E(mn) (mn=m1~m2).

[0043] The communication unit 31 transmits the ciphertext E(mn) to the intermediate server 40 and receives E(mMix) from the intermediate server 40, which is the result of a homomorphic operation (e.g., superposition) performed on the ciphertext E(mn) from each user terminal 30.

[0044] The decoding device 10D decodes E(mMix) and outputs mMix.

[0045] The intermediate server 40 is one or more computers that mediate (relay) communication between user terminals 30. In Figure 7, the intermediate server 40 has a communication unit 41 and a processing unit 42.

[0046] The communication unit 41 receives multiple encrypted inputs E(m1) to E(m2) transmitted from each user terminal 30 and inputs E(m1) to E(m2) to the processing unit 42. The communication unit 41 also transmits E(mMix) output from the processing unit 42 to each user terminal 30.

[0047] The processing unit 42 takes the multiple encrypted inputs E(m1) to E(m2) input from the communication unit 41, performs superposition processing while keeping them encrypted, and outputs E(mMix).

[0048] Even in systems requiring real-time performance, such as web conferencing systems, the encryption device 10E and decryption device 10D in this embodiment can perform encryption and decryption at high speed. Furthermore, the same m-mP full table T1 may be shared between the encryption device 10E and decryption device 10D in each user terminal 30.

[0049] As described above, according to this embodiment, processing related to elliptic lifted-ElGamal encryption (encryption and decryption) can be accelerated.

[0050] Furthermore, this embodiment is applicable not only to elliptic lifted-ElGamal cryptography but also to cryptographic schemes defined on a cyclic group G, such as Keyed Homomorphic Public Key Encryption.

[0051] Although embodiments of the present invention have been described in detail above, the present invention is not limited to these specific embodiments, and various modifications and changes are possible within the scope of the gist of the present invention as described in the claims. [Explanation of Symbols]

[0052] 10D Decoder 10E Encryption device 10T Cryptographic Transmutation Device 20 Homogeneous Adder 30 User terminals 31 Communications Department 40 Intermediate Servers 41 Communications Department 42 Processing Units 100 drive unit 101 Recording media 102 Auxiliary storage device 103 Memory device 104 Processors 105 Interface device 111 Encryption Random Number Generation Unit 112 Encryption section 121 Decoding section 130D Pre-calculation table storage unit 130E Pre-calculation table storage unit B Bus

Claims

1. A decryption unit is configured to decrypt a ciphertext by referring to a storage unit that stores a plurality of possible values ​​for a plaintext m, which is an integer, an elliptic point mP corresponding to each of the plurality of values, and the hash value of the elliptic point mP, and identifying the plaintext corresponding to the hash value of the elliptic point related to the input ciphertext. A decoding device characterized by having the following features.

2. A decryption procedure for decrypting a ciphertext involves referring to a storage unit that stores multiple possible values ​​for an integer plaintext m, corresponding elliptic points mP for each of these multiple values, and the hash value of the elliptic point mP, to identify the plaintext corresponding to the hash value of the elliptic point related to the input ciphertext. A decryption method characterized by being performed by a computer.

3. A program characterized by causing a computer to execute the decoding method described in claim 2.

Images