Encryption system, encryption method, and encryption program

Abstract

An encryption device (400) uses a first internal public key and a first external public key to double-encrypt plaintext and generate ciphertext. A re-encryption key generation device (500) generates a randomized internal secret key using a second random number and a first internal secret key, generates a second encrypted random number using a second internal public key, generates a randomized external secret key using a first random number and a first external secret key, and generates a first encrypted random number using a second external public key. A re-encryption device (600) generates re-encrypted text using the randomized external secret key, the randomized internal secret key, the second internal public key, the second external public key, and the ciphertext. A decoding device (700) calculates the plaintext by using the second internal secret key, the second encrypted random number, the second external secret key, the first encrypted random number, and the re-encrypted text.

Description

Cryptographic system, cryptographic method and cryptographic program

[0001] The present disclosure relates to a method for re-encrypting ciphertext without decrypting it.

[0002] Proxy re-encryption is a public key cryptography technique that enables changing a ciphertext to a different key without decrypting the ciphertext. Non-Patent Document 1 discloses a public key cryptography method that realizes proxy re-encryption.

[0003] Also, a method has been proposed that allows proxy re-encryption to be achieved even when different encryption methods are used.

[0004] ACHIEVING FLEXIBILITY FOR ABE WITH OUTSOURCING VIA PROXY RE-ENCRYPTION, ASIACCS'18, JUNE 4-8, 2018, INCHEON, REPUBLIC OF KOREA

[0005] Non-Patent Document 1 describes a method for changing the key while keeping the encryption. Non-Patent Document 1 also indicates that conversion to a different encryption method is possible if certain characteristics are met. However, Non-Patent Document 1 does not mention how to deal with double encryption.

[0006] The present disclosure aims to enable double encryption to change the key of the inner encryption scheme while leaving the key of the outer encryption scheme unchanged.

[0007] The cryptographic system of the present disclosure includes an encryption device that double-encrypts plaintext using a first internal public key and a first external public key to generate a ciphertext; a re-encryption key generation device that randomizes a first internal private key using a second random number to generate a randomized internal private key, encrypts the second random number using the second internal public key to generate a second encrypted random number, randomizes the first external private key using the first random number to generate a randomized external private key, and encrypts the first random number using the second external public key to generate a first encrypted random number; and a re-encryption device that decrypts the ciphertext using the randomized external private key and the randomized internal private key to obtain a randomized decrypted text, and encrypts the randomized decrypted text using the second internal public key and the second external public key to generate a re-encrypted text. a decryption device that decrypts the second random number from the second encrypted random number using a second internal private key, decrypts the first random number from the first encrypted random number using a second external private key, decrypts the randomized decrypted text from the re-encrypted text using the second external private key and the second internal private key, and calculates the plaintext using the randomized decrypted text, the second random number, and the first random number.

[0008] According to the present disclosure, it is possible to change the key for the inner encryption scheme in double encryption while leaving the key for the outer encryption scheme unchanged.

[0009] FIG. 1 is a configuration diagram of a cryptographic system 100 according to a first embodiment. FIG. 2 is a configuration diagram of a parameter generation device 200 according to the first embodiment. FIG. 3 is a configuration diagram of a key generation device 300 according to the first embodiment. FIG. 4 is a configuration diagram of an encryption device 400 according to the first embodiment. FIG. 5 is a configuration diagram of a re-encryption key generation device 500 according to the first embodiment. FIG. 6 is a configuration diagram of a re-encryption device 600 according to the first embodiment. FIG. 7 is a configuration diagram of a decryption device 700 according to the first embodiment. FIG. 8 is a functional configuration diagram of the parameter generation device 200 according to the first embodiment. FIG. 9 is a flowchart of a parameter generation method according to the first embodiment. FIG. 10 is a functional configuration diagram of a key generation device 300 according to the first embodiment. FIG. 11 is a flowchart of a key generation method according to the first embodiment. FIG. 12 is a functional configuration diagram of an encryption device 400 according to the first embodiment. FIG. 13 is a flowchart of an encryption method according to the first embodiment. FIG. 14 is a functional configuration diagram of a re-encryption key generation device 500 according to the first embodiment. FIG. 15 is a flowchart of a re-encryption key generation method according to the first embodiment. FIG. 16 is a functional configuration diagram of a re-encryption device 600 according to the first embodiment. FIG. 17 is a flowchart of a re-encryption method according to the first embodiment. FIG. 18 is a functional configuration diagram of a decryption device 700 according to the first embodiment. FIG. 19 is a flowchart of a decryption method according to the first embodiment. FIG. 1 is a hardware configuration diagram of a parameter generation device 200 according to embodiment 1. FIG. 2 is a hardware configuration diagram of a key generation device 300 according to embodiment 1. FIG. 3 is a hardware configuration diagram of an encryption device 400 according to embodiment 1. FIG. 4 is a hardware configuration diagram of a re-encryption key generation device 500 according to embodiment 1. FIG. 5 is a hardware configuration diagram of a re-encryption device 600 according to embodiment 1. FIG. 6 is a hardware configuration diagram of a decryption device 700 according to embodiment 1.

[0010] In the embodiments and drawings, the same or corresponding elements are denoted by the same reference numerals. The description of elements denoted by the same reference numerals as those already described will be omitted or simplified as appropriate. Arrows in the drawings primarily indicate the flow of data or the flow of processing.

[0011] First Embodiment A cryptographic system 100 will be described with reference to FIGS.

[0012] ***Description of Configuration*** The configuration of the cryptographic system 100 will be described with reference to Fig. 1. The cryptographic system 100 includes a parameter generation device 200, a plurality of key generation devices 300, a plurality of encryption devices 400, a re-encryption key generation device 500, a re-encryption device 600, and a decryption device 700. These devices communicate with each other via a network 101. The network 101 is a communication path connecting these devices. An example of the network 101 is the Internet. When the cryptographic system 100 is installed within a company, for example, a local area network (LAN) is used as the network 101. Other types of networks 101 may also be used.

[0013] The configuration of the parameter generation device 200 will be described with reference to Fig. 2. The parameter generation device 200 is a computer including hardware such as a processor 201, a memory 202, an auxiliary storage device 203, a communication device 204, and an input / output interface 205. These pieces of hardware are connected to one another via signal lines.

[0014] A processor is an IC that performs arithmetic processing and controls other hardware. For example, a processor is a CPU. IC is an abbreviation for Integrated Circuit. CPU is an abbreviation for Central Processing Unit.

[0015] Memory is a volatile or non-volatile storage device. Memory is also called primary storage or main memory. For example, memory is RAM. Data stored in memory is saved in secondary storage as needed. RAM is an abbreviation for Random Access Memory.

[0016] The auxiliary storage device is a non-volatile storage device. For example, the auxiliary storage device may be a ROM, a HDD, a flash memory, or a combination of these. Data stored in the auxiliary storage device is loaded into the memory as needed. ROM is an abbreviation for Read Only Memory. HDD is an abbreviation for Hard Disk Drive.

[0017] The parameter generating device 200 communicates using a communication device 204. The communication device is a receiver and a transmitter. For example, the communication device is a communication chip or NIC. NIC is an abbreviation for Network Interface Card.

[0018] Input and output of the parameter generating device 200 is performed using an input / output interface 205. The input / output interface is a port to which an input device and an output device are connected. For example, the input / output interface is a USB terminal, the input devices are a keyboard and a mouse, and the output device is a display. USB is an abbreviation for Universal Serial Bus.

[0019] The parameter generating device 200 includes elements such as a receiving unit 210, a parameter generating unit 220, and an output unit 230. These elements are realized by software.

[0020] The auxiliary storage device stores an OS. At least a portion of the OS is loaded into memory and executed by the processor. The auxiliary storage device 203 also stores a parameter generation program for causing the computer to function as a reception unit 210, a parameter generation unit 220, and an output unit 230. The parameter generation program is loaded into memory 202 and executed by the processor 201. The processor 201 executes the parameter generation program while running the OS. OS is an abbreviation for Operating System.

[0021] Input and output data of the parameter generation program are stored in the storage unit 290. The memory functions as the storage unit. However, a storage unit such as an auxiliary storage device, a register in a processor, or a cache memory in a processor may function as the storage unit instead of or together with the memory.

[0022] The parameter generation program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0023] The configuration of the key generation device 300 will be described with reference to Fig. 3. The key generation device 300 is a computer that includes hardware such as a processor 301, a memory 302, an auxiliary storage device 303, a communication device 304, and an input / output interface 305. These pieces of hardware are connected to each other via signal lines.

[0024] Communication with the key generation device 300 is performed using a communication device 304. Input and output with the key generation device 300 is performed using an input / output interface 305.

[0025] The key generation device 300 includes elements such as a reception unit 310, an internal key generation unit 321, an external key generation unit 322, and an output unit 330. These elements are realized by software. A key generation program for causing a computer to function as the reception unit 310, the internal key generation unit 321, the external key generation unit 322, and the output unit 330 is stored in the auxiliary storage device 303. The key generation program is loaded into the memory 302 and executed by the processor 301. The processor 301 executes the key generation program while running the OS.

[0026] Input and output data of the key generation program are stored in the storage unit 390 .

[0027] The key generation program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0028] The configuration of the encryption device 400 will be described with reference to Fig. 4. The encryption device 400 is a computer equipped with hardware such as a processor 401, a memory 402, an auxiliary storage device 403, a communication device 404, and an input / output interface 405. These pieces of hardware are connected to one another via signal lines.

[0029] Communications of the encryption device 400 are performed using a communication device 404. Input and output of the encryption device 400 are performed using an input / output interface 405.

[0030] The encryption device 400 includes elements such as a reception unit 410, an encryption unit 420, and an output unit 430. These elements are realized by software. An encryption program for causing a computer to function as the reception unit 410, the encryption unit 420, and the output unit 430 is stored in the auxiliary storage device 403. The encryption program is loaded into the memory 402 and executed by the processor 401. The processor 401 executes the encryption program while running the OS.

[0031] The input and output data of the encrypted program are stored in the storage unit 490 .

[0032] The encryption program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0033] The configuration of the re-encryption key generation device 500 will be described with reference to Fig. 5. The re-encryption key generation device 500 is a computer including hardware such as a processor 501, a memory 502, an auxiliary storage device 503, a communication device 504, and an input / output interface 505. These pieces of hardware are connected to each other via signal lines.

[0034] The re-encryption key generating device 500 communicates using a communication device 504. The re-encryption key generating device 500 inputs and outputs data using an input / output interface 505.

[0035] The re-encryption key generation device 500 includes elements such as a reception unit 510, a re-encryption key generation unit 520, and an output unit 530. These elements are realized by software. A secondary storage device 503 stores a re-encryption key generation program for causing a computer to function as the reception unit 510, the re-encryption key generation unit 520, and the output unit 530. The re-encryption key generation program is loaded into memory 502 and executed by the processor 501. The processor 501 executes the re-encryption key generation program while running the OS.

[0036] Input and output data of the re-encryption key generation program are stored in storage unit 590 .

[0037] The re-encryption key generation program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0038] The configuration of the re-encryption device 600 will be described with reference to Fig. 6. The re-encryption device 600 is a computer equipped with hardware such as a processor 601, a memory 602, an auxiliary storage device 603, a communication device 604, and an input / output interface 605. These pieces of hardware are connected to each other via signal lines.

[0039] Communications of the re-encryption device 600 are performed using a communication device 604. Input and output of the re-encryption device 600 are performed using an input / output interface 605.

[0040] The re-encryption device 600 includes elements such as a reception unit 610, a re-encryption unit 620, and an output unit 630. These elements are realized by software. A re-encryption program for causing a computer to function as the reception unit 610, the re-encryption unit 620, and the output unit 630 is stored in the auxiliary storage device 603. The re-encryption program is loaded into the memory 602 and executed by the processor 601. The processor 601 executes the re-encryption program while running the OS.

[0041] The input and output data of the re-encryption program are stored in the storage unit 690 .

[0042] The re-encryption program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0043] The configuration of a decoding device 700 will be described with reference to Fig. 7. The decoding device 700 is a computer including hardware such as a processor 701, a memory 702, an auxiliary storage device 703, a communication device 704, and an input / output interface 705. These pieces of hardware are connected to one another via signal lines.

[0044] The communication of the decoding device 700 is performed using a communication device 704. The input / output of the decoding device 700 is performed using an input / output interface 705.

[0045] The decoding device 700 includes elements such as a reception unit 710, a decoding unit 720, and an output unit 730. These elements are realized by software. A decoding program for causing a computer to function as the reception unit 710, the decoding unit 720, and the output unit 730 is stored in the auxiliary storage device 703. The decoding program is loaded into the memory 702 and executed by the processor 701. The processor 701 executes the decoding program while running the OS.

[0046] Input and output data of the decoding program are stored in storage unit 790 .

[0047] The decoding program can be recorded (stored) in a computer-readable manner on a non-volatile recording medium such as an optical disk or a flash memory.

[0048] ***Explanation of Operation*** The operation procedures of the encryption system 100 correspond to an encryption method. Also, the operation procedures of the encryption system 100 correspond to processing procedures according to an encryption program. The operation procedures of the parameter generation device 200 correspond to a parameter generation method. Also, the operation procedures of the parameter generation device 200 correspond to processing procedures according to a parameter generation program. The operation procedures of the key generation device 300 correspond to a key generation method. Also, the operation procedures of the key generation device 300 correspond to processing procedures according to a key generation program. The operation procedures of the encryption device 400 correspond to an encryption method. Also, the operation procedures of the encryption device 400 correspond to processing procedures according to an encryption program. The operation procedures of the re-encryption key generation device 500 correspond to a re-encryption key generation method. Also, the operation procedures of the re-encryption key generation device 500 correspond to processing procedures according to a re-encryption key generation program. The operation procedures of the re-encryption device 600 correspond to a re-encryption method. Also, the operation procedures of the re-encryption device 600 correspond to processing procedures according to a re-encryption program. The operation procedures of the decryption device 700 correspond to a decryption method. The operation procedures of the decryption device 700 correspond to the processing procedures of the decryption program. The encryption methods include a parameter generation method, a key generation method, an encryption method, a re-encryption key generation method, a re-encryption method, and a decryption method. The encryption programs include a parameter generation program, a key generation program, an encryption program, a re-encryption key generation program, a re-encryption program, and a decryption program.

[0049] In the cryptographic method, the following relationships hold: M = DEC(SK, C) RANDM(R, M) = DEC(RANDSKEY(R, SK), C) = DEC(SK, RANDCT(R, C))

[0050] "DEC" represents a decryption algorithm for public key encryption. For example, M = DEC(SK, C) means that a secret key SK and ciphertext C are input and plaintext M is output. "RANDM" represents a plaintext randomization algorithm. For example, RANDM(R, M) means that plaintext M is randomized using a random number R. "RANDSKEY" represents a key randomization algorithm. For example, RANDSKEY(R, SK) means that a secret key SK is randomized using a random number R. "RANDCT" represents a ciphertext randomization algorithm. For example, RANDDCT(R, C) means that ciphertext C is randomized using a random number R.

[0051] The parameter generation method will be described with reference to Figures 8 and 9. Figure 8 shows the functional configuration of the parameter generation device 200. Figure 9 shows a flowchart of the parameter generation method.

[0052] In step S210, the reception unit 210 receives a key length K. The key length K indicates a bit length. For example, an administrator inputs the key length K to the parameter generation device 200, and the reception unit 210 receives the input key length K.

[0053] The key length K is information for generating the common parameters PARAM, and ultimately becomes part of the common parameters PARAM.

[0054] In step S220, the parameter generation unit 220 generates a common parameter PARAM. The common parameter PARAM is a parameter that is the basis of calculations in a cryptographic method. In other words, the common parameter PARAM is a parameter for encryption. An example of the common parameter PARAM is an elliptic curve parameter for elliptic curve cryptography. For example, the parameter generation unit 220 generates a random number and uses the random number to generate the common parameter PARAM.

[0055] In step S230, the output unit 230 outputs the common parameters PARAM. For example, the output unit 230 transmits the common parameters PARAM to a plurality of key generation devices 300. The output unit 230 may transmit the common parameters PARAM to a plurality of key generation devices 300, a plurality of encryption devices 400, a re-encryption key generation device 500, a re-encryption device 600, and a decryption device 700. The common parameters PARAM may be delivered to each device manually, such as by mail.

[0056] The key generation method will be described with reference to Figures 10 and 11. Figure 10 shows the functional configuration of a key generation device 300. The key generation unit 320 includes elements such as an internal key generation unit 321 and an external key generation unit 322. The output unit 330 includes elements such as a public key setting unit 331, a public key output unit 332, a private key setting unit 333, and a private key output unit 334. Figure 11 shows a flowchart of the key generation method. Each of the multiple key generation devices 300 performs the key generation method.

[0057] In step S310, the receiving unit 310 receives the common parameters PARAM. For example, the receiving unit 310 receives the common parameters PARAM transmitted from the parameter generating device 200.

[0058] In step S321, the internal key generation unit 321 generates an internal key pair using the common parameter PARAM.

[0059] The internal key pair is a pair of an internal public key PK2 and an internal private key SK2. The internal public key PK2 is a public key for internal encryption. The internal private key SK2 is a private key for internal encryption. Internal encryption refers to internal encryption in double encryption (first encryption, first encryption, previous encryption).

[0060] The internal key pair (PK2, SK2) is expressed as follows: (PK2, SK2) = KG2(PARAM)

[0061] "KG2" represents a key generation algorithm for public key encryption (PKE). When the key generation algorithm KG2 is executed with the common parameter PARAM as input, it outputs an internal key pair (PK2, SK2).

[0062] In step S322, the external key generation unit 322 generates an external key pair using the common parameter PARAM.

[0063] The external key pair is a pair of an external public key PK1 and an external private key SK1. The external public key PK1 is a public key for external encryption. The external private key SK1 is a private key for external encryption. External encryption refers to external encryption in double encryption (second encryption, second encryption, later encryption).

[0064] The external key pair (PK1, SK1) is expressed as follows: (PK1, SK1) = KG1(PARAM)

[0065] "KG1" represents a key generation algorithm for public key cryptography. When the key generation algorithm KG1 is executed with the common parameter PARAM as input, it outputs an external key pair (PK1, SK1). The key generation algorithm KG1 may be the same as the key generation algorithm KG2, or may be different from the key generation algorithm KG2.

[0066] Steps S321 and S322 may be executed in reverse order or in parallel.

[0067] In step S330, the output unit 330 outputs the public key information PK and the secret key information SK. For example, the output unit 330 transmits the public key information PK to one of the encryption devices 400 and the re-encryption key generation device 500. For example, the output unit 330 transmits the secret key information SK to the re-encryption key generation device 500 and the decryption device 700.

[0068] The public key information PK includes a common parameter PARAM, an internal public key PK2, and an external public key PK1, and the secret key information SK includes a common parameter PARAM, an internal secret key SK2, and an external secret key SK1.

[0069] The public key information PK and the private key information SK are expressed as follows: PK=(PARAM, PK2, PK1) SK=(PARAM, SK2, SK1)

[0070] The public key information PK and secret key information SK are output as follows: The public key setting unit 331 generates the public key information PK using the common parameter PARAM, the internal public key PK2, and the external public key PK1. The public key output unit 332 outputs the public key information PK. The secret key setting unit 333 generates the secret key information SK using the common parameter PARAM, the internal secret key SK2, and the external secret key SK1. The secret key output unit 334 outputs the secret key information SK.

[0071] The public key information PK and the secret key information SK may not necessarily include the common parameters PARAM. In this case, the common parameters PARAM are transmitted from the parameter generating device 200 to each device, for example.

[0072] The encryption method will be described with reference to Fig. 12 and Fig. 13. Fig. 12 shows the functional configuration of an encryption device 400. The reception unit 410 includes elements such as a key reception unit 411 and a plaintext reception unit 412. The encryption unit 420 includes elements such as an internal encryption unit 421 and an external encryption unit 422. Fig. 13 shows a flowchart of the encryption method. Each of the multiple encryption devices 400 performs the encryption method.

[0073] In step S411, the key receiving unit 411 receives the public key information PK. For example, the key receiving unit 411 receives the public key information PK transmitted from one of the key generating devices 300.

[0074] In step S412, the plaintext receiving unit 412 receives the plaintext M. For example, the user inputs the plaintext M to the encryption device 400, and the plaintext receiving unit 412 receives the input plaintext M.

[0075] Steps S411 and S412 may be executed in reverse order or in parallel.

[0076] In step S421, the internal encryption unit 421 encrypts the plaintext M using the internal public key PK2. The ciphertext generated in this way is referred to as internal ciphertext C2. The internal encryption unit 421 may generate a random number and use the random number for encryption.

[0077] The inner ciphertext C2 is expressed as follows: C2=ENC2(PK2, M)

[0078] "ENC2" represents an encryption algorithm for public key cryptography. When the encryption algorithm ENC2 is executed with an internal public key PK2 and plaintext M as input, it outputs an internal ciphertext C2.

[0079] In step S422, the external encryption unit 422 encrypts the internal ciphertext C2 using the external public key PK1. The ciphertext generated in this way is referred to as external ciphertext C1. The external encryption unit 422 may generate a random number and use the random number for encryption.

[0080] The outer ciphertext C1 is expressed as follows: C1=ENC1(PK1, C2)

[0081] "ENC1" represents an encryption algorithm for public key cryptography. When the encryption algorithm ENC1 is executed with an external public key PK1 and an internal ciphertext C2 as input, it outputs an external ciphertext C1. The encryption algorithm ENC1 may be the same as the encryption algorithm ENC2, or may be different from the encryption algorithm ENC2.

[0082] In step S430, the output unit 430 outputs the outer ciphertext C1 as the ciphertext C for the plaintext M. For example, the output unit 430 transmits the ciphertext C to the re-encryption device 600 and the decryption device 700.

[0083] The re-encryption key generation method will be described with reference to Fig. 14 and Fig. 15. Fig. 14 shows the functional configuration of a re-encryption key generation device 500. A reception unit 510 includes elements such as a public key reception unit 511 and a private key reception unit 512. Fig. 15 shows a flowchart of the re-encryption key generation method.

[0084] In step S511, the public key receiving unit 511 receives public key information PK'. The public key information PK' is the public key information PK of the re-encryption destination. For example, the public key receiving unit 511 receives the public key information PK transmitted from the key generating device 300 of the re-encryption destination.

[0085] The external public key PK1 included in the public key information PK' is referred to as the external public key PK'1, and the internal public key PK2 included in the public key information PK' is referred to as the internal public key PK'2.

[0086] In step S512, the private key receiving unit 512 receives the private key information SK'. The private key information SK' is the private key information SK of the source of re-encryption. For example, the private key receiving unit 512 receives the private key information SK transmitted from the key generating device 300 of the source of re-encryption.

[0087] The external private key SK1 included in the private key information SK' is referred to as the external private key SK'1. The internal private key SK2 included in the private key information SK' is referred to as the internal private key SK'2.

[0088] Steps S511 and S512 may be executed in reverse order or in parallel.

[0089] In step S521, the re-encryption key generation unit 520 generates a random number R2. Then, the re-encryption key generation unit 520 encrypts the random number R2 using the internal public key PK′2. The encrypted random number generated in this way is referred to as an encrypted random number C2′_R.

[0090] The encrypted random number C2'_R is expressed as follows: C2'_R=ENC2(PK'2, R2)

[0091] When the encryption algorithm ENC2 is executed with the internal public key PK'2 and the random number R2 as input, it outputs an encrypted random number C2'_R.

[0092] Furthermore, the re-encryption key generation unit 520 randomizes the internal secret key SK'2 using the random number R2. The randomized secret key generated in this way is referred to as a randomized secret key SK2_R2.

[0093] The randomized secret key SK2_R2 is expressed as follows: SK2_R2=RANDSKEY(SK′2, R2)

[0094] "RANDSKEY" represents a key randomization algorithm. For example, the key randomization algorithm randomizes a key by multiplying the key by a random number. When the key randomization algorithm RANDSKEY is executed with the internal secret key SK'2 and the random number R2 as input, it outputs a randomized secret key SK2_R2.

[0095] In step S522, the re-encryption key generation unit 520 generates a random number R1. Then, the re-encryption key generation unit 520 encrypts the random number R1 using the external public key PK′1. The encrypted random number thus generated is referred to as an encrypted random number C1′_R.

[0096] The encrypted random number C1'_R is expressed as follows: C1'_R=ENC2(PK'1, R1)

[0097] When the encryption algorithm ENC2 is executed with the internal public key PK'1 and the random number R1 as input, it outputs an encrypted random number C1'_R.

[0098] Furthermore, the re-encryption key generating unit 520 randomizes the external secret key SK'1 using the random number R1. The randomized secret key generated in this way is referred to as a randomized secret key SK1_R1.

[0099] The randomized secret key SK1_R1 is expressed as follows: SK1_R1=RANDSKEY(SK′1, R1)

[0100] When the key randomization algorithm RANDSKEY is executed with the external secret key SK'1 and the random number R1 as input, it outputs a randomized secret key SK1_R1.

[0101] Steps S521 and S522 may be executed in reverse order or in parallel.

[0102] In step S530, the output unit 530 outputs the re-encryption key RK. For example, the output unit 530 transmits the re-encryption key RK to the re-encryption device 600.

[0103] The re-encryption key RK is expressed as follows: RK=(C2′_R, C1′_R, SK2_R2, SK1_R1).

[0104] The re-encryption method will be described with reference to Fig. 16 and Fig. 17. Fig. 16 shows the functional configuration of a re-encryption device 600. A reception unit 610 includes elements such as a ciphertext reception unit 611 and a re-encryption key reception unit 612. Fig. 17 shows a flowchart of the re-encryption method.

[0105] In step S611, the ciphertext receiving unit 611 receives the ciphertext C. For example, the ciphertext receiving unit 611 receives the ciphertext C transmitted from one of the encryption devices 400.

[0106] In step S612, the re-encryption key receiving unit 612 receives the re-encryption key RK. For example, the re-encryption key receiving unit 612 receives the re-encryption key RK transmitted from the re-encryption key generating device 500.

[0107] Steps S611 and S612 may be executed in reverse order or in parallel.

[0108] In step S621, the re-encryption unit 620 uses the randomized secret key SK1_R1 to decrypt the ciphertext C. The decrypted text obtained in this way is referred to as decrypted text RCT1.

[0109] The decrypted text RCT1 is expressed as follows: RCT1=DEC1(SK1_R1, C)=RANDCT(R1, ENC2(PK2, M))

[0110] "DEC1" represents a decryption algorithm for public key encryption. When the decryption algorithm DEC1 is executed with the randomized secret key SK1_R1 and the ciphertext C as input, it outputs the decrypted text RCT1.

[0111] "RANDCT" stands for ciphertext randomization algorithm, which is an algorithm that randomizes ciphertext using random numbers.

[0112] Furthermore, the re-encryption unit 620 decrypts the decrypted text RCT1 using the randomized secret key SK2_R2. The decrypted text obtained in this way is referred to as decrypted text RM.

[0113] The decrypted text RM is expressed as follows: RM=DEC1(SK2_R2, RCT1)=RANDCT(R1, RANDCT(R2, M))

[0114] When the decryption algorithm DEC1 is executed with the randomized secret key SK2_R2 and the decrypted text RCT1 as input, it outputs the decrypted text RM.

[0115] In step S622, the re-encryption unit 620 encrypts the decrypted text RM using the internal public key PK'2. The ciphertext generated in this way is referred to as the ciphertext RM. The re-encryption unit 620 then encrypts the ciphertext RM using the external public key PK'1. The ciphertext generated in this way is referred to as the ciphertext RC1.

[0116] The ciphertext RC1 is expressed as follows: RC1=ENC1(PK'1, ENC2(PK'2, RM))

[0117] In step S630, the output unit 630 outputs the re-encrypted text RC. For example, the output unit 630 transmits the re-encrypted text RC to the decryption device 700.

[0118] The re-encrypted text RC is expressed as follows: RC=(RC1, C2′_R, C1′_R)

[0119] The decryption method will be described with reference to Fig. 18 and Fig. 19. Fig. 18 shows the functional configuration of a decryption device 700. A reception unit 710 includes elements such as a key reception unit 711 and a ciphertext reception unit 712. Fig. 19 shows a flowchart of the decryption method.

[0120] In step S711, the key acceptance unit 711 receives the private key information SK'. For example, the key acceptance unit 711 receives the private key information SK transmitted from one of the key generation devices 300 as the private key information SK'.

[0121] In step S712, the ciphertext receiving unit 712 receives the ciphertext C1. The ciphertext C1 is the ciphertext C or the re-encrypted text RC. For example, the ciphertext receiving unit 712 receives the ciphertext C transmitted from the encryption device 400 or the re-encrypted text RC transmitted from the re-encryption device 600.

[0122] Steps S711 and S712 may be executed in reverse order or in parallel.

[0123] In step S721, the decryption unit 720 determines the type of the ciphertext C1.

[0124] The type of the ciphertext C1 is determined based on the size of the ciphertext C1 and other factors.

[0125] If the ciphertext C1 is the ciphertext C, the process proceeds to step S722. If the ciphertext C1 is the re-encrypted text RC, the process proceeds to step S723.

[0126] In step S722, the decryption unit 720 decrypts the plaintext M from the ciphertext C1 using the external secret key SK'1 and the internal secret key SK'2.

[0127] The plaintext M is expressed as follows: M=DEC(SK'2, DEC(SK'1, C1))

[0128] "DEC" represents a decryption algorithm for public key cryptography, which takes a private key and ciphertext as input and outputs decrypted text.

[0129] In step S723, the ciphertext C1 is a re-encrypted text RC=(RC1, C2'_R, C1'_R). The decryption unit 720 decrypts the random number R2 from the encrypted random number C2'_R using the internal private key SK'2. The decryption unit 720 also decrypts the random number R1 from the encrypted random number C1'_R using the external private key SK'1. The decryption unit 720 also decrypts the ciphertext RC1 using the external private key SK'1. The decrypted text obtained in this way is referred to as the decrypted text RC1. The decryption unit 720 also decrypts the decrypted text RM from the decrypted text RC1 using the internal private key SK'2.

[0130] The random numbers R2 and R1 and the decrypted text RM are expressed as follows: R2=DEC(SK'2, C2'_R) R1=DEC(SK'1, C1'_R) RM=DEC(SK'2, DEC(SK'1, RC1))

[0131] Then, the decryption unit 720 calculates the plaintext M using the random numbers R2, R1, and the decrypted text RM.

[0132] The plaintext M is calculated by calculating the inverse function of the ciphertext randomization algorithm RANDCT using the random numbers R2, R1, and the decrypted text RM.

[0133] After step S722 or step S723, the process proceeds to step S730.

[0134] In step S730, the output unit 730 outputs the plaintext M.

[0135] Summary of First Embodiment The encryption system 100 includes a parameter generation device 200, a plurality of key generation devices 300, a plurality of encryption devices 400, a re-encryption key generation device 500, a re-encryption device 600, and a decryption device 700. The parameter generation device 200 receives as input the bit length of the key to be used, etc., and generates commonly used parameters. The key generation device 300 receives as input the parameters, and generates a public key and a private key for both inner encryption and outer encryption. The encryption device 400 receives as input the public key, and generates an original ciphertext. The re-encryption key generation device 500 receives as input the public key of the re-encryption destination and the private key of the re-encryption source, and generates a re-encryption key. The re-encryption key is a key for converting ciphertext without decrypting it. The re-encryption device 600 receives as input the ciphertext and the re-encryption key, and outputs the re-encrypted ciphertext. In other words, the re-encryption device 600 changes only the internal public key without decrypting the ciphertext, and converts the ciphertext to a ciphertext for a new destination. The decryption device 700 receives the ciphertext and the private key as input and outputs the decryption result.

[0136] ***Effects of First Embodiment*** In the first embodiment, ciphertext is re-encrypted without being decrypted. Re-encryption realizes encryption using a different key.

[0137] The first embodiment relates to double encryption. In double encryption, plaintext is encrypted by scheme 1 and then encrypted by scheme 2. In the first embodiment, only the key for scheme 1 is changed. This makes it possible to address various security risks, such as the compromise of only the key for scheme 2.

[0138] In the first embodiment, a method is proposed for double encryption using different encryption methods, in which the key for the inner encryption method is changed while the key for the outer encryption method is not changed. This improves the security of the double encryption. Specifically, it becomes possible to change the key efficiently and safely.

[0139] In the first embodiment, when plaintext is double-encrypted, the private key used in the internal encryption and the private key used in the external encryption are each randomized to generate a re-encryption key. This allows re-encryption without decryption in double encryption. As a result, key changes can be implemented more safely and efficiently.

[0140] *** Supplementary Note to First Embodiment *** The hardware configuration of the parameter generation device 200 will be described with reference to Fig. 20. The parameter generation device 200 includes a processing circuit 209. The processing circuit 209 is hardware that realizes a reception unit 210, a parameter generation unit 220, and an output unit 230. The processing circuit may be dedicated hardware, or may be a processor that executes a program stored in a memory.

[0141] If the processing circuit is dedicated hardware, it may be, for example, a single circuit, a multiple circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0142] The parameter generating device 200 may include a plurality of processing circuits that replace the processing circuit 209 .

[0143] In the processing circuit, some functions may be realized by dedicated hardware and the remaining functions may be realized by software or firmware.

[0144] Thus, the functions of the parameter generating device 200 can be realized by hardware, software, firmware, or a combination thereof.

[0145] The hardware configuration of the key generation device 300 will be described with reference to Fig. 21. The key generation device 300 includes a processing circuit 309. The processing circuit 309 is hardware that implements a reception unit 310, a key generation unit 320, and an output unit 330. The key generation device 300 may include multiple processing circuits that replace the processing circuit 309. The functions of the key generation device 300 can be implemented by hardware, software, firmware, or a combination of these.

[0146] The hardware configuration of the encryption device 400 will be described with reference to Fig. 22. The encryption device 400 includes a processing circuit 409. The processing circuit 409 is hardware that implements a reception unit 410, an encryption unit 420, and an output unit 430. The encryption device 400 may include multiple processing circuits that replace the processing circuit 409. The functions of the encryption device 400 can be implemented by hardware, software, firmware, or a combination of these.

[0147] The hardware configuration of the re-encryption key generation device 500 will be described with reference to Fig. 23. The re-encryption key generation device 500 includes a processing circuit 509. The processing circuit 509 is hardware that implements a reception unit 510, a re-encryption key generation unit 520, and an output unit 530. The re-encryption key generation device 500 may include multiple processing circuits that replace the processing circuit 509. The functions of the re-encryption key generation device 500 can be implemented by hardware, software, firmware, or a combination of these.

[0148] The hardware configuration of the re-encryption device 600 will be described with reference to Fig. 24. The re-encryption device 600 includes a processing circuit 609. The processing circuit 609 is hardware that implements a reception unit 610, a re-encryption unit 620, and an output unit 630. The re-encryption device 600 may include multiple processing circuits that replace the processing circuit 609. The functions of the re-encryption device 600 can be implemented by hardware, software, firmware, or a combination of these.

[0149] The hardware configuration of the decoding device 700 will be described with reference to Fig. 25. The decoding device 700 includes a processing circuit 709. The processing circuit 709 is hardware that implements a reception unit 710, a decoding unit 720, and an output unit 730. The decoding device 700 may include multiple processing circuits that replace the processing circuit 709. The functions of the decoding device 700 can be implemented by hardware, software, firmware, or a combination of these.

[0150] The first embodiment is an example of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. The first embodiment may be implemented in part or in combination with other embodiments. The procedures described using flowcharts and the like may be modified as appropriate.

[0151] The "unit" of each element of each device in the cryptographic system 100 may be read as a "process," a "step," a "circuit," or a "circuitry."

[0152] Below, the aspects of the present disclosure will be described with the symbols used in the first embodiment added in parentheses. The encryption system (100) includes: an encryption device (400) that double-encrypts a plaintext (M) using a first internal public key (PK2) and a first external public key (PK1) to generate a ciphertext (C); and a re-encryption key generation device (500) that randomizes a first internal secret key (SK'2) using a second random number (R2) to generate a randomized internal secret key (SK2_R2), encrypts the second random number (R2) using the second internal public key (PK'2) to generate a second encrypted random number (C2'_R), randomizes a first external secret key (SK'1) using the first random number (R1) to generate a randomized external secret key (SK1_R1), and encrypts the first random number (R1) using the second external public key (PK'1) to generate a first encrypted random number (C1'_R). a re-encryption device (600) that decrypts the ciphertext (C) using the randomized external private key (SK1_R1) and the randomized internal private key (SK2_R2) to obtain a randomized decrypted text (RM), and encrypts the randomized decrypted text (RM) using the second internal public key (PK'2) and the second external public key (PK'1) to generate a re-encrypted text (RC1); a decryption device (700) that decrypts the second random number (R2) from the second encrypted random number (C2'_R) using a second internal private key (SK'2), decrypts the first random number (R1) from the first encrypted random number (C1'_R) using a second external private key (SK'1), decrypts the randomized decrypted text (RM) from the re-encrypted text (RC1) using the second external private key (SK'1) and the second internal private key (SK'2), and calculates the plaintext (M) using the randomized decrypted text (RM), the second random number (R2), and the first random number (R1).

[0153] 100 Cryptographic system, 101 Network, 200 Parameter generation device, 201 Processor, 202 Memory, 203 Auxiliary storage device, 204 Communication device, 205 Input / output interface, 209 Processing circuit, 210 Reception unit, 220 Parameter generation unit, 230 Output unit, 290 Storage unit, 300 Key generation device, 301 Processor, 302 Memory, 303 Auxiliary storage device, 304 Communication device, 305 Input / output interface, 309 Processing circuit, 310 Reception unit, 320 Key generation unit, 321 Internal key generation unit, 322 External key generation unit, 330 Output unit, 331 Public key setting unit, 332 Public key output unit, 333 Private key setting unit, 334 Private key output unit, 390 Storage unit, 400 Encryption device, 401 Processor, 402 Memory, 403 Auxiliary storage device, 404 Communication device, 405 Input / output interface, 409 Processing circuit, 410 Acceptance unit, 411 Key acceptance unit, 412 Plaintext acceptance unit, 420 Encryption unit, 421 Internal encryption unit, 422 External encryption unit, 430 Output unit, 490 Storage unit, 500 Re-encryption key generation device, 501 Processor, 502 Memory, 503 Auxiliary storage device, 504 Communication device, 505 Input / output interface, 509 Processing circuit, 510 Acceptance unit, 511 Public key acceptance unit, 512 Private key acceptance unit, 520 Re-encryption key generation unit, 530 Output unit, 590 Storage unit, 600 Re-encryption device, 601 Processor, 602 Memory, 603 Auxiliary storage device, 604 Communication device, 605 Input / output interface, 609 Processing circuit, 610 Acceptance unit, 611 Ciphertext acceptance unit, 612 re-encryption key acceptance unit, 620 re-encryption unit, 630 output unit, 690 storage unit, 700 decryption device, 701 processor, 702 memory, 703 auxiliary storage device, 704 communication device, 705 input / output interface, 709 processing circuit, 710 acceptance unit, 711 key acceptance unit, 712 ciphertext acceptance unit, 720 decryption unit, 730 output unit, 790 storage unit.

Claims

1. An encryption device that double-encrypts a plaintext using a first internal public key and a first external public key to generate a ciphertext; a re-encryption key generation device that randomizes a first internal private key using a second random number to generate a randomized internal private key, encrypts the second random number using the second internal public key to generate a second encrypted random number, randomizes a first external private key using the first random number to generate a randomized external private key, and encrypts the first random number using the second external public key to generate a first encrypted random number; a re-encryption device that decrypts the ciphertext using the randomized external private key and the randomized internal private key to obtain a randomized decrypted text, and encrypts the randomized decrypted text using the second internal public key and the second external public key to generate a re-encrypted text. a decryption device that decrypts the second random number from the second encrypted random number using a second internal private key, decrypts the first random number from the first encrypted random number using a second external private key, decrypts the randomized decrypted text from the re-encrypted text using the second external private key and the second internal private key, and calculates the plaintext using the randomized decrypted text, the second random number, and the first random number.

2. doubly encrypting a plaintext using a first internal public key and a first external public key to generate a ciphertext; randomizing a first internal private key using a second random number to generate a randomized internal private key; encrypting the second random number using a second internal public key to generate a second encrypted random number; randomizing a first external private key using the first random number to generate a randomized external private key; encrypting the first random number using a second external public key to generate a first encrypted random number; decrypting the ciphertext using the randomized external private key and the randomized internal private key to obtain a randomized decrypted text; and encrypting the randomized decrypted text using the second internal public key and the second external public key to generate a re-ciphertext; decrypting the second random number from the second encrypted random number using a second internal private key, decrypting the first random number from the first encrypted random number using a second external private key, decrypting the randomized decrypted text from the re-encrypted text using the second external private key and the second internal private key, and calculating the plaintext using the randomized decrypted text, the second random number, and the first random number.

3. An encryption program for causing a computer to execute an encryption process for double-encrypting a plaintext using a first internal public key and a first external public key to generate a ciphertext; a re-encryption key generation program for causing a computer to execute a re-encryption key generation process for randomizing a first internal private key using a second random number to generate a randomized internal private key, encrypting the second random number using the second internal public key to generate a second encrypted random number, randomizing a first external private key using the first random number to generate a randomized external private key, and encrypting the first random number using the second external public key to generate a first encrypted random number; and a re-encryption program for causing a computer to execute a re-encryption process for decrypting the ciphertext using the randomized external private key and the randomized internal private key to obtain a randomized decrypted text, and encrypting the randomized decrypted text using the second internal public key and the second external public key to generate a re-encrypted text. and a decryption program for causing a computer to execute a decryption process of decrypting the second random number from the second encrypted random number using a second internal private key, decrypting the first random number from the first encrypted random number using a second external private key, decrypting the randomized decrypted text from the re-encrypted text using the second external private key and the second internal private key, and calculating the plaintext using the randomized decrypted text, the second random number, and the first random number.