Re-encryption key generation device, re-encryption device, ciphertext conversion system, re-encryption method, and re-encryption program

Abstract

A re-encryption key generation device (500) comprises a re-encryption key generation unit (503) that generates a randomized secret key by randomizing a first secret key of public key encryption using a random number, and generates an encrypted random number by encrypting a random number by homomorphic encryption using a second public key of the homomorphic encryption. Each of the randomized secret key and the encrypted random number is an element of a re-encryption key for re-encrypting original ciphertext generated by encrypting plaintext using a first public key corresponding to the first secret key.

Description

Re-encryption key generation device, re-encryption device, ciphertext conversion system, re-encryption method, and re-encryption program

[0001] The present disclosure relates to a re-encryption key generation device, a re-encryption device, a ciphertext conversion system, a re-encryption method, and a re-encryption program.

[0002] Proxy re-encryption is a public key cryptography technique that enables ciphertext to be changed to ciphertext of another key without decrypting the ciphertext. Non-Patent Document 1 discloses an example of proxy re-encryption. It also proposes a method for realizing proxy re-encryption in which the encryption method before and after changing the ciphertext is different.

[0003] Yu, Zuoxia, et al. , “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption”, ASIACCS'18, June 4-8, 2018, Incheon, Republic of Korea

[0004] Non-Patent Document 1 discloses a method for changing a key while keeping the encryption, and a method for converting the encryption method of a ciphertext to another encryption method when the encryption method has certain characteristics. However, the technology disclosed in Non-Patent Document 1 has a problem in that when re-encryption is performed, i.e., when ciphertext of a certain key is converted to ciphertext of a different key, the data size of the ciphertext becomes very large. Here, the upper limit of the number of times re-encryption can be performed is determined depending on the size of the storage that stores the ciphertext. Therefore, this technology imposes a strict limit on the upper limit of the number of re-encryption times. This limit is a significant constraint on the implementation of proxy re-encryption.

[0005] The present disclosure aims to reduce the data size of ciphertext after re-encryption processing compared to conventional techniques in proxy re-encryption in which the encryption method after re-encryption processing is homomorphic encryption.

[0006] A re-encryption key generation device according to the present disclosure includes a re-encryption key generation unit that generates a randomized private key by randomizing a first private key of public key cryptography using a random number, and generates an encrypted random number by encrypting the random number by homomorphic encryption using a second public key of homomorphic encryption, wherein each of the randomized private key and the encrypted random number is an element of a re-encryption key for re-encrypting an original ciphertext that was generated by encrypting a plaintext using a first public key corresponding to the first private key.

[0007] According to the present disclosure, the re-encryption key generation unit generates a randomized private key and a random number encrypted by homomorphic encryption as elements of the re-encryption key. Even when the ciphertext is re-encrypted using the re-encryption key, the size of the re-encrypted ciphertext is smaller than that of conventional techniques due to the properties of homomorphic encryption. Therefore, according to the present disclosure, in proxy re-encryption in which the encryption method after the re-encryption process is homomorphic encryption, the data size of the ciphertext after the re-encryption process can be reduced compared to conventional techniques.

[0008] FIG. 1 is a diagram showing an example of the configuration of a ciphertext conversion system 100 according to the first embodiment. FIG. 2 is a diagram showing an example of the configuration of a common parameter generation device 200 according to the first embodiment. FIG. 3 is a diagram showing an example of the configuration of a key generation device 300 according to the first embodiment. FIG. 4 is a diagram showing an example of the configuration of an encryption device 400 according to the first embodiment. FIG. 5 is a diagram showing an example of the configuration of a re-encryption key generation device 500 according to the first embodiment. FIG. 6 is a diagram showing an example of the configuration of a re-encryption device 600 according to the first embodiment. FIG. 7 is a diagram showing an example of the configuration of a decryption device 700 according to the first embodiment. FIG. 8 is a diagram showing an example of the hardware configuration of each device according to the first embodiment. A flowchart showing the operation of the common parameter generation device 200 according to the first embodiment. A flowchart showing the operation of the key generation device 300 according to the first embodiment. A flowchart showing the operation of the encryption device 400 according to the first embodiment. A flowchart showing the operation of the re-encryption key generation device 500 according to the first embodiment. A flowchart showing the operation of the re-encryption device 600 according to the first embodiment. A flowchart showing the operation of the decryption device 700 according to the first embodiment. FIG. 9 is a diagram showing an example of the hardware configuration of each device according to a variation of the first embodiment.

[0009] In the description of the embodiments and drawings, the same elements and corresponding elements are given the same symbols. The description of elements given the same symbols is omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be interpreted as "circuit," "device," "equipment," "process," "step," "procedure," "processing," or "circuitry" as appropriate. The functions of each unit provided in each device may be realized by firmware, software, hardware, or a combination of these.

[0010] First Embodiment Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0011] ***Configuration*** FIG. 1 is a block diagram showing an example configuration of a ciphertext conversion system 100 according to the present embodiment. As shown in FIG. 1, the ciphertext conversion system 100 includes a common parameter generation device 200, multiple key generation devices 300, an encryption device 400, a re-encryption key generation device 500, a re-encryption device 600, and a decryption device 700. There may be multiple devices constituting the ciphertext conversion system 100. The multiple devices constituting the ciphertext conversion system 100 may be integrated as appropriate. The ciphertext conversion system 100 is a system that performs proxy re-encryption, re-encrypting a ciphertext without decrypting it (encrypting it using another key). The multiple devices constituting the ciphertext conversion system 100 are connected to each other as appropriate so that they can communicate with each other via the Internet 101. The devices constituting the ciphertext conversion system 100 may not be connected to the Internet 101, but may be installed within a LAN (Local Area Network) installed within the same company, for example.

[0012] The Internet 101 is a communication path that appropriately connects the common parameter generation device 200, the multiple key generation devices 300, the encryption device 400, the re-encryption key generation device 500, the re-encryption device 600, and the decryption device 700 so that they can communicate with each other. The Internet 101 is a specific example of a network. Other types of networks may be used instead of the Internet 101.

[0013] The common parameter generation device 200 generates a common parameter and transmits the generated common parameter to the multiple key generation devices 300 and the encryption device 400 via the Internet 101. The common parameter is a parameter that is used in common in the ciphertext conversion system 100. Note that the common parameter may be transmitted directly by mail or the like, without transmitting via the Internet 101.

[0014] A specific example of each key generation device 300 is a PC (Personal Computer). Each key generation device 300 is a computer that generates a user private key and transmits the generated user private key to the encryption device 400, the re-encryption key generation device 500, and the decryption device 700 as appropriate. The user private key is a general term for the private key and public key in public key cryptography.

[0015] The encryption device 400 functions as a device for encrypting data, and is specifically a PC. The encryption device 400 is a computer that receives the common parameters from the common parameter generation device 200, receives the public key from the key generation device 300, takes plain text as input, and outputs an original cipher text.

[0016] The re-encryption key generation device 500 generates a re-encryption key and is, for example, a PC. The re-encryption key generation device 500 is a computer that receives the public key and the private key from the key generation device 300 and generates a re-encryption key. The re-encryption key is a key for converting ciphertext without decrypting it.

[0017] The re-encryption device 600 receives the re-encryption key from the re-encryption key generation device 500, and converts the ciphertext generated by the encryption device 400 into ciphertext for a new destination by changing only the internal public key, without decrypting the ciphertext. The re-encryption device 600 is, as a specific example, a PC.

[0018] A specific example of the decryption device 700 is a PC. The decryption device 700 is a computer that receives ciphertext from the encryption device 400 or the re-encryption device 600, receives a private key from the key generation device 300, and outputs the decryption result. The term "ciphertext" is a general term for various types of ciphertext.

[0019] FIG. 2 is a block diagram showing an example configuration of the common parameter generation device 200. As shown in FIG. 2, the common parameter generation device 200 includes an input unit 201, a common parameter generation unit 202, and a transmission unit 203. Although not shown, each device included in the ciphertext conversion system 100 includes a recording medium for storing data used in each unit of the device. The input unit 201 receives the bit length of a key used in the ciphertext conversion system 100. The common parameter generation unit 202 generates parameters PARAM that are the basis of calculations used in the ciphertext conversion system 100. As a specific example, when elliptic curve cryptography is used, elliptic curve parameters or the like are generated as the parameters PARAM. Although not shown, the common parameter generation unit 202 may also include a random number generation function or the like to generate the PARAM. The transmission unit 203 transmits the common parameters PARAM generated by the common parameter generation unit 202 to the key generation device 300 and the encryption device 400.

[0020] 3 is a block diagram showing an example configuration of a key generation device 300. As shown in FIG. 3, the key generation device 300 includes an input unit 301, a key generation unit 302, a public key setting unit 303, a private key setting unit 304, a public key transmission unit 305, and a private key transmission unit 306. The input unit 301 receives common parameters PARAM. The key generation unit 302 generates a public key and a private key for a set public key cryptosystem using the common parameters PARAM. The public key setting unit 303 sets a public key value from among the keys generated by the key generation unit 302. The private key setting unit 304 sets a private key value from among the keys generated by the key generation unit 302. The public key transmission unit 305 transmits the public key generated by the public key setting unit 303 to the encryption device 400 and the re-encryption key generation device 500. The private key transmitting unit 306 transmits the private key generated by the private key setting unit 304 to the re-encryption key generating device 500 and the decryption device 700 .

[0021] 4 is a block diagram showing an example configuration of the encryption device 400. As shown in FIG. 4, the encryption device 400 includes an input unit 401, a key receiving unit 402, an encryption unit 403, and a transmission unit 404. Plain text M is input to the input unit 401. The key receiving unit 402 receives a common parameter PARAM and a public key PK. The encryption unit 403 generates an original cipher text C using the plain text M, the common parameter PARAM, and the public key PK. The encryption unit 403 may include a random number generation function, etc. The cipher text transmission unit 404 transmits the original cipher text C to the re-encryption device 600 and the decryption device 700.

[0022] FIG. 5 is a block diagram showing an example configuration of a re-encryption key generation device 500. As shown in FIG. 5, the re-encryption key generation device 500 includes a public key receiving unit 501, a private key receiving unit 502, a re-encryption key generation unit 503, and a re-encryption key output unit 504. The public key receiving unit 501 receives a public key HPK from the key generation device 300. The private key receiving unit 502 receives a private key SK from the key generation device 300. The re-encryption key generation unit 503 generates a re-encryption key RK using the public key HPK and the private key SK. Specifically, the re-encryption key generation unit 503 generates a randomized private key by randomizing a first private key of public key encryption using a random number. The re-encryption key generation unit 503 also generates an encrypted random number by encrypting the random number using homomorphic encryption using a second public key of homomorphic encryption. The randomized private key and the encrypted random number are each elements of a re-encryption key for re-encrypting an original ciphertext. The original ciphertext is ciphertext generated by encrypting plaintext using the first public key corresponding to the first secret key. The re-encryption key output unit 504 transmits the re-encryption key RK to the re-encryption device 600.

[0023] 6 is a block diagram showing an example configuration of a re-encryption device 600. As shown in FIG. 6, the re-encryption device 600 includes a ciphertext receiving unit 601, a re-encryption key receiving unit 602, a re-encryption processing unit 603, and a ciphertext output unit 604. The ciphertext receiving unit 601 receives an original ciphertext C from the encryption device 400. The re-encryption key receiving unit 602 receives a re-encryption key RK from the re-encryption key generation device 500. The re-encryption processing unit 603 generates a re-encrypted ciphertext RC using the original ciphertext C and the re-encryption key RK. Specifically, the re-encryption processing unit 603 generates the re-encrypted ciphertext by re-encrypting the original ciphertext using the re-encryption key consisting of a randomized secret key and an encrypted random number. The re-encryption processing unit 603 may generate a randomized plaintext by decrypting the original ciphertext using public key cryptography with the randomized private key, generate a randomized ciphertext by encrypting the randomized plaintext using homomorphic encryption with the second public key, and then generate a re-encrypted ciphertext by performing a homomorphic operation using the randomized ciphertext and the encrypted random number. The ciphertext output unit 604 transmits the re-encrypted ciphertext RC to the decryption device 700.

[0024] FIG. 7 is a block diagram showing an example configuration of a decryption device 700. As shown in FIG. 7, the decryption device 700 includes a ciphertext receiving unit 701, a key receiving unit 702, a decryption processing unit 703, and a result output unit 704. The ciphertext receiving unit 701 receives an original ciphertext C or a re-encrypted ciphertext RC. The key receiving unit 702 receives a secret key SK or HSK from the key generating device 300. The decryption processing unit 703 generates plaintext M by performing a decryption process using the original ciphertext C and the secret key SK, or the re-encrypted ciphertext RC and the secret key HSK. In other words, the decryption processing unit 703 has a function of decrypting the original ciphertext using a first secret key and decrypting the re-encrypted ciphertext using a second secret key corresponding to the second public key. The result output unit 704 outputs the plaintext M.

[0025] 8 shows an example of the hardware resources of each device, that is, an example of the hardware configuration of each device. Each device is made up of a computer. Each device may be made up of multiple computers.

[0026] As shown in Fig. 8, each device is a computer including hardware such as a processor 11, a ROM 13, a RAM 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20. These pieces of hardware are connected as appropriate via a bus 12. The ROM 13, the RAM 14, the magnetic disk device 20, and the drive 34 are each an example of a storage device. The keyboard 32, the mouse 33, and the communication board 15 are each an example of an input device. The display 31 and the communication board 15 are each an example of an output device.

[0027] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of a computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). Each device may include multiple processors that serve as the processor 11. The multiple processors share the role of the processor 11.

[0028] The ROM 13 is typically a non-volatile storage device, and specific examples thereof include a hard disk drive (HDD) or a flash memory. Data stored in the ROM 13 is loaded into the RAM 14 as needed.

[0029] The RAM 14 is typically a volatile storage device. The RAM 14 is also called a primary storage device or a main memory. Data stored in the RAM 14 is saved in the ROM 13 as needed. The ROM 13 and the RAM 14 may be integrated.

[0030] The communication board 15 is a receiver and a transmitter. Specific examples of the communication board 15 include a communication chip or a NIC (Network Interface Card). The communication board 15 is connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line via a wired or wireless connection. Each unit of each device may use the communication board 15 as appropriate when communicating with other devices.

[0031] The drive 34 is a device that reads and writes data from a storage medium such as a flexible disk drive (FD), a compact disk (CD), or a digital versatile disk (DVD).

[0032] The magnetic disk device 20 stores an OS 21 (operating system), a group of programs 22, and a group of files 23.

[0033] The program group 22 includes programs that execute functions described as "units" in this embodiment. The programs (specifically, a data search program and a data registration program) are read and executed by the processor 11. That is, the programs cause the computer to function as "units" and also cause the computer to execute the procedures and methods of the "units."

[0034] The file group 23 includes various data (input, output, determination results, calculation results, processing results, etc.) used in the "units" described in this embodiment.

[0035] Data used when executing the re-encryption program and data obtained by executing the re-encryption program are stored in a storage device as appropriate. Each part of each device uses a storage device as appropriate. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of ROM 13 and RAM 14 may be realized by other storage devices.

[0036] The re-encryption program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The re-encryption program may be provided as a program product.

[0037] ***Description of Operation*** The operating procedures of each device included in the ciphertext conversion system 100 are collectively referred to as a re-encryption method. Also, the programs that realize the operations of each device included in the ciphertext conversion system 100 are collectively referred to as a re-encryption program.

[0038] Before describing the operation, the basic encryption technique and its notation used in this embodiment will be described.

[0039] Public key encryption (PKE) is composed of algorithms that execute key generation KG, encryption ENC, and decryption DEC. Key generation KG takes as input the key length and the like and outputs a secret key SK and a public key PK. Encryption ENC takes as input the public key PK and plaintext M and outputs ciphertext C. Decryption DEC takes as input the secret key SK and ciphertext C and outputs the decryption result.

[0040] Homomorphic encryption (HE) is composed of an algorithm that executes key generation HKG, encryption HENC, and decryption HDEC. Key generation HKG takes as input the key length and the like and outputs a secret key HSK and a public key HPK. Encryption HENC takes as input the public key HPK and plaintext M and outputs ciphertext HC. Decryption HDEC takes as input the secret key HSK and ciphertext HC and outputs the decryption result. Homomorphic arithmetic processing HEVAL takes as input ciphertext HC1=HENC(HPK, M1), ciphertext HC2=HENC(HPK, M2), and operation content OP, and outputs HEVAL(HC1, HC2, OP)=HENC(HPK, OP(M1, M2)). In other words, HEVAL allows operations to be performed on plaintexts while they remain encrypted by HPK.

[0041] The key randomization algorithm RANDSKEY refers to an algorithm that randomizes the secret key SK using a random number R. Specifically, this algorithm refers to multiplication, etc. The plaintext randomization algorithm RANDM refers to an algorithm that randomizes the plaintext M using the random number R. The ciphertext randomization algorithm RANDCT refers to an algorithm that randomizes the ciphertext C using the random number R. Furthermore, it is assumed that the following relationship holds: if M = DEC(SK, C), then RANDM(R, M) = DEC(RANDSKEY(R, SK), C) = DEC(SK, RANDCT(R, C)).

[0042] 9 is a flowchart showing an example of the parameter generation step, which will be described with reference to FIG.

[0043] (Step S201: Information Input Step) The input unit 201 receives the bit length K of the key as an input.

[0044] (Step S202: Common Parameter Generation Step) The common parameter generation unit 202 uses K to generate a common parameter PARAM.

[0045] (Step S203: Distribution Step) The transmission unit 203 transmits the PARAM to each device.

[0046] 10 is a flowchart showing an example of the user private key generation step, which will be described with reference to FIG.

[0047] (Step S301: Information Input Step) The input unit 301 receives PARAM as an input.

[0048] (Step S302: Key Generation Step) The key generation unit 302 generates (PK, SK) = KG(PARAM), or (HPK, HSK) = HKG(PARAM). Here, "public key" is a general term for PK and HPK. "Private key" is a general term for SK and HSK. PK corresponds to the first public key. HPK corresponds to the second public key. SK corresponds to the first secret key. HSK corresponds to the second secret key.

[0049] (Step S303: Distribution Step) The private key transmission unit 306 transmits the PK and SK, or the HPK and HSK, to each device.

[0050] 11 is a flowchart showing an example of the ciphertext generation step, which will be described with reference to FIG.

[0051] (Step S401: Receiving Step) The key receiving unit 402 receives PK=(PARAM, PK).

[0052] (Step S402: Plain Text Input Step) The input unit 401 receives plain text M.

[0053] (Step S403: Encryption Step) The encryption unit 403 generates an original ciphertext C by executing C=ENC(PK, M).

[0054] (Step 404: Transmission Step) The ciphertext transmission unit 404 outputs the original ciphertext C.

[0055] 12 is a flowchart showing an example of the re-encryption key generation step, which will be described with reference to FIG.

[0056] (Step S501: Re-encryption Destination Key Receiving Step) The public key receiving unit 501 receives the homomorphic encryption public key HPK that is the re-encryption destination.

[0057] (Step 502: Private Key Input Step) The private key receiving unit 502 receives the private key SK to be re-encrypted.

[0058] (Step 503: Random Number Selection Step) The re-encryption key generation unit 503 selects a random number R.

[0059] (Step 504: Re-encryption key generation step) The re-encryption key generation unit 503 randomizes HPK and SK using a random number R. Specifically, the re-encryption key generation unit 503 executes C_R = HENC(HPK, R) and SK_R = RANDSKEY(SK, R). C_R corresponds to the encryption random number. SK_R corresponds to the randomized secret key.

[0060] (Step 505: Transmission Step) The re-encryption key output unit 504 outputs RK=(C_R, SK_R).

[0061] 13 is a flowchart showing an example of the re-encryption step, which will be described with reference to FIG.

[0062] (Step S601: Ciphertext Receiving Step) The ciphertext receiving unit 601 receives the original ciphertext C=ENC(PK, M).

[0063] (Step S602: Key Receiving Step) The re-encryption key receiving unit 602 receives the re-encryption key RK=(C_R, SK_R).

[0064] (Step S603: Conversion Step) The re-encryption processing unit 603 calculates RM = DEC(SK_R, C), and then calculates HCRM = HENC(HPK, RM). RM corresponds to randomized plaintext. HCRM corresponds to randomized ciphertext. The re-encryption processing unit 603 executes RC = HEVAL(HCRM, C_R, OP). Here, OP refers to an operation having the property of removing R from RM.

[0065] (Step S604: Output Step) The ciphertext output unit 604 outputs the RC.

[0066] 14 is a flowchart showing an example of the decoding step, which will be described with reference to FIG.

[0067] (Step S701: Ciphertext Receiving Step) The ciphertext receiving unit 701 receives the original ciphertext C or the re-encrypted ciphertext RC.

[0068] (Step S702: Input Step) The key receiving unit 702 receives the private key SK or HSK.

[0069] (Step S703A: Decryption Processing Step) When the ciphertext received by the ciphertext receiving unit 701 is the original ciphertext C, the decryption processing unit 703 calculates M=DEC(SK, C).

[0070] (Step S703B: Decryption Processing Step) When the ciphertext received by the ciphertext receiving unit 701 is the re-encrypted ciphertext RC, the decryption processing unit 703 calculates M=HDEC(HSK, RC).

[0071] (Step S704: Output Step) The result output unit 704 outputs the plaintext M.

[0072] ***Description of Effects of First Embodiment*** As described above, according to the present embodiment, in agent re-encryption, when the re-encryption destination is homomorphic encryption, the re-encryption key is composed of the result of randomizing the private key and the result of homomorphically encrypting the random number used in randomizing the private key. Therefore, according to the present embodiment, in agent re-encryption where the encryption method after the re-encryption process is homomorphic encryption, the size of the ciphertext after re-encryption can be reduced by utilizing the properties of homomorphic encryption. Therefore, according to the present embodiment, in agent re-encryption, key changes can be achieved more safely and efficiently than with conventional techniques.

[0073] ***Other Configurations*** <Modification 1> Fig. 15 shows an example of the hardware configuration of each device according to this modification. Each device includes a processing circuit 18 instead of the processor 11, the processor 11 and ROM 13, the processor 11 and RAM 14, or the processor 11, ROM 13, and RAM 14. The processing circuit 18 is hardware that realizes at least a portion of the functions of each device. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the ROM 13.

[0074] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, multiple circuits, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. Each device may include multiple processing circuits that replace processing circuitry 18. The multiple processing circuits share the role of processing circuitry 18.

[0075] In each device, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0076] The processing circuitry 18 is realized by, for example, hardware, software, firmware, or a combination of these. The processor 11, ROM 13, RAM 14, and processing circuitry 18 are collectively referred to as the "processing circuitry." In other words, the functions of each functional component of each device are realized by the processing circuitry.

[0077] ***Other Embodiments*** Although the first embodiment has been described, it is also possible to combine multiple parts of this embodiment and implement it. Alternatively, it is also possible to implement this embodiment in part. In addition, various modifications may be made to this embodiment as necessary, and it is also possible to implement it in any combination, either as a whole or in part. Note that the above-described embodiments are essentially preferred examples and are not intended to limit the scope of this disclosure, its applications, and uses. The procedures described using flowcharts, etc. may be modified as appropriate. The processing described based on flowcharts, etc. is executed using the hardware provided in each device.

[0078] 11 processor, 12 bus, 13 ROM, 14 RAM, 15 communication board, 18 processing circuit, 19 signal line, 20 magnetic disk device, 21 OS, 22 program group, 23 file group, 31 display, 32 keyboard, 33 mouse, 34 drive, 100 ciphertext conversion system, 101 Internet, 200 common parameter generation device, 201 input unit, 202 common parameter generation unit, 203 transmission unit, 300 key generation device, 301 input unit, 302 key generation unit, 303 public key setting unit, 304 private key setting unit, 305 public key transmission unit, 306 private key transmission unit, 400 encryption device, 401 input unit, 402 key reception unit, 403 encryption unit, 404 transmission unit, 500 re-encryption key generation device, 501 public key reception unit, 502 Private key receiving unit, 503 re-encryption key generating unit, 504 re-encryption key output unit, 600 re-encryption device, 601 ciphertext receiving unit, 602 re-encryption key receiving unit, 603 re-encryption processing unit, 604 ciphertext output unit, 700 decryption device, 701 ciphertext receiving unit, 702 key receiving unit, 703 decryption processing unit, 704 result output unit.

Claims

1. A re-encryption key generation device comprising: a re-encryption key generation unit that generates a randomized private key by randomizing a first private key of public key cryptography using a random number, and generates an encrypted random number by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption, wherein the randomized private key and the encrypted random number are each elements of a re-encryption key for re-encrypting an original ciphertext that was generated by encrypting plaintext using a first public key corresponding to the first private key.

2. A re-encryption device comprising a re-encryption processing unit that generates a re-encrypted ciphertext by re-encrypting an original ciphertext, which was generated by encrypting plaintext using a first public key corresponding to the first private key, using a re-encryption key consisting of a randomized private key generated by randomizing a first private key of public key cryptography using a random number and an encrypted random number generated by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption.

3. The re-encryption device according to claim 2, wherein the re-encryption processing unit generates a randomized plaintext by decrypting the original ciphertext using public key cryptography with the randomized private key, generates a randomized ciphertext by encrypting the randomized plaintext using homomorphic cryptography with the second public key, and generates the re-encrypted ciphertext by performing a homomorphic operation using the randomized ciphertext and the encrypted random number.

4. A ciphertext conversion system comprising: a re-encryption key generation device according to claim 1; and a re-encryption device according to claim 2 or 3.

5. The ciphertext conversion system according to claim 4, further comprising: a decryption device including a decryption processing unit that decrypts the re-encrypted ciphertext using a second private key corresponding to the second public key.

6. The ciphertext conversion system according to claim 5, wherein the decryption processing unit decrypts the original ciphertext using the first private key.

7. A re-encryption method in which a re-encryption key generation unit of a re-encryption key generation device, which is a computer, generates a randomized private key by randomizing a first private key of public key cryptography using a random number, and generates an encrypted random number by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption, wherein the randomized private key and the encrypted random number are each elements of a re-encryption key for re-encrypting an original ciphertext generated by encrypting plaintext using a first public key corresponding to the first private key.

8. A re-encryption method in which a re-encryption processing unit of a re-encryption device, which is a computer, generates a re-encrypted ciphertext by re-encrypting an original ciphertext, which was generated by encrypting plaintext using a first public key corresponding to the first private key, using a re-encryption key consisting of a randomized private key generated by randomizing a first private key of public key cryptography using a random number, and an encrypted random number generated by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption.

9. A re-encryption program that causes a computer to function as a re-encryption key generation device that performs a re-encryption key generation process in which a re-encryption key generation unit generates a randomized private key by randomizing a first private key of public key cryptography using a random number, and generates an encrypted random number by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption, wherein the randomized private key and the encrypted random number are each elements of a re-encryption key for re-encrypting an original ciphertext that was generated by encrypting plaintext using a first public key corresponding to the first private key.

10. A re-encryption program that causes a computer to function as a re-encryption device that performs re-encryption processing to generate re-encrypted ciphertext by re-encrypting an original ciphertext that was generated by encrypting plaintext using a first public key corresponding to the first private key, using a re-encryption key consisting of a randomized private key generated by randomizing a first private key of public key cryptography using a random number and an encrypted random number generated by encrypting the random number using homomorphic encryption with a second public key of homomorphic encryption.

Images