Ciphertext conversion system, re-encryption verification method, and re-encryption verification program

Abstract

This re-encryption verification device (700) comprises a verification unit (703) that verifies, on the basis of a re-encrypted ciphertext and a re-encryption key, whether or not the re-encrypted ciphertext has been generated by using the re-encryption key. The re-encrypted ciphertext is formed from: a randomized plaintext generated by using a randomized secret key generated by randomizing a first secret key of public key encryption using a random number to decrypt an original ciphertext generated by encrypting a plaintext using a first public key; and an encrypted random number generated by encrypting a random number using a second public key of the public key encryption. The re-encryption key is formed from the encrypted random number and the randomized secret key.

Description

Ciphertext conversion system, re-encryption verification method, and re-encryption verification program

[0001] The present disclosure relates to a ciphertext conversion system, a re-encryption verification method, and a re-encryption verification program.

[0002] Proxy re-encryption is a public key cryptography technique that enables ciphertext to be changed to ciphertext of another key without decrypting the ciphertext. Non-Patent Document 1 discloses an example of proxy re-encryption. It also proposes a method for realizing proxy re-encryption in which the encryption method before and after changing the ciphertext is different.

[0003] Yu, Zuoxia, et al. , “Achieving Flexibility for ABE with Outsourcing via Proxy Re-Encryption”, ASIACCS'18, June 4-8, 2018, Incheon, Republic of Korea

[0004] Non-Patent Document 1 discloses a method of changing the key while keeping the ciphertext encrypted, and a method of converting the encryption method of the ciphertext to another encryption method when the encryption method has certain characteristics. Here, proxy re-encryption is a technology that enables the transfer of ciphertext to another party. The technology disclosed in Non-Patent Document 1, when re-encryption is performed, i.e., when converting ciphertext of a certain key to ciphertext of a different key, does not provide any method for verifying whether the re-encrypted ciphertext is a ciphertext that has been re-encrypted. Therefore, this technology has a problem in that even the original owner of the re-encrypted ciphertext, i.e., the person who is supposed to decrypt the re-encrypted ciphertext, cannot claim to be the original owner of the re-encrypted ciphertext.

[0005] The present disclosure aims to enable, in proxy re-encryption, the original owner of a re-encrypted ciphertext to claim to be the original owner of the re-encrypted ciphertext based on the re-encrypted ciphertext and the re-encryption key.

[0006] The ciphertext conversion system according to the present disclosure includes: a re-encrypted ciphertext, the re-encrypted ciphertext including a randomized plaintext generated by decrypting an original ciphertext generated by encrypting a plaintext using a first public key corresponding to a first private key, using a randomized private key generated by randomizing a first private key of public key cryptography using a random number, and an encrypted random number generated by encrypting the random number using a second public key of public key cryptography; and a re-encryption verification device including a verification unit that verifies whether the re-encrypted ciphertext was generated using the re-encryption key, the re-encryption key being a key for re-encrypting the original ciphertext and consisting of the encrypted random number and the randomized private key.

[0007] According to the present disclosure, the verification unit verifies, based on the re-encrypted ciphertext and the re-encryption key, whether the re-encrypted ciphertext was generated using the re-encryption key. Therefore, according to the present disclosure, in proxy re-encryption, it is possible to enable the original owner of the re-encrypted ciphertext to claim that he or she is the original owner of the re-encrypted ciphertext, based on the re-encrypted ciphertext and the re-encryption key.

[0008] FIG. 1 is a diagram showing an example of the configuration of a ciphertext conversion system 100 according to the first embodiment. FIG. 2 is a diagram showing an example of the configuration of a common parameter generation device 200 according to the first embodiment. FIG. 3 is a diagram showing an example of the configuration of a key generation device 300 according to the first embodiment. FIG. 4 is a diagram showing an example of the configuration of an encryption device 400 according to the first embodiment. FIG. 5 is a diagram showing an example of the configuration of a re-encryption key generation device 500 according to the first embodiment. FIG. 6 is a diagram showing an example of the configuration of a re-encryption device 600 according to the first embodiment. FIG. 7 is a diagram showing an example of the configuration of a re-encryption verification device 700 according to the first embodiment. FIG. 8 is a diagram showing an example of the configuration of a decryption device 800 according to the first embodiment. FIG. 9 is a diagram showing an example of the hardware configuration of each device according to the first embodiment. A flowchart showing the operation of the common parameter generation device 200 according to the first embodiment. A flowchart showing the operation of the key generation device 300 according to the first embodiment. A flowchart showing the operation of the encryption device 400 according to the first embodiment. A flowchart showing the operation of the re-encryption key generation device 500 according to the first embodiment. A flowchart showing the operation of the re-encryption device 600 according to the first embodiment. A flowchart showing the operation of the re-encryption verification device 700 according to the first embodiment. A flowchart showing the operation of the decryption device 800 according to the first embodiment. FIG. 10 is a diagram showing an example of the hardware configuration of each device according to a modification of the first embodiment.

[0009] In the description of the embodiments and drawings, the same elements and corresponding elements are given the same symbols. The description of elements given the same symbols is omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be interpreted as "circuit," "device," "equipment," "process," "step," "procedure," "processing," or "circuitry" as appropriate. The functions of each unit provided in each device may be realized by firmware, software, hardware, or a combination of these.

[0010] First Embodiment Hereinafter, the present embodiment will be described in detail with reference to the drawings.

[0011] ***Configuration*** FIG. 1 is a block diagram showing an example configuration of a ciphertext conversion system 100 according to the present embodiment. As shown in FIG. 1, the ciphertext conversion system 100 includes a common parameter generation device 200, multiple key generation devices 300, an encryption device 400, a re-encryption key generation device 500, a re-encryption device 600, a re-encryption verification device 700, and a decryption device 800. There may be multiple devices constituting the ciphertext conversion system 100. The multiple devices constituting the ciphertext conversion system 100 may be integrated as appropriate. The ciphertext conversion system 100 is a system that performs proxy re-encryption, re-encrypting a ciphertext without decrypting it (encrypting it using another key). The multiple devices constituting the ciphertext conversion system 100 are connected to each other as appropriate so that they can communicate with each other via the Internet 101. The devices constituting the ciphertext conversion system 100 may not be connected to the Internet 101, but may be installed within a LAN (Local Area Network) installed within the same company, for example.

[0012] The Internet 101 is a communication path that appropriately connects the common parameter generation device 200, the multiple key generation devices 300, the encryption device 400, the re-encryption key generation device 500, the re-encryption device 600, the re-encryption verification device 700, and the decryption device 800 so that they can communicate with each other. The Internet 101 is a specific example of a network. Other types of networks may be used instead of the Internet 101.

[0013] The common parameter generation device 200 generates a common parameter and transmits the generated common parameter to the multiple key generation devices 300 and the encryption device 400 via the Internet 101. The common parameter is a parameter that is used in common in the ciphertext conversion system 100. Note that the common parameter may be transmitted directly by mail or the like, without transmitting via the Internet 101.

[0014] A specific example of each key generation device 300 is a PC (Personal Computer). Each key generation device 300 is a computer that generates a user private key and transmits the generated user private key to the encryption device 400, the re-encryption key generation device 500, and the decryption device 800 as appropriate. The user private key is a general term for the private key and public key in public key cryptography.

[0015] The encryption device 400 functions as a device for encrypting data, and is specifically a PC. The encryption device 400 is a computer that receives the common parameters from the common parameter generation device 200, receives the public key from the key generation device 300, takes plain text as input, and outputs an original cipher text.

[0016] The re-encryption key generation device 500 generates a re-encryption key and is, for example, a PC. The re-encryption key generation device 500 is a computer that receives the public key and the private key from the key generation device 300 and generates a re-encryption key. The re-encryption key is a key for converting ciphertext without decrypting it.

[0017] The re-encryption device 600 receives the re-encryption key from the re-encryption key generation device 500, and converts the ciphertext generated by the encryption device 400 into ciphertext for a new destination by changing only the internal public key, without decrypting the ciphertext. The re-encryption device 600 is, as a specific example, a PC.

[0018] A specific example of the re-encryption verification device 700 is a PC. The re-encryption verification device 700 is a computer that receives a re-encryption key from the re-encryption key generation device 500 and a re-encrypted ciphertext from the re-encryption device 600, and outputs a verification result based on the received data.

[0019] A specific example of the decryption device 800 is a PC. The decryption device 800 is a computer that receives ciphertext from the encryption device 400 or the re-encryption device 600, receives a private key from the key generation device 300, and outputs the decryption result. The term "ciphertext" is a general term for various types of ciphertext.

[0020] FIG. 2 is a block diagram showing an example configuration of the common parameter generation device 200. As shown in FIG. 2, the common parameter generation device 200 includes an input unit 201, a common parameter generation unit 202, and a transmission unit 203. Although not shown, each device included in the ciphertext conversion system 100 includes a recording medium for storing data used in each unit of the device. The input unit 201 receives the bit length of a key used in the ciphertext conversion system 100. The common parameter generation unit 202 generates parameters PARAM that are the basis of calculations used in the ciphertext conversion system 100. As a specific example, when elliptic curve cryptography is used, elliptic curve parameters or the like are generated as the parameters PARAM. Although not shown, the common parameter generation unit 202 may also include a random number generation function or the like to generate the PARAM. The transmission unit 203 transmits the common parameters PARAM generated by the common parameter generation unit 202 to the key generation device 300 and the encryption device 400.

[0021] 3 is a block diagram showing an example configuration of a key generation device 300. As shown in FIG. 3, the key generation device 300 includes an input unit 301, a key generation unit 302, a public key setting unit 303, a private key setting unit 304, a public key transmission unit 305, and a private key transmission unit 306. The input unit 301 receives common parameters PARAM. The key generation unit 302 generates a public key and a private key for a set public key cryptosystem using the common parameters PARAM. The public key setting unit 303 sets a public key value from among the keys generated by the key generation unit 302. The private key setting unit 304 sets a private key value from among the keys generated by the key generation unit 302. The public key transmission unit 305 transmits the public key generated by the public key setting unit 303 to the encryption device 400 and the re-encryption key generation device 500. The private key transmitting unit 306 transmits the private key generated by the private key setting unit 304 to the re-encryption key generating device 500 and the decryption device 800 .

[0022] 4 is a block diagram showing an example configuration of the encryption device 400. As shown in FIG. 4, the encryption device 400 includes an input unit 401, a key receiving unit 402, an encryption unit 403, and a transmission unit 404. Plain text M is input to the input unit 401. The key receiving unit 402 receives a common parameter PARAM and a public key PK. The encryption unit 403 generates an original cipher text C using the plain text M, the common parameter PARAM, and the public key PK. The encryption unit 403 may include a random number generation function, etc. The cipher text transmission unit 404 transmits the original cipher text C to the re-encryption device 600 and the decryption device 800.

[0023] 5 is a block diagram showing an example configuration of a re-encryption key generation device 500. As shown in FIG. 5, the re-encryption key generation device 500 includes a public key receiving unit 501, a private key receiving unit 502, a re-encryption key generation unit 503, and a re-encryption key output unit 504. The public key receiving unit 501 receives a public key PK2 from the key generation device 300. The private key receiving unit 502 receives a private key SK1 from the key generation device 300. The re-encryption key generation unit 503 generates a re-encryption key RK using the public key PK2 and the private key SK1. The re-encryption key output unit 504 transmits the re-encryption key RK to the re-encryption device 600.

[0024] Fig. 6 is a block diagram showing an example configuration of the re-encryption device 600. As shown in Fig. 6, the re-encryption device 600 includes a ciphertext receiving unit 601, a re-encryption key receiving unit 602, a re-encryption processing unit 603, and a ciphertext output unit 604. The ciphertext receiving unit 601 receives an original ciphertext C from the encryption device 400. The re-encryption key receiving unit 602 receives a re-encryption key RK from the re-encryption key generation device 500. The re-encryption processing unit 603 generates a re-encrypted ciphertext RC using the original ciphertext C and the re-encryption key RK. The ciphertext output unit 604 transmits the re-encrypted ciphertext RC to the re-encryption verification device 700 and the decryption device 800.

[0025] FIG. 7 is a block diagram showing an example configuration of a re-encryption verification device 700. As shown in FIG. 7, the re-encryption verification device 700 includes a ciphertext receiving unit 701, a re-encryption key receiving unit 702, a verification unit 703, and a result output unit 704. The ciphertext receiving unit 701 receives the re-encrypted ciphertext RC. The re-encryption key receiving unit 702 receives the re-encryption key RK from the re-encryption key generating device 500. The verification unit 703 verifies whether the re-encrypted ciphertext RC is a ciphertext generated using the re-encryption key RK. Specifically, the verification unit 703 verifies whether the re-encrypted ciphertext was generated using the re-encryption key, based on the re-encrypted ciphertext and the re-encryption key. The re-encrypted ciphertext includes a randomized plaintext generated by decrypting an original ciphertext, which was generated by encrypting a plaintext using a first public key corresponding to the first private key, using a randomized private key generated by randomizing a first private key of public key cryptography using a random number, and an encrypted random number generated by encrypting the random number using a second public key of public key cryptography. The re-encryption key is a key for re-encrypting the original ciphertext and is a key composed of the encrypted random number and the randomized private key. The verification unit 703 may verify whether the re-encrypted ciphertext was generated using the re-encryption key, based on the encrypted random number constituting the re-encrypted ciphertext and the encrypted random number constituting the re-encryption key. The second public key may be a public key of homomorphic encryption. The result output unit 704 outputs the verification result by the verification unit 703.

[0026] FIG. 8 is a block diagram showing an example configuration of a decryption device 800. As shown in FIG. 8, the decryption device 800 includes a ciphertext receiving unit 801, a key receiving unit 802, a decryption processing unit 803, and a result output unit 804. The ciphertext receiving unit 801 receives an original ciphertext C or a re-encrypted ciphertext RC. The key receiving unit 802 receives a secret key SK or HSK from the key generating device 300. The decryption processing unit 803 generates plaintext M by performing a decryption process using the original ciphertext C and the secret key SK, or the re-encrypted ciphertext RC and the secret key HSK. The decryption processing unit 803 decrypts the encrypted random numbers constituting the re-encrypted ciphertext using a second secret key corresponding to the second public key, thereby decrypting the random numbers. Then, the decryption processing unit 803 decrypts the plaintext by removing randomization from the randomized plaintext constituting the re-encrypted ciphertext using the random numbers. The decryption processing unit 803 also decrypts the plaintext by performing a decryption process on the original ciphertext using a first secret key. The result output unit 804 outputs the plaintext M.

[0027] 9 shows an example of the hardware resources of each device, that is, an example of the hardware configuration of each device. Each device is made up of a computer. Each device may be made up of multiple computers.

[0028] As shown in Fig. 9, each device is a computer including hardware such as a processor 11, a ROM 13, a RAM 14, a communication board 15, a display 31 (display device), a keyboard 32, a mouse 33, a drive 34, and a magnetic disk device 20. These hardware components are connected as appropriate via a bus 12. The ROM 13, the RAM 14, the magnetic disk device 20, and the drive 34 are each an example of a storage device. The keyboard 32, the mouse 33, and the communication board 15 are each an example of an input device. The display 31 and the communication board 15 are each an example of an output device.

[0029] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of a computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). Each device may include multiple processors that serve as the processor 11. The multiple processors share the role of the processor 11.

[0030] The ROM 13 is typically a non-volatile storage device, and specific examples thereof include a hard disk drive (HDD) or a flash memory. Data stored in the ROM 13 is loaded into the RAM 14 as needed.

[0031] The RAM 14 is typically a volatile storage device. The RAM 14 is also called a primary storage device or a main memory. Data stored in the RAM 14 is saved in the ROM 13 as needed. The ROM 13 and the RAM 14 may be integrated.

[0032] The communication board 15 is a receiver and a transmitter. Specific examples of the communication board 15 include a communication chip or a NIC (Network Interface Card). The communication board 15 is connected to a communication network such as a LAN (Local Area Network), the Internet, or a telephone line via a wired or wireless connection. Each unit of each device may use the communication board 15 as appropriate when communicating with other devices.

[0033] The drive 34 is a device that reads and writes data from a storage medium such as a flexible disk drive (FD), a compact disk (CD), or a digital versatile disk (DVD).

[0034] The magnetic disk device 20 stores an OS 21 (operating system), a group of programs 22, and a group of files 23.

[0035] The program group 22 includes programs that execute functions described as "units" in this embodiment. The programs (specifically, a data search program and a data registration program) are read and executed by the processor 11. That is, the programs cause the computer to function as "units" and also cause the computer to execute the procedures and methods of the "units."

[0036] The file group 23 includes various data (input, output, determination results, calculation results, processing results, etc.) used in the "units" described in this embodiment.

[0037] Data used when executing the re-encryption verification program and data obtained by executing the re-encryption verification program are stored in a storage device as appropriate. Each unit of each device uses a storage device as appropriate. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of ROM 13 and RAM 14 may be realized by other storage devices.

[0038] The re-encryption verification program may be recorded on a computer-readable non-volatile recording medium. Specific examples of the non-volatile recording medium include an optical disk and a flash memory. The re-encryption verification program may be provided as a program product.

[0039] ***Description of Operation*** The operating procedures of each device included in the ciphertext conversion system 100 are collectively referred to as a re-encryption verification method. Also, the programs that realize the operations of each device included in the ciphertext conversion system 100 are collectively referred to as a re-encryption verification program.

[0040] Before describing the operation, the basic encryption technique and its notation used in this embodiment will be described.

[0041] Public key encryption (PKE) is composed of algorithms that execute key generation KG, encryption ENC, and decryption DEC. Key generation KG takes as input the key length and the like and outputs a secret key SK and a public key PK. Encryption ENC takes as input the public key PK and plaintext M and outputs ciphertext C. Decryption DEC takes as input the secret key SK and ciphertext C and outputs the decryption result.

[0042] Homomorphic encryption (HE) is composed of an algorithm that executes key generation HKG, encryption HENC, and decryption HDEC. Key generation HKG takes as input the key length and the like and outputs a secret key HSK and a public key HPK. Encryption HENC takes as input the public key HPK and plaintext M and outputs ciphertext HC. Decryption HDEC takes as input the secret key HSK and ciphertext HC and outputs the decryption result.

[0043] The key randomization algorithm RANDSKEY refers to an algorithm that randomizes the secret key SK using a random number R. Specifically, this algorithm refers to multiplication, etc. The plaintext randomization algorithm RANDM refers to an algorithm that randomizes the plaintext M using the random number R. The ciphertext randomization algorithm RANDCT refers to an algorithm that randomizes the ciphertext C using the random number R. It is also assumed that the following relationship holds: if M = DEC(SK, C), then RANDM(R, M) = DEC(RANDSKEY(R, SK), C) = DEC(SK, RANDDCT(R, C)). It is also assumed that there exists a randomization algorithm REMRAND such that M = REMRAND(RANDM(R, M), R). It is also assumed that this algorithm refers to division, etc.

[0044] 10 is a flowchart showing an example of the parameter generation step, which will be described with reference to FIG.

[0045] (Step S201: Information Input Step) The input unit 201 receives the bit length K of the key as an input.

[0046] (Step S202: Common Parameter Generation Step) The common parameter generation unit 202 uses K to generate a common parameter PARAM.

[0047] (Step S203: Distribution Step) The transmission unit 203 transmits the PARAM to each device.

[0048] 11 is a flowchart showing an example of the user private key generation step, which will be described with reference to FIG.

[0049] (Step S301: Information Input Step) The input unit 301 receives PARAM as an input.

[0050] (Step S302: Key Generation Step) The key generation unit 302 generates (PK1, SK1) = KG(PARAM), or (PK2, SK2) = HKG(PARAM). Here, "public key" is a general term for PK1 and PK2. "Private key" is a general term for SK1 and SK2. PK1 corresponds to the first public key. PK2 corresponds to the second public key. SK1 corresponds to the first secret key. SK2 corresponds to the second secret key. Note that although PK2 and SK2 do not have to be keys for homomorphic encryption, in the following description, PK2 and SK2 are assumed to be keys for homomorphic encryption.

[0051] (Step S303: Distribution Step) The private key transmission unit 306 transmits PK1 and SK1, or PK2 and SK2, to each device.

[0052] 12 is a flowchart showing an example of the ciphertext generation step, which will be described with reference to FIG.

[0053] (Step S401: Receiving Step) The key receiving unit 402 receives PK=(PARAM, PK1).

[0054] (Step S402: Plain Text Input Step) The input unit 401 receives plain text M.

[0055] (Step S403: Encryption Step) The encryption unit 403 generates an original ciphertext C by executing C=ENC(PK, M).

[0056] (Step 404: Transmission Step) The ciphertext transmission unit 404 outputs the original ciphertext C.

[0057] 13 is a flowchart showing an example of the re-encryption key generation step, which will be described with reference to FIG.

[0058] (Step S501: Re-encryption Destination Key Receiving Step) The public key receiving unit 501 receives the re-encryption destination public key PK2.

[0059] (Step 502: Private Key Input Step) The private key receiving unit 502 receives the private key SK1 that is the source of re-encryption.

[0060] (Step 503: Random Number Selection Step) The re-encryption key generation unit 503 selects a random number R.

[0061] (Step 504: Re-encryption key generation step) The re-encryption key generation unit 503 randomizes PK2 and SK1 using a random number R. Specifically, the re-encryption key generation unit 503 executes C_R=HENC(PK2, R) and SK_R=RANDSKEY(SK1, R). C_R corresponds to the encryption random number. SK_R corresponds to the randomized secret key.

[0062] (Step 505: Transmission Step) The re-encryption key output unit 504 outputs RK=(C_R, SK_R).

[0063] 14 is a flowchart showing an example of the re-encryption step, which will be described with reference to FIG.

[0064] (Step S601: Ciphertext Receiving Step) The ciphertext receiving unit 601 receives the original ciphertext C=ENC(PK, M).

[0065] (Step S602: Key Receiving Step) The re-encryption key receiving unit 602 receives the re-encryption key RK=(C_R, SK_R).

[0066] (Step S603: Conversion Step) The re-encryption processing unit 603 calculates RM=DEC(SK_R, C), where RM corresponds to randomized plaintext.

[0067] (Step S604: Output Step) The ciphertext output unit 604 outputs the re-encrypted ciphertext RC=(RM, C_R).

[0068] 15 is a flowchart showing an example of the re-encryption verification step, which will be described with reference to FIG.

[0069] (Step S701: Ciphertext Receiving Step) The ciphertext receiving unit 701 receives the re-encrypted ciphertext RC.

[0070] (Step S702: Re-encryption Key Receiving Step) The re-encryption key receiving unit 702 receives the re-encryption key RK.

[0071] (Step S703: Result Output Step) The verification unit 703 verifies whether the C_R component of the re-encrypted ciphertext RC is the same as the C_R component of the re-encryption key RK, thereby verifying whether the re-encrypted ciphertext RC is a ciphertext generated using the re-encryption key RK. If the verification unit 703 determines that the re-encrypted ciphertext RC is a ciphertext generated using the re-encryption key RK, the result output unit 704 outputs 1. If not, the result output unit 704 outputs 0.

[0072] 16 is a flowchart showing an example of the decoding step, which will be described with reference to FIG.

[0073] (Step S801: Ciphertext Receiving Step) The ciphertext receiving unit 801 receives the original ciphertext C or the re-encrypted ciphertext RC.

[0074] (Step S802: Input Step) The key receiving unit 802 receives the private key SK1 or SK2.

[0075] (Step S803: Decryption Processing Step) When the ciphertext received by the ciphertext receiving unit 801 is the original ciphertext C, the decryption processing unit 803 calculates M=DEC(SK1, C). When the ciphertext received by the ciphertext receiving unit 801 is the re-encrypted ciphertext RC, the decryption processing unit 803 calculates R=HDEC(SK2, C_R), and then calculates M=REMRAND(RM, R).

[0076] (Step S804: Output Step) The result output unit 804 outputs the plaintext M.

[0077] ***Description of Effects of First Embodiment*** As described above, according to this embodiment, in proxy re-encryption, it is verified whether the re-encrypted ciphertext was generated using the re-encryption key, based on the re-encrypted ciphertext and the re-encryption key. Specifically, it is verified whether the re-encrypted ciphertext was generated from the re-encryption key by using a technique for verifying whether there is a relationship between the random number used when generating the re-encryption key and the random number included in the re-encrypted ciphertext. Therefore, according to this embodiment, the original owner of the re-encrypted ciphertext can claim to be the original owner of the re-encrypted ciphertext, based on the re-encrypted ciphertext and the re-encryption key, and key changes can be achieved more safely.

[0078] ***Other Configurations*** <Modification 1> Fig. 17 shows an example of the hardware configuration of each device according to this modification. Each device includes a processing circuit 18 instead of the processor 11, the processor 11 and ROM 13, the processor 11 and RAM 14, or the processor 11, ROM 13, and RAM 14. The processing circuit 18 is hardware that realizes at least a portion of the functions of each device. The processing circuit 18 may be dedicated hardware, or may be a processor that executes a program stored in the ROM 13.

[0079] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, multiple circuits, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. Each device may include multiple processing circuits that replace processing circuitry 18. The multiple processing circuits share the role of processing circuitry 18.

[0080] In each device, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0081] The processing circuitry 18 is realized by, for example, hardware, software, firmware, or a combination of these. The processor 11, ROM 13, RAM 14, and processing circuitry 18 are collectively referred to as the "processing circuitry." In other words, the functions of each functional component of each device are realized by the processing circuitry.

[0082] ***Other Embodiments*** Although the first embodiment has been described, it is possible to combine multiple parts of this embodiment and implement it. Alternatively, it is possible to implement this embodiment in part. In addition, various modifications may be made to this embodiment as necessary, and it is possible to implement it in any combination, either as a whole or in part. Note that the above-described embodiments are essentially preferred examples and are not intended to limit the scope of the present disclosure, its applications, and uses. The procedures described using flowcharts, etc. may be modified as appropriate.

[0083] Various aspects of the present disclosure are summarized below as appendices.

[0084] (Supplementary Note 1) A ciphertext conversion system comprising: a re-encrypted ciphertext, the re-encrypted ciphertext being composed of a randomized plaintext generated by decrypting, using a randomized private key generated by randomizing a first private key of public key cryptography using a random number, an original ciphertext generated by encrypting a plaintext using a first public key corresponding to the first private key, and an encrypted random number generated by encrypting the random number using a second public key of public key cryptography; and a re-encryption verification device comprising: a verification unit that verifies, based on the re-encryption key, which is a key for re-encrypting the original ciphertext and is composed of the encrypted random number and the randomized private key, whether the re-encrypted ciphertext was generated using the re-encryption key.

[0085] (Supplementary Note 2) The ciphertext conversion system according to Supplementary Note 1, wherein the verification unit verifies whether the re-encrypted ciphertext was generated using the re-encryption key, based on the encrypted random number constituting the re-encrypted ciphertext and the encrypted random number constituting the re-encryption key.

[0086] (Supplementary Note 3) The ciphertext conversion system according to Supplementary Note 1 or 2, wherein the second public key is a public key for homomorphic encryption.

[0087] (Supplementary Note 4) The ciphertext transformation system according to any one of Supplementary Notes 1 to 3, further comprising: a re-encryption device including a re-encryption processing unit that generates the re-encrypted ciphertext.

[0088] (Supplementary Note 5) The ciphertext conversion system according to any one of Supplementary Notes 1 to 4, further comprising: a re-encryption key generation device including a re-encryption key generation unit that generates the re-encryption key.

[0089] (Supplementary Note 6) The ciphertext conversion system according to any one of Supplementary Notes 1 to 5, further comprising: a decryption device comprising: a decryption processing unit that decrypts the encrypted random numbers that constitute the re-encrypted ciphertext by performing a decryption process on the encrypted random numbers that constitute the re-encrypted ciphertext, using a second private key that corresponds to the second public key; and decrypts the plaintext by removing randomization from the randomized plaintext that constitutes the re-encrypted ciphertext, using the random number.

[0090] (Supplementary Note 7) The ciphertext conversion system according to Supplementary Note 6, wherein the decryption processing unit decrypts the plaintext by executing a decryption process on the original ciphertext using the first private key.

[0091] 11 processor, 12 bus, 13 ROM, 14 RAM, 15 communication board, 18 processing circuit, 19 signal line, 20 magnetic disk device, 21 OS, 22 program group, 23 file group, 31 display, 32 keyboard, 33 mouse, 34 drive, 100 ciphertext conversion system, 101 Internet, 200 common parameter generation device, 201 input unit, 202 common parameter generation unit, 203 transmission unit, 300 key generation device, 301 input unit, 302 key generation unit, 303 public key setting unit, 304 private key setting unit, 305 public key transmission unit, 306 private key transmission unit, 400 encryption device, 401 input unit, 402 key reception unit, 403 encryption unit, 404 transmission unit, 500 re-encryption key generation device, 501 public key reception unit, 502 Private key receiving unit, 503 re-encryption key generating unit, 504 re-encryption key output unit, 600 re-encryption device, 601 ciphertext receiving unit, 602 re-encryption key receiving unit, 603 re-encryption processing unit, 604 ciphertext output unit, 700 re-encryption verification device, 701 ciphertext receiving unit, 702 re-encryption key receiving unit, 703 verification unit, 704 result output unit, 800 decryption device, 801 ciphertext receiving unit, 802 key receiving unit, 803 decryption processing unit, 804 result output unit.

Claims

1. A ciphertext conversion system comprising: a re-encrypted ciphertext consisting of a randomized plaintext generated by decrypting an original ciphertext generated by encrypting plaintext using a first public key corresponding to a first private key of public key cryptography using a random number, using a randomized private key generated by randomizing a first private key of public key cryptography using the random number, and an encrypted random number generated by encrypting the random number using a second public key of public key cryptography; and a re-encryption verification device comprising: a key for re-encrypting the original ciphertext, the re-encryption key being a key composed of the encrypted random number and the randomized private key, and a verification unit that verifies whether the re-encrypted ciphertext was generated using the re-encryption key, based on the re-encryption key.

2. The ciphertext conversion system of claim 1, wherein the verification unit verifies whether the re-encrypted ciphertext was generated using the re-encryption key based on the encrypted random number that constitutes the re-encrypted ciphertext and the encrypted random number that constitutes the re-encryption key.

3. The ciphertext conversion system according to claim 1 or 2, wherein the second public key is a public key for homomorphic encryption.

4. The ciphertext conversion system according to any one of claims 1 to 3, further comprising a re-encryption device comprising a re-encryption processing unit that generates the re-encrypted ciphertext.

5. The ciphertext conversion system according to any one of claims 1 to 4, further comprising a re-encryption key generation device including a re-encryption key generation unit that generates the re-encryption key.

6. The ciphertext conversion system according to any one of claims 1 to 5, further comprising a decryption device including a decryption processing unit that uses a second private key corresponding to the second public key to perform a decryption process on the encrypted random number that constitutes the re-encrypted ciphertext, thereby decrypting the random number, and that uses the random number to decrypt the plaintext by removing randomization from the randomized plaintext that constitutes the re-encrypted ciphertext.

7. The ciphertext conversion system according to claim 6, wherein the decryption processing unit decrypts the plaintext by executing a decryption process on the original ciphertext using the first private key.

8. A re-encryption verification method in which a verification unit of a re-encryption verification device, which is a computer, verifies whether the re-encrypted ciphertext was generated using a re-encryption key, based on: a randomized private key generated by randomizing a first private key of public key cryptography using a random number, and using the randomized private key to decrypt an original ciphertext generated by encrypting plaintext using a first public key corresponding to the first private key; a re-encrypted ciphertext consisting of an encrypted random number generated by encrypting the random number using a second public key of public key cryptography; and a re-encryption key, which is a key for re-encrypting the original ciphertext and consists of the encrypted random number and the randomized private key.

9. A re-encryption verification program that causes a computer to function as a re-encryption verification device, wherein a verification unit performs a verification process to verify whether the re-encrypted ciphertext was generated using a re-encryption key, based on: a randomized private key generated by randomizing a first private key of public key cryptography using a random number, and a re-encrypted ciphertext consisting of a randomized plaintext generated by decrypting an original ciphertext generated by encrypting plaintext using a first public key corresponding to the first private key, and an encrypted random number generated by encrypting the random number using a second public key of public key cryptography; and a re-encryption key, which is a key for re-encrypting the original ciphertext and consists of the encrypted random number and the randomized private key.

Images