Abstract: According to a data analysis method by which time required for data analysis is shortened and practicality is improved, a client terminal requests institution terminals to perform analysis of a matching attribute; each of the institution terminals encrypts an element belonging to the matching attribute within a database and sends the converted data to an outsource terminal; the outsource terminal integrates the plurality of converted data sent from the institution terminals and sends the integrated converted data to the institution terminals; and each of the institution terminals compares each matching attribute of a plurality of the elements within the database of the institution terminal against the integrated converted data, thereby identifying, as a common element, an element associated with the matching attribute and held in common by the institution terminals.

Abstract: According to a data analysis method by which time required for data analysis is shortened and practicality is improved, a client terminal requests institution terminals to perform analysis of a matching attribute; each of the institution terminals encrypts an element belonging to the matching attribute within a database and sends the converted data to an outsource terminal; the outsource terminal integrates the plurality of converted data sent from the institution terminals and sends the integrated converted data to the institution terminals; and each of the institution terminals compares each matching attribute of a plurality of the elements within the database of the institution terminal against the integrated converted data, thereby identifying, as a common element, an element associated with the matching attribute and held in common by the institution terminals.

Abstract: A random number generating unit generates a random number t. An elliptic curve setting unit defines an elliptic curve E: y^2=x^3?3x+t. An elliptic curve finitude judging unit judges whether orders m1 and m2 of respective elliptic curves Ep1 and Ep2 produced by reducing the elliptic curve E on a rational number field modulo primes p1 and p2 are relatively prime. An elliptic curve order computing unit computes an order of the elliptic curve E. An elliptic curve condition judging unit judges the security of the elliptic curve E based on the computed order.

Abstract: A random number generating unit generates a random number t. An elliptic curve setting unit defines an elliptic curve E: y{circumflex over ( )}2=x{circumflex over ( )}3−3x+t. An elliptic curve finitude judging unit judges whether orders m1 and m2 of respective elliptic curves Ep1 and Ep2 produced by reducing the elliptic curve E on a rational number field modulo primes p1 and p2 are relatively prime. An elliptic curve order computing unit computes an order of the elliptic curve E. An elliptic curve condition judging unit judges the security of the elliptic curve E based on the computed order.

Abstract: A management center 520 determines a public key yA of a user A 510 using the user A's secret key xA and announces the public key yA to a user B 530. The user A 510 repeats generation of a random number k and calculation of r1=gk(mod p) and r2=f(r1,m)=r1+m(mod p) until r2 and q meet a condition r2<q. If the condition is met, the user A 510 finds s by calculating sk=(r2+S+1)+r2xA(mod q) and sends a ciphertext (r2,s) to the user B 530. The user B 530 rejects the ciphertext if q≦r2. If r2<q, the user B 530 recovers a message m by calculating r1=gk=g(r2+s+1)/syAr2/s(mod p) and f−1(r1,r2)=m(mod p). With this procedure, a highly secure message recovery signature apparatus is realized.

Abstract: A random number generating unit generates a random number t. An elliptic curve setting unit defines an elliptic curve E: y{circumflex over ( )}2=x{circumflex over ( )}3−3x+t. An elliptic curve finitude judging unit judges whether orders m1 and m2 of respective elliptic curves Ep1 and Ep2 produced by reducing the elliptic curve E on a rational number field modulo primes p1 and p2 are relatively prime. An elliptic curve order computing unit computes an order of the elliptic curve E. An elliptic curve condition judging unit judges the security of the elliptic curve E based on the computed order.

Abstract: A data converting unit includes a key adding unit for performing an arithmetic addition modulo 232 for input data F and subkey data Ki and outputting the outcome as data G, and a data substituting unit for performing an exclusive-OR operation for corresponding bits in data Rot7(G) obtained by shift-rotating the data G by 7 bits toward higher-order bit positions, data Rot1(G) obtained by shift-rotating the data G by 1 bit toward higher-order bit positions, and the data G itself.

Abstract: A fixed-point multiple calculation apparatus, for use in an encryption method and a signature method that use elliptic curves, finds multiples of a fixed point and an arbitrary point at high speed. The fixed-point multiple calculation apparatus generates a pre-computation tables for multiples of digits at one-word intervals and for multiples of digits at half-word intervals. Using the tables, multiples of points on an elliptic curve are calculated using a doubling process, but with a reduced number of additions. This reduces the overall amount of required calculation.

Abstract: A parameter receiving unit receives parameters &agr; and &bgr; of an elliptic curve E and an element G=(x0,y0) on the elliptic curve E. A transformation coefficient acquiring unit calculates a transformation coefficient t which is an element on a finite field GF(p) so that t{circumflex over ( )}4×&agr;(mod p) will not exceed 32 bits.

Abstract: A 6-digit decimal input value A and a previously prepared 6-digit decimal extension fixed value L are substituted in an extension function f, thereby extending the input value A to a 12-digit decimal value f(A,L). This extended value f(A,L) is bit-agitated with a bit agitation key R. Further, a value C obtained by the bit agitation processing is substituted in a reduction function g, thereby obtaining a 6-digit decimal output value B. Thus, the input value A is extended by the extension processing to be thereafter subjected to the bit agitation processing, whereby safety of secret information can be improved without increasing the number of digits of the input value A. Further, the value obtained by the bit agitation is thereafter reduced, whereby the output value B can be reduced to a number of digits which is applicable to the human memory. Thus, a bit agitator is obtained which is safer than a conventional one and has an excellent user interface.

Abstract: A 6-digit decimal input value A and a previously prepared 6-digit decimal extension fixed value L are substituted in an extension function f, thereby extending the input value A to a 12-digit decimal value f(A,L). This extended value f(A,L) is bit-agitated with a bit agitation key R. Further, a value C obtained by the bit agitation processing is substituted in a reduction function g, thereby obtaining a 6-digit decimal output value B. Thus, the input value A is extended by the extension processing to be thereafter subjected to the bit agitation processing, whereby safety of secret information can be improved without increasing the number of digits of the input value A. Further, the value obtained by the bit agitation is thereafter reduced, whereby the output value B can be reduced to a number of digits which is applicable to the human memory. Thus, a bit agitator is obtained which is safer than at conventional one and has an excellent user interface.

Abstract: The present invention provides a method of implementing digital signatures or verification and a privacy communication using the following: (1) choose a positive integer d such that gives an imaginary quadratic field Q{(-d).sup.1/2 } a small class number, and choose a prime number p such that is expressed by 2.sup.t -.alpha. (where .alpha. is a small number), such that either p+1-a or p+1+a is divisible by a prime number, and such that 4p-a.sup.2 =d.multidot.b.sup.2 to construct a finite field GF(p), or a definition filed of an elliptic curve, then construct an elliptic curve over the finite filed GF(p) having a root for a class polynomial H.sub.d (x)=0 modulo GF(p) as j-invariant; (2) construct elliptic curves E.sub.1, E.sub.2, . . . , E.sub.n in such a way that each will be not isomorphic but have a same number of elements to replace an elliptic curve one from the others.

Abstract: The present invention discloses a method of generating and verifying electronic signatures for signed communication via a public digital network system by using an elliptic curve. The method is characterized by the step of supplying on the network system public data to each of users from a system provider, wherein an element P whose x-coordinate has 0 is chosen, a single parameter is chosen for the elliptic curve E over a finite field and its base point, and a prime number p is chosen such that one of p=2.sup.t +.alpha. and p=2.sup.t -.alpha. where t is a positive integer and .alpha. is a positive integer. Accordingly, fewer parameters can represent the elliptic curve E, base point P, field of definition GF(p), and order of the base point P, and either the x-coordinate or y-coordinate of the base point P have a small value. As a result, the elliptic curve addition kP can be calculated faster for any k.

Abstract: The present invention provides a method of privacy communication, in which an elliptic curve E and an element thereof are notified to all parties who wish to communicate, and data are transmitted from one party to another by using a calculation of the element and coded data made in secret by each party. The method is characterized by a construction of E(GF(p)) such whose number of elements has exactly p, assuming that p is a prime number and E(GF(p)) is a group of elements of GF(p) on the elliptic curve E. More particularly, E(GF(p)) is constructed by an algorithm: let d be a positive integer such that gives an imaginary quadratic field Q((-d.sup.1/2)) with a small class number; then find a prime number p such that 4.multidot.p-1=d.multidot.square number; and find a solution of a class polynomial H.sub.d (x)=0 modulo p such that is defined by d and given with a j-invariant.

Abstract: The present invention provides a public key cryptosystem with an elliptic curve which comprises the steps of informing public data, selecting first and second privacy keys at the end of first and second users, mutually notifying numbers calculated by the public data and the first and second privacy keys, calculating a common key by using the first privacy key and the number from the second user or by using the second privacy key and the number from the first user, ciphering transmission data using the common key by either the first or second user, and deciphering the ciphered data using the common key by the other use. The step of informing public data includes the stages of choosing d as a positive integer such that gives an imaginary quadratic field Q((-d)).sup.1/2) a small class number, choosing p as a prime number such that 4*p-1=d*square number, so that an elliptic curve E over GF(p) will have a j-invariant as a solution modulo p for a class polynomial H.sub.