Abstract: An encryption device (20) generates a ciphertext by setting, in the ciphertext, one of a predicate vector of arithmetic branching programs (ABP) and an attribute vector over a basis B of the basis B and a basis B*, which are dual bases in dual vector spaces. A key generation device (30) generates a decryption key by setting, in the decryption key, the other one of the predicate vector and the attribute vector over the basis B*. A decryption device (40) decrypts the ciphertext by performing a pairing operation on the ciphertext generated by the encryption device (20) and the decryption key generated by the key generation device (30).

Abstract: A signature device (30) acquires a signature key SK(x?) in which an attribute vector x? is set over a basis B* of a basis B and the basis B*, which are dual bases in dual vector spaces. The signature device (30) generates a signature sig for a message MSG by setting predicate information of arithmetic branching programs (ABP) for the signature key SK(x?). The signature device (30) outputs the signature sig and the message MSG to a verification device (40).

Abstract: A cryptographic system (1) performs a cryptographic process in which a Richelot isogeny sequence ?s whose starting point is an abelian surface A0 and whose end point is an abelian surface As is a secret key and the abelian surface As is a public key. An encryption device (28) computes an abelian surface Am by transitioning the abelian surface As, which is the public key, by a Richelot isogeny sequence ?m generated by encoding a plaintext m, and sets the abelian surface Am as a ciphertext. A decryption device (30) computes a Richelot isogeny ?m whose starting point is the abelian surface As, which is the public key, and whose end point is the abelian surface Am, which is the ciphertext, based on the Richelot isogeny sequence ?s, which is the secret key.

Abstract: An inner-product functional encryption scheme in which the maximum length of a ciphertext and the maximum length of a secret key are not restricted can be constructed. An encryption device (20) generates a ciphertext ctx in which a vector x is encrypted, using encryption setting information that is of a size depending on the size of the vector x and is generated using as input public information of a fixed size. A key generation device (30) generates a secret key sky in which a vector y is set, using key setting information that is of a size depending on the size of the vector y and is generated using as input the public information. A decryption device (40) decrypts the ciphertext ctx with the secret key sky to calculate an inner-product value of the vector x and the vector y.

Abstract: A signature device (30) acquires a signature key SK(x?) in which an attribute vector x? is set over a basis B* of a basis B and the basis B*, which are dual bases in dual vector spaces. The signature device (30) generates a signature sig for a message MSG by setting predicate information of arithmetic branching programs (ABP) for the signature key SK(x?). The signature device (30) outputs the signature sig and the message MSG to a verification device (40).

Abstract: An objective is to enable conversion of a key sharing scheme having asymmetricity into a key sharing scheme with an authentication function. In a key sharing device, a key selection unit selects, out of two static keys of different classifications, one static key being different from a static key of a key-sharing counterpart. A temporary key generation unit generates a temporary key of the same classification as the static key selected by the key selection unit. A shared key generation unit generates a shared key using the static key selected by the key selection unit and a temporary key generated by the counterpart.

Abstract: An encryption device (20) generates a ciphertext by setting, in the ciphertext, one of a predicate vector of arithmetic branching programs (ABP) and an attribute vector over a basis B of the basis B and a basis B*, which are dual bases in dual vector spaces. A key generation device (30) generates a decryption key by setting, in the decryption key, the other one of the predicate vector and the attribute vector over the basis B*. A decryption device (40) decrypts the ciphertext by performing a pairing operation on the ciphertext generated by the encryption device (20) and the decryption key generated by the key generation device (30).

Abstract: An objective is to enable conversion of a key sharing scheme having asymmetricity into a key sharing scheme with an authentication function. In a key sharing device, a key selection unit selects, out of two static keys of different classifications, one static key being different from a static key of a key-sharing counterpart. A temporary key generation unit generates a temporary key of the same classification as the static key selected by the key selection unit. A shared key generation unit generates a shared key using the static key selected by the key selection unit and a temporary key generated by the counterpart.

Abstract: An inner-product functional encryption scheme in which the maximum length of a ciphertext and the maximum length of a secret key are not restricted can be constructed. An encryption device (20) generates a ciphertext ctx in which a vector x is encrypted, using encryption setting information that is of a size depending on the size of the vector x and is generated using as input public information of a fixed size. A key generation device (30) generates a secret key sky in which a vector y is set, using key setting information that is of a size depending on the size of the vector y and is generated using as input the public information. A decryption device (40) decrypts the ciphertext ctx with the secret key sky to calculate an inner-product value of the vector x and the vector y.

Abstract: A cryptographic system uses a group G0, a group Gt associated with the group G0, a group G{circumflex over (?)}0, a group G{circumflex over (?)}t associated with the group G{circumflex over (?)}0, and a group GT associated with the group G0 and the group G{circumflex over (?)}0 by pairing operation e0 and associated with the group Gt and the group G{circumflex over (?)} by pairing operation et. The cryptographic system generates a ciphertext ct using an element X of the group GT and an element Y{circumflex over (?)} of the group G{circumflex over (?)}t, at least either one of the element X and the element Y{circumflex over (?)} being generated through conversion of a generator by a key generation random.

Abstract: A cryptographic system implements a functional encryption scheme that is based on the lattice theory. In the cryptographic system, a key generation apparatus generates, as a secret key skv for a predicate vector v, a secret key skv including a matrix e as a key element, wherein a product of the matrix e and a matrix AY determined by the predicate vector v being input parameter Y forms a matrix uj for a value j in a set [N] including a plurality of values, the matrix uj being among a plurality of matrices u obtained from public parameters PP.

Abstract: A cryptographic system implements a functional encryption scheme that is based on the lattice theory. In the cryptographic system, a key generation apparatus generates, as a secret key skv for a predicate vector v, a secret key skv including a matrix e as a key element, wherein a product of the matrix e and a matrix AY determined by the predicate vector v being input parameter Y forms a matrix uj for a value j in a set [N] including a plurality of values, the matrix uj being among a plurality of matrices u obtained from public parameters PP.

Abstract: An encryption device 200 outputs a ciphertext ct including a ciphertext c and a ciphertext c˜. The ciphertext c has been set with one of attribute information x and attribute information v related to each other. The ciphertext c˜ has been set with one of attribute information y and attribute information z related to each other. A decryption device 300 outputs a re-encryption key rk including a decryption key k*rk, a decryption key k˜*rk, and encrypted conversion information ?rk. The decryption key k*rk is obtained by converting the decryption key k* which is set with the other one of attribute information x and attribute information v, with conversion information W1,t. The decryption key k˜*rk has been set with the other one of the attribute information y and the attribute information z. The encrypted conversion information ?rk is obtained by encrypting the conversion information W1,t by setting one of attribute information x? and attribute information v? related to each other.

Abstract: It is an object to provide predicate encryption that can conceal both attribute information being set in a ciphertext and predicate information being set in a decryption key even in a public key setting. An encryption device 200 generates a ciphertext ctx in which attribute information x is set as a basis vector of a basis D. A conversion device 300 converts with conversion information W the basis D of the ciphertext ctx generated by the encryption device 200 to a basis B so as to generate a ciphertext CTx. A decryption device 400 decrypts the ciphertext CTx generated by the conversion device 300 with a token tkv in which predicate information v is set as a coefficient of a basis vector of a basis B* corresponding to the basis B.

Abstract: An inner-product predicate encryption scheme with improved flexibility without a restriction that the dimensions of an attribute vector x? and a predicate vector v? should be equivalent. A ciphertext having an element c0 and an element ct for each index t included in a set Ix? is decrypted with a decryption key having an element k0 and an element kt for each index t included in a set Iv? by computing a product of pairing operations between corresponding pairs of basis vectors on the element c0 and the element k0 and on the element ct and the element kt.

Abstract: A cryptographic system (10) performs a cryptographic process using a basis. B and a basis B*. An encryption device (200) generates a ciphertext including a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj of a polynomial having xi as roots and a second vector consisting of v1i being a power of v1. A decryption device (300) decrypts the ciphertext generated by the encryption device (200) with a decryption key including a reception-side vector being a vector in the basis B* and being generated using the other vector of the first vector and the second vector.

Abstract: A cryptographic system (10) performs a cryptographic process using a basis. B and a basis B*. An encryption device (200) generates a ciphertext including a transmission-side vector being a vector in the basis B and being generated using one vector of a first vector consisting of coefficients yj of a polynomial having xi as roots and a second vector consisting of v1i being a power of v1. A decryption device (300) decrypts the ciphertext generated by the encryption device (200) with a decryption key including a reception-side vector being a vector in the basis B* and being generated using the other vector of the first vector and the second vector.

Abstract: An encryption device (200) outputs a ciphertext ct0 in which is set one of attribute information x0 and attribute information v0 corresponding to each other. A decryption device (300) receives a decryption key k* in which is set the other one of the attribute information x0 and the attribute information v0, and outputs a re-encryption key rk1 that includes a decryption key k*rk0 obtained by converting the received decryption key k* with conversion information r1, and includes a ciphertext ct?1 obtained by encrypting the conversion information r1 with one of attribute information x1 and attribute information v1 corresponding to each other being set. A re-encryption device (400) outputs a re-encrypted ciphertext ct1 that includes a session key K?0 obtained by decrypting the ciphertext ct0 with the decryption key k*rk0, and includes the ciphertext ct?1.

Abstract: A cryptographic system (10) uses a cryptographic scheme capable of decrypting ciphertext on which one of two pieces of information corresponding to each other is set, with a decryption key on which the other piece of information is set. A key generation apparatus (401) generates a user private key on which one of key information u and key information y corresponding to each other is set, and a re-encryption key to convert ciphertext which can be decrypted with an attribute private key on which one of user attribute information x and user attribute information v corresponding to each other is set, into a re-ciphertext on which the other of the key information u and the key information y is set. A ciphertext storage apparatus (201) stores ciphertext on which the other of the user attribute information x and the user attribute information v is set. A re-encryption apparatus (301) re-encrypts the ciphertext stored in the ciphertext storage apparatus with the re-encryption key to generate the re-ciphertext.

Abstract: An encryption device 200 outputs a ciphertext ct including a ciphertext c and a ciphertext c˜. The ciphertext c has been set with one of attribute information x and attribute information v related to each other. The ciphertext c˜ has been set with one of attribute information y and attribute information z related to each other. A decryption device 300 outputs a re-encryption key rk including a decryption key k*rk, a decryption key k˜*rk, and encrypted conversion information ?rk. The decryption key k*rk is obtained by converting the decryption key k* which is set with the other one of attribute information x and attribute information v, with conversion information W1,t. The decryption key k˜*rk has been set with the other one of the attribute information y and the attribute information z. The encrypted conversion information ?rk is obtained by encrypting the conversion information W1,t by setting one of attribute information x? and attribute information v? related to each other.