Abstract: A decentralized multi-authority functional encryption according to which the security of the whole system does not depend on a single party. Among a plurality of key generation devices, arbitrary one key generation device generates gparam, and each key generation device generates an authority public key and an authority secret key based on gparam. At least some key generation devices among the plurality of key generation devices generate a part of a decryption key of the user based on the authority secret key ask. The user forms one decryption by putting together the decryption keys generated by at least some of the key generation devices, and decrypts a ciphertext.

Abstract: The object is to provide an attribute-based signature scheme which is flexible in the design and which supports a non-monotone predicate. An access structure is constituted by applying the inner-product of the attribute vectors to a non-monotone span program. This access structure is flexible in the design of the span program and in the design of the attribute vectors, providing high flexibility in the design of access control. By incorporating the concept of secret distribution in the access structure, the attribute-based signature scheme which supports the non-monotone predicate is realized.

Abstract: It is an object of this invention to implement a predicate encryption scheme with delegation capability. A cryptographic process is performed using dual vector spaces (dual distortion vector spaces) of a space V and a space V* paired through a pairing operation. An encryption device generates as a cipher vector a vector in which transmission information is embedded, the cipher vector being the vector of the space V. Using a predetermined vector of the space V* as a key vector, a decryption device performs the pairing operation on the cipher vector generated by the encryption device and the key vector to decrypt the cipher vector and to extract information concerning the transmission information.

Abstract: It is aimed to implement a hierarchical predicate encryption (HPE) scheme. A cryptographic process is performed using dual vector spaces (dual distortion vector spaces (DDVS)) of a space V and a space V* paired through a pairing operation. An encryption device generates as a cipher vector a vector in the space V, the vector having transmission information embedded therein. A decryption device, using a predetermined vector in the space V* as a key vector, performs the pairing operation on the cipher vector generated by the encryption device and the key vector, to decrypt the cipher vector and to extract information concerning the transmission information.

Abstract: The object is to provide a secure functional encryption scheme having many cryptographic functions. An access structure is constituted by applying the inner-product of attribute vectors to a span program. The access structure has a degree of freedom in design of the span program and design of the attribute vectors, thus having a large degree of freedom in design of access control. A functional encryption process is implemented by imparting the access structure to each of a ciphertext and a decryption key.

Abstract: An integer partitioning unit inputs an order p of a finite group G and an integer e, and calculates an integer e1 and an integer e2 that satisfy e1·e?e2 (mod p) based on the order p of the finite group G and the integer e which are input. A verification value calculation unit inputs an element s of the finite group G and an element h of the finite group G, and calculates an element a (=e1·h?e2·s) of the finite group G based on the element s and the element h which are input and the integer e1 and the integer e2 which are calculated by the integer partitioning unit in the integer partitioning process. A verification judging unit judges, based on the element a calculated by the verification value calculation unit, whether or not the element a is an identity element O of the finite group G. Hence, whether or not h =e·s is judged at high speed.

Abstract: A sophisticated cryptographic system is realized without using a pairing operation on a composite order. A random matrix selection unit 142 randomly selects a random matrix V* from a plurality of matrices satisfying a predetermined condition, based on a plurality of pairing log coefficients ?i calculated by an encryption parameter setting apparatus 100. An output base calculation unit 143 calculates a plurality of output bases gk, based on a plurality of base divisors D˜j calculated by the encryption parameter setting apparatus 100 and the random matrix V* selected by the random matrix selection unit 142.

Abstract: It is an object of this invention to implement a predicate encryption scheme with delegation capability. A cryptographic process is performed using dual vector spaces (dual distortion vector spaces) of a space V and a space V* paired through a pairing operation. An encryption device generates as a cipher vector a vector of the space V, the cipher vector being a vector in which transmission information is embedded. Using a predetermined vector of the space V* as a key vector, a decryption device performs the pairing operation on the cipher vector generated by the encryption device and the key vector to decrypt the cipher vector and to extract information concerning the transmission information. In particular, the encryption device and the decryption device perform the cryptographic process without using some dimensions of the space V and the space V*.

Abstract: The object is to provide a secure functional encryption scheme having a large number of cryptographic functions. An access structure is constituted by applying the inner-product of attribute vectors to a span program. The access structure has a degree of freedom in design of the span program and design of the attribute vectors, thus having a large degree of freedom in design of access control. A secure functional encryption process having a large number of cryptographic functions is implemented by employing the concept of secret sharing for the access structure.

Abstract: In a secure search system to be used by a plurality of users, the size of a ciphertext is reduced and the need to generate a new ciphertext when a new user is added is eliminated. A public parameter generation device 100 generates a pair of a public parameter and a master secret key. Using the public parameter, an encryption device 400 encrypts a keyword and generates a ciphertext. Using the master secret key, a user secret key generation device 200 generates a user secret key of a query issuing device 300. Using the user secret key, the query issuing device 300 generates a query for searching for the keyword. Based on the ciphertext and the query, a search device 500 determines whether a hit is obtained for searching.

Abstract: It is an object of this invention to implement a predicate encryption scheme with delegation capability. A cryptographic process is performed using dual vector spaces (dual distortion vector spaces) of a space V and a space V* paired through a pairing operation. An encryption device generates as a cipher vector a vector in which transmission information is embedded, the cipher vector being the vector of the space V. Using a predetermined vector of the space V* as a key vector, a decryption device performs the pairing operation on the cipher vector generated by the encryption device and the key vector to decrypt the cipher vector and to extract information concerning the transmission information.

Abstract: The random number generating unit 222 randomly generates an integer s. The first ciphertext generating unit 241 generates a first ciphertext C1 by encrypting the plaintext M, based on the integer s. The second ciphertext generating unit 242 generates a second ciphertext C2, based on the integer s and a recipient ID. The third ciphertext generating unit 243 generates a third ciphertext C3, based on the integer s. The hash value calculation unit 244 calculates a hash value H0 by combining the first ciphertext C1, the second ciphertext C2, and the third ciphertext C3. The fourth ciphertext generating unit 245 generates a fourth ciphertext C4, based on the hash value H0. The ciphertext combining unit 246 generates a ciphertext C by combining the first ciphertext C1, the second ciphertext C2, the third ciphertext C3, and the fourth ciphertext C4.

Abstract: A certification device 101 encrypts a feature vector for registration by using a random number and a public key which is set to correspond to a secret key in a decryption device 103. The encrypted feature vector for registration is registered in an authentication device 102. In authentication, the certification device encrypts a feature vector for authentication by using the public key and a random number. With the two encrypted feature vectors being kept encrypted, the authentication device generates encrypted similarity degree information from which the decryption device can derive the similarity degree between the two feature vectors by a decryption process using the secret key. The decryption device 103 decrypts the encrypted similarity degree information to derive the similarity degree of the plaintext. The authentication device 102, if the similarity degree is equal to or larger than a threshold, determines that the user is the correct user.

Abstract: It is aimed to implement a hierarchical predicate encryption (HPE) scheme. A cryptographic process is performed using dual vector spaces (dual distortion vector spaces (DDVS)) of a space V and a space V* paired through a pairing operation. An encryption device generates as a cipher vector a vector in the space V, the vector having transmission information embedded therein. A decryption device, using a predetermined vector in the space V* as a key vector, performs the pairing operation on the cipher vector generated by the encryption device and the key vector, to decrypt the cipher vector and to extract information concerning the transmission information.

Abstract: A prime number generation unit 110 generates an integer r having a form suitable for fast elliptic curve pairing computation, by using a processing device (S302 to S303). The prime number generation unit 110 judges whether the integer r is a prime number or not, by using the processing device (S304). When the integer r is a prime number, the prime number generation unit 110 judges whether the prime number r is a group order capable of easily changing the level of security or not, by using the processing device (S305). Thereby, it is possible to generate an elliptic curve parameter which is settable to an elliptic curve cryptographic processor that performs elliptic curve pairing computation using an algorithm capable of performing fast computation even by using a processing device with low computational capacity and which is capable of easily changing the level of security.

Abstract: A sophisticated cryptographic system is realized without using a pairing operation on a composite order. A random matrix selection unit 142 randomly selects a random matrix V* from a plurality of matrices satisfying a predetermined condition, based on a plurality of pairing log coefficients ?i calculated by an encryption parameter setting apparatus 100. An output base calculation unit 143 calculates a plurality of output bases gk, based on a plurality of base divisors D˜j calculated by the encryption parameter setting apparatus 100 and the random matrix V* selected by the random matrix selection unit 142.

Abstract: In an integer partitioning process S701, an integer partitioning unit 110 inputs an order p of a finite group G and an integer e, and calculates an integer e1 and an integer e2 that satisfy e1·e?e2(mod p) based on the order p of the finite group G and the integer e which are input. In a verification value calculation process S702, a verification value calculation unit 130 inputs an element s of the finite group G and an element h of the finite group G, and calculates an element a (=e1·h?e2·s) of the finite group G based on the element s and the element h which are input and the integer e1 and the integer e2 which are calculated by the integer partitioning unit 110 in the integer partitioning process S701. In a verification judging process S703, a verification judging unit 150 judges, based on the element a calculated by the verification value calculation unit 130, whether or not the element a is an identity element O of the finite group G. Hence, whether or not h=e·s is established is judged at high speed.

Abstract: The random number generating unit 222 randomly generates an integer s. The first ciphertext generating unit 241 generates a first ciphertext C1 by encrypting the plaintext M, based on the integer s. The second ciphertext generating unit 242 generates a second ciphertext C2i based on the integer s and a recipient ID. The third ciphertext generating unit 243 generates a third ciphertext C3i based on the integer s. The hash value calculation unit 244 calculates a hash value H0 by combining the first ciphertext C1i the second ciphertext C2i and the third ciphertext C3. The fourth ciphertext generating unit 245 generates a fourth ciphertext C4, based on the hash value H0. The ciphertext combining unit 246 generates a ciphertext C by combining the first ciphertext C1i the second ciphertext C2i the third ciphertext C3i and the fourth ciphertext C4.

Abstract: A prime number generation unit 110 generates an integer r having a form suitable for fast elliptic curve pairing computation, by using a processing device (S302 to S303). The prime number generation unit 110 judges whether the integer r is a prime number or not, by using the processing device (S304). When the integer r is a prime number, the prime number generation unit 110 judges whether the prime number r is a group order capable of easily changing the level of security or not, by using the processing device (S305). Thereby, it is possible to generate an elliptic curve parameter which is settable to an elliptic curve cryptographic processor that performs elliptic curve pairing computation using an algorithm capable of performing fast computation even by using a processing device with low computational capacity and which is capable of easily changing the level of security.

Abstract: An object is to make a conventional GLV scalar multiplication applicable to a wider range of elliptic curves. An elliptic curve encryption processor includes an input section 2 that inputs information indicating an elliptic curve E, a point P on the elliptic curve, and an operation value K; an embedding operation section 3 that maps the point P on the elliptic curve E to a Jacobi variety of an algebraic curve corresponding to the elliptic curve E, thereby obtaining a point on the Jacobi variety of the algebraic curve corresponding to the elliptic curve E as an embedding point D; a homomorphic processing section 4 that performs a mapping by a homomorphism on the Jacobi variety of the algebraic curve, thereby obtaining a mapping point ?D; a projection operation section 5 that performs a mapping to the elliptic curve E, thereby obtaining a projection point P? on the elliptic curve; and a computing section 6 that performs a computation using the operation value K and the projection point P?.