Abstract: An ID-based hash proof system configuration apparatus includes a processor, and a memory storing program instructions that cause the processor to receive a security parameter, and output a public parameter and a master private key by using a multi identity-based encryption (MIBE) setup algorithm and a key K randomly selected, receive the public parameter, the master private key, and an identifier, and output a private key by using a bit value ri (1?i?n) that is selected, and a MIBE key generation algorithm, receive the public parameter and the identifier, and output a ciphertext and a key k by using a MIBE encryption algorithm, receive the public parameter and the identifier, and output a wrong ciphertext by using the MIBE encryption algorithm, and receive the public parameter, the private key, the identifier, and the ciphertext, and output the key k by using a MIBE decryption algorithm.

Abstract: A digital watermark system that realizes digital watermark for a cryptographic function, including a memory and a processor configured to take as input a security parameter and generate a watermark embedding key for embedding information representative of a watermark in a circuit that realizes the cryptographic function, and a watermark extraction key for extracting information representative of the watermark from a circuit in which a watermark is embedded; take as input a master private key used for the cryptographic function, the watermark embedding key, and information representative of a watermark, and generate a circuit in which the watermark is embedded and that realizes the cryptographic function; and take as input the watermark extraction key and the circuit in which the watermark has been embedded, and extract information representative of a watermark from the circuit.

Abstract: A transformation key generation apparatus has key generation means for receiving a decryption key sks of a first public key encryption scheme ?s and a public key pkd of a second public key encryption scheme ?d, and generating a transformation key utks?d for transforming first ciphertext cts of the first public key encryption scheme ?s into second ciphertext tct of the second public key encryption scheme ?d by using a probabilistic circuit or function secret sharing.

Abstract: A communication terminal which is capable of reducing load of a server apparatus by reutilizing a message key to be used for encrypting a message is provided.

Abstract: There is provided an encrypted message search technique making it difficult to, at the time of searching for a message in a state of being encrypted, guess content of the search and a result of the search.

Abstract: A communication terminal shares a session key with and sends cipher text to another communication terminal via a server device, including: a common key cipher text obtaining unit that encrypts a message based on a common key to obtain common key cipher text; a function computation result obtaining unit that computes the common key and the session key based on a predetermined first function to obtain a function computation result; a public key cipher text obtaining unit that encrypts the function computation result based on a public key to obtain public key cipher text; and a cipher text sending unit that sends the common key cipher text and the public key cipher text to the server device. The communication terminal can update data previously saved in a server to data that can be decrypted on the communication terminal side using an updated session key, without the server decrypting the data.

Abstract: A transformation key generation apparatus has key generation means for receiving a decryption key sks of a first public key encryption scheme ?s and a public key pkd of a second public key encryption scheme ?d, and generating a transformation key utks?d for transforming first ciphertext cts of the first public key encryption scheme ?s into second ciphertext tct of the second public key encryption scheme ?d by using a probabilistic circuit or function secret sharing.

Abstract: A communication terminal which is capable of reducing load of a server apparatus by reutilizing a message key to be used for encrypting a message is provided.

Abstract: Included are: a setup means of taking an input of a security parameter 1?, and outputting a public parameter pp and a master private key (msk, K) by using a setup algorithm SetupMIBE and a key K, the setup algorithm SetupMIBE including a setup algorithm SetuplPE for inner-product encryption, the key K being randomly selected from a key space of a pseudorandom function PRF; a key generation means of taking an input of the public parameter pp, the master private key (msk, K), and an identifier id, and outputting a private key skid=(skid?, {ri}i?[n]) by using a bit value ri (1?i?n) that is selected, a key generation algorithm KeyGenMIBE, and the pseudorandom function PRF, the bit value ri (1?i?n) being one of n bit values ri (1?i?n) randomly selected from {0, 1}, the key generation algorithm KeyGenMIBE including a key generation algorithm KeyGenIPE for the inner-product encryption, the private key skid=(skid?, {ri}i?[n]) being configured by using an output skid? of the key generation algorithm KeyGenMIBE and the

Abstract: A communication terminal shares a session key with and sends cipher text to another communication terminal via a server device, including: a common key cipher text obtaining unit that encrypts a message based on a common key to obtain common key cipher text; a function computation result obtaining unit that computes the common key and the session key based on a predetermined first function to obtain a function computation result; a public key cipher text obtaining unit that encrypts the function computation result based on a public key to obtain public key cipher text; and a cipher text sending unit that sends the common key cipher text and the public key cipher text to the server device. The communication terminal can update data previously saved in a server to data that can be decrypted on the communication terminal side using an updated session key, without the server decrypting the data.

Abstract: There is provided an encrypted message search technique making it difficult to, at the time of searching for a message in a state of being encrypted, guess content of the search and a result of the search.

Abstract: A sharing apparatus independently shares a value corresponding to each element ?(?, i, ?)·g2 of basis vectors bi*(?) among each subset SUB(?) consisting of H(?) share management apparatuses PA(?, 1), . . . , PA(?, H(?)) to generate share information SH(?, i, ?, ?, h(?)) corresponding to each element ?(?, i, ?)·g2. The share management apparatus PA(?, h(?)) generates a share secret value DSH(?, ?, h(?)) by performing a common calculation common in the subset SUB(?) on common information shared in the subset SUB(?) and the share information SH(?, i, ?, ?, h(?)). An acquisition apparatus generates reconstructed secret values SUBSK(?, ?) for each subset SUB(?) by performing a reconstruction processing for the subset SUB(?) and generates generation information D*(?) from the reconstructed secret values SUBSK(?, ?).

Abstract: Hierarchical cryptography expressed in a general semiordered structure other than a tree structure is implemented. In information generation, random numbers ?v and (?vj)j?w(v)?Zq are generated; main information kv=?v?i?{1, . . . , N-1}\w(v)vibi*+bN* is calculated; and derivation information kvj=?vj?i?{1, . . . , N-1}\w(v)vibi*+bj* is calculated for each j?w(v). In information derivation, random numbers ?u and (?uj)j?w(u)?Zq are generated; main information ku=?u?i?w(v)\w(u)uikvi+kv is calculated; and derivation information kuj=?uj?i?w(v)\w(u)uikvi+kvj is calculated for each j?w(v).

Abstract: A secure secret sharing system is implemented. Shares SH(?, h(?)) are generated by secret sharing of secret information separately for each subset SUB(?); each of share management apparatuses PA(?, h(?)) generates a shared secret value DSH(?, h(?)) by performing a common operation to a corresponding share SH(?, h(?)) and common information containing a common value ?(?) shared in each subset SUB(?); and an acquisition apparatus generates a reconstructed secret value SUBSK(?) by reconstruction processing for each subset SUB(?), using a plurality of shared secret values DSH(?, h(?)) corresponding to the same subset SUB(?), and generates generation information SK by using the reconstructed secret values SUBSK(?).

Abstract: A sharing apparatus independently shares a value corresponding to each element ?(?, i, ?)·g2 of basis vectors bi*(?) among each subset SUB(?) consisting of H(?) share management apparatuses PA(?, 1), . . . , PA(?, H(?)) to generate share information SH(?, i, ?, ?, h(?)) corresponding to each element ?(?, i, ?)·g2. The share management apparatus PA(?, h(?)) generates a share secret value DSH(?, ?, h(?)) by performing a common calculation common in the subset SUB(?) on common information shared in the subset SUB(?) and the share information SH(?, i, ?, ?, h(?)). An acquisition apparatus generates reconstructed secret values SUBSK(?, ?) for each subset SUB(?) by performing a reconstruction processing for the subset SUB(?) and generates generation information D*(?) from the reconstructed secret values SUBSK(?, ?).

Abstract: A secure secret sharing system is implemented. Shares SH(?, h(?)) are generated by secret sharing of secret information separately for each subset SUB(?); each of share management apparatuses PA(?, h(?)) generates a shared secret value DSH(?, h(?)) by performing a common operation to a corresponding share SH(?, h(?)) and common information containing a common value ?(?) shared in each subset SUB(?); and an acquisition apparatus generates a reconstructed secret value SUBSK(?) by reconstruction processing for each subset SUB(?), using a plurality of shared secret values DSH(?, h(?)) corresponding to the same subset SUB(?), and generates generation information SK by using the reconstructed secret values SUBSK(?).

Abstract: Hierarchical cryptography expressed in a general semiordered structure other than a tree structure is implemented. In information generation, random numbers ?v and (?vj)j?w(v)?Zq are generated; main information kv=?v?i?{1, . . . , N-1}\w(v)vibi*+bN* is calculated; and derivation information kvj=?vj?i?{1, . . . , N-1}\w(v)vibi*+bj* is calculated for each j?w(v). In information derivation, random numbers ?u and (?uj)j?w(u)?Zq are generated; main information ku=?u?i?w(v)\w(u)uikvi+kv is calculated; and derivation information kuj=?uj?i?w(v)\w(u)uikvi+kvj is calculated for each j?w(v).