Abstract: At the time of setting authority, a management apparatus stores a database in which authority information corresponding to authority to physically drive a drive apparatus, which is a tangible object, using a terminal apparatus, and registration identification information corresponding to a subject that is given the authority are associated, and outputs information representing any of the registration identification information; and a permission apparatus receives and stores the information. At the time of exercising the authority, the terminal apparatus outputs information representing identification information, and the permission apparatus receives the information and, when the identification information corresponds to registration identification information comprised in setting information, outputs information representing authority exercise information required to exercise the authority.

Abstract: A computing apparatus outputs ?1 and ?2 corresponding to a ciphertext x, a capability providing apparatus uses ?1 to correctly compute f(?1) with a probability greater than a certain probability and sets the result of the computation as z1, uses ?2 to correctly compute f(?2) with a probability greater than a certain probability and sets the result of the computation as z2, the computing apparatus generates a computation result u=f(x)bx1 from z1, generates a computation result v=f(x)ax2 from z2, and outputs ub?va? if the computation results u and v satisfy a particular relation, where G and H are groups, f(x) is a function for obtaining an element of the group G for x?H, X1 and X2 are random variables having values in the group G, x1 is a realization of the random variable X1, and x2 is a realization of the random variable X2.

Abstract: A computing apparatus outputs ?1 and ?2 corresponding to a ciphertext x, a capability providing apparatus uses ?1 to correctly compute f(?1) with a probability greater than a certain probability and sets the result of the computation as z1, uses ?2 to correctly compute f(?2) with a probability greater than a certain probability and sets the result of the computation as z2, the computing apparatus generates a computation result u=f(x)bx1 from z1, generates a computation result v=f(x)ax2 from z2, and outputs ub?va? if the computation results u and v satisfy a particular relation, where G and H are groups, f(x) is a function for obtaining an element of the group G for x?H, X1 and X2 are random variables having values in the group G, x1 is a realization of the random variable X1, and x2 is a realization of the random variable X2.

Abstract: A computing apparatus outputs ?1 and ?2 corresponding to a ciphertext x, a capability providing apparatus uses ?1 to correctly compute f(?1) with a probability greater than a certain probability and sets the result of the computation as z1, uses ?2 to correctly compute f(?2) with a probability greater than a certain probability and sets the result of the computation as z2, the computing apparatus generates a computation result u=f(x)bx1 from z1, generates a computation result v=f(x)ax2 from z2, and outputs ub?va? if the computation results u and v satisfy a particular relation, where G and H are groups, f(x) is a function for obtaining an element of the group G for x?H, X1 and X2 are random variables having values in the group G, x1 is a realization of the random variable X1, and x2 is a realization of the random variable X2.

Abstract: A computing apparatus outputs ?1 and ?2 corresponding to a ciphertext x, a capability providing apparatus uses ?1 to correctly compute f(?1) with a probability greater than a certain probability and sets the result of the computation as z1, uses ?2 to correctly compute f(?2) with a probability greater than a certain probability and sets the result of the computation as z2, the computing apparatus generates a computation result u=f(x)bx1 from z1, generates a computation result v=f(x)ax2 from z2, and outputs ub?va? if the computation results u and v satisfy a particular relation, where G and H are groups, f(x) is a function for obtaining an element of the group G for x?H, X1 and X2 are random variables having values in the group G, x1 is a realization of the random variable X1, and x2 is a realization of the random variable X2.

Abstract: Where G and H are cyclic groups, M is an integer of two or more, i=1, . . . , M, f is a homomorphic function of mapping a member xi of group H to group G, Ri and R0 are random variables with a value in group G, ri is a realized value of the random variable Ri,, r0 is a realized value of the random variable R0, and ai is a random number of an integer of 0 or more, a random number generation unit 11 generates random numbers a1, a2, . . . , aM. A sampler 21 is capable of calculating f(x1)r1, f(x2)r2, . . . , f(xM)rM to obtain a calculation result thereof as z1, z2, . . . , zM, respectively. A power calculation unit 12 calculates (z1)a1, (z2)a2, . . . , (zM)aM. An extended randomizable sampler 22 is capable of calculating f(x1a1×x2a2× . . . ×xMaM)r0 to obtain a calculation result z0 thereof. A determination unit 16 determines whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0.

Abstract: Registered network-based identification corresponding to any of networks is stored in a key device 12. A terminal device 11 sends ciphertext and network-based identification to the key device 12, using a network. The key device 12 receives the sent ciphertext and network-based identification and outputs response information corresponding to a decrypted value of the ciphertext when the network-based identification corresponds to the registered network-based identification. The terminal device 11 obtains the decrypted value from the response information.

Abstract: A first calculation unit is capable of calculating f(x)bx1 and sets a calculation result of f(x)bx1 to u, and a second calculation unit is capable of calculating f(x)ax2, and sets a calculation result of f(x)ax2 to v. A final calculation unit outputs (ub?va?)1/d for d=a?a+b?b when the calculation result u and the calculation result v satisfy ua=vb. Here, G and H are groups, f is a function for mapping an element x of the group H to the group G, X1 and X2 are random variables values of which are in the group G, a realization of the random variable X1 is x1, a realization of the random variable X2 is x2, and a, b, a?, and b? are integers.

Abstract: A key storage apparatus which prevents a service from being resumed with the same configuration as a configuration during an arithmetic processing provision period, a key storage method, and a program therefor. The key storage apparatus is such that it is assumed that, before expiration of a period for providing arithmetic processing using a key, the key is secretly managed, and that the key is outputted when the period expires, and the key storage apparatus comprises: a one-way function section causing a one-way function to act on first information to generate the key; a storage section secretly storing the first information during the period; and an expiration judging section eliminating the first information from the storage section and outputting the key when the period expires.

Abstract: A decoding apparatus performs self-correcting processing with a decoding capability providing apparatus holding a decoding key for decoding first ciphertext which can be decoded by homomorphic operation to obtain a decoding value of the first ciphertext, and performs non-homomorphic operation using a value corresponding to or deriving from the decoding value of the first ciphertext and an addition value to output plaintext.

Abstract: The risk of leakage of secret information caused by leakage of a secret key is reduced. A segmented secret-key storage system segments a secret key SK into segments that can be combined at the time of decryption or at the time of generation of a signature and records the secret-key segments sk1, . . . , skN in segment storage apparatuses. The secret-key segments are changed, periodically or under a predetermined condition, to another set of secret-key segments that satisfies a condition for combination. In the segmented secret-key storage system, the secret key SK is not revealed unless the secret-key segments are stolen from all the segment storage apparatuses in an interval between changes made to the secret-key segments. Accordingly, the risk of leakage can be greatly reduced in comparison with the risk of leakage of the secret key from a single apparatus.

Abstract: A private key is held which conforms to an ElGamal encryption system on a semigroup, calculation of an order of an element of the semigroup being computationally difficult, information corresponding to ciphertext conforming to the ElGamal encryption system is input, a private key s is used to decrypt the information corresponding to the ciphertext in conformance to the ElGamal encryption system, and information corresponding to a result of decrypting the ciphertext is obtained and output. Alternatively, whether it is computationally difficult or easy to calculate the order of the element of the semigroup is determined, and the safety of a decryption service providing device is evaluated based on the determination result.

Abstract: A function f(x) is calculated with a calculating apparatus that makes a correct calculation with a low probability. Provided that G and H are cyclic groups, f is a function that maps an element x of the group H into the group G, X1 and X2 are random variables whose values are elements of the group G, x1 is a realized value of the random variable X1, and x2 is a realized value of the random variable X2, an integer calculation part calculates integers a? and b? that satisfy a relation a?a+b?b=1 using two natural numbers a and b that are relatively prime. A first randomizable sampler is capable of calculating f(x)bx1 and designates the calculation result as u. A first exponentiation part calculates u?=ua. A second randomizable sampler is capable of calculating f(x)ax2 and designates the calculation result as v. A second exponentiation part calculates v?=vb. A determining part determines whether u?=v? or not. A final calculation part calculates ub?va? in a case where it is determined that u?=v?.

Abstract: A cryptographic communication technology that is based on functional encryption and that can operate flexibly is provided. A conversion rule information pair is determined in advance, which has attribute conversion rule information prescribing a conversion rule for converting attribute designation information to attribute information used in a functional encryption algorithm and logical expression conversion rule information prescribing a conversion rule for converting logical expression designation information to logic information used in the functional encryption algorithm. One kind of conversion rule information included in the conversion rule information pair is used to obtain first attribute information or first logic information from input information. The first attribute information or the first logic information is used for encryption.

Abstract: A cryptographic communication technology that is based on predicate encryption and that can operate flexibly is provided. A conversion rule information pair is determined in advance, which has attribute conversion rule information prescribing a conversion rule for converting attribute designation information to attribute information used in a predicate encryption algorithm and predicate conversion rule information prescribing a conversion rule for converting predicate designation information to predicate information used in the predicate encryption algorithm. One kind of conversion rule information included in the conversion rule information pair is used to obtain first attribute information or first predicate information from input information. The first attribute information or the first predicate information is used for encryption.

Abstract: An information output apparatus identifies, according to a rule established for each of functional encryption protocols or a rule established for each combination of the protocols, one or more identifiers corresponding to a particular functional encryption protocol or a combination of the particular protocols, sets a particular piece of first correspondence information corresponding to the identifier or identifiers, and outputs first information which is a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information.

Abstract: Where G and H are cyclic groups, M is an integer of two or more, i=1, . . . , M, f is a homomorphic function of mapping a member xi of group H to group G, Ri and R0 are random variables with a value in group G, ri is a realized value of the random variable Ri,, r0 is a realized value of the random variable R0, and ai is a random number of an integer of 0 or more, a random number generation unit 11 generates random numbers a1, a2, . . . , aM. A sampler 21 is capable of calculating f(x1)r1, f(x2)r2, . . . , f(xM)rM to obtain a calculation result thereof as z1, z2, . . . , zM, respectively. A power calculation unit 12 calculates (z1)a1, (z2)a2, . . . , (zM)aM. An extended randomizable sampler 22 is capable of calculating f(x1a1×x2a2× . . . ×xMaM)r0 to obtain a calculation result z0 thereof. A determination unit 16 determines whether or not (z1)a1×(z2)a2× . . . ×(zM)aM=z0.

Abstract: A computing apparatus outputs ?1 and ?2 corresponding to a ciphertext x, a capability providing apparatus uses ?1 to correctly compute f(?1) with a probability greater than a certain probability and sets the result of the computation as z1, uses ?2 to correctly compute f(?2) with a probability greater than a certain probability and sets the result of the computation as z2, the computing apparatus generates a computation result u=f(x)bx1 from z1, generates a computation result v=f(x)ax2 from z2, and outputs ub?va? if the computation results u and v satisfy a particular relation, where G and H are groups, f(x) is a function for obtaining an element of the group G for x?H, X1 and X2 are random variables having values in the group G, x1 is a realization of the random variable X1, and x2 is a realization of the random variable X2.

Abstract: A calculation ?i=0N?1e(R(i, 0), . . . , R(i, K?1)) where a calculation of K elements R(i, k)?GF(pm) of a finite field GF(pm) over a finite field is expressed as e(R(i, 0), . . . , R(i, K?1)) is efficiently performed. Polynomials poly(R(i, 0), . . . , R(i, K?1)) that express a d-th-order extension field of the finite field GF(pm), which are obtained by the calculations e(R(i, 0), . . . , R(i, K?1)) for different values of i, are multiplied by each other, and a cumulative multiplication of the products is performed, for example. The polynomial poly(R(i, 0), . . . , R(i, K?1)) is a mapping from the input elements of the finite field GF(pm), and the coefficients of at least some of the terms thereof are 0. The same process is performed for different sets of values of i, and the calculation ?i=0N?1e(R(i, 0), . . . , R(i, K?1)) is performed using the result.

Abstract: A cryptographic communication technology that is based on functional encryption and that can operate flexibly is provided. A conversion rule information pair is determined in advance, which has attribute conversion rule information prescribing a conversion rule for converting attribute designation information to attribute information used in a functional encryption algorithm and logical expression conversion rule information prescribing a conversion rule for converting logical expression designation information to logic information used in the functional encryption algorithm. One kind of conversion rule information included in the conversion rule information pair is used to obtain first attribute information or first logic information from input information. The first attribute information or the first logic information is used for encryption.